aboutsummaryrefslogtreecommitdiff
path: root/lang
Commit message (Collapse)AuthorAge
* django: bump version 4.1.3Peter Stadler2022-12-08
| | | | | | fix CVE-2022-41323 Signed-off-by: Peter Stadler <peter.stadler@student.uibk.ac.at>
* Merge pull request #19973 from julienmalik/borgHannu Nyman2022-11-29
|\ | | | | borgbackup: initial commit
| * borgbackup: add package for 1.2.2Julien Malik2022-11-26
| | | | | | | | Signed-off-by: Julien Malik <julien.malik@paraiso.me>
| * python-pyfuse3: add package for 3.2.2Julien Malik2022-11-26
| | | | | | | | Signed-off-by: Julien Malik <julien.malik@paraiso.me>
| * python-trio: add package for 0.22.0Julien Malik2022-11-26
| | | | | | | | Signed-off-by: Julien Malik <julien.malik@paraiso.me>
| * python-sniffio: add package for 1.3.0Julien Malik2022-11-26
| | | | | | | | Signed-off-by: Julien Malik <julien.malik@paraiso.me>
| * python-outcome: add package for 1.2.0Julien Malik2022-11-26
| | | | | | | | Signed-off-by: Julien Malik <julien.malik@paraiso.me>
| * python-async-generator: add package for 1.10Julien Malik2022-11-26
| | | | | | | | Signed-off-by: Julien Malik <julien.malik@paraiso.me>
| * python-exceptiongroup: add package for 1.0.4Julien Malik2022-11-26
| | | | | | | | Signed-off-by: Julien Malik <julien.malik@paraiso.me>
| * python-sortedcontainers: add package for 2.4.0Julien Malik2022-11-26
| | | | | | | | Signed-off-by: Julien Malik <julien.malik@paraiso.me>
* | php8: update to 8.1.13Michael Heimpold2022-11-28
|/ | | | Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* Merge pull request #19652 from wormi4ok/lang-golang-update-1-19-2Tianling Shen2022-11-24
|\ | | | | golang: update to v1.19.2
| * golang: update to v1.19.3Stanislav Petrashov2022-11-23
| | | | | | | | Signed-off-by: Stanislav Petrashov <s@petrashov.ru>
| * golang: update to v1.19.2Stanislav Petrashov2022-11-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Includes fixes for security vulnerabilities: * [CVE-2022-27664](https://github.com/advisories/GHSA-69cg-p879-7622) net/http: handle server errors after sending GOAWAY * [CVE-2022-32190](https://github.com/golang/go/issues/54385) net/url: JoinPath does not strip relative path components in all circumstances * [CVE-2022-2879](https://github.com/golang/go/issues/54853) archive/tar: unbounded memory consumption when reading headers * [CVE-2022-2880](https://github.com/golang/go/issues/54663) net/http/httputil: ReverseProxy should not forward unparseable query parameters * [CVE-2022-41715](https://github.com/golang/go/issues/55949) regexp/syntax: limit memory used by parsing regexps Addresses the build failure: * https://github.com/openwrt/packages/pull/19613 Signed-off-by: Stanislav Petrashov <s@petrashov.ru>
* | php8-pecl-xdebug: update to 3.1.6Michael Heimpold2022-11-16
|/ | | | Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* golang: update to version 1.18.8Josef Schlehofer2022-11-10
| | | | | | | | | | | | | | | | | | | | Fixes following CVEs: - CVE-2022-32189 (version 1.18.5 [1]] - CVE-2022-27664 (version 1.18.6 [2]) - CVE-2022-32190 (version 1.18.6 [2]) - CVE-2022-2879 (version 1.18.7 [3]) - CVE-2022-2880 (version 1.18.7 [3]) - CVE-2022-41715 (version 1.18.7 [3]) - CVE-2022-41716 (version 1.18.8 [4]) and refreshed patch [1] https://groups.google.com/g/golang-announce/c/YqYYG87xB10 [2] https://groups.google.com/g/golang-announce/c/x49AQzIVX-s [3] https://groups.google.com/g/golang-announce/c/xtuG5faxtaU [4] https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* luaexpat: trim trailing spacesStijn Tintel2022-11-03
| | | | | | Found with modified Kconfiglib. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* php8: update to 8.1.12Michael Heimpold2022-11-02
| | | | | | | | This fixes: - CVE-2022-31630 - CVE-2022-37454 Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* python3-pytz: bump to version 2022.5Alexandru Ardelean2022-10-30
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* pillow: bump to version 9.3.0Alexandru Ardelean2022-10-30
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* node: bump to v16.18.0Hirokazu MORIKAWA2022-10-23
| | | | | | Update to v16.18.0 Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* python-certifi: bump to 2022.9.24Eneas U de Queiroz2022-10-21
| | | | | | This version updates the CA bundle, and needs urllib as dependency. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* python-docutils: bump to version 0.19Eneas U de Queiroz2022-10-21
| | | | | | | Package does not currently build because of distutil dependency. Fix this by updating to the latest version. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* django-restframework: bump to version 3.14.0Alexandru Ardelean2022-10-11
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python3: update to 3.10.7Michal Vasilek2022-10-10
| | | | | | | | * fixes CVE-2021-28861 * adjust pip and setuptools versions * refresh patches Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
* Merge pull request #19554 from commodo/numpyAlexandru Ardelean2022-10-09
|\ | | | | numpy: bump to version 1.23.3
| * numpy: bump to version 1.23.3Alexandru Ardelean2022-10-07
| | | | | | | | | | | | | | | | | | | | | | Also bump Cython version to 0.29.32 And yeeeey: zip -> tar.gz And they fixed the Intel AVX extension stuff/detection. Which is why I deferred updating it until now. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* | Merge pull request #19552 from commodo/python-pytzAlexandru Ardelean2022-10-09
|\ \ | | | | | | python3-pytz: bump to version 2022.4
| * | python3-pytz: bump to version 2022.4Alexandru Ardelean2022-10-07
| |/ | | | | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* | Merge pull request #19529 from blocktrron/qcsuperDavid Bauer2022-10-08
|\ \ | |/ |/| qcsuper: add Package w/ necessary dependencies
| * python-pycrate: add packageDavid Bauer2022-10-06
| | | | | | | | Signed-off-by: David Bauer <mail@david-bauer.net>
| * python-crcmod: add packageDavid Bauer2022-10-06
| | | | | | | | Signed-off-by: David Bauer <mail@david-bauer.net>
* | perl-net-dns: update to version 1.35Daniel Golle2022-10-07
|/ | | | | | | | | | | | | | | | | | | | | | | **** 1.35 Oct 4, 2022 Improve SVCB error reporting. Fix rt.cpan.org #144328 accept_reply test fails with matched consecutive "random" generated packet->id Fix rt.cpan.org #144299 Spelling errors. **** 1.34 May 30, 2022 Improve robustness of EDNS option compose/decompose functions. Simplify code in Makefile.PL. Fix rt.cpan.org #142426 Avoid "Useless use of a constant in void context" warning. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* django: bump to version 4.1.1Alexandru Ardelean2022-10-06
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* Merge pull request #19534 from mhei/php8-pecl-http-update-4.2.3Michael Heimpold2022-10-06
|\ | | | | php8-pecl-http: update to 4.2.3
| * php8-pecl-http: update to 4.2.3Michael Heimpold2022-10-05
| | | | | | | | Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* | node: bump to v16.17.1Hirokazu MORIKAWA2022-10-05
|/ | | | | | | | | | | | | | | | | | | | | | The following CVEs are fixed in this release: * CVE-2022-32212: DNS rebinding in --inspect on macOS (High) * Insufficient fix for macOS devices on v18.5.0 * CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium) * CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium) * Insufficient fix on v18.5.0 * CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium) * Insufficient fix on v18.5.0 * CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium) * CVE-2022-35255: Weak randomness in WebCrypto keygen More detailed information on each of the vulnerabilities can be found in September 22nd 2022 Security Releases blog post. llhttp updated to 6.0.10 llhttp is updated to 6.0.10 which includes fixes for the following vulnerabilities. * HTTP Request Smuggling - CVE-2022-32213 bypass via obs-fold mechanic (Medium)(CVE-2022-32213 ): The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). * HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215): The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). * HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)(CVE-35256): The llhttp parser in the http does not correctly handle header fields that are not terminated with CLRF. This can lead to HTTP Request Smuggling (HRS). Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* treewide: fix security issues by bumping all packages using libwolfsslPetr Štetiar2022-10-04
| | | | | | | | | | | | | | | | | | | | As wolfSSL is having hard time maintaining ABI compatibility between releases, we need to manually force rebuild of packages depending on libwolfssl and thus force their upgrade. Otherwise due to the ABI handling we would endup with possibly two libwolfssl libraries in the system, including the patched libwolfssl-5.5.1, but still have vulnerable services running using the vulnerable libwolfssl-5.4.0. So in order to propagate update of libwolfssl to latest stable release done in commit ec8fb542ec3e4 ("wolfssl: fix TLSv1.3 RCE in uhttpd by using 5.5.1-stable (CVE-2022-39173)") which fixes several remotely exploitable vulnerabilities, we need to bump PKG_RELEASE of all packages using wolfSSL library. Same bump has been done in buildroot in commit f1b7e1434f66 ("treewide: fix security issues by bumping all packages using libwolfssl"). Signed-off-by: Petr Štetiar <ynezz@true.cz>
* Merge pull request #19512 from mhei/php8-update-8.1.11Michael Heimpold2022-10-04
|\ | | | | php8: update to 8.1.11
| * php8: update to 8.1.11Michael Heimpold2022-10-03
| | | | | | | | | | | | | | | | This fixes: - CVE-2022-31628 - CVE-2022-31629 Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* | python-stem: update to v1.8.1Javier Marcet2022-10-03
|/ | | | Signed-off-by: Javier Marcet <javier@marcet.info>
* php8-pecl-sodium: drop package, replaced by php8-mod-sodium (refs #18997)Michael Heimpold2022-09-30
| | | | Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* php8: add sodium extensions (refs #18997)Michael Heimpold2022-09-30
| | | | Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* python3: use tools/expat for host buildRosen Penev2022-09-28
| | | | | | Oversight from when the expat host build was removed. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* lua-eco: adapt SSL choice to libwolfsslcpu-cryptoEneas U de Queiroz2022-09-26
| | | | | | | libwolfsslcpu-crypto has to be taken into consideration when selecting the default SSL backend. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* lang: lua-penlight: update to 1.13.1Karl Palsson2022-09-26
| | | | | | | | | | | These are bugfix and feature releases. Changes from 1.11->1.12: https://github.com/lunarmodules/Penlight/blob/master/CHANGELOG.md#1120-2022-jan-10 Changes from 1.12->1.13: https://github.com/lunarmodules/Penlight/blob/master/CHANGELOG.md#1130-2022-jul-22 Signed-off-by: Karl Palsson <karlp@etactica.com>
* php8-pecl-xdebug: add package (refs 19424)Michael Heimpold2022-09-24
| | | | Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* python-jsonschema: Update to 4.16.0Javier Marcet2022-09-17
| | | | | | | | | | | - Improve the base URI behavior when resolving a $ref to a resolution URI which is different from the resolved schema's declared $id. - Accessing jsonschema.draftN_format_checker is deprecated. Instead, if you want access to the format checker itself, it is exposed as jsonschema.validators.DraftNValidator.FORMAT_CHECKER on any jsonschema.protocols.Validator. Signed-off-by: Javier Marcet <javier@marcet.info>
* python-jsonschema: Update to 4.15.0, broken since 4.6.0Javier Marcet2022-09-17
| | | | Signed-off-by: Javier Marcet <javier@marcet.info>
* python-flask-socketio: update to 5.3.1Michal Vasilek2022-09-16
| | | | Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
Powered by cgit, Themed by Ted Yin.