aboutsummaryrefslogtreecommitdiff
path: root/lang
Commit message (Collapse)AuthorAge
* node: July 7th 2022 Security ReleasesHirokazu MORIKAWA2022-07-10
| | | | | | | | | | | | | | | | Update to v16.16.0 Release for the following issues: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)(CVE-2022-32213) HTTP Request Smuggling - Improper Delimiting of Header Fields (Medium)(CVE-2022-32214) HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215) DNS rebinding in --inspect via invalid IP addresses (High)(CVE-2022-32212) https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/ No vulnerabilities related with openssl (uses system openssl) Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* python-requests: bump to version 2.28.1Alexandru Ardelean2022-07-07
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python-lxml: bump to version 4.9.1Alexandru Ardelean2022-07-07
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* pillow: bump to version 9.2.0Alexandru Ardelean2022-07-07
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python-chardet: bump to version 5.0.0Alexandru Ardelean2022-07-07
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python-cryptography: Fix failing buildJeffery To2022-07-07
| | | | | | | Fixes https://github.com/openwrt/packages/issues/18876. Fixes https://github.com/openwrt/packages/issues/18879. Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python-jsonschema: Update to 4.6.1Javier Marcet2022-07-01
| | | | | | | | | | What's Changed: - Type annotate format checker methods by @sirosen - Fix fuzzer to include instrumentation by @DavidKorczynski - [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci Signed-off-by: Javier Marcet <javier@marcet.info>
* Merge pull request #18823 from mhei/php8-updateMichael Heimpold2022-06-26
|\ | | | | php8: update to 8.1.7
| * php8: update to 8.1.7Michael Heimpold2022-06-21
| | | | | | | | | | | | | | | | This fixes: - CVE-2022-31625 - CVE-2022-31626 Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* | python-websocket-client: update to 1.3.3Javier Marcet2022-06-25
| | | | | | | | | | | | | | | | - Fix unclosed socket error - Update header dict access - Add utf8 workaround to docs Signed-off-by: Javier Marcet <javier@marcet.info>
* | luajit: backport softfloat ppc supportRosen Penev2022-06-22
|/ | | | Signed-off-by: Rosen Penev <rosenp@gmail.com>
* samba4: drop maintainershipAndy Walsh2022-06-21
| | | | | | | | | | | | | drop maintainership: * samba4 * ksmbd-tools * perl-parse-yapp * libtirpc * softethervpn5 * wsdd2 * rpcsvc-proto Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
* django: bump to version 4.0.5Alexandru Ardelean2022-06-19
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* lxml: bump to version 4.9.0Alexandru Ardelean2022-06-19
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python3: Update to 3.10.5, refresh patchesJeffery To2022-06-13
| | | | Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* node: bump to v16.15.1Hirokazu MORIKAWA2022-06-09
| | | | | | | Upgrade npm to 8.11.0 Suppressed unnecessary builds. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* python-jsonschema: Update to 4.6.0Javier Marcet2022-06-09
| | | | | | | | | | | | | | | | | | What's Changed: - Add package_url for changelog by @fhightower - Only validate unevaluated properties/items on applicable types by @EpicWink - Mark library as typed (PEP-561) by @ssbarnea - Add v4.5.1 to changelog by @sirosen - Modernize the packaging setup via PEP 621 and Hatch. by @Julian New Contributors: - @fhightower made their first contribution - @EpicWink made their first contribution Signed-off-by: Javier Marcet <javier@marcet.info>
* micropython-lib: Update to latest masterJeffery To2022-06-06
| | | | Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* golang: Update to 1.18.3Jeffery To2022-06-06
| | | | | | | Includes fix for CVE-2022-30634 (crypto/rand: Read hangs when passed buffer larger than 1<<32 - 1). Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* openpyxl: bump to version 3.0.10Alexandru Ardelean2022-06-03
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* pillow: bump to version 9.1.1Alexandru Ardelean2022-06-03
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* node: bump to v16.15.0Hirokazu MORIKAWA2022-05-31
| | | | | | | | Description: Update from v16.15.0 Changed handling of host's npm problems due to npm updates. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* Merge pull request #18584 from mpratt14/golang-bootstrap-archJeffery To2022-05-31
|\ | | | | golang: some makefile fixes
| * golang: do not rely on Go script host detectionMichael Pratt2022-05-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | for some use cases, for example: a system with 64 bit kernel and 32 bit userspace programs the local Go installation is "detected" using the kernel "uname", causing build failure if they happen to differ by adding the argument GOHOSTARCH using the corresponding make variable it would be fully controlled in the openwrt git tree based on the HOST_ARCH make variable. Signed-off-by: Michael Pratt <mcpratt@pm.me>
| * golang: enable verbose outputMichael Pratt2022-05-27
| | | | | | | | | | | | | | allow the building script of Go to output verbose when make is executed with "V=s..." Signed-off-by: Michael Pratt <mcpratt@pm.me>
| * golang: split compile recipe into configure and compileMichael Pratt2022-05-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | the default Configure recipe for packages assumes that there is a "configure" script in the source tree directory Go does not have such a script, configure and compile is done with the same script so split the current Compile recipe into both Configure and Compile recipes Signed-off-by: Michael Pratt <mcpratt@pm.me>
* | php8: update to 8.1.6Michael Heimpold2022-05-29
|/ | | | Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* lua-openssl: update to version 0.8.2-1Maciej Krüger2022-05-26
| | | | Signed-off-by: Maciej Krüger <mkg20001@gmail.com>
* python-jsonschema: Update to 4.5.1Javier Marcet2022-05-25
| | | | | | | | | | | What's Changed: - Extend dynamicRef keyword by @nezhar - Add FORMAT_CHECKER attribute for Validator by @TiborVoelcker - Remove stray double-quote by @lurch - Ensure proper sorting of list in error message by @ssbarnea Signed-off-by: Javier Marcet <javier@marcet.info>
* python3-paramiko: update to version 2.11.0Javier Marcet2022-05-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2.11.0: - [Feature] Add SSH config token expansion (eg %h, %p) when parsing ProxyJump directives. Patch courtesy of Bruno Inec. - [Support] (via #2011) Apply unittest skipIf to tests currently using SHA1 in their critical path, to avoid failures on systems starting to disable SHA1 outright in their crypto backends (eg RHEL 9). Report & patch via Paul Howarth. - [Support] Update camelCase method calls against the threading module to be snake_case; this and related tweaks should fix some deprecation warnings under Python 3.10. Thanks to Karthikeyan Singaravelan for the report, @Narendra-Neerukonda for the patch, and to Thomas Grainger and Jun Omae for patch workshopping. - [Support] Recent versions of Cryptography have deprecated Blowfish algorithm support; in lieu of an easy method for users to remove it from the list of algorithms Paramiko tries to import and use, we’ve decided to remove it from our “preferred algorithms” list. This will both discourage use of a weak algorithm, and avoid warnings. Credit for report/patch goes to Mike Roest. 2.10.5: - [Bug] Windows-native SSH agent support as merged in 2.10 could encounter Errno 22 OSError exceptions in some scenarios (eg server not cleanly closing a relevant named pipe). This has been worked around and should be less problematic. Reported by Danilo Campana Fuchs and patched by Jun Omae. - [Bug] OpenSSH 7.7 and older has a bug preventing it from understanding how to perform SHA2 signature verification for RSA certificates (specifically certs - not keys), so when we added SHA2 support it broke all clients using RSA certificates with these servers. This has been fixed in a manner similar to what OpenSSH’s own client does: a version check is performed and the algorithm used is downgraded if needed. Reported by Adarsh Chauhan, with fix suggested by Jun Omae. - [Bug] Align signature verification algorithm with OpenSSH re: zero-padding signatures which don’t match their nominal size/length. This shouldn’t affect most users, but will help Paramiko-implemented SSH servers handle poorly behaved clients such as PuTTY. Thanks to Jun Omae for catch & patch. Signed-off-by: Javier Marcet <javier@marcet.info>
* lua-eco: Add packageJianhui Zhao2022-05-15
| | | | | | Lua-eco is a `Lua coroutine` library which was implemented based on `IO event`. Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
* golang: Update to 1.18.2Jeffery To2022-05-14
| | | | Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* micropython-lib: Update to latest masterJeffery To2022-05-14
| | | | Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3-networkx: update to 2.8W. Michael Petullo2022-05-11
| | | | Signed-off-by: W. Michael Petullo <mike@flyn.org>
* luasocket: update to 3.0.0W. Michael Petullo2022-05-11
| | | | Signed-off-by: W. Michael Petullo <mike@flyn.org>
* luaexpat: update to 1.4.1W. Michael Petullo2022-05-11
| | | | Signed-off-by: W. Michael Petullo <mike@flyn.org>
* python3-paramiko: update to version 2.10.4Javier Marcet2022-05-02
| | | | | | | | | | | | | | | | | | | | | - [Bug] Servers offering certificate variants of hostkey algorithms (eg ssh-rsa-cert-v01@openssh.com) could not have their host keys verified by Paramiko clients, as it only ever considered non-cert key types for that part of connection handshaking. This has been fixed. - [Bug] PKey instances’ __eq__ did not have the usual safety guard in place to ensure they were being compared to another PKey object, causing occasional spurious BadHostKeyException (among other things). This has been fixed. Thanks to Shengdun Hua for the original report /patch and to Christopher Papke for the final version of the fix. - [Support] Update camelCase method calls against the threading module to be snake_case; this and related tweaks should fix some deprecation warnings under Python 3.10. Thanks to Karthikeyan Singaravelan for the report, @Narendra-Neerukonda for the patch, and to Thomas Grainger and Jun Omae for patch workshopping. Signed-off-by: Javier Marcet <javier@marcet.info>
* Merge pull request #18403 from turris-cz/change-Flask-Jinja2-maintainerJosef Schlehofer2022-04-28
|\ | | | | Flask, Jinja2: change maintainer
| * Jinja2: change maintainer to Šimon BořekŠimon Bořek2022-04-27
| | | | | | | | | | | | | | | | | | | | | | As we are using this package in Turris OS and Daniel Golle decided to no longer maintain this and some other Python packages I'd like to take this package maintainership as was originally suggested in https://github.com/openwrt/packages/pull/17911 by Josef Schlehofer (@BKPepe). Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
| * Flask: change maintainer to Šimon BořekŠimon Bořek2022-04-27
| | | | | | | | | | | | | | | | | | | | | | As we are using this package in Turris OS and Daniel Golle decided to no longer maintain this and some other Python packages I'd like to take this package maintainership as was originally suggested in https://github.com/openwrt/packages/pull/17911 by Josef Schlehofer (@BKPepe). Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
* | django: bump to version 4.0.4Alexandru Ardelean2022-04-28
| | | | | | | | | | | | | | | | Fixes https://nvd.nist.gov/vuln/detail/CVE-2022-28347 https://nvd.nist.gov/vuln/detail/CVE-2022-28346 Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* | php8: update to 8.1.5Michael Heimpold2022-04-26
|/ | | | Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* ruby: update to 3.1.2Luiz Angelo Daros de Luca2022-04-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ruby 3.1.0 major changes: - YJIT: New experimental in-process JIT compiler - debug gem: A new debugger - error_highlight: Fine-grained error location in backtrace - IRB Autocomplete and Documentation Display - Many more. See: https://www.ruby-lang.org/en/news/2021/12/25/ruby-3-1-0-released/ Ruby 3.1.1 changes: - Many non-security bug fixes. See: https://www.ruby-lang.org/en/news/2022/02/18/ruby-3-1-1-released/ Ruby 3.1.2 changes: - CVE-2022-28738: Double free in Regexp compilation - CVE-2022-28739: Buffer overrun in String-to-Float conversion Packaging changes: - Dropped 100-musl.patch (upstream fix) - Added: ruby-error_highlight, ruby-random_formatter, ruby-ruby2_keywords - Removed: ruby-dbm, ruby-gdbm, ruby-fiber, ruby-gdbm, ruby-tracer - ruby_find_pkgsdeps script: * cleaned some ignored and weak dependencies - ruby_missingfiles script: * fix the example cmdline * let diff use all terminal columns Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
* pillow: bump to version 9.1.0Alexandru Ardelean2022-04-19
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python-twisted: Update to 22.4.0, refresh patchesJeffery To2022-04-18
| | | | Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* node-serialport-bindings: Support for npm@8Hirokazu MORIKAWA2022-04-16
| | | | | | | With the upgrade of node.js to version 16, the npm version will also change to version 8. This fix is to support npm@8. npm@6 can also build without problems. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node-arduino-firmata: Support for npm@8Hirokazu MORIKAWA2022-04-16
| | | | | | | With the upgrade of node.js to version 16, the npm version will also change to version 8. This fix is to support npm@8. npm@6 can also build without problems. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node-cylon: Support for npm@8Hirokazu MORIKAWA2022-04-16
| | | | | | | With the upgrade of node.js to version 16, the npm version will also change to version 8. This fix is to support npm@8. npm@6 can also build without problems. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node-serialport: Support for npm@8Hirokazu MORIKAWA2022-04-16
| | | | | | | With the upgrade of node.js to version 16, the npm version will also change to version 8. This fix is to support npm@8. npm@6 can also build without problems. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node-javascript-obfuscator: Support for npm@8Hirokazu MORIKAWA2022-04-16
| | | | | | | | | | | With the upgrade of node.js to version 16, the npm version will also change to version 8. This fix is to support npm@8. npm@6 can also build without problems. The modification method is different from other node modules. The reason is due to the npm@8 issue. https://github.com/npm/cli/issues/4027 Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
Powered by cgit, Themed by Ted Yin.