Commit Graph

5041 Commits

Author SHA1 Message Date
Tianling Shen ff826adfa8 rust: Update to 1.94.0
Changelog:
- https://github.com/rust-lang/rust/releases/tag/1.91.1
- https://github.com/rust-lang/rust/releases/tag/1.92.0
- https://github.com/rust-lang/rust/releases/tag/1.93.0
- https://github.com/rust-lang/rust/releases/tag/1.93.1
- https://github.com/rust-lang/rust/releases/tag/1.94.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2026-03-12 00:52:21 +08:00
Wei-Ting Yang d1923a44fd django: bump to version 6.0.3
Fix CVE-2026-25674.

Full release notes:
https://docs.djangoproject.com/en/6.0/releases/6.0.3/

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
2026-03-11 13:52:18 +02:00
Wei-Ting Yang 551fe9b9b6 django: clean up Makefile
- Add AUTHORS into PKG_LICENSE_FILES.
- Drop no longer required python3-pytz dependency.
- Remove obsolete CONFLICTS field.

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
2026-03-11 13:52:18 +02:00
George Sapkin ddb2995ef0 golang: bump 1.26 to 1.26.1
Fixes: CVE-2026-25679
Fixes: CVE-2026-27137
Fixes: CVE-2026-27138
Fixes: CVE-2026-27139
Fixes: CVE-2026-27142
Changes: https://github.com/golang/go/issues?q=milestone%3AGo1.26.1+label%3ACherryPickApproved
Signed-off-by: George Sapkin <george@sapk.in>
2026-03-07 01:15:09 +02:00
George Sapkin b284c4de94 golang: remove broken mirror
Remove dl.google.com mirror because it's not responding.

Signed-off-by: George Sapkin <george@sapk.in>
2026-03-07 01:15:09 +02:00
Orne Brocaar 4c3a649dd7 rust: set llvm.download-ci-llvm=false
These LLVM builds get deleted after a certain time, causing Rust builds
to break as the LLVM build can no longer be downloaded.

Fixes #27331.

Signed-off-by: Orne Brocaar <info@brocaar.com>
2026-03-06 00:38:44 +02:00
Rosen Penev 3c32225190 python-gmpy2: update to 2.2.2
Fixes compilation.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2026-02-23 15:14:17 +07:00
Wei-Ting Yang f7e3317515 treewide: fix licenses
Fix licenses.

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
2026-02-19 20:15:36 +02:00
Rosen Penev 126562da30 python-gevent: use LF for Makefile
Done with all other Makefiles.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2026-02-14 14:58:44 +02:00
Rosen Penev 1d3b5f7791 python-gevent: update to 25.9.1
Fixes compilation.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2026-02-14 14:58:44 +02:00
George Sapkin e9e8502f78 golang: replace 1.25 with to 1.26.0
Replace golang1.25 with golang1.26 with version 1.26.0.

Update OS/arch combinations.

Bump bootstrap to 1.24.13.

Link: https://go.dev/doc/go1.26
Link: https://github.com/openwrt/packages/pull/28552
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-11 13:24:21 +02:00
Wei-Ting Yang b54cc9b69e django: bump to version 6.0.2
Release notes:
https://docs.djangoproject.com/en/dev/releases/6.0/
https://docs.djangoproject.com/en/dev/releases/6.0.1/
https://docs.djangoproject.com/en/dev/releases/6.0.2/

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
2026-02-06 19:59:56 +02:00
George Sapkin 5065a2ff8f golang: bump 1.25 to 1.25.7
Fixes: CVE-2025-61732
Fixes: CVE-2025-68121
Changes: https://github.com/golang/go/issues?q=milestone%3AGo1.25.7+label%3ACherryPickApproved
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-05 22:04:26 +02:00
George Sapkin e013778bac golang: add support for release candidates
Support building release candidates by setting GO_VERSION_RC to the
release candidate number, e.g. GO_VERSION_RC:=2, and unsetting
GO_VERSION_PATCH.

Signed-off-by: George Sapkin <george@sapk.in>
2026-02-05 22:04:26 +02:00
George Sapkin 35303fb1ab golang: add missing 386 and arm64 suffixes
Add missing 386 and arm64 suffixes to -installsuffix so as not to
accidentally mix incompatible binaries.

Signed-off-by: George Sapkin <george@sapk.in>
2026-02-05 22:04:26 +02:00
George Sapkin 1eaa1f848b golang: use upstream OS/arch format
Use OS/arch format used by Go and reported by go tool dist list.

Update OS/arch combinations.

Signed-off-by: George Sapkin <george@sapk.in>
2026-02-05 22:04:26 +02:00
George Sapkin 9d8ac9df17 golang: add option to skip building bootstrap
Introduce a new configuration option - GOLANG_BUILD_BOOTSTRAP - that
defaults to enabled:

- When enabled, build the local bootstrap instead of using an external
  one for host Go. If GOLANG_EXTERNAL_BOOTSTRAP_ROOT is set, skip the
  initial 1.4 step.

- When disabled, let Go auto-detect the toolchain or use the toolchain
  specified in GOLANG_EXTERNAL_BOOTSTRAP_ROOT to skip building the
  bootstrap and build host Go using that toolchain directly. Configured
  toolchain must be compatible with the current version of Go.

HOST_BUILD_DEPENDS cannot be conditional, so some Makefile juggling is
needed.

Put menu config under bootstrap only.

Remove unnecessary package-related flags from host-only bootstrap.

Signed-off-by: George Sapkin <george@sapk.in>
2026-02-04 08:56:32 +02:00
George Sapkin 5657eb0e2e golang: split src into separate packages
Split misc sources and test data into separate packages. Reduces target
src package size by a third.

Move architecture-dependent generated source from src to the main
package.

Mark doc, misc, src and tests packages with PKGARCH:=all as they don't
have any architecture-specific files.

Fix stripping and strip compiler only.

Fixes: c137c382 ("golang: new packages")
Link: https://github.com/openwrt/packages/pull/28445
Suggested-by: Jeffery To <jeffery.to@gmail.com>
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
George Sapkin 6f4155c0a0 golang: install into lib instead of share
Installing into share and symlinking to lib breaks tests:

--- FAIL: TestAllDependencies (0.01s)

    moddeps_test.go:49: findGorootModules didn't find the well-known module "std"

--- FAIL: TestDependencyVersionsConsistent (0.00s)

    moddeps_test.go:356: findGorootModules didn't find the well-known module "std"

Install into lib directly instead.

Fixes: c137c382 ("golang: new packages")
Link: https://github.com/openwrt/packages/pull/28445
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
George Sapkin a6e94447f7 golang: fix missing dependency check
Add libraries used in test data to extra_provides to pass dependency
checks in package-pack.

Remove unnecessary dependencies.

Fixes: https://github.com/openwrt/packages/issues/27633
Fixes: b2119465 ("golang: Update to 1.24.0")
Link: https://github.com/openwrt/packages/pull/28445
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
George Sapkin 4396682602 golang: fix generating zbootstrap
Fix setting architecture-specific defaults in zbootstrap.go.

Fixes: b2119465 ("golang: Update to 1.24.0")
Link: https://github.com/golang/go/commit/cce90c1eebb315da7611bb79a7bf807df5a1abd9
Link: https://github.com/openwrt/packages/pull/28445
Suggested-by: Jeffery To <jeffery.to@gmail.com>
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
George Sapkin d7e97387d1 golang: don't set GO_LDSO
Don't set GO_LDSO as it's determined automatically at link time.

Link: https://github.com/golang/go/issues/54197
Link: https://github.com/openwrt/packages/pull/28445
Suggested-by: Jeffery To <jeffery.to@gmail.com>
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
George Sapkin 97566a8308 golang: avoid expanding Makefile variables
Replace Makefile variables in comments to avoid expanding them
unnecessarily.

Link: https://github.com/openwrt/packages/pull/28445
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
Daniel F. Dickinson 4cb00fd5fb python3: error on host python path too long
Error if shebang to host python interpreter would exceed 127 characters
(124 characters plus shebang and newline). This is used to alert user
when python-installer would fail to correctly set a Python program's
shebang line.

Closes: https://github.com/openwrt/packages/issues/28310

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-01-26 09:16:08 +02:00
George Sapkin 8958c991c9 golang: add generic package definition
Move version definition to a helper file so multiple versions can be
easily defined using it.

Variables HOST_GO_VARS, PKG_GO_ASMFLAGS, PKG_GO_GCFLAGS,
PKG_GO_INSTALL_ARGS, PKG_GO_LDFLAGS, PKG_GO_VARS, and
PKG_GO_ZBOOTSTRAP_MODS are defined using conditional variable
assignment and can be overridden for each go version.

Link: https://github.com/openwrt/packages/pull/28309
Signed-off-by: George Sapkin <george@sapk.in>
2026-01-25 19:23:45 +02:00
George Sapkin ca501ee61e golang: add versioned package for 1.25
Add versioned package for 1.25 to enable having multiple host go
versions side by side.

Set default version to 1.25 in golang-values.mk

Add unversioned dummy package to allow go-based packages to continue
using the default go host version. Packages can use it by specifying:

PKG_BUILD_DEPENDS:=golang/host

or use a specific version out of the ones that are available in that
branch by specifying:

PKG_BUILD_DEPENDS:=golang1.25/host

Host go is exposed to each package through PATH set in
GO_PKG_BUILD_CONFIG_VARS and GO_PKG_VARS.

Target go is installed through alternatives with the default version
having higher priority.

Newer versions can reuse older ones as bootstraps by setting
GO_BOOTSTRAP_VERSION package variable to older version, e.g.:

GO_BOOTSTRAP_VERSION:=1.24

All subpackages provide suffix-less names, e.g. golang, golang-src, etc.
Default versions are marked as default variants.

Link: https://github.com/openwrt/packages/pull/28309
Signed-off-by: George Sapkin <george@sapk.in>
2026-01-25 19:23:45 +02:00
George Sapkin 662972a252 golang: split bootstrap into a separate package
Split bootstrap into a new package to enable multiple versions of go to
reuse the same bootstrap.

Add more source mirrors.

Link: https://github.com/openwrt/packages/pull/28309
Signed-off-by: George Sapkin <george@sapk.in>
2026-01-25 19:23:45 +02:00
George Sapkin 51aa478bea golang: add SPDX license identifiers
Link: https://spdx.org/licenses/GPL-2.0-only.html
Link: https://github.com/openwrt/packages/pull/28309
Signed-off-by: George Sapkin <george@sapk.in>
2026-01-25 19:23:45 +02:00
David Mandy dbaeeb38d3 golang: bump to 1.25.6
Fixes: CVE-2025-61726
Fixes: CVE-2025-61728
Fixes: CVE-2025-61730
Fixes: CVE-2025-61731
Fixes: CVE-2025-68119
Fixes: CVE-2025-68121
Link: https://github.com/golang/go/issues?q=milestone%3AGo1.25.6+label%3ACherryPickApproved
Signed-off-by: David Mandy <smallprogramzhusir@gmail.com>
2026-01-25 15:29:44 +02:00
Rosen Penev e8e657d381 python-greenlet: update to 3.3.1
Removed MIPS16 hacks. They were fixed upstream and didn't work anyway.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2026-01-25 07:10:21 +02:00
Michael Heimpold 551e00c8fc php8: small maintainance cleanups
- align the config option names
- re-order the configuration options
- add some help text
- drop obsolete notes regarding older PHP versions and obsolete CONFLICT
- remove (meanwhile) unrecognized configure options

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2026-01-25 07:06:40 +02:00
Jens Wagner fcaf398736 perlbase-encode: added dependency on perlbase-storable
The Encode module uses the Storable module.

Signed-off-by: Jens Wagner <jens@wagner2013.de>
2026-01-22 13:02:25 -07:00
W. Michael Petullo e05f524244 python-semanage: update to 3.9
Upstream list of changes is available at
https://github.com/SELinuxProject/selinux/releases/tag/3.9.

Signed-off-by: W. Michael Petullo <mike@flyn.org>
2026-01-22 21:47:39 +02:00
Hirokazu MORIKAWA 3cb4028f46 node: january 13, 2026 Security Releases
HOST BUILD ONLY

Update to 22.22.0
This is a security release.
Notable Changes

    (CVE-2025-59465) add TLSSocket default error handler
    (CVE-2025-55132) disable futimes when permission model is enabled
    lib,permission:
    (CVE-2025-55130) require full read and write to symlink APIs
    src:
    (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks
    src,lib:
    (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle
    tls:
    (CVE-2026-21637) route callback exceptions through error handlers

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
2026-01-22 20:53:49 +02:00
W. Michael Petullo 5de77732b6 python-selinux: update to 3.9
Upstream list of changes is available at
https://github.com/SELinuxProject/selinux/releases/tag/3.9.

Signed-off-by: W. Michael Petullo <mike@flyn.org>
2026-01-22 20:52:28 +02:00
Daniel F. Dickinson 3de4d24830 python-passlib: remove unmaintained package
passlib is unmaintained since 2020 and a maintained fork called libpass,
which is a drop-in replacement (even using the passlib module name), is
now available. https://github.com/Kozea/Radicale/issues/1952 has more
information.

Therefore we remove the python-passlib package from this repo.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-01-22 13:57:48 +07:00
Daniel F. Dickinson ead09d5fd9 python-libpass: add replacement for passlib
passlib has not be updated since 2020 and is therefore a dead project.
Radicale (used in this repo as radicale3) has updated to use libpass (a
maintained fork of passlib): https://github.com/Kozea/Radicale/pull/1953
therefore add python3-libpass to provide libpass, a drop-in replacement
for passlib, and a dependency for Radicale v3.6.0.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-01-22 13:57:48 +07:00
Daniel F. Dickinson f8b8ce62c5 php8: fix gettext and intl dependencies and build
* Add a needed BUILD_DEPENDENCY on icu package, when PHP8_INTL is
  defined.
* Make PHP8_DOM selecting PHP8_LIBXML instead of depending on it.
* PHP8_INTL does not depend on PHP8_GETTEXT, it builds also
  without gettext.
* Always show option for choosing PHP8_FULLUCIDATA
* For php8-cgi, php-cli, etc, a libstdcpp dependency is only gained
when PHP8_INTL is selected, therefore update those conditional depends.

As some combinations of these changes can change the binaries output,
PKG_RELEASE has been bumped.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2026-01-16 07:35:52 +01:00
Daniel F. Dickinson 1a01a175fa php8: add more help text and tweak whitespace
Add more menuconfig help text descriptions, and
convert some mixed tabs and spaces to spaces.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-01-16 07:35:52 +01:00
Daniel F. Dickinson 247c1a1964 php8: fix xmlreader dom circular dependency
xmlreader was selecting package php8-mod-dom as well as depending on
PHP8_DOM, while php8-mod-dom also depended on PHP8_DOM (and therefore
selected PHP8_DOM when php8-mod-dom was selected). This is a Kconfig
recursive dependency, so break the recursion by noting that because
php8-mod-xmlreader selects php8-mod-dom, PHP8_DOM is a transitive
depends, so php8-mod-xmlreader should not depend on PHP8_DOM itself.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-01-16 07:35:52 +01:00
Daniel F. Dickinson 8d7faa245a php8: reformat CONFIG_DEPENDS
Switch to a single CONFIG_ per line, and alphabetize.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-01-16 07:35:52 +01:00
Jens Wagner 552298e218 perl-www: added dependency on perlbase-module
As mentioned by @tofurky in
https://github.com/openwrt/packages/pull/26781#issuecomment-3703144370
LWP::UserAgent uses Module::Load since 6.71

Signed-off-by: Jens Wagner <jens@wagner2013.de>
2026-01-12 17:11:39 +01:00
Florian Eckert 74a3da92b2 php8: add php8 depends and move compile option to Config.in
The php8 Makefile is already quite large. To improve readability, move
config section to a separate 'Config.in' file. To ensure that the PHP8
option is only saved in '.config' if PHP8 has been selected for building. A
depends on 'PACKAGE_php8' is added to the configuration option in the
'Config.in' file.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2026-01-11 20:45:13 +01:00
Wei-Ting Yang 295c75a2b9 python-urllib3: update to 2.6.3
- Fixed HTTPResponse.read_chunked() to properly handle leftover data
  in the decoder's buffer when reading compressed chunked responses.
- Fixed a security issue where decompression-bomb safeguards of the
  streaming API were bypassed when HTTP redirects were followed.
  (CVE-2026-21441)
- Started treating Retry-After times greater than 6 hours as 6 hours
  by default.
- Fixed urllib3.connection.VerifiedHTTPSConnection on Emscripten.

Release notes:
https://github.com/urllib3/urllib3/releases/tag/2.6.2
https://github.com/urllib3/urllib3/releases/tag/2.6.3

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
2026-01-10 12:58:47 +01:00
W. Michael Petullo 65f8f2340d php8-pecl-imagick: update to 3.8.1
Fixes compilation against PHP 8.5.

Signed-off-by: W. Michael Petullo <mike@flyn.org>
2026-01-09 21:30:06 +01:00
Josef Schlehofer d8437af213 python-pika: add new package for radicale3
Pika is a pure-Python implementation of the AMQP 0-9-1 protocol that
tries to stay fairly independent of the underlying network support
library.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2026-01-09 17:09:08 +01:00
Yanase Yuki 670f4c023e lua-lzlib: remove package
This software seems no longer maintained.
The latest upstream commit is 11 years ago,
and upstream repo has been archived.
No package depends on this.

Signed-off-by: Yanase Yuki <dev@zpc.st>
2026-01-09 13:04:41 +01:00
W. Michael Petullo 75c6dc2a7c luafilesystem: update to 1.9.0
This upstream release adds support for Lua 5.5.

Signed-off-by: W. Michael Petullo <mike@flyn.org>
2026-01-09 10:54:56 +01:00
Wei-Ting Yang b1bd9b18ee python-certifi: update to 2026.1.4
Use the latest CA bundle from Mozilla.

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
2026-01-05 09:44:07 +01:00
Hannu Nyman 7e25efa101 php8: revert "php8: fix PHP8_GETTEXT missing icu dependency"
This reverts commit 996046e642.

After that faulty commit the 'icu' package is always selected
even if php8 itself is not even selected.

Simple bug reproduction process:

 perus@ub2510:/OpenWrt/aarch64$ rm .config
 perus@ub2510:/OpenWrt/aarch64$ touch .config
 perus@ub2510:/OpenWrt/aarch64$ make defconfig
 Collecting package info: done
 ...
 #
 # configuration written to .config
 #

 perus@ub2510:/OpenWrt/aarch64$ grep -iE "php8|icu" .config
 # PHP8
 # CONFIG_PACKAGE_php8 is not set
 CONFIG_PHP8_LIBXML=y
 CONFIG_PHP8_DOM=y
 CONFIG_PHP8_GETTEXT=y
 CONFIG_PHP8_INTL=y
 # CONFIG_PHP8_FULLICUDATA is not set
 # end of PHP8
 CONFIG_PACKAGE_icu=y
 # CONFIG_PACKAGE_icu-data-tools is not set
 # CONFIG_PACKAGE_icu-full-data is not set

Revert the commit, so that a fix can be developed and tested.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
2025-12-31 21:45:30 +02:00