aboutsummaryrefslogtreecommitdiff
path: root/lang
Commit message (Collapse)AuthorAge
* lua-eco: update to 3.3.0Jianhui Zhao2024-04-01
| | | | Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
* perl-text-csv_xs: Update to 1.53Philip Prindeville2024-03-29
| | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* rust: update to 1.77.0krant2024-03-26
| | | | | | | | - Restore patch hunk mis-deleted in dccb910 - Refresh patches - Remove --enable-missing-tools configure option deleted in the upstream Signed-off-by: krant <aleksey.vasilenko@gmail.com>
* perl-cgi: Update to 4.64Philip Prindeville2024-03-25
| | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* erlang: update to 26.2.3krant2024-03-22
| | | | Signed-off-by: krant <aleksey.vasilenko@gmail.com>
* Merge pull request #23695 from mhei/php8-update-to-8.3.4Michael Heimpold2024-03-21
|\ | | | | php8: update to 8.3.4
| * php8: update to 8.3.4Michael Heimpold2024-03-17
| | | | | | | | Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* | lualanes: update to version 3.16.3 and use tarballJosef Schlehofer2024-03-21
| | | | | | | | | | | | | | | | | | | | | | | | 1. Update it to version 3.16.3 Release notes: https://github.com/LuaLanes/lanes/releases/tag/v3.16.3 2. Change to download tarball instead of checking out Git sources In the previous commit (in the Fixes tag), it was changed to Git sources without any reason. Let's revert it back. Let's use again tagged release. Fixes: b93e5b45b1daac827d429b51d8763226268f2b9a ("lualanes: Version bump to v3.16.2") Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* | golang: Update to 1.22.1Zephyr Lykos2024-03-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Go 1.22.1 contains the following security fixes: - CVE-2024-24783: crypto/x509: Verify panics on certificates with an unknown public key algorithm - CVE-2023-45290 net/http: memory exhaustion in Request.ParseMultipartForm - CVE-2023-45289 net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect - CVE-2024-24785 html/template: errors returned from MarshalJSON methods may break template escaping - CVE-2024-24784 net/mail: comments in display names are incorrectly handled https://go.dev/doc/devel/release#go1.22.1 https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg Signed-off-by: Zephyr Lykos <git@mochaa.ws>
* | golang: Update to 1.22.0Zephyr Lykos2024-03-20
| | | | | | | | | | | | | | | | | | Added a third bootstrap stage since go1.22 (and onwards) requires at least go1.20.14 to build.[1] [1]: https://go.dev/doc/go1.22#bootstrap Signed-off-by: Zephyr Lykos <git@mochaa.ws>
* | Merge pull request #23648 from commodo/python-updates1Alexandru Ardelean2024-03-19
|\ \ | | | | | | python-{pytz,dateutil,evdev},django: bump versions
| * | django: bump to version 5.0.3Alexandru Ardelean2024-03-14
| | | | | | | | | | | | Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
| * | python-evdev: bump to version 1.7.0Alexandru Ardelean2024-03-14
| | | | | | | | | | | | Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
| * | python-dateutil: bump to version 2.9.0.post0Alexandru Ardelean2024-03-14
| | | | | | | | | | | | Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
| * | python-pytz: bump to version 2024.1Alexandru Ardelean2024-03-14
| |/ | | | | | | Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
* / luafilesystem: add missing license informationFlorian Eckert2024-03-19
|/ | | | Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* lua-struct: add packagejasle2024-03-04
| | | | | | | | | lua-struct is a implementation of binary packing/unpacking in pure lua. Resulting-package: * lua-struct Signed-off-by: jasle <jasle@riseup.net>
* python-bcrypt: Update to 4.1.2Fabian Lipken2024-03-02
| | | | Signed-off-by: Fabian Lipken <dynasticorpheus@gmail.com>
* golang: Update to 1.21.7Tianling Shen2024-03-02
| | | | | | | | | | go1.21.6 (released 2024-01-09) includes fixes to the compiler, the runtime, and the crypto/tls, maps, and runtime/pprof packages. go1.21.7 (released 2024-02-06) includes fixes to the compiler, the go command, the runtime, and the crypto/x509 package. Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* php8/pecl8-pecl-*: use https URLs for PKG_SOURCE_URLsMichael Heimpold2024-02-26
| | | | | | | Most packages already use https URLs and for PHP and PECL package downloads https is working properly. Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* rust: update to 1.76.0krant2024-02-25
| | | | | | | - Use .xz for source archive - Refresh patches Signed-off-by: krant <aleksey.vasilenko@gmail.com>
* python-yaml: fix build with Cython 3krant2024-02-24
| | | | Signed-off-by: krant <aleksey.vasilenko@gmail.com>
* micropython: disable moldOskari Rauta2024-02-22
| | | | | | package fails to build with mold linker due to unregocnized flag. Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
* php8: update to 8.3.3Michael Heimpold2024-02-19
| | | | Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* node: February 14 2024 Security ReleasesHirokazu MORIKAWA2024-02-16
| | | | | | | | | | | | | | | | | | | | Update to v20.11.1 This is a security release. Notable changes * CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High) * CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High) * CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High) * CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High) * CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium) * CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium) * CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium) * CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium) * undici version 5.28.3 * libuv version 1.48.0 * OpenSSL version 3.0.13+quic1 (Depends on shared library provided by OpenWrt) Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* vala: remove pcre2 patchRosen Penev2024-02-14
| | | | | | Issue was avoided with glib2. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* python-aiohttp: update to 3.9.3Rosen Penev2024-02-14
| | | | | | Fixes CVE-2023-47627 Signed-off-by: Rosen Penev <rosenp@gmail.com>
* erlang: update to 26.2.2krant2024-02-08
| | | | | | | | | - Drop upstreamed patch - Fix broken symlink /usr/bin/epmd - Re-enable mips16 - Formatting Signed-off-by: krant <aleksey.vasilenko@gmail.com>
* python-lxml: bump to version 5.1.0Alexandru Ardelean2024-02-08
| | | | | | Also add a quick test.sh file. Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
* django: bump to version 5.0.1Alexandru Ardelean2024-02-08
| | | | Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
* numpy: bump to version 1.26.3Alexandru Ardelean2024-02-08
| | | | Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
* python-certifi: Update to 2024.2.2Eneas U de Queiroz2024-02-05
| | | | Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* python-orjson: update to version 3.9.13Timothy M. Ace2024-02-05
| | | | | | | | | | Relevant changes since 3.9.12: - FIXED: Serialization str escape uses only 128-bit SIMD. - FIXED: Fix compatibility with CPython 3.13 alpha 3. - Publish musllinux_1_2 instead of musllinux_1_1 wheels. - Serialization uses small integer optimization in CPython 3.12 or later. Signed-off-by: Timothy M. Ace <openwrt@timothyace.com>
* lang/python/python-yaml: fix PKG_CPE_IDFabrice Fontaine2024-02-05
| | | | | | | | | | There is not a single CVE linked to pyyaml_project:pyyaml so use pyyaml:pyyaml instead: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:pyyaml:pyyaml Fixes: c06a04c754bdcfdb2ea0bd1d654128863a2b6738 (python-yaml: update to version 5.1) Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
* lualanes: Version bump to v3.16.2Mark Baker2024-02-04
| | | | | | | | | | | | | | Update the PKG_VERSION and PKG_SOURCE_VERSION to pull version 3.16.2 from upstream. The upstream version includes fixes for the `pthread_yield: symbol not found` issue. Removed patches 100-musl-compat.patch and 200-fix-redef-error.patch as fixes were implemented upstream. Build tested on aarch64, arm_cortex_a15/a9, i386, mips[el]_24kc, powerpc_464fp/8548, riscv64, x86_64. Confirmed on x86_64. Signed-off-by: Mark Baker <mark@vpost.net>
* perl-time-moment: initial package at v0.44Timothy Ace2024-02-04
| | | | | | Builds compiled perl module Time::Moment v0.44 from CPAN. Signed-off-by: Timothy Ace <openwrt@timothyace.com>
* treewide: assign PKG_CPE_IDFabrice Fontaine2024-02-04
| | | | Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
* lang/python/python-pip: fix PKG_CPE_IDFabrice Fontaine2024-02-04
| | | | | | | | | | | There is not a single CVE linked to python:pip so use pypa:pip instead: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:pypa:pip Moreover, CPE_ID missed PKG_ prefix Fixes: eee273507b868ad5f6f7e744d513c85330967906 (python3: Split pip into separate source package) Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
* lang/python/python-paho-mqtt: fix licenseFabrice Fontaine2024-02-04
| | | | | | | | | | | | python-paho-mqtt is licensed under EPL-2.0, not EPL-1.0, since version 1.6.0 and https://github.com/eclipse/paho.mqtt.python/commit/fabe7500fb6fde31fd98c619e0117d1c651fd18d While at it, add LICENSE.txt to PKG_LICENSE_FILES Fixes: 784f2a519bb8cdfaa973070f65ff9a3a481e5cd1 (python-paho-mqtt: bump to version 1.6.1) Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
* lang/python/python-requests: fix PKG_CPE_IDFabrice Fontaine2024-02-04
| | | | | | | | | | There is not a single CVE linked to python-requests:requests so use python:requests instead: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:python:requests Fixes: ceadbcbb64de727c3a974e552d9a723d532e4e40 (treewide: add PKG_CPE_ID for cvescanner) Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
* lang/python/python-urllib3: fix PKG_CPE_IDFabrice Fontaine2024-02-04
| | | | | | | | | | There is not a single CVE linked to urllib3_project:urllib3 so use python:urllib3 instead: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:python:urllib3 Fixes: 6dcaa769d8ce8921dc3bfaf78ab9a8c1cef4a9b9 (python-urllib3: update to version 1.25) Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
* lang/python/python-aiohttp: fix PKG_CPE_IDFabrice Fontaine2024-02-04
| | | | | | | | | | | aiohttp:aiohttp is a better CPE ID than aio-libs_projet:aiohttp as this CPE ID has the latest CVEs (whereas aio-libs_project:aiohttp only has one CVE from 2018): https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:aiohttp:aiohttp Fixes: 2edf5034f1c09fe60af52087abe7b6fcef9433fc (python-aiohttp: add a new package) Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
* treewide: fix licence typosFabrice Fontaine2024-01-31
| | | | | | | | | | | | | - PKG_LICENCE -> PKG_LICENSE - PKC_LICENSE_FILES -> PKG_LICENSE_FILES - BSD 3-Clause -> BSD-3-Clause - BSD-3-clause -> BSD-3-Clause - BSD-2-clause -> BSD-2-Clause - Public Domain -> Public-Domain - PublicDomain -> Public-Domain - Drop unneeded ',' in PKG_LICENSE or PKG_LICENSE_FILES Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
* erlang: remove CFLAGS modification since it has been fixed in the upstreamkrant2024-01-29
| | | | Signed-off-by: krant <aleksey.vasilenko@gmail.com>
* erlang: update to 26.2.1krant2024-01-29
| | | | | | | | | | - Update to Erlang/OTP 26.2.1 - Remove obsolete configure options - Remove obsolete patches, add new one - Add missing no_dot_erlang.boot file (fixes #20587) - Change package URL to https Signed-off-by: krant <aleksey.vasilenko@gmail.com>
* lang/python/python-docker: assign PKG_CPE_IDFabrice Fontaine2024-01-29
| | | | | | https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:docker:docker-py Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
* lang/vala: assign PKG_CPE_IDFabrice Fontaine2024-01-29
| | | | | | https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:gnome:vala Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
* Merge pull request #23182 from mhei/php8-update-to-8.3.2Michael Heimpold2024-01-29
|\ | | | | php8: update to 8.3.2
| * php8: update to 8.3.2Michael Heimpold2024-01-28
| | | | | | | | Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* | python-dotenv: update to v1.0.1Javier Marcet2024-01-29
| | | | | | | | Signed-off-by: Javier Marcet <javier@marcet.info>
Powered by cgit, Themed by Ted Yin.