summaryrefslogtreecommitdiff
path: root/lang/python
Commit message (Collapse)AuthorAgeFilesLines
* python3: Update to 3.6.15Jeffery To2021-09-082-2/+2
| | | | | | Includes fix for CVE-2013-0340 ("Billion Laughs" vulnerability). Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: Update to 3.6.14Jeffery To2021-07-072-2/+2
| | | | | | Includes fix for CVE-2021-3426 (Information disclosure via pydoc). Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: Update to 3.6.13Jeffery To2021-02-222-3/+3
| | | | | | | | | Includes fixes for: * CVE-2021-3177 - ctypes: Buffer overflow in PyCArg_repr * CVE-2021-23336 - urllib parse_qsl(): Web cache poisoning - semicolon as a query args separator Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: fix host compilation with clangRosen Penev2020-12-074-4/+4
| | | | | | | Matched rpath parameter with Makefile. Signed-off-by: Rosen Penev <rosenp@gmail.com> (cherry-picked from commit b40c40151c2ac3dd11d908a0548ac97e6b5c8455)
* python3: Update to 3.6.12, remove backported patchesJeffery To2020-10-176-346/+3
| | | | Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: Backport security fixesJeffery To2020-07-205-1/+344
| | | | | | | | This backports fixes for security issues, including: * CVE-2020-14422: Hash collisions in IPv4Interface and IPv6Interface * CVE-2019-20907: Infinite loop in the tarfile module Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: Update to 3.6.11Jeffery To2020-07-012-3/+3
| | | | | | | | | This contains a fix for CVE-2020-8492 (Denial of service in urllib.request.AbstractBasicAuthHandler)[1]. [1]: https://docs.python.org/release/3.6.11/whatsnew/changelog.html#python-3-6-11-release-candidate-1 Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python-openssl,python3-openssl: Add dependency on ca-bundleJeffery To2020-05-204-4/+4
| | | | | | | | | The ssl module assumes OpenSSL can load the default trust anchors (root CA certificates). From https://github.com/openwrt/packages/issues/12209 Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* Python: Fix compile of host modulesJan Kardell2020-05-201-1/+1
| | | | | | | | | Add -rpath linker option to host build, pointing to staging/hostpkh/lib. It's needed to find the correct host libs during runtime, without it the hosts libs may be used instaead, causing failures. Signed-off-by: Jan Kardell <jan.kardell@telliq.com> (cherry picked from commit 0311e58bb645b8f5a2b96528d78edc90c811ed94)
* Python3: Fix host build on OpenSUSEJan Kardell2020-05-201-1/+1
| | | | | | | | | | | | | | The linker option -rpath is required to find libs in staging_dir. Now it is included when building host modules. Without it the import test of the _ctypes and _uuid modules would fail. The _ctypes module uses libffi.so.6 from staging, but OpenSUSE LEAP 15 has libffi.so.7. It will also fail on LEAP 42.x, Fedora28 and 29 and future or old versions of Ubuntu. Fix needed in master and 18.06 branches. Signed-off-by: Jan Kardell <jan.kardell@telliq.com> (cherry picked from commit 6ade5a1e3adb189d062b707e2b8f731c9faab844)
* python: Update to 2.7.18, refresh patchesJeffery To2020-04-294-6/+6
| | | | Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: Updated to version 3.6.10Josef Schlehofer2019-12-214-220/+3
| | | | | | | | | | Remove backported patches: 025-bpo-34155-Dont-parse-domains-containing-GH-13079-GH-.patch 026-bpo-38243-xmlrpc.server-Escape-the-server_title-GH-1.patch Fixes CVE-2019-16056 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* python-cryptography: fix CVE-2018-10903Josef Schlehofer2019-10-251-0/+78
| | | | Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* python-cryptography: Add support for LibreSSL 2.7.xJosef Schlehofer2019-10-252-1/+183
| | | | Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* python: Update to 2.7.17, refresh patchesJeffery To2019-10-2214-571/+14
| | | | | | | | | | | | | | | Patches already merged and so removed: * 019-bpo-36216-Add-check-for-characters-in-netloc-that-normalize-to-separators-GH-12216.patch * 020-bpo-36216-Only-print-test-messages-when-verbose-GH-12291.patch * 021-2.7-bpo-35121-prefix-dot-in-domain-for-proper-subdom.patch * 027-bpo-38243-Escape-the-server-title-of-DocXMLRPCServer.patch * 028-bpo-34155-Dont-parse-domains-containing-GH-13079.patch Patches no longer necessary and so removed: * 017_lib2to3_fix_pyc_search.patch Signed-off-by: Jeffery To <jeffery.to@gmail.com> (cherry picked from 83b300aa83f3cf663747998f4500a8592acf9959)
* python3-pip: fix install ruleAlexandru Ardelean2019-10-082-2/+2
| | | | | | | | | | | | This seems to have slipped for some time. No idea if it ever worked. It could be that this worked at some point. In any case, the shebang is properly updated now. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com> (cherry-picked from commit 1b96dc01715f4f03f758ff1d087caf15726016af) Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> (bump PKG_RELEASE for python3-pip)
* python: Fix CVE-2019-16056, CVE-2019-16935Jeffery To2019-10-053-1/+240
| | | | | | | | | | | | These patches address issues: CVE-2019-16056: email.utils.parseaddr mistakenly parse an email CVE-2019-16935: A reflected XSS in python/Lib/DocXMLRPCServer.py Links to Python issues: https://bugs.python.org/issue34155 https://bugs.python.org/issue38243 Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: fix CVE-2019-16056 and delete two patchesJosef Schlehofer2019-09-304-235/+155
| | | | Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* python3: backport three security patchesJosef Schlehofer2019-09-304-1/+298
| | | | | | | Fixes: CVE-2019-16935 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> (cherry-picked from commit 80def9e)
* python-crypto: Fix two CVEsRosen Penev2019-09-263-3/+161
| | | | | | | | | | | CVE-2013-7459 and CVE-2018-6594. Both patches taken from Fedora. Also took the liberty to update the PKG_SOURCE_URL to a standard one. Updated the home URL as well. Signed-off-by: Rosen Penev <rosenp@gmail.com> (cherry-picked from 32b23e28ad892395a5575c09606cd07db175f7cc)
* django: Update to 1.8.19Rosen Penev2019-09-201-10/+11
| | | | | | | | | | | Fixes: CVE-2018-7536 CVE-2018-7537 Switches to pypi, as in upstream. Updated maintainer as well. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* python,python3: Fix overridden usr/bin symlinksJeffery To2019-08-083-1/+5
| | | | | | | | | | | | | Currently, all files in usr/bin (presumably all Python scripts) are run through sed to replace the shebang; sed will overwrite the file whether or not a match is found. This causes symlinks to be overridden and made into copies of their targets. python[3]-base and python[3]-dev are affected by this. This adds the --follow-symlinks flag to sed, in addition to using $(SED), so that symlinks are not overridden. Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python,python3: move shebang handle in install scriptAlexandru Ardelean2019-08-087-10/+8
| | | | | | | | | | | | This extends the Python[3] shebang fixup to all packages. Only Python scripts in `/usr/bin` will be handled at the moment. Later it may make sense to also cover executables in `/bin`, though typically Python executables shouldn't be placed there. Previously the shebang handling was only done for python[3]-pip & python[3]-setuptools. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python,python3: Fix ctypes.util.find_library()Jeffery To2019-07-224-2/+150
| | | | | | | | | | | | | | | Python's ctypes.util.find_library() function currently doesn't work for musl libraries/systems[1]. This adds a patch to fix this function, based on a patch from Alpine Linux[2]. Fixes #9448. [1]: https://bugs.python.org/issue21622 [2]: https://git.alpinelinux.org/aports/tree/main/python2/musl-find_library.patch Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python: add patch for CVE-2018-20852Josef Schlehofer2019-07-221-0/+123
| | | | Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* python: bump to version 2.7.16Alexandru Ardelean2019-07-224-130/+7
| | | | | | | | This change updates Python to version 2.7.16, which is a bugfix release in the Python 2.7 series. This also removes patches back-ported from upstream. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python3: update to version 3.6.9Josef Schlehofer2019-07-2215-522/+22
| | | | | | | | | | 3.6.9 is the latest security fix release of Python 3.6. - Fixes: CVE-2018-20852, CVE-2019-9948, CVE-2019-9740, CVE-2019-5010 - Refreshed patches - Removed a few backports patches Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* python-urllib3: update to 1.24.3Josef Schlehofer2019-05-081-17/+11
| | | | | | | | | | - Fixes CVE-2019-9740, CVE-2019-11324 - RFC 3986 compliant - Fix TITLE, which was too long for make menuconfig - Add PKG_LICENSE_FILES - Remove current maintainer Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* python,python3: Fix CVE-2019-9636 - urlsplit missing NFKC normalizationJeffery To2019-04-215-2/+353
| | | | | | | | | | These patches address issue: CVE-2019-9636: urlsplit does not handle NFKC normalization Link to Python issue: https://bugs.python.org/issue36216 Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* Jinja2: Update to 2.10Rosen Penev2019-03-191-3/+3
| | | | | Switch URL to a deterministic one. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* Jinja2: add missing dependency on markupsafeKarel Kočí2019-03-051-1/+1
| | | | Signed-off-by: Karel Kočí <karel.koci@nic.cz>
* [18.06] python3: fix [CVE-2018-20406]Alexandru Ardelean2019-02-132-1/+207
| | | | | | | | | | | | | | Link to Python bug: https://bugs.python.org/issue34656 Upstream commit: https://github.com/python/cpython/commit/71a9c65e74a70b6ed39adc4ba81d311ac1aa2acc OpenWrt 18.06 contains version Python 3.6.5, which doesn't contain this fix. Python 2.7 is not affected. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python-idna: Add missing dependency on python(3)-codecsJeffery To2019-01-271-3/+3
| | | | Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python/python3: Fix lib2to3 fixes searchJeffery To2019-01-134-2/+36
| | | | | | | This is the patch from c98b12d9a920ede376d1eaef0da0c0da9d26d6b3 (#7931), applied for both python 2 and 3. Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* Merge pull request #7757 from jefferyto/openwrt-18.06-python-dist-infoHannu Nyman2019-01-016-16/+12
|\ | | | | [openwrt-18.06] python/python3: fix .dist-info missing for setuptools and pip
| * python/python3: fix .dist-info missing for setuptools and pipJeffery To2018-12-236-16/+12
| | | | | | | | | | | | | | Without .dist-info (similar to .egg-info), setuptools and pip are not discoverable by pkg_resources. Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* | Merge pull request #7820 from commodo/18-06-python3-CVE-2018-14647Hannu Nyman2018-12-313-1/+120
|\ \ | | | | | | [18.06] python3: backport CVE-2018-14647 patch from upstream
| * | python3: backport CVE-2018-14647 patch from upstream [18.06]Alexandru Ardelean2018-12-313-1/+120
| |/ | | | | | | | | | | | | | | | | | | | | These patches are backports from Python 3.6 upstream. The security issue is described here: https://nvd.nist.gov/vuln/detail/CVE-2018-14647 The Python bug report: https://bugs.python.org/issue34623 Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* / python: backport CVE-2018-14647 patches from upstream [18.06]Alexandru Ardelean2018-12-313-1/+124
|/ | | | | | | | | | | These patches are backports from Python 2.7 upstream. The security issue is described here: https://nvd.nist.gov/vuln/detail/CVE-2018-14647 The Python bug report: https://bugs.python.org/issue34623 Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* twisted: update to 18.4.0, refresh patchesJeffery To2018-06-263-19/+13
| | | | Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python-zope-interface: update to 4.5.0Jeffery To2018-06-262-18/+27
| | | | Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python-pyasn1: update to 0.4.3Jeffery To2018-06-261-7/+7
| | | | Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python-ply: update to 3.11Jeffery To2018-06-261-6/+7
| | | | Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python-ipaddress: update to 1.0.22Jeffery To2018-06-261-5/+5
| | | | Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python-hyperlink: update to 18.0.0Jeffery To2018-06-261-4/+8
| | | | Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python-automat: update to 0.7.0, refresh patchesJeffery To2018-06-264-6/+6
| | | | Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python-attrs: update to 18.1.0Jeffery To2018-06-261-7/+7
| | | | Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python,python3: remove `--ignore-installed` flag for host packagesAlexandru Ardelean2018-05-142-2/+0
| | | | | | | | | | | | | | | This was copied over from python-packages, when support for installing packages host-side (via pip) was added. Based on the discussion on this commit: https://github.com/openwrt/packages/commit/612c53fc6c3d9ba2a57f7329baf055f1d59a9246 it was mentioned that removing this may add more benefit in terms of reducing build time, because packages won't get reinstalled every time. I'm not entirely sure about any potential side-effects of this, but it's worth trying it out. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python3: update to version 3.6.5Alexandru Ardelean2018-05-035-20/+17
| | | | | | | Add PKG_RELEASE for setuptools and pip. Refresh all patches. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python: update to version 2.7.15Alexandru Ardelean2018-05-038-41/+24
| | | | | | | | | | | This also updates pip and setuptools. With this occasion, they also get PKG_RELEASEs of their own. Dropped patch 011-remove-setupterm-definition.patch Manually re-applied 005-fix-bluetooth-support.patch Ran make package/python/refresh to refresh other patches. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
generated by cgit (git 2.46.0) at 2026-10-13 01:40:23 +0000