Qingfang Deng [Thu, 2 Apr 2026 02:42:09 +0000 (10:42 +0800)]
ovpn-dco: switch to the new source
The ovpn kernel module is is part of the Linux kernel starting from
version 6.16.
Switch to the new officially maintained backports source:
https://github.com/OpenVPN/ovpn-backports
Build is failing for a while now with error:
```
14.3.0_musl/usr/include -I/builder/shared-workdir/build/sdk/staging_dir/toolchain-mipsel_24kc_gcc-14.3.0_musl/include -I/builder/shared-workdir/build/sdk/staging_dir/toolchain-mipsel_24kc_gcc-14.3.0_musl/include/fortify -I/builder/shared-workdir/build/sdk/staging_dir/target-mipsel_24kc_musl/usr/include/python3.14 -fPIC -I/builder/shared-workdir/build/sdk/staging_dir/target-mipsel_24kc_musl/usr/include/python3.14 -c ./ubus_python.c -o build/temp.linux-mipsel-cpython-314/ubus_python.o
./ubus_python.c: In function 'ubus_python_add':
./ubus_python.c:1081:17: error: implicit declaration of function 'PyEval_CallMethod'; did you mean 'PyObject_CallMethod'? [-Wimplicit-function-declaration]
1081 | PyEval_CallMethod(python_alloc_list, "pop", "");
| ^~~~~~~~~~~~~~~~~
| PyObject_CallMethod
error: command '/builder/shared-workdir/build/sdk/staging_dir/toolc
```
This has been fixed on version 0.1.3, but that hasn't been
published to pypi yet.
Major version 2.0 breaking changes:
- Hub API deprecated; replaced with new_scope / isolation_scope API;
configure_scope / push_scope removed; Hub class retained but deprecated
- Python 2.7 support dropped; internal SDK data model refactored
- Migration guide: https://docs.sentry.io/platforms/python/migration/1.x-to-2.x
New features (2.0 - 2.57):
- Many integrations now auto-activate if the package is detected:
Ariadne, ARQ, asyncpg, Chalice, Loguru, PyMongo, Quart, Starlite,
Strawberry, Anthropic, Cohere, Graphene, LiteLLM, Google GenAI
- Extensive AI/LLM monitoring with gen_ai.* span attributes aligned
with OpenTelemetry semantic conventions
- Feature flag tracking: LaunchDarkly, Unleash integrations
- Sentry structured logs (beta, 2.30): capture Loguru log messages
- New SysExitIntegration (2.14)
- failed_request_status_codes configurable for FastAPI/Starlette (2.5)
- Client cert/key support for HttpTransport (2.10)
- Experimental async transport added (2.57)
0.7.0: SSE-C arguments now passed to CompleteMultipartUpload for upload
operations.
0.8.0 (CRT improvements): Wider CRT upload functionality; CRC32
auto-configured for CRT uploads; file-like object support for seekable
and non-seekable streams; dynamic target throughput via AWS CRT system
detection.
0.9.0: Python 3.7 dropped.
0.10.0: S3 Express support for CRT; Multi-Region Access Point support
for CRT (0.10.4).
0.11.0 (CRC32 default): Now uses CRC32 by default and supports
user-provided full-object checksums.
0.12.0: Python 3.8 dropped.
0.13.0: ETag validation during multipart downloads.
0.15.0: ETag validation during multipart copies.
0.16.0: TransferConfig options (multipart_threshold, multipart_chunksize,
max_request_concurrency) now supported in CRTTransferManager.
1.32.1: botocore wheel now ships compressed service models to reduce
disk footprint.
1.33.0: Version aligned; boto3/botocore share the same version number.
1.36.0 (S3 checksum overhaul): CRC32 default for uploads; CRC64NVME
support via awscrt; configurable via request_checksum_calculation and
response_checksum_validation settings.
1.37.0 (Account-based endpoints): DynamoDB support for account-based
endpoint routing; smithy-rpc-v2-cbor protocol support (1.37.2).
1.33.0: boto3 and botocore now share the same version number.
1.36.0 (S3 checksum overhaul): CRC32 is now calculated by default for
all supported S3 operations; Content-MD5 header no longer auto-populated;
response checksum validation added; CRC64NVME and SHA512 algorithms
supported via optional awscrt.
1.38.0 (Account-based endpoints): DynamoDB and future services now use
https://<account-id>.ddb.<region>.amazonaws.com endpoints when account
ID is available. Python 3.8 end of support.
1.40.0 (STS endpoint default): Changed from legacy to regional; override
via sts_regional_endpoints config or AWS_STS_REGIONAL_ENDPOINTS env var.
1.41.0 (New credential provider): login credential provider added,
allowing use of AWS Management Console credentials.
Hundreds of API additions across Bedrock, ECS, EKS, Lambda, SageMaker,
and many more services.
* fixed two issues in the mail template, reported in the forum
* tweak the f_report function
* changed the f_actual function to reduce subshell calls
* further optimize the monitor function:
* fixed a possible RDAP rate-limit race condition,
serialize the rdap_tsfile via flock
* block_cache bounded growth, when the cache reaches 500
entries it resets to empty, preventing unbounded string growth
in the monitor loop
* set the printf format string in single quotes (overall)
7.3.0:
- License changed from MIT to 0BSD (no attribution required)
- New mime_type field in all detection results -- identifies binary and text
file types via magic number matching (40+ formats supported)
- Performance: 4 additional modules compiled with mypyc; per-file detection
capped at 16 KB (worst-case time: 62ms -> 26ms)
- Added riscv64 prebuilt wheel support
- Bug fix: null-separated ASCII data was misdetected as UTF-16-BE
7.4.0:
- Accuracy improved from 98.6% to 99.3%; speed improved with new dense
zlib-compressed model format (cold start: ~75ms -> ~13ms with mypyc)
- Training data overhauled: added MADLAD-400 and Wikipedia sources,
eliminated train/test overlap, samples increased from 15K to 25K per
language/encoding pair
- Bug fix: dedicated structural analyzers added for CP932, CP949, and
Big5-HKSCS (previously sharing base encoding byte-range analyzer)
7.4.1:
- Bug fix: BOM-prefixed UTF-16/32 input now correctly returns utf-16/utf-32
instead of endian-specific variants (utf-16-le/utf-16-be/etc.), which
previously caused a stray U+FEFF character at the start of decoded text
Security fixes:
- CVE-2026-33033: DoS fix in MultiPartParser -- base64-encoded multipart
uploads with excessive whitespace could cause repeated memory copying
- CVE-2026-3902: ASGI header spoofing fixed -- headers containing underscores
are now ignored by ASGIRequest to prevent hyphen/underscore conflation
attacks
- CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin -- add permissions
on inline model instances were not validated against forged POST data
- CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable -- changelist
forms incorrectly allowed new instances to be created via forged POST data
- CVE-2026-33034: DoS via ASGI memory upload limit bypass -- missing or
understated Content-Length could bypass DATA_UPLOAD_MAX_MEMORY_SIZE
Bug fixes:
- alogin/alogout regression where request.user was not set/cleared if already
materialized by sync middleware
- RelatedFieldWidgetWrapper regression incorrectly wrapping all widgets in a
fieldset in admin forms
Qingfang Deng [Sat, 11 Apr 2026 06:50:22 +0000 (09:50 +0300)]
collectd: remove redundant liblua link flag
The link flag makes the main program depend on liblua in official
package feeds, even if collectd-mod-lua is not installed.
The plugin is already linked against liblua.so, so this can be removed.
Signed-off-by: Qingfang Deng <redacted>
[added PKG_RELEASE bump]
watchcat: use logical network to fix restart_interface
Watchcat was failing to restart layer-3 interfaces when in mode
'restart_iface'. The previously attempted fix made the situation
worse in that it resulted in layer 2 interfaces also failing to
start.
This was because we are passed the interface name (e.g. eth0,
l2p0, or br-lan), but ifup needs the logical network (e.g. 'lan'
which corresponds to the network device).
Update to use find_config from /lib/network/config.sh to find the
logical network from the interface name, and use ifup on the
logical network to restart the underlying interface(s) associated
with the logical network.
The test.sh lacked a package name guard, causing it to run (and fail)
when the -src subpackage was tested without python3 installed.
Add the standard guard to skip the test for non-main packages.
The test.sh imports xml.etree.ElementTree from the stdlib, and
et_xmlfile itself falls back to stdlib xml when lxml is unavailable.
Add python3-xml to DEPENDS to ensure the xml module is present at
both install and test time.
The test used et_xmlfile.__version__ without importing the et_xmlfile
module (only 'from et_xmlfile import xmlfile' was present). Add
'import et_xmlfile' so the version check works correctly.
The test.sh lacked a package name guard, causing it to run (and fail)
when the -src subpackage was tested without python3 installed.
Add the standard guard to skip the test for non-main packages.
Bug fix:
- Correctly serialize nanosecond-precision DataFrame timestamps;
previously nanosecond timestamps were not serialized correctly when
writing via DataFrameClient
Security fix:
- CVE-2025-71176: Fixed use of an insecure temporary directory
Bug fixes:
- pytest.approx now correctly accounts for collections.abc.Mapping key
order when comparing mappings
- Blocking a conftest.py with -p no: is now explicitly disallowed with a
clear UsageError (previously caused an internal assertion failure)
- Fixed crash when a test raises an ExceptionGroup with
__tracebackhide__ = True
- Fixed non-string messages in unittest.TestCase.subTest() not printed
4.9.5: Silent patch release.
4.9.6: Fixed shell quoting bug in the release workflow -- double quotes
now used for tag variable expansion in CI scripts.
No functional or API changes for end users between 4.9.4 and 4.9.6.
3.1.0: Added support for data table formulae; Rich Text in cells; Custom
Document Properties; mapped chartspace graphical properties to charts.
Breaking: removed deprecated workbook methods (get_named_range,
add_named_range, remove_named_range) and several worksheet properties.
Bug fixes: fixed table filters being overridden, various dataframe and
multiindex alignment issues.
3.1.1: Fixed DocumentProperties times being set only at module import;
fixed missing worksheet-specific definitions.
3.1.2: Fixed reading worksheets in read-only mode with locally scoped
definitions; fixed empty custom properties causing invalid files.
3.1.3: Major performance fixes -- column name caching, pivot table
loading, custom properties reading; fixed rich-text save without lxml;
fixed file handler leaks; fixed timedelta reading in read-only mode;
improved duplicate named styles handling.
3.1.4: Minor bug fixes and stability improvements.
3.1.5: Latest stable release with cumulative fixes.
Add test.sh to verify write/read roundtrip of xlsx workbooks.
Security fixes:
- Prevent FITS decompression bomb -- GZIP data from FITS images is now
limited to prevent decompression bomb attacks
- Fix OOB write with invalid tile extents -- 12.1.1 PSD tile extent checks
did not account for integer overflow
- Prevent PDF parsing trailer infinite loop -- cyclic trailer references
in PDFs are now detected and stopped
- Fix integer overflow when processing fonts with excessively large
per-glyph advances
- Fix heap buffer overflow with nested list coordinates -- nested lists
passed to ImagePath.Path, polygon(), line() etc. are now validated to
contain exactly two numeric coordinates
New features:
- ImageText.Text.wrap() -- new method to wrap text within a given
width/height, with optional shrink/grow scaling
- FontFile.to_imagefont() -- FontFile instances can now be directly
converted to ImageFont instances
- Support reading JPEG2000 images with CMYK palettes
Performance:
- Lazy plugin loading -- open is 2.3-15.6x faster, save is 2.2-9x faster
for common formats
1.6.0: Removed Python 2 and six dependency; field names with literals
now enclosed in quotes; removed decorator and testscenarios dependencies;
made path instances hashable.
1.6.1: Fixed lambda-based updates; fixed assignment when root element is
a list; added keys keyword; added slice step support; don't fail on regex
match against non-strings; Python 3.12 support.
1.7.0: Added wherenot operator; added path extension exposing datum's
path from the expression itself; allowed numeric values as keys; added
negative and wildcard indices in Split; fixed boolean value update bug;
removed Python 3.7 support; parse table constructed only once
(performance improvement).
1.8.0: Added support for comma-separated indices (e.g., field[0,1,2]);
added EMOJI and CJK Unicode support; added type hints; fixed wildcard
path resolution in field filters; fixed False/None value handling in
bool filters; vendored ply (no longer maintained upstream); dropped
Python 3.8 and 3.9 support; Python 3.13/3.14 tested.
Changes:
- Added binary wheels for RISC-V 64
- Fixed multiple rare crash paths during interpreter shutdown; now uses
the atexit module (subtle API change: getcurrent unavailable once
atexit fires)
- Fixed multiple race conditions in free-threaded (no-GIL) builds when
greenlets are accessed from multiple threads, some causing assertion
failures or interpreter crashes
- Several minor correctness fixes from automated code audit
3.19.0: Added ECDH support via Crypto.Protocol.DH; TupleHash128/256
update() can now hash multiple items at once; fixed cffi bug on Windows
with Python 3.12+.
3.19.1 (security): Patched side-channel leakage in OAEP decryption that
could enable a Manger attack.
3.20.0: Added TurboSHAKE128 and TurboSHAKE256; added Crypto.Hash.new()
factory; AES-GCM support for PBES2/PKCS#8 containers; SHA-2/SHA-3 support
in PBKDF2 for key containers.
3.21.0: Added Curve25519/X25519 and Curve448/X448 support; added
PYCRYPTODOME_DISABLE_GMP env var; RSA keys for PSS can now be imported;
fixed Ed25519 point negation; dropped Python 3.5 support.
3.22.0: Added HPKE (RFC 9180) support; CCM cipher now enforces
nonce-length data limits; fixed RC4 infinite loop for data >4GB; fixed
invalid PEM file handling; dropped Python 3.6 support.
3.23.0: Added Key Wrap (KW/KWP, RFC 3394/5649/NIST SP 800-38F) cipher
modes; Windows ARM wheels; fixed HashEdDSA/Ed448 sign/verify mutating
XOF state.
Refresh 001-fix-libgmp-loading.patch and 002-omit-tests.patch for the
updated source (hunk offsets shifted by 2-4 lines due to new functions).
kea: add support synthesizing imported config files
Configuring Kea JSON files is not trivial, and this might impede
the adoption of Kea as a DHCP server. There are, however, many
users who used its predecessor ISC-DHCP, at least for DHCPv4.
A filter could ingest the legacy UCI and synthesize a JSON config
file for Kea DHCPv4.
* fixed a parsing issue in the DNS reporting,
see https://github.com/openwrt/packages/pull/29063 for details
* optimized the CGI/Adblock Remote Allow
* optimized the TLD function
* optimized the mail include
* removed needless forks
* various code-cleanups & small fixes
* updated the readme
* LuCI: small fixes & optimizations
Multiple minor releases since 2.4.1 adding new record types,
improved DNSSEC support, and bug fixes.
Add test.sh to verify DNS name parsing and rdatatype lookups.
Multiple minor/patch releases since 3.7.2 with bug fixes and
Python 3.13+ compatibility improvements. Resets PKG_RELEASE to 1.
Add test.sh to verify async_to_sync and sync_to_async adapters.
Refresh all patches for pip 26.0.1:
- 001 (pyproject-hooks-pyc-fix): vendored pyproject_hooks switched
from single to double quotes and multiline block format; restructure
to minimal diff (keep unchanged context lines as context)
- 002 (pip-runner-pyc-fix): get_runnable_pip() shifted ~20 lines;
Set[str] -> set[str] in trailing context; refresh offsets
- 003 (disable-pip-version-check): option definition moved ~174 lines;
refresh line number
pip 26 also dropped the version-specific binary (e.g. pip3.14).
Update the install rule to use pip3 as the primary binary and
symlink pip/pip$(VERSION) to it.
Update to 3.11.8 to fix the build error with Python 3.14
```
--- stderr
error: the configured Python interpreter version (3.14) is newer than PyO3's maximum supported version (3.13)
= help: please check if an updated version of PyO3 is available. Current version: 0.23.0-dev
= help: set PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1 to suppress this check and build anyway using the stable ABI
warning: build failed, waiting for other jobs to finish...
💥 maturin failed
```
orjson imports uuid.py at module init to look up uuid.UUID type;
python3-uuid is a separate package not included in python3-light,
causing a segfault when python3-uuid is absent. Add it as an explicit
dependency to fix the crash on all architectures.
Crash is:
```
importing orjson...
Fatal Python error: Segmentation fault
Current thread 0xecf37c64 [python3] (most recent call first):
File "<frozen importlib._bootstrap>", line 491 in _call_with_frames_removed
File "<frozen importlib._bootstrap_external>", line 1061 in exec_module
File "<frozen importlib._bootstrap>", line 938 in _load_unlocked
File "<frozen importlib._bootstrap>", line 1342 in _find_and_load_unlocked
File "<frozen importlib._bootstrap>", line 1371 in _find_and_load
File "/usr/lib/python3.14/site-packages/orjson/__init__.py", line 8 in <module>
File "<frozen importlib._bootstrap>", line 491 in _call_with_frames_removed
File "<frozen importlib._bootstrap_external>", line 759 in exec_module
File "<frozen importlib._bootstrap>", line 938 in _load_unlocked
File "<frozen importlib._bootstrap>", line 1342 in _find_and_load_unlocked
File "<frozen importlib._bootstrap>", line 1371 in _find_and_load
File "<stdin>", line 5 in <module>
Current thread's C stack trace (most recent call first):
<cannot get C stack on this system>
Segmentation fault (core dumped)
Test failed
```
Mateusz Jończyk [Sun, 1 Feb 2026 19:00:24 +0000 (20:00 +0100)]
bind: prevent mismatch of bind-libs version
When upgrading specific packages manually, like:
apk upgrade bind-dig
the bind-libs package is not upgraded automatically, which results in
problems when running the program, for example:
root@OpenWrt:~# dig
Error loading shared library libisc-9.20.10.so: No such file or directory (needed by /usr/bin/dig)
Error loading shared library libdns-9.20.10.so: No such file or directory (needed by /usr/bin/dig)
Error loading shared library libisccfg-9.20.10.so: No such file or directory (needed by /usr/bin/dig)
Error relocating /usr/bin/dig: cfg_map_getname: symbol not found
Error relocating /usr/bin/dig: irs_resconf_getndots: symbol not found
Error relocating /usr/bin/dig: isc_managers_destroy: symbol not found
Error relocating /usr/bin/dig: dns_fixedname_init: symbol not found
Error relocating /usr/bin/dig: isc_nm_read: symbol not found
Error relocating /usr/bin/dig: dns_rdata_init: symbol not found
Error relocating /usr/bin/dig: isc_random_uniform: symbol not found
[...]
This has happened to me twice on OpenWRT 24.10.
To fix this, enforce that the version of bind-libs matches the version
of any dependent packages. Use the same approach as in
net/knot/Makefile: make the dependency be present twice, once in the
DEPENDS variable, the other one in the EXTRA_DEPENDS variable.
Also, add an explicit EXTRA_DEPENDS variable to other internal
dependencies. For example, versions of the bind-server-filter-aaaa and
bind-server packages must match.
* removed needless fork/exec calls (#29010)
* removed needless eval calls
* added parallel country and ASN feed downloads (#29010)
* rework the IP monitor:
* IP extraction, counting, and threshold detection now run
entirely inside a single gawk process
* added a dynamic cache management and a three-tier IP deduplication
* added asynchronous/non-blocking RDAP requests
* hardend the cgi script and mail template
* fixed #28998
* LuCI: added more status information
* LuCI: more fixes & optimizations (e.g. #8486)
* readme update
Co-authored-by: Colin Brown <redacted> Signed-off-by: Dirk Brenken <redacted>
Major version bump from 11.0.3 to 16.0. The legacy API
(websockets.legacy.*) was removed in 14.0; the current public
API (connect/serve in websockets.asyncio.*) is stable and
backward-compatible since 12.0. Add test.sh that verifies core
imports (frames, http11, datastructures).
Changelog: https://websockets.readthedocs.io/en/stable/changelog.html Signed-off-by: Alexandru Ardelean <redacted>
Current description is getting
cut off and is formatted incorrectly
in LuCI when viewing packages.
Rewrote description to shorten,
correct and provide a more
concise description that will
work in LuCI.
This is a security release.
Notable Changes
* (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High
* (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High
* (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium
* (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium
* (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
* (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low
* (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low
The 0001-distutils-use-python-sysroot.patch was written against an
older setuptools where the build_ext LIBDIR yield had less indentation.
In 82.0.1, a z/OS platform check wrapped the code adding an extra
indentation level. Regenerate the patch against the actual 82.0.1 source.
Signed-off-by: Alexandru Ardelean <redacted> Signed-off-by: Alexandru Ardelean <redacted>
Starting with 46.x, cryptography switched its build backend from
setuptools-rust to maturin. Update PKG_BUILD_DEPENDS accordingly:
replace python-setuptools-rust/host with python-maturin/host and
python-setuptools/host (setuptools is still required by cffi).
Drop 001-Update-ouroboros.patch: the ouroboros crate is no longer a
dependency in 46.x, so the patch (which bumped it from 0.15 to 0.18
to fix RUSTSEC-2023-0042) no longer applies.
python-setuptools: re-introduce patch from python3
When Python3 was updated via commit 97a92f2e7 , distutils was
disappeared from Python3 and moved to setuptools.
So that patch should have moved here as well.
This should fix all packages which still use the 'build_ext'
module from setuptools.
As we're seeing in various test.sh scrip runs, importing 'email' fails
with not finding 'urllib' and vice-versa.
Then via a7e96ec91 ("python3-email: add python3-urllib as dependency")
I created a circular dependency.
So, might as well merge the two packages into one (named python3-urllib)
and updates all dependencies to pull python3-urllib.
The python3-pkg-resources package does not exist in OpenWrt.
The only distutils/setuptools usage in fail2ban 1.1.0 is in
filterpyinotify.py and filtersystemd.py, both of which are
optional backends not available on OpenWrt. They are loaded
lazily via ImportError-guarded calls and the default auto
backend falls through to polling without them.
Also add test.sh with basic import and CLI smoke test.
git.99rst.org / openwrt-packages.git / log