Update package to 4.8.1.
Security fix:
- Empty or missing tokens are no longer accepted; previously this could
allow bypassing token authentication
Documentation improvements: new installation section, revised docs, fixed
broken links.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update package to 6.0.4.
Security fixes:
- CVE-2026-33033: DoS fix in MultiPartParser -- base64-encoded multipart
uploads with excessive whitespace could cause repeated memory copying
- CVE-2026-3902: ASGI header spoofing fixed -- headers containing underscores
are now ignored by ASGIRequest to prevent hyphen/underscore conflation
attacks
- CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin -- add permissions
on inline model instances were not validated against forged POST data
- CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable -- changelist
forms incorrectly allowed new instances to be created via forged POST data
- CVE-2026-33034: DoS via ASGI memory upload limit bypass -- missing or
understated Content-Length could bypass DATA_UPLOAD_MAX_MEMORY_SIZE
Bug fixes:
- alogin/alogout regression where request.user was not set/cleared if already
materialized by sync middleware
- RelatedFieldWidgetWrapper regression incorrectly wrapping all widgets in a
fieldset in admin forms
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
I could not reproduce the bug reported, but the update should fix it
anyway. Tested on Turris Omnia, OpenWrt r31111.
Signed-off-by: Marius Dinu <m95d+git at psihoexpert.ro>
[imported from mailing list]
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
The link flag makes the main program depend on liblua in official
package feeds, even if collectd-mod-lua is not installed.
The plugin is already linked against liblua.so, so this can be removed.
Signed-off-by: Qingfang Deng <dqfext@gmail.com>
[added PKG_RELEASE bump]
Build without PKG_FIXUP:=autoreconf
This was introduced with: a79c49578c
Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: Intel N150
Signed-off-by: John Audia <therealgraysky@proton.me>
Watchcat was failing to restart layer-3 interfaces when in mode
'restart_iface'. The previously attempted fix made the situation
worse in that it resulted in layer 2 interfaces also failing to
start.
This was because we are passed the interface name (e.g. eth0,
l2p0, or br-lan), but ifup needs the logical network (e.g. 'lan'
which corresponds to the network device).
Update to use find_config from /lib/network/config.sh to find the
logical network from the interface name, and use ifup on the
logical network to restart the underlying interface(s) associated
with the logical network.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
* Fix path to fping and use fping as fping6
* For privacy, disable call to public API to check for Zabbix version update
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
The test.sh lacked a package name guard, causing it to run (and fail)
when the -src subpackage was tested without python3 installed.
Add the standard guard to skip the test for non-main packages.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The test.sh imports xml.etree.ElementTree from the stdlib, and
et_xmlfile itself falls back to stdlib xml when lxml is unavailable.
Add python3-xml to DEPENDS to ensure the xml module is present at
both install and test time.
The test used et_xmlfile.__version__ without importing the et_xmlfile
module (only 'from et_xmlfile import xmlfile' was present). Add
'import et_xmlfile' so the version check works correctly.
The test.sh lacked a package name guard, causing it to run (and fail)
when the -src subpackage was tested without python3 installed.
Add the standard guard to skip the test for non-main packages.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update package to 5.3.2.
Bug fix:
- Correctly serialize nanosecond-precision DataFrame timestamps;
previously nanosecond timestamps were not serialized correctly when
writing via DataFrameClient
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update package to 9.0.3.
Security fix:
- CVE-2025-71176: Fixed use of an insecure temporary directory
Bug fixes:
- pytest.approx now correctly accounts for collections.abc.Mapping key
order when comparing mappings
- Blocking a conftest.py with -p no: is now explicitly disallowed with a
clear UsageError (previously caused an internal assertion failure)
- Fixed crash when a test raises an ExceptionGroup with
__tracebackhide__ = True
- Fixed non-string messages in unittest.TestCase.subTest() not printed
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update package to 4.9.6.
4.9.5: Silent patch release.
4.9.6: Fixed shell quoting bug in the release workflow -- double quotes
now used for tag variable expansion in CI scripts.
No functional or API changes for end users between 4.9.4 and 4.9.6.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update package to 3.1.5.
Changes since 3.0.10:
3.1.0: Added support for data table formulae; Rich Text in cells; Custom
Document Properties; mapped chartspace graphical properties to charts.
Breaking: removed deprecated workbook methods (get_named_range,
add_named_range, remove_named_range) and several worksheet properties.
Bug fixes: fixed table filters being overridden, various dataframe and
multiindex alignment issues.
3.1.1: Fixed DocumentProperties times being set only at module import;
fixed missing worksheet-specific definitions.
3.1.2: Fixed reading worksheets in read-only mode with locally scoped
definitions; fixed empty custom properties causing invalid files.
3.1.3: Major performance fixes -- column name caching, pivot table
loading, custom properties reading; fixed rich-text save without lxml;
fixed file handler leaks; fixed timedelta reading in read-only mode;
improved duplicate named styles handling.
3.1.4: Minor bug fixes and stability improvements.
3.1.5: Latest stable release with cumulative fixes.
Add test.sh to verify write/read roundtrip of xlsx workbooks.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update package to 12.2.0.
Security fixes:
- Prevent FITS decompression bomb -- GZIP data from FITS images is now
limited to prevent decompression bomb attacks
- Fix OOB write with invalid tile extents -- 12.1.1 PSD tile extent checks
did not account for integer overflow
- Prevent PDF parsing trailer infinite loop -- cyclic trailer references
in PDFs are now detected and stopped
- Fix integer overflow when processing fonts with excessively large
per-glyph advances
- Fix heap buffer overflow with nested list coordinates -- nested lists
passed to ImagePath.Path, polygon(), line() etc. are now validated to
contain exactly two numeric coordinates
New features:
- ImageText.Text.wrap() -- new method to wrap text within a given
width/height, with optional shrink/grow scaling
- FontFile.to_imagefont() -- FontFile instances can now be directly
converted to ImageFont instances
- Support reading JPEG2000 images with CMYK palettes
Performance:
- Lazy plugin loading -- open is 2.3-15.6x faster, save is 2.2-9x faster
for common formats
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update package to 1.8.0.
Changes since 1.5.3:
1.6.0: Removed Python 2 and six dependency; field names with literals
now enclosed in quotes; removed decorator and testscenarios dependencies;
made path instances hashable.
1.6.1: Fixed lambda-based updates; fixed assignment when root element is
a list; added keys keyword; added slice step support; don't fail on regex
match against non-strings; Python 3.12 support.
1.7.0: Added wherenot operator; added path extension exposing datum's
path from the expression itself; allowed numeric values as keys; added
negative and wildcard indices in Split; fixed boolean value update bug;
removed Python 3.7 support; parse table constructed only once
(performance improvement).
1.8.0: Added support for comma-separated indices (e.g., field[0,1,2]);
added EMOJI and CJK Unicode support; added type hints; fixed wildcard
path resolution in field filters; fixed False/None value handling in
bool filters; vendored ply (no longer maintained upstream); dropped
Python 3.8 and 3.9 support; Python 3.13/3.14 tested.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update package to 3.4.0.
Changes:
- Added binary wheels for RISC-V 64
- Fixed multiple rare crash paths during interpreter shutdown; now uses
the atexit module (subtle API change: getcurrent unavailable once
atexit fires)
- Fixed multiple race conditions in free-threaded (no-GIL) builds when
greenlets are accessed from multiple threads, some causing assertion
failures or interpreter crashes
- Several minor correctness fixes from automated code audit
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update package to 1.6.2.
Security fix:
- Updated bundled libsodium to 1.0.20-stable (2025-12-31 build) to
resolve CVE-2025-69277
Refresh 001-always-compile-ed25519.patch for the updated source.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update package to 3.23.0.
pycryptodomex is the same codebase as pycryptodome under the Cryptodome
namespace. All changes are identical to python3-cryptodome 3.23.0:
3.19.0: Added ECDH support via Cryptodome.Protocol.DH; TupleHash128/256
update() can now hash multiple items at once.
3.19.1 (security): Patched side-channel leakage in OAEP decryption that
could enable a Manger attack.
3.20.0: Added TurboSHAKE128 and TurboSHAKE256; Cryptodome.Hash.new()
factory; AES-GCM support for PBES2/PKCS#8 containers.
3.21.0: Added Curve25519/X25519 and Curve448/X448 support; dropped
Python 3.5 support.
3.22.0: Added HPKE (RFC 9180) support; dropped Python 3.6 support.
3.23.0: Added Key Wrap (KW/KWP, RFC 3394/5649) cipher modes; Windows
ARM wheels; fixed HashEdDSA/Ed448 sign/verify mutating XOF state.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update package to 3.23.0.
Changes since 3.18.0:
3.19.0: Added ECDH support via Crypto.Protocol.DH; TupleHash128/256
update() can now hash multiple items at once; fixed cffi bug on Windows
with Python 3.12+.
3.19.1 (security): Patched side-channel leakage in OAEP decryption that
could enable a Manger attack.
3.20.0: Added TurboSHAKE128 and TurboSHAKE256; added Crypto.Hash.new()
factory; AES-GCM support for PBES2/PKCS#8 containers; SHA-2/SHA-3 support
in PBKDF2 for key containers.
3.21.0: Added Curve25519/X25519 and Curve448/X448 support; added
PYCRYPTODOME_DISABLE_GMP env var; RSA keys for PSS can now be imported;
fixed Ed25519 point negation; dropped Python 3.5 support.
3.22.0: Added HPKE (RFC 9180) support; CCM cipher now enforces
nonce-length data limits; fixed RC4 infinite loop for data >4GB; fixed
invalid PEM file handling; dropped Python 3.6 support.
3.23.0: Added Key Wrap (KW/KWP, RFC 3394/5649/NIST SP 800-38F) cipher
modes; Windows ARM wheels; fixed HashEdDSA/Ed448 sign/verify mutating
XOF state.
Refresh 001-fix-libgmp-loading.patch and 002-omit-tests.patch for the
updated source (hunk offsets shifted by 2-4 lines due to new functions).
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
If the renewal-time isn't set for the host, but it's forced to send,
send the subnet renew time value instead.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
Now that ISC-DHCP is EOLs, users might want to transparently
to the functionality of Kea. This supports most of the
functionality of ISC-DHCP for v4.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
Configuring Kea JSON files is not trivial, and this might impede
the adoption of Kea as a DHCP server. There are, however, many
users who used its predecessor ISC-DHCP, at least for DHCPv4.
A filter could ingest the legacy UCI and synthesize a JSON config
file for Kea DHCPv4.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* fixed a parsing issue in the DNS reporting,
see https://github.com/openwrt/packages/pull/29063 for details
* optimized the CGI/Adblock Remote Allow
* optimized the TLD function
* optimized the mail include
* removed needless forks
* various code-cleanups & small fixes
* updated the readme
* LuCI: small fixes & optimizations
Signed-off-by: Dirk Brenken <dev@brenken.org>
Update package to 3.8.0.
Add PYPI_SOURCE_NAME since PyPI switched sdist filename to use
underscores (pytest_xdist-3.8.0.tar.gz).
Add test.sh to verify basic plugin functionality.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update package to 5.0.1.
Add PYPI_SOURCE_NAME since PyPI switched sdist filename to use
underscores (async_timeout-5.0.1.tar.gz).
Add test.sh to verify timeout context manager functionality.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update package to 0.4.2.
Changelog:
- 0.3.0: Updated ASN.1 module imports to use RFC-based names
- 0.4.0: Added support for newer RFC modules and improved compatibility
- 0.4.1: Minor bug fixes
- 0.4.2: Latest stable release
Add PYPI_SOURCE_NAME since PyPI switched sdist filename to use
underscores (pyasn1_modules-0.4.2.tar.gz).
Add test.sh to verify basic functionality.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Changelog: https://github.com/django/asgiref/blob/main/CHANGELOG.txt
Multiple minor/patch releases since 3.7.2 with bug fixes and
Python 3.13+ compatibility improvements. Resets PKG_RELEASE to 1.
Add test.sh to verify async_to_sync and sync_to_async adapters.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Refresh all patches for pip 26.0.1:
- 001 (pyproject-hooks-pyc-fix): vendored pyproject_hooks switched
from single to double quotes and multiline block format; restructure
to minimal diff (keep unchanged context lines as context)
- 002 (pip-runner-pyc-fix): get_runnable_pip() shifted ~20 lines;
Set[str] -> set[str] in trailing context; refresh offsets
- 003 (disable-pip-version-check): option definition moved ~174 lines;
refresh line number
pip 26 also dropped the version-specific binary (e.g. pip3.14).
Update the install rule to use pip3 as the primary binary and
symlink pip/pip$(VERSION) to it.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update to 3.11.8 to fix the build error with Python 3.14
```
--- stderr
error: the configured Python interpreter version (3.14) is newer than PyO3's maximum supported version (3.13)
= help: please check if an updated version of PyO3 is available. Current version: 0.23.0-dev
= help: set PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1 to suppress this check and build anyway using the stable ABI
warning: build failed, waiting for other jobs to finish...
💥 maturin failed
```
orjson imports uuid.py at module init to look up uuid.UUID type;
python3-uuid is a separate package not included in python3-light,
causing a segfault when python3-uuid is absent. Add it as an explicit
dependency to fix the crash on all architectures.
Crash is:
```
importing orjson...
Fatal Python error: Segmentation fault
Current thread 0xecf37c64 [python3] (most recent call first):
File "<frozen importlib._bootstrap>", line 491 in _call_with_frames_removed
File "<frozen importlib._bootstrap_external>", line 1061 in exec_module
File "<frozen importlib._bootstrap>", line 938 in _load_unlocked
File "<frozen importlib._bootstrap>", line 1342 in _find_and_load_unlocked
File "<frozen importlib._bootstrap>", line 1371 in _find_and_load
File "/usr/lib/python3.14/site-packages/orjson/__init__.py", line 8 in <module>
File "<frozen importlib._bootstrap>", line 491 in _call_with_frames_removed
File "<frozen importlib._bootstrap_external>", line 759 in exec_module
File "<frozen importlib._bootstrap>", line 938 in _load_unlocked
File "<frozen importlib._bootstrap>", line 1342 in _find_and_load_unlocked
File "<frozen importlib._bootstrap>", line 1371 in _find_and_load
File "<stdin>", line 5 in <module>
Current thread's C stack trace (most recent call first):
<cannot get C stack on this system>
Segmentation fault (core dumped)
Test failed
```
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
When upgrading specific packages manually, like:
apk upgrade bind-dig
the bind-libs package is not upgraded automatically, which results in
problems when running the program, for example:
root@OpenWrt:~# dig
Error loading shared library libisc-9.20.10.so: No such file or directory (needed by /usr/bin/dig)
Error loading shared library libdns-9.20.10.so: No such file or directory (needed by /usr/bin/dig)
Error loading shared library libisccfg-9.20.10.so: No such file or directory (needed by /usr/bin/dig)
Error relocating /usr/bin/dig: cfg_map_getname: symbol not found
Error relocating /usr/bin/dig: irs_resconf_getndots: symbol not found
Error relocating /usr/bin/dig: isc_managers_destroy: symbol not found
Error relocating /usr/bin/dig: dns_fixedname_init: symbol not found
Error relocating /usr/bin/dig: isc_nm_read: symbol not found
Error relocating /usr/bin/dig: dns_rdata_init: symbol not found
Error relocating /usr/bin/dig: isc_random_uniform: symbol not found
[...]
This has happened to me twice on OpenWRT 24.10.
To fix this, enforce that the version of bind-libs matches the version
of any dependent packages. Use the same approach as in
net/knot/Makefile: make the dependency be present twice, once in the
DEPENDS variable, the other one in the EXTRA_DEPENDS variable.
Also, add an explicit EXTRA_DEPENDS variable to other internal
dependencies. For example, versions of the bind-server-filter-aaaa and
bind-server packages must match.
Tested on snapshot, on x86/64.
Signed-off-by: Mateusz Jończyk <mat.jonczyk@o2.pl>
* removed needless fork/exec calls (#29010)
* removed needless eval calls
* added parallel country and ASN feed downloads (#29010)
* rework the IP monitor:
* IP extraction, counting, and threshold detection now run
entirely inside a single gawk process
* added a dynamic cache management and a three-tier IP deduplication
* added asynchronous/non-blocking RDAP requests
* hardend the cgi script and mail template
* fixed#28998
* LuCI: added more status information
* LuCI: more fixes & optimizations (e.g. #8486)
* readme update
Co-authored-by: Colin Brown <devs@coralesoft.nz>
Signed-off-by: Dirk Brenken <dev@brenken.org>
This software seems no longer maintained.
The latest upstream commit is 11 years ago,
and no package depends on this.
Signed-off-by: Yanase Yuki <dev@zpc.st>
When we updated the zabbix agent to use username zabbix-agent
we neglected to update ubus acls for zabbix-extra-network.
Therefore update the username for the network and wifi acls.
Will close#29058 once backported to 25.12.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
