Commit Graph
5430 Commits
Author SHA1 Message Date
Hirokazu MORIKAWA a8b6b3b551 node: bump to 22.23.2
This is a security release.
Notable Changes
* (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
* (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
* (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
* (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
* (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
* (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
* (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
* (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
* (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
* (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
* deps: update llhttp to 9.4.3 (Paolo Insogna)
* deps: update undici to 6.28.0 (Node.js GitHub Bot)

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
2026-08-02 09:35:26 +02:00
Alexandru Ardelean 60f5e4b230 luasec: add Lua 5.4 variant
Add luasec5.4 (Lua 5.4 + luasocket5.4 + libopenssl) next to existing
luasec (Lua 5.1, default). Installs ssl.so / ssl.lua / ssl/https.lua
under /usr/lib/lua/5.4/.

Needed for the prosody 13.x upgrade.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-07-31 09:46:08 +03:00
Alexandru Ardelean 2eaaed5cdf luasocket: add Lua 5.4 variant
Add luasocket5.4 next to the existing luasocket (Lua 5.1) and
luasocket5.3 variants, installed via the upstream makefile's
'make install LUAV=5.4'.

That makefile defaults to prefix=/usr/local on linux, which is where
the luasocket5.3 variant still installs, so pass prefix=/usr explicitly
to land in /usr/share/lua/5.4 and /usr/lib/lua/5.4 like the other Lua
5.4 module packages.

Needed for the prosody 13.x upgrade.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-07-31 09:46:08 +03:00
Alexandru Ardelean 59977dc387 luaexpat: add Lua 5.4 variant
Add luaexpat5.4, parallel to existing luaexpat (Lua 5.1, default).
Builds against the Lua 5.4 headers under /usr/include/lua5.4 and
installs to /usr/lib/lua/5.4/. Same pattern as the luasocket 5.3
variant already shipped.

Needed for the prosody 13.x upgrade.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-07-31 09:46:08 +03:00
Alexandru Ardelean 27152e6f34 luafilesystem: add Lua 5.4 variant
Lua 5.1 is EOL and many downstream packages need 5.2+. Mirror the
luasocket multi-variant pattern: keep luafilesystem (Lua 5.1, default)
and add luafilesystem5.4 which builds the same source against
liblua5.4 and installs to /usr/lib/lua/5.4/.

Needed for the prosody 13.x upgrade (Lua 5.1 unsupported upstream).

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-07-31 09:46:08 +03:00
Alexandru Ardelean 3fe92e63f5 lua: look for lua5.4 modules under /usr instead of /usr/local
luaconf.h hardcodes LUA_ROOT to "/usr/local/", and nothing in this
package overrides it for the target build, so the interpreter only ever
searches /usr/local/{share,lib}/lua/5.4. Nothing installs there on
OpenWrt, which leaves every Lua 5.4 module package unreachable:

  # lua5.4 -e 'require "lfs"'
  lua5.4: module 'lfs' not found:
          no file '/usr/local/share/lua/5.4/lfs.lua'
          no file '/usr/local/lib/lua/5.4/lfs.so'
          [...]
  # find / -name lfs.so
  /usr/lib/lua/5.4/lfs.so

Point LUA_ROOT at /usr. LUA_LDIR and LUA_CDIR are derived from it and
keep the version suffix, so the search paths become /usr/share/lua/5.4
and /usr/lib/lua/5.4 - exactly where the Lua 5.4 module packages
install. The core lua (5.1) package carries an equivalent patch.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-07-31 09:46:08 +03:00
Alexandru Ardelean dfb4bd477a lua-eco: fix LUA_ECO_CRASH_BACKTRACE recursive dependency
LUA_ECO_CRASH_BACKTRACE declared "depends on PACKAGE_lua-eco" while
lua-eco's DEPENDS carries "+LUA_ECO_CRASH_BACKTRACE:libunwind", which the
generator turns into "select libunwind if LUA_ECO_CRASH_BACKTRACE". kconfig
then sees lua-eco and the symbol depending on each other:

  error: recursive dependency detected!
    symbol LUA_ECO_CRASH_BACKTRACE depends on PACKAGE_lua-eco
    symbol PACKAGE_lua-eco depends on LUA_ECO_CRASH_BACKTRACE

Drop the redundant guard; the option only affects lua-eco's own build, so
nothing is pulled in when lua-eco itself is not selected.

Fixes: https://github.com/openwrt/packages/pull/30098#issuecomment-5113528752
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-07-30 14:23:00 +03:00
Jianhui Zhao b7defd3980 lua-eco: update to 4.1.4
Add the new cli module as a separate subpackage.

Expose the optional C crash backtrace diagnostics through
CONFIG_LUA_ECO_CRASH_BACKTRACE. Depend on libunwind when enabled.
Keep the option unavailable on musl/powerpc, where OpenWrt's
libunwind package is not supported.

changelog: https://github.com/zhaojh329/lua-eco/compare/v4.0.0...v4.1.4

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
2026-07-28 09:57:37 +03:00
Wei-Ting Yang 870abb80ed python-certifi: update to 2026.7.22
Use the latest CA bundle from Mozilla.

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
2026-07-27 09:35:43 +03:00
Wei-Ting Yang 9412243052 python-idna: bump to 3.18
Release notes:
https://github.com/kjd/idna/releases/tag/v3.18

Remove the test for UTS 46 transitional processing, which is now
deprecated and emits a warning. See [1].

[1] https://github.com/kjd/idna/commit/94bcdc38fd75ae8a259132f7e3f5f1fb5373c717

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
2026-07-27 09:35:43 +03:00
Wei-Ting Yang bf1bd0a50a python-charset-normalizer: bump to 3.4.9
Release notes:
https://github.com/jawah/charset_normalizer/releases/tag/3.4.8
https://github.com/jawah/charset_normalizer/releases/tag/3.4.9

Also update package GitHub URL.

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
2026-07-27 09:35:43 +03:00
Alexandru Ardelean 87a7be0326 vobject: add missing pytz and six dependencies
vobject 0.9.9 lists both pytz and six as unconditional runtime requirements
in install_requires, but neither was in DEPENDS. Running the change_tz
console script failed with "ModuleNotFoundError: No module named 'pytz'".

six happened to resolve transitively through python3-dateutil even though
vobject/base.py imports it directly, so list it explicitly rather than rely
on another package's dependency.

Extend test.sh to check that both modules import and that vobject.change_tz
loads.

Fixes: https://github.com/openwrt/packages/issues/29992
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-07-22 09:31:42 +03:00
Alexandru Ardelean f51b9af6f0 python-websocket-client: drop package
There are currently no more users for this.
Drop it.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-07-16 08:46:54 +02:00
Alexandru Ardelean 7db4f7bb69 python-paramiko: drop package
There are no longer packages that need this.
This offers advanced SSH functions in Python.
But for OpenWrt's context it may work with just using ssh commands
with the subprocess package.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-07-16 08:46:54 +02:00
Alexandru Ardelean b47d9caf8e python-docker: drop package
This has migrated in favor of the Go version of docker tools.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-07-16 08:46:54 +02:00
Alexandru Ardelean 30b34ef130 python-dockerpty: drop package
It's ~12 yrs old.
Probably not even used anymore.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-07-16 08:46:54 +02:00
Wei-Ting Yang bdab2f1f59 python-asgiref: improve version check in test.sh
Verify that asgiref.__version__ strictly equals the expected version
argument ($2), instead of just checking that it is non-empty.

Also remove single quotes from EOF to enable variable expansion.

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
2026-07-15 10:22:17 +03:00
Michael Heimpold c0d279e175 php8: update to 8.4.23
This fixes:
    - CVE-2025-14179
    - CVE-2026-6104
    - CVE-2026-6722
    - CVE-2026-6735
    - CVE-2026-7258
    - CVE-2026-7262
    - CVE-2026-7568
    - CVE-2026-12184
    - CVE-2026-14355

Full upstream changelogs:
https://www.php.net/ChangeLog-8.php#8.4.17
https://www.php.net/ChangeLog-8.php#8.4.18
https://www.php.net/ChangeLog-8.php#8.4.19
https://www.php.net/ChangeLog-8.php#8.4.20
https://www.php.net/ChangeLog-8.php#8.4.21
https://www.php.net/ChangeLog-8.php#8.4.22
https://www.php.net/ChangeLog-8.php#8.4.23

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2026-07-13 21:54:20 +02:00
Philip A. Prindeville 5544edf33a python-pexpect: add package
Useful for provisioning devices like modems that present themselves
via a serial device.

Signed-off-by: Philip A. Prindeville <philipp@redfish-solutions.com>
2026-07-12 19:03:48 -06:00
Philip A. Prindeville 592a4ac758 python-ptyprocess: add package
Requirement for python-pexpect.

Signed-off-by: Philip A. Prindeville <philipp@redfish-solutions.com>
2026-07-12 19:03:48 -06:00
Andy Chiang 66febba4e1 golang: bump 1.26 to 1.26.5
Fixes: CVE-2026-39822
Fixes: CVE-2026-42505
Changes: https://github.com/golang/go/issues?q=milestone%3AGo1.26.5+label%3ACherryPickApproved

Signed-off-by: Andy Chiang <AndyChiang_git@outlook.com>
2026-07-12 20:58:26 +02:00
Jianhui Zhao e1ec189d45 lua-eco: add CONFIG_ prefix to PKG_CONFIG_DEPENDS options
Options listed in PKG_CONFIG_DEPENDS must start with
CONFIG_ prefix.

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
2026-07-11 23:07:44 +08:00
Wei-Ting Yang 4af6cb6efd django: bump to version 6.0.7
Fix CVE-2026-48588, CVE-2026-53877, and CVE-2026-53878.

Full release notes:
https://docs.djangoproject.com/en/6.0/releases/6.0.7/

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
2026-07-09 17:50:31 +03:00
Philip A. Prindeville c08761bfcc treewide: homogenize references to libfts for MUSL
The way we use -lfts isn't particularly consistent.  There's no reason
it shouldn't be.  glibc users shouldn't have to deal with someone else's
lack of rigor.

Signed-off-by: Philip A. Prindeville <philipp@redfish-solutions.com>
2026-07-05 22:45:59 -06:00
Josef Schlehofer e755a9aef2 tree-wide: remove redundant test.sh files
Generic version checks were introduced in actions-shared-workflows,
making these individual test.sh files obsolete.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2026-07-04 23:42:46 +03:00
Hirokazu MORIKAWA a408cf014b node: bump to 22.23.0
This is a security release.
Notable Changes

    (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
    (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
    (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
    (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
    (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
    (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
    (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
    (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
    (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
    (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
    (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
2026-06-23 08:19:18 +03:00
Alexandru Ardelean 491f1df066 python-decorator: drop package
No longer needed by any package in the feed; jsonpath-ng was the
last consumer and no longer imports it.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-17 06:53:07 +03:00
Alexandru Ardelean 06c1e146e2 python-ply: drop package
No longer needed by any package in the feed; jsonpath-ng (the last
consumer) vendors ply internally as jsonpath_ng._ply.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-17 06:53:07 +03:00
Alexandru Ardelean 933152c011 python-jsonpath-ng: drop ply, six and decorator dependencies
jsonpath-ng 1.8.0 vendors ply as jsonpath_ng._ply and no longer imports
six or decorator, so none are required at runtime.

It builds through the setuptools.build_meta legacy backend but never
declared setuptools as a build dependency; it was only present in the host
build env transitively via those packages' builds. Add python-setuptools/host
explicitly so the build no longer relies on that side effect.

The jsonpath_ng CLI takes a required expression argument and has no version
flag, so the generic version check cannot detect the package version from it.
Add a test-version.sh override and assert __version__ in test.sh instead,
mirroring python-jmespath.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-17 06:53:07 +03:00
Alexandru Ardelean b9395cbfeb python-editables: drop package
No longer needed by any package in the feed; hatchling 1.27+ removed
it from install_requires.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-16 09:31:53 +03:00
Alexandru Ardelean b1160f9524 python-hatchling: drop editables dependency
Upstream removed editables from install_requires in hatchling 1.27;
1.30.1 no longer needs it at runtime or build-time.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-16 09:31:53 +03:00
Alexandru Ardelean 48785f6dfe python-contextlib2: drop package
No longer needed by any package in the feed; only python-schema
depended on it and it was a Python <3.3 conditional shim.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-16 09:31:53 +03:00
Alexandru Ardelean a87a048279 python-schema: drop contextlib2 dependency
Upstream only requires contextlib2 on Python <3.3, so it is never
pulled in on a Python 3.14 runtime.

schema builds through the setuptools.build_meta legacy backend but never
declared setuptools as a build dependency; it was only present in the host
build env transitively via contextlib2's build. Add python-setuptools/host
explicitly so the build no longer relies on that side effect.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-16 09:31:53 +03:00
Jianhui Zhao b666073649 lua-ffi: update to 1.3.0
changelog: https://github.com/zhaojh329/lua-ffi/releases/tag/v1.3.0

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
2026-06-15 11:39:51 +03:00
Alexandru Ardelean e503480606 python3: fix host PGO build failure on deep build paths
Python 3.14 made "forkserver" the default multiprocessing start method on
Linux, which binds an AF_UNIX socket under $TMPDIR during the PGO profile-run.
OpenWrt points TMPDIR at the deeply nested build tree, so the socket path can
exceed the 108-byte AF_UNIX limit and abort the host build with "AF_UNIX path
too long" in test_re (cpython#149527). Pin TMPDIR=/tmp for the host build.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-15 11:39:24 +03:00
Alexandru Ardelean 77566058f4 jdcall: drop package
No longer needed.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-14 18:21:03 +03:00
Alexandru Ardelean d6ddf8ee67 openpyxl: remove jdcal dependency
It's no longer needed since ~2021
 https://foss.heptapod.net/openpyxl/openpyxl/-/merge_requests/393

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-14 18:21:03 +03:00
Alexandru Ardelean 82b94afb30 python-frozenlist: drop package
No longer needed by any package in the feed.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-14 08:21:45 +03:00
Alexandru Ardelean e0ed322c0c python-flit-scm: drop package
No longer needed by any package in the feed.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-14 08:21:45 +03:00
George Sapkin 7fe08b4652 golang: bump 1.26 to 1.26.4
Fixes: CVE-2026-27145
Fixes: CVE-2026-42504
Fixes: CVE-2026-42507
Changes: https://github.com/golang/go/issues?q=milestone%3AGo1.26.4+label%3ACherryPickApproved
Signed-off-by: George Sapkin <george@sapk.in>
2026-06-14 00:51:12 +03:00
George Sapkin 6149f90711 golang: use upstream build ID logic
Don't override the upstream build ID logic to hopefully improve
reproducibility.

Signed-off-by: George Sapkin <george@sapk.in>
2026-06-14 00:51:12 +03:00
Alexandru Ardelean 4f5b1824c9 python-chardet: drop package
python-requests now uses charset-normalizer and nothing else in the
feed depends on it.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-12 12:26:50 +02:00
Alexandru Ardelean dcc90f1920 python-requests: use charset-normalizer instead of chardet
Switch runtime and host build deps from chardet to charset-normalizer,
the mandatory charset-detection backend since requests 2.26. Extend
test.sh to cover the new backend and bump PKG_RELEASE.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-12 12:26:50 +02:00
Alexandru Ardelean 9c97b73b1a python-charset-normalizer: add host build
Add a HostBuild variant so it can be used as a /host build dependency,
mirroring python-certifi/idna/urllib3.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-12 12:26:50 +02:00
Alexandru Ardelean 81b237d43a python-toml: drop package
No idea if this is used.
It's a pure python package.
No other packages depend on this.
Can be installed via pip on device.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-11 19:56:36 +03:00
Alexandru Ardelean 3993db02bd python-pyparsing: drop package
No idea if this is used.
It's a pure python package.
No other packages depend on this.
Can be installed via pip on device.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-11 19:56:36 +03:00
Alexandru Ardelean a06fb85350 python-apipkg: drop package
No idea if this is used.
It's a pure python package.
No other packages depend on this.
Can be installed via pip on device.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-11 19:56:36 +03:00
Alexandru Ardelean 8338b02877 python-incremental: add test-version.sh generic version-check override
The incremental CLI requires an "update" subcommand and prints a usage
error instead of a version for the flags the generic check probes, so it
fails generic tests (e.g. when python3 is bumped). Override it; test.sh
still covers functionality.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-09 17:18:01 +03:00
Alexandru Ardelean f5490954f5 python-automat: drop broken automat-visualize entry point
The package excludes automat/_visualize.py (it needs the optional graphviz
dependency), but the automat-visualize console script was still installed and
imports that module, so it failed at runtime and broke the CI generic test.
Skip the /usr/bin install so the package ships as a pure library.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-09 17:18:01 +03:00
Alexandru Ardelean e266bed8d8 python-greenlet: bump to 3.5.1
Refresh sha256 from PyPI sdist.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-06-09 17:18:01 +03:00