Commit Graph
3865 Commits
Author SHA1 Message Date
Alexandru Ardelean 8bf399f78e Merge pull request #19192 from turris-cz/cython-pip-requirements
host-pip-requirements: update Cython to version 0.29.28
2022-08-19 20:45:10 +03:00
Josef Schlehofer e78352c043 host-pip-requirements: update Cython to version 0.29.28
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2022-08-17 16:07:16 +02:00
Alexandru Ardelean 222a8683c0 python3-simplejson: drop package
Was only used by Bigclown.
The project (Bigclown) has accepted the switch from simplejson to it's
built-in json lib, and we can now drop this lib.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2022-08-16 13:12:33 -07:00
Josef Schlehofer ce1679a07f python-websockets: update to version 10.3
- Update copyright

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2022-08-12 21:35:39 +02:00
Michael Heimpold 55e06d66fa php8: update to 8.1.9
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2022-08-08 00:58:45 +02:00
Šimon Bořek a4a484fbca luajit: patch: PPC/e500 SPE: use soft float instead of failing
makes LuaJit builds for mpc85xx targets with SPE ISA extension
enabled possible

Quoting inner commit message:

This allows building LuaJit for systems with Power ISA SPE
extension[^1] support by using soft float on LuaJit side.

While e500 CPU cores support SPE instruction set extension
allowing them to perform floating point arithmetic natively,
this isn't required. They can function with software floating
point to integer arithmetic translation as well,
just like FPU-less PowerPC CPUs without SPE support.

Therefore I see no need to prevent them from running LuaJit
explicitly.

[^1]: https://www.nxp.com/docs/en/reference-manual/SPEPEM.pdf

Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
2022-08-06 10:34:58 -07:00
Jan Hoffmann 52ae0a2018 python-paho-mqtt: add missing dependency
The uuid module has been split out into a separate package with the
update to Python 3.10.

Signed-off-by: Jan Hoffmann <jan@3e8.eu>
2022-08-03 17:04:42 +02:00
Javier Marcet 500cdd1243 python-jsonschema: Update to 4.9.0
Signed-off-by: Javier Marcet <javier@marcet.info>
2022-08-02 18:07:56 -07:00
Michael Heimpold d413cdf17a Merge pull request #18993 from mhei/php8-update-8.1.8
php8: update to 8.1.8
2022-07-28 10:31:41 +02:00
ZiMing Mo fd1e3e2890 ruby: fix build with LibreSSL over v3.5
LibreSSL 3.5 and later provide and need to use
PEM_write_bio_PrivateKey_traditional()

upstream commit:
https://github.com/ruby/openssl/commit/e25fb0d0d86da5a9398ebdc9216b2ea89f80fa3d
https://github.com/ruby/openssl/commit/b02815271fcc295cb8b07ef740684b88a10f2760

Signed-off-by: ZiMing Mo <msylgj@immortalwrt.org>
2022-07-23 19:19:12 -07:00
Sebastian Kemper 6544b67f1f erlang: workaround LibreSSL-3.5.0 compat issues
Cherry-pick four upstream commits that prevent building of
otp_test_engine when LibreSSL-3.5.0 is used.

Since OpenWrt bumped LibreSSL to 3.5.3 the erlang host builds fail to
complete.

 CC	../priv/obj/x86_64-pc-linux-gnu/otp_test_engine.o
otp_test_engine.c: In function 'test_engine_md5_init':
otp_test_engine.c:144:34: error: dereferencing pointer to incomplete type 'EVP_MD_CTX' {aka 'struct env_md_ctx_st'}
 #define data(ctx) ((MD5_CTX *)ctx->md_data)
                                  ^~

Also switch to AUTORELEASE.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
2022-07-23 12:45:10 -07:00
Andre Heider bd6e205421 python3: update patches for libressl v3.5
Based upon patches from OpenBSD[0] and Gentoo[1].

Switched to the LibreSSL provided LIBRESSL_VERSION_NUMBER macro, which
makes OPENWRT_HOST_BUILD redundant.

[0] https://github.com/openbsd/ports/tree/master/lang/python/3.10/patches
[1] https://github.com/gentoo/libressl/tree/master/dev-lang/python/files

Signed-off-by: Andre Heider <a.heider@gmail.com>
2022-07-23 12:28:55 -07:00
Alexandru Ardelean 0ae4a5195a Merge pull request #18966 from commodo/django-bump
django: bump to version 4.0.6
2022-07-22 14:44:43 +03:00
Michael Heimpold 78f45bb651 php8: update to 8.1.8
This fixes:
    - CVE-2022-31627

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2022-07-20 21:47:20 +02:00
Michael Heimpold 61b31a3157 Merge pull request #18919 from mhei/php8-full-libiconv
php8: fixup libiconv usage (refs openwrt/openwrt#10024)
2022-07-19 19:20:11 +02:00
Alexandru Ardelean b0ddec3161 django: bump to version 4.0.6
Fixes https://nvd.nist.gov/vuln/detail/CVE-2022-34265

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2022-07-18 17:46:36 +03:00
Jeffery To 60168651a2 golang: Update to 1.18.4
Includes fixes for:

* CVE-2022-1705: net/http: improper sanitization of Transfer-Encoding
  header
* CVE-2022-1962: go/parser: stack exhaustion in all Parse* functions
* CVE-2022-28131: encoding/xml: stack exhaustion in Decoder.Skip
* CVE-2022-30630: io/fs: stack exhaustion in Glob
* CVE-2022-30631: compress/gzip: stack exhaustion in Reader.Read
* CVE-2022-30632: path/filepath: stack exhaustion in Glob
* CVE-2022-30633: encoding/xml: stack exhaustion in Unmarshal
* CVE-2022-30635: encoding/gob: stack exhaustion in Decoder.Decode
* CVE-2022-32148: net/http/httputil: NewSingleHostReverseProxy - omit
  X-Forwarded-For not working

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2022-07-18 17:35:11 +08:00
Michael Heimpold a24a76783e php8: fixup libiconv usage (refs openwrt/openwrt#10024)
Since the OpenWrt's stub libiconv implementation is now gone,
we can build against musl's internal one or the external libiconv
implementation.
This needs minor adjustements in the makefile to allow PHPs build
to choose the right path when cross-compiling.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2022-07-17 14:11:39 +02:00
Hirokazu MORIKAWA 8db0d09823 node: July 7th 2022 Security Releases
Update to v16.16.0

Release for the following issues:
HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)(CVE-2022-32213)
HTTP Request Smuggling - Improper Delimiting of Header Fields (Medium)(CVE-2022-32214)
HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215)
DNS rebinding in --inspect via invalid IP addresses (High)(CVE-2022-32212)

https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/

No vulnerabilities related with openssl (uses system openssl)

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
2022-07-10 22:38:20 +02:00
Alexandru Ardelean 884ac1e35b python-requests: bump to version 2.28.1
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2022-07-07 10:35:14 -07:00
Alexandru Ardelean 44e880df4b python-lxml: bump to version 4.9.1
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2022-07-07 10:35:14 -07:00
Alexandru Ardelean ed8420cd97 pillow: bump to version 9.2.0
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2022-07-07 10:35:14 -07:00
Alexandru Ardelean efd57e201d python-chardet: bump to version 5.0.0
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2022-07-07 10:35:14 -07:00
Jeffery To 9e3b7d7883 python-cryptography: Fix failing build
Fixes https://github.com/openwrt/packages/issues/18876.
Fixes https://github.com/openwrt/packages/issues/18879.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2022-07-07 17:35:41 +08:00
Javier Marcet 83de96fbb3 python-jsonschema: Update to 4.6.1
What's Changed:

 - Type annotate format checker methods by @sirosen
 - Fix fuzzer to include instrumentation by @DavidKorczynski
 - [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci

Signed-off-by: Javier Marcet <javier@marcet.info>
2022-07-01 14:42:19 +02:00
Michael Heimpold 8ec712ff61 Merge pull request #18823 from mhei/php8-update
php8: update to 8.1.7
2022-06-26 21:49:47 +02:00
Javier Marcet 766cfa19cf python-websocket-client: update to 1.3.3
- Fix unclosed socket error
 - Update header dict access
 - Add utf8 workaround to docs

Signed-off-by: Javier Marcet <javier@marcet.info>
2022-06-25 10:42:22 -07:00
Rosen Penev 24c0007ea2 luajit: backport softfloat ppc support
Signed-off-by: Rosen Penev <rosenp@gmail.com>
2022-06-22 12:48:32 -06:00
Michael Heimpold f8f72420cd php8: update to 8.1.7
This fixes:
    - CVE-2022-31625
    - CVE-2022-31626

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2022-06-21 23:48:13 +02:00
Andy Walsh cd49a8fb27 samba4: drop maintainership
drop maintainership:
* samba4
* ksmbd-tools
* perl-parse-yapp
* libtirpc
* softethervpn5
* wsdd2
* rpcsvc-proto

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
2022-06-21 12:24:15 -06:00
Alexandru Ardelean b9a47cc470 django: bump to version 4.0.5
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2022-06-19 09:03:03 +02:00
Alexandru Ardelean 7fddb0b6fb lxml: bump to version 4.9.0
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2022-06-19 09:03:03 +02:00
Jeffery To 57e2b656cb python3: Update to 3.10.5, refresh patches
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2022-06-13 18:21:20 +08:00
Hirokazu MORIKAWA d8dc54ceea node: bump to v16.15.1
Upgrade npm to 8.11.0
Suppressed unnecessary builds.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
2022-06-09 21:07:59 -07:00
Javier Marcet f7a00eb6ab python-jsonschema: Update to 4.6.0
What's Changed:

 - Add package_url for changelog by @fhightower
 - Only validate unevaluated properties/items on applicable types by
 @EpicWink
 - Mark library as typed (PEP-561) by @ssbarnea
 - Add v4.5.1 to changelog by @sirosen
 - Modernize the packaging setup via PEP 621 and Hatch. by @Julian

New Contributors:

 - @fhightower made their first contribution
 - @EpicWink made their first contribution

Signed-off-by: Javier Marcet <javier@marcet.info>
2022-06-09 11:01:25 -07:00
Jeffery To faa546ac0a micropython-lib: Update to latest master
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2022-06-06 15:09:51 -07:00
Jeffery To 112cf09031 golang: Update to 1.18.3
Includes fix for CVE-2022-30634 (crypto/rand: Read hangs when passed
buffer larger than 1<<32 - 1).

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2022-06-06 15:08:39 -07:00
Alexandru Ardelean 5e1546c4c9 openpyxl: bump to version 3.0.10
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2022-06-03 21:30:45 -07:00
Alexandru Ardelean e65d982541 pillow: bump to version 9.1.1
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2022-06-03 21:30:45 -07:00
Hirokazu MORIKAWA fcfd2599d9 node: bump to v16.15.0
Description:
Update from  v16.15.0
Changed handling of host's npm problems due to npm updates.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
2022-05-31 23:14:52 -07:00
Jeffery To d71f082cdc Merge pull request #18584 from mpratt14/golang-bootstrap-arch
golang: some makefile fixes
2022-05-31 14:59:04 +08:00
Michael Heimpold fbcb35b33f php8: update to 8.1.6
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2022-05-29 11:05:11 +02:00
Michael Pratt bb7c596028 golang: do not rely on Go script host detection
for some use cases, for example:
a system with 64 bit kernel
and 32 bit userspace programs

the local Go installation is "detected"
using the kernel "uname",
causing build failure if they happen to differ

by adding the argument GOHOSTARCH using the corresponding make variable
it would be fully controlled in the openwrt git tree
based on the HOST_ARCH make variable.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2022-05-27 02:39:52 -04:00
Michael Pratt b99164aff4 golang: enable verbose output
allow the building script of Go to output verbose
when make is executed with "V=s..."

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2022-05-27 02:39:52 -04:00
Michael Pratt abf28899a0 golang: split compile recipe into configure and compile
the default Configure recipe for packages
assumes that there is a "configure" script
in the source tree directory

Go does not have such a script,
configure and compile is done with the same script

so split the current Compile recipe
into both Configure and Compile recipes

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2022-05-27 02:39:52 -04:00
Maciej Krüger 0b5eb86718 lua-openssl: update to version 0.8.2-1
Signed-off-by: Maciej Krüger <mkg20001@gmail.com>
2022-05-26 20:39:30 -07:00
Javier Marcet f1ed3f5bc2 python-jsonschema: Update to 4.5.1
What's Changed:

 - Extend dynamicRef keyword by @nezhar
 - Add FORMAT_CHECKER attribute for Validator by @TiborVoelcker
 - Remove stray double-quote by @lurch
 - Ensure proper sorting of list in error message by @ssbarnea

Signed-off-by: Javier Marcet <javier@marcet.info>
2022-05-25 17:04:47 -07:00
Javier Marcet 117e3d6a18 python3-paramiko: update to version 2.11.0
2.11.0:

 - [Feature] Add SSH config token expansion (eg %h, %p) when parsing
 ProxyJump directives. Patch courtesy of Bruno Inec.

 - [Support] (via #2011) Apply unittest skipIf to tests currently
 using SHA1 in their critical path, to avoid failures on systems
 starting to disable SHA1 outright in their crypto backends (eg RHEL
 9). Report & patch via Paul Howarth.

 - [Support] Update camelCase method calls against the threading
 module to be snake_case; this and related tweaks should fix some
 deprecation warnings under Python 3.10. Thanks to Karthikeyan
 Singaravelan for the report, @Narendra-Neerukonda for the patch,
 and to Thomas Grainger and Jun Omae for patch workshopping.

 - [Support] Recent versions of Cryptography have deprecated Blowfish
 algorithm support; in lieu of an easy method for users to remove it
 from the list of algorithms Paramiko tries to import and use, we’ve
 decided to remove it from our “preferred algorithms” list. This will
 both discourage use of a weak algorithm, and avoid warnings. Credit
 for report/patch goes to Mike Roest.

2.10.5:

 - [Bug] Windows-native SSH agent support as merged in 2.10 could
 encounter Errno 22 OSError exceptions in some scenarios (eg server
 not cleanly closing a relevant named pipe). This has been worked
 around and should be less problematic. Reported by Danilo Campana
 Fuchs and patched by Jun Omae.

 - [Bug] OpenSSH 7.7 and older has a bug preventing it from
 understanding how to perform SHA2 signature verification for RSA
 certificates (specifically certs - not keys), so when we added SHA2
 support it broke all clients using RSA certificates with these
 servers. This has been fixed in a manner similar to what OpenSSH’s
 own client does: a version check is performed and the algorithm used
 is downgraded if needed. Reported by Adarsh Chauhan, with fix
 suggested by Jun Omae.

 - [Bug] Align signature verification algorithm with OpenSSH re:
 zero-padding signatures which don’t match their nominal size/length.
 This shouldn’t affect most users, but will help Paramiko-implemented
 SSH servers handle poorly behaved clients such as PuTTY. Thanks to
 Jun Omae for catch & patch.

Signed-off-by: Javier Marcet <javier@marcet.info>
2022-05-25 17:03:28 -07:00
Jianhui Zhao 3d2c8121e2 lua-eco: Add package
Lua-eco is a `Lua coroutine` library which was implemented based on `IO event`.

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
2022-05-15 05:49:13 -07:00
Jeffery To 659f87d5d4 golang: Update to 1.18.2
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2022-05-14 21:28:14 -07:00