aboutsummaryrefslogtreecommitdiff
path: root/lang
Commit message (Collapse)AuthorAge
...
| * php8-pecl-mcrypt: update to 1.0.5Michael Heimpold2022-12-15
| | | | | | | | Signed-off-by: Michael Heimpold <mhei@heimpold.de>
| * php8-pecl-xdebug: update to 3.2.0Michael Heimpold2022-12-12
| | | | | | | | | | | | This update brings support for PHP 8.2.0. Signed-off-by: Michael Heimpold <mhei@heimpold.de>
| * php8: update to 8.2.0Michael Heimpold2022-12-12
| | | | | | | | Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* | python3-pytz: bump to version 2022.6Alexandru Ardelean2022-12-16
| | | | | | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* | perl: enable threading support for aarch64 by defaultDoug Thomson2022-12-14
| | | | | | | | | | | | | | | | | | Perl threads seem to be supported and working for aarch64, and including aarch64 here would allow packages like freeswitch-mod-perl to become available from the standard OpwnWrt package repository for popular routers such as the Linksys E8450 and Belkin RT3200. Signed-off-by: Doug Thomson <dwt62f+github@gmail.com>
* | python-pycares: PKG_RELEASE:=1Fabian Lipken2022-12-13
| | | | | | | | Signed-off-by: Fabian Lipken <dynasticorpheus@gmail.com>
* | python-pycares: bump to 4.3.0Fabian Lipken2022-12-12
|/ | | | Signed-off-by: Fabian Lipken <dynasticorpheus@gmail.com>
* ruby: update to 3.1.3Luiz Angelo Daros de Luca2022-12-12
| | | | | | | | | | | This release includes a security fix. - CVE-2021-33621: HTTP response splitting in CGI For more details: - https://www.ruby-lang.org/en/news/2022/11/24/ruby-3-1-3-released/ Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
* Merge pull request #20037 from 1715173329/g1194Josef Schlehofer2022-12-09
|\ | | | | golang: Update to 1.19.4
| * golang: Update to 1.19.4Tianling Shen2022-12-08
| | | | | | | | | | | | | | | | go1.19.4 (released 2022-12-06) includes security fixes to the net/http and os packages, as well as bug fixes to the compiler, the runtime, and the crypto/x509, os/exec, and sync/atomic packages. Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* | django: bump version 4.1.3Peter Stadler2022-12-08
|/ | | | | | fix CVE-2022-41323 Signed-off-by: Peter Stadler <peter.stadler@student.uibk.ac.at>
* Merge pull request #19973 from julienmalik/borgHannu Nyman2022-11-29
|\ | | | | borgbackup: initial commit
| * borgbackup: add package for 1.2.2Julien Malik2022-11-26
| | | | | | | | Signed-off-by: Julien Malik <julien.malik@paraiso.me>
| * python-pyfuse3: add package for 3.2.2Julien Malik2022-11-26
| | | | | | | | Signed-off-by: Julien Malik <julien.malik@paraiso.me>
| * python-trio: add package for 0.22.0Julien Malik2022-11-26
| | | | | | | | Signed-off-by: Julien Malik <julien.malik@paraiso.me>
| * python-sniffio: add package for 1.3.0Julien Malik2022-11-26
| | | | | | | | Signed-off-by: Julien Malik <julien.malik@paraiso.me>
| * python-outcome: add package for 1.2.0Julien Malik2022-11-26
| | | | | | | | Signed-off-by: Julien Malik <julien.malik@paraiso.me>
| * python-async-generator: add package for 1.10Julien Malik2022-11-26
| | | | | | | | Signed-off-by: Julien Malik <julien.malik@paraiso.me>
| * python-exceptiongroup: add package for 1.0.4Julien Malik2022-11-26
| | | | | | | | Signed-off-by: Julien Malik <julien.malik@paraiso.me>
| * python-sortedcontainers: add package for 2.4.0Julien Malik2022-11-26
| | | | | | | | Signed-off-by: Julien Malik <julien.malik@paraiso.me>
* | php8: update to 8.1.13Michael Heimpold2022-11-28
|/ | | | Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* Merge pull request #19652 from wormi4ok/lang-golang-update-1-19-2Tianling Shen2022-11-24
|\ | | | | golang: update to v1.19.2
| * golang: update to v1.19.3Stanislav Petrashov2022-11-23
| | | | | | | | Signed-off-by: Stanislav Petrashov <s@petrashov.ru>
| * golang: update to v1.19.2Stanislav Petrashov2022-11-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Includes fixes for security vulnerabilities: * [CVE-2022-27664](https://github.com/advisories/GHSA-69cg-p879-7622) net/http: handle server errors after sending GOAWAY * [CVE-2022-32190](https://github.com/golang/go/issues/54385) net/url: JoinPath does not strip relative path components in all circumstances * [CVE-2022-2879](https://github.com/golang/go/issues/54853) archive/tar: unbounded memory consumption when reading headers * [CVE-2022-2880](https://github.com/golang/go/issues/54663) net/http/httputil: ReverseProxy should not forward unparseable query parameters * [CVE-2022-41715](https://github.com/golang/go/issues/55949) regexp/syntax: limit memory used by parsing regexps Addresses the build failure: * https://github.com/openwrt/packages/pull/19613 Signed-off-by: Stanislav Petrashov <s@petrashov.ru>
* | php8-pecl-xdebug: update to 3.1.6Michael Heimpold2022-11-16
|/ | | | Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* golang: update to version 1.18.8Josef Schlehofer2022-11-10
| | | | | | | | | | | | | | | | | | | | Fixes following CVEs: - CVE-2022-32189 (version 1.18.5 [1]] - CVE-2022-27664 (version 1.18.6 [2]) - CVE-2022-32190 (version 1.18.6 [2]) - CVE-2022-2879 (version 1.18.7 [3]) - CVE-2022-2880 (version 1.18.7 [3]) - CVE-2022-41715 (version 1.18.7 [3]) - CVE-2022-41716 (version 1.18.8 [4]) and refreshed patch [1] https://groups.google.com/g/golang-announce/c/YqYYG87xB10 [2] https://groups.google.com/g/golang-announce/c/x49AQzIVX-s [3] https://groups.google.com/g/golang-announce/c/xtuG5faxtaU [4] https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* luaexpat: trim trailing spacesStijn Tintel2022-11-03
| | | | | | Found with modified Kconfiglib. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* php8: update to 8.1.12Michael Heimpold2022-11-02
| | | | | | | | This fixes: - CVE-2022-31630 - CVE-2022-37454 Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* python3-pytz: bump to version 2022.5Alexandru Ardelean2022-10-30
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* pillow: bump to version 9.3.0Alexandru Ardelean2022-10-30
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* node: bump to v16.18.0Hirokazu MORIKAWA2022-10-23
| | | | | | Update to v16.18.0 Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* python-certifi: bump to 2022.9.24Eneas U de Queiroz2022-10-21
| | | | | | This version updates the CA bundle, and needs urllib as dependency. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* python-docutils: bump to version 0.19Eneas U de Queiroz2022-10-21
| | | | | | | Package does not currently build because of distutil dependency. Fix this by updating to the latest version. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* django-restframework: bump to version 3.14.0Alexandru Ardelean2022-10-11
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python3: update to 3.10.7Michal Vasilek2022-10-10
| | | | | | | | * fixes CVE-2021-28861 * adjust pip and setuptools versions * refresh patches Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
* Merge pull request #19554 from commodo/numpyAlexandru Ardelean2022-10-09
|\ | | | | numpy: bump to version 1.23.3
| * numpy: bump to version 1.23.3Alexandru Ardelean2022-10-07
| | | | | | | | | | | | | | | | | | | | | | Also bump Cython version to 0.29.32 And yeeeey: zip -> tar.gz And they fixed the Intel AVX extension stuff/detection. Which is why I deferred updating it until now. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* | Merge pull request #19552 from commodo/python-pytzAlexandru Ardelean2022-10-09
|\ \ | | | | | | python3-pytz: bump to version 2022.4
| * | python3-pytz: bump to version 2022.4Alexandru Ardelean2022-10-07
| |/ | | | | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* | Merge pull request #19529 from blocktrron/qcsuperDavid Bauer2022-10-08
|\ \ | |/ |/| qcsuper: add Package w/ necessary dependencies
| * python-pycrate: add packageDavid Bauer2022-10-06
| | | | | | | | Signed-off-by: David Bauer <mail@david-bauer.net>
| * python-crcmod: add packageDavid Bauer2022-10-06
| | | | | | | | Signed-off-by: David Bauer <mail@david-bauer.net>
* | perl-net-dns: update to version 1.35Daniel Golle2022-10-07
|/ | | | | | | | | | | | | | | | | | | | | | | **** 1.35 Oct 4, 2022 Improve SVCB error reporting. Fix rt.cpan.org #144328 accept_reply test fails with matched consecutive "random" generated packet->id Fix rt.cpan.org #144299 Spelling errors. **** 1.34 May 30, 2022 Improve robustness of EDNS option compose/decompose functions. Simplify code in Makefile.PL. Fix rt.cpan.org #142426 Avoid "Useless use of a constant in void context" warning. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* django: bump to version 4.1.1Alexandru Ardelean2022-10-06
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* Merge pull request #19534 from mhei/php8-pecl-http-update-4.2.3Michael Heimpold2022-10-06
|\ | | | | php8-pecl-http: update to 4.2.3
| * php8-pecl-http: update to 4.2.3Michael Heimpold2022-10-05
| | | | | | | | Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* | node: bump to v16.17.1Hirokazu MORIKAWA2022-10-05
|/ | | | | | | | | | | | | | | | | | | | | | The following CVEs are fixed in this release: * CVE-2022-32212: DNS rebinding in --inspect on macOS (High) * Insufficient fix for macOS devices on v18.5.0 * CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium) * CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium) * Insufficient fix on v18.5.0 * CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium) * Insufficient fix on v18.5.0 * CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium) * CVE-2022-35255: Weak randomness in WebCrypto keygen More detailed information on each of the vulnerabilities can be found in September 22nd 2022 Security Releases blog post. llhttp updated to 6.0.10 llhttp is updated to 6.0.10 which includes fixes for the following vulnerabilities. * HTTP Request Smuggling - CVE-2022-32213 bypass via obs-fold mechanic (Medium)(CVE-2022-32213 ): The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). * HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215): The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). * HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)(CVE-35256): The llhttp parser in the http does not correctly handle header fields that are not terminated with CLRF. This can lead to HTTP Request Smuggling (HRS). Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* treewide: fix security issues by bumping all packages using libwolfsslPetr Štetiar2022-10-04
| | | | | | | | | | | | | | | | | | | | As wolfSSL is having hard time maintaining ABI compatibility between releases, we need to manually force rebuild of packages depending on libwolfssl and thus force their upgrade. Otherwise due to the ABI handling we would endup with possibly two libwolfssl libraries in the system, including the patched libwolfssl-5.5.1, but still have vulnerable services running using the vulnerable libwolfssl-5.4.0. So in order to propagate update of libwolfssl to latest stable release done in commit ec8fb542ec3e4 ("wolfssl: fix TLSv1.3 RCE in uhttpd by using 5.5.1-stable (CVE-2022-39173)") which fixes several remotely exploitable vulnerabilities, we need to bump PKG_RELEASE of all packages using wolfSSL library. Same bump has been done in buildroot in commit f1b7e1434f66 ("treewide: fix security issues by bumping all packages using libwolfssl"). Signed-off-by: Petr Štetiar <ynezz@true.cz>
* Merge pull request #19512 from mhei/php8-update-8.1.11Michael Heimpold2022-10-04
|\ | | | | php8: update to 8.1.11
| * php8: update to 8.1.11Michael Heimpold2022-10-03
| | | | | | | | | | | | | | | | This fixes: - CVE-2022-31628 - CVE-2022-31629 Signed-off-by: Michael Heimpold <mhei@heimpold.de>
Powered by cgit, Themed by Ted Yin.