0.7.0: SSE-C arguments now passed to CompleteMultipartUpload for upload
operations.
0.8.0 (CRT improvements): Wider CRT upload functionality; CRC32
auto-configured for CRT uploads; file-like object support for seekable
and non-seekable streams; dynamic target throughput via AWS CRT system
detection.
0.9.0: Python 3.7 dropped.
0.10.0: S3 Express support for CRT; Multi-Region Access Point support
for CRT (0.10.4).
0.11.0 (CRC32 default): Now uses CRC32 by default and supports
user-provided full-object checksums.
0.12.0: Python 3.8 dropped.
0.13.0: ETag validation during multipart downloads.
0.15.0: ETag validation during multipart copies.
0.16.0: TransferConfig options (multipart_threshold, multipart_chunksize,
max_request_concurrency) now supported in CRTTransferManager.
1.32.1: botocore wheel now ships compressed service models to reduce
disk footprint.
1.33.0: Version aligned; boto3/botocore share the same version number.
1.36.0 (S3 checksum overhaul): CRC32 default for uploads; CRC64NVME
support via awscrt; configurable via request_checksum_calculation and
response_checksum_validation settings.
1.37.0 (Account-based endpoints): DynamoDB support for account-based
endpoint routing; smithy-rpc-v2-cbor protocol support (1.37.2).
1.33.0: boto3 and botocore now share the same version number.
1.36.0 (S3 checksum overhaul): CRC32 is now calculated by default for
all supported S3 operations; Content-MD5 header no longer auto-populated;
response checksum validation added; CRC64NVME and SHA512 algorithms
supported via optional awscrt.
1.38.0 (Account-based endpoints): DynamoDB and future services now use
https://<account-id>.ddb.<region>.amazonaws.com endpoints when account
ID is available. Python 3.8 end of support.
1.40.0 (STS endpoint default): Changed from legacy to regional; override
via sts_regional_endpoints config or AWS_STS_REGIONAL_ENDPOINTS env var.
1.41.0 (New credential provider): login credential provider added,
allowing use of AWS Management Console credentials.
Hundreds of API additions across Bedrock, ECS, EKS, Lambda, SageMaker,
and many more services.
* fixed two issues in the mail template, reported in the forum
* tweak the f_report function
* changed the f_actual function to reduce subshell calls
* further optimize the monitor function:
* fixed a possible RDAP rate-limit race condition,
serialize the rdap_tsfile via flock
* block_cache bounded growth, when the cache reaches 500
entries it resets to empty, preventing unbounded string growth
in the monitor loop
* set the printf format string in single quotes (overall)
7.3.0:
- License changed from MIT to 0BSD (no attribution required)
- New mime_type field in all detection results -- identifies binary and text
file types via magic number matching (40+ formats supported)
- Performance: 4 additional modules compiled with mypyc; per-file detection
capped at 16 KB (worst-case time: 62ms -> 26ms)
- Added riscv64 prebuilt wheel support
- Bug fix: null-separated ASCII data was misdetected as UTF-16-BE
7.4.0:
- Accuracy improved from 98.6% to 99.3%; speed improved with new dense
zlib-compressed model format (cold start: ~75ms -> ~13ms with mypyc)
- Training data overhauled: added MADLAD-400 and Wikipedia sources,
eliminated train/test overlap, samples increased from 15K to 25K per
language/encoding pair
- Bug fix: dedicated structural analyzers added for CP932, CP949, and
Big5-HKSCS (previously sharing base encoding byte-range analyzer)
7.4.1:
- Bug fix: BOM-prefixed UTF-16/32 input now correctly returns utf-16/utf-32
instead of endian-specific variants (utf-16-le/utf-16-be/etc.), which
previously caused a stray U+FEFF character at the start of decoded text
Security fixes:
- CVE-2026-33033: DoS fix in MultiPartParser -- base64-encoded multipart
uploads with excessive whitespace could cause repeated memory copying
- CVE-2026-3902: ASGI header spoofing fixed -- headers containing underscores
are now ignored by ASGIRequest to prevent hyphen/underscore conflation
attacks
- CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin -- add permissions
on inline model instances were not validated against forged POST data
- CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable -- changelist
forms incorrectly allowed new instances to be created via forged POST data
- CVE-2026-33034: DoS via ASGI memory upload limit bypass -- missing or
understated Content-Length could bypass DATA_UPLOAD_MAX_MEMORY_SIZE
Bug fixes:
- alogin/alogout regression where request.user was not set/cleared if already
materialized by sync middleware
- RelatedFieldWidgetWrapper regression incorrectly wrapping all widgets in a
fieldset in admin forms
Qingfang Deng [Sat, 11 Apr 2026 06:50:22 +0000 (09:50 +0300)]
collectd: remove redundant liblua link flag
The link flag makes the main program depend on liblua in official
package feeds, even if collectd-mod-lua is not installed.
The plugin is already linked against liblua.so, so this can be removed.
Signed-off-by: Qingfang Deng <redacted>
[added PKG_RELEASE bump]
watchcat: use logical network to fix restart_interface
Watchcat was failing to restart layer-3 interfaces when in mode
'restart_iface'. The previously attempted fix made the situation
worse in that it resulted in layer 2 interfaces also failing to
start.
This was because we are passed the interface name (e.g. eth0,
l2p0, or br-lan), but ifup needs the logical network (e.g. 'lan'
which corresponds to the network device).
Update to use find_config from /lib/network/config.sh to find the
logical network from the interface name, and use ifup on the
logical network to restart the underlying interface(s) associated
with the logical network.
The test.sh lacked a package name guard, causing it to run (and fail)
when the -src subpackage was tested without python3 installed.
Add the standard guard to skip the test for non-main packages.
The test.sh imports xml.etree.ElementTree from the stdlib, and
et_xmlfile itself falls back to stdlib xml when lxml is unavailable.
Add python3-xml to DEPENDS to ensure the xml module is present at
both install and test time.
The test used et_xmlfile.__version__ without importing the et_xmlfile
module (only 'from et_xmlfile import xmlfile' was present). Add
'import et_xmlfile' so the version check works correctly.
The test.sh lacked a package name guard, causing it to run (and fail)
when the -src subpackage was tested without python3 installed.
Add the standard guard to skip the test for non-main packages.
Bug fix:
- Correctly serialize nanosecond-precision DataFrame timestamps;
previously nanosecond timestamps were not serialized correctly when
writing via DataFrameClient
Security fix:
- CVE-2025-71176: Fixed use of an insecure temporary directory
Bug fixes:
- pytest.approx now correctly accounts for collections.abc.Mapping key
order when comparing mappings
- Blocking a conftest.py with -p no: is now explicitly disallowed with a
clear UsageError (previously caused an internal assertion failure)
- Fixed crash when a test raises an ExceptionGroup with
__tracebackhide__ = True
- Fixed non-string messages in unittest.TestCase.subTest() not printed
4.9.5: Silent patch release.
4.9.6: Fixed shell quoting bug in the release workflow -- double quotes
now used for tag variable expansion in CI scripts.
No functional or API changes for end users between 4.9.4 and 4.9.6.
3.1.0: Added support for data table formulae; Rich Text in cells; Custom
Document Properties; mapped chartspace graphical properties to charts.
Breaking: removed deprecated workbook methods (get_named_range,
add_named_range, remove_named_range) and several worksheet properties.
Bug fixes: fixed table filters being overridden, various dataframe and
multiindex alignment issues.
3.1.1: Fixed DocumentProperties times being set only at module import;
fixed missing worksheet-specific definitions.
3.1.2: Fixed reading worksheets in read-only mode with locally scoped
definitions; fixed empty custom properties causing invalid files.
3.1.3: Major performance fixes -- column name caching, pivot table
loading, custom properties reading; fixed rich-text save without lxml;
fixed file handler leaks; fixed timedelta reading in read-only mode;
improved duplicate named styles handling.
3.1.4: Minor bug fixes and stability improvements.
3.1.5: Latest stable release with cumulative fixes.
Add test.sh to verify write/read roundtrip of xlsx workbooks.
Security fixes:
- Prevent FITS decompression bomb -- GZIP data from FITS images is now
limited to prevent decompression bomb attacks
- Fix OOB write with invalid tile extents -- 12.1.1 PSD tile extent checks
did not account for integer overflow
- Prevent PDF parsing trailer infinite loop -- cyclic trailer references
in PDFs are now detected and stopped
- Fix integer overflow when processing fonts with excessively large
per-glyph advances
- Fix heap buffer overflow with nested list coordinates -- nested lists
passed to ImagePath.Path, polygon(), line() etc. are now validated to
contain exactly two numeric coordinates
New features:
- ImageText.Text.wrap() -- new method to wrap text within a given
width/height, with optional shrink/grow scaling
- FontFile.to_imagefont() -- FontFile instances can now be directly
converted to ImageFont instances
- Support reading JPEG2000 images with CMYK palettes
Performance:
- Lazy plugin loading -- open is 2.3-15.6x faster, save is 2.2-9x faster
for common formats
1.6.0: Removed Python 2 and six dependency; field names with literals
now enclosed in quotes; removed decorator and testscenarios dependencies;
made path instances hashable.
1.6.1: Fixed lambda-based updates; fixed assignment when root element is
a list; added keys keyword; added slice step support; don't fail on regex
match against non-strings; Python 3.12 support.
1.7.0: Added wherenot operator; added path extension exposing datum's
path from the expression itself; allowed numeric values as keys; added
negative and wildcard indices in Split; fixed boolean value update bug;
removed Python 3.7 support; parse table constructed only once
(performance improvement).
1.8.0: Added support for comma-separated indices (e.g., field[0,1,2]);
added EMOJI and CJK Unicode support; added type hints; fixed wildcard
path resolution in field filters; fixed False/None value handling in
bool filters; vendored ply (no longer maintained upstream); dropped
Python 3.8 and 3.9 support; Python 3.13/3.14 tested.
Changes:
- Added binary wheels for RISC-V 64
- Fixed multiple rare crash paths during interpreter shutdown; now uses
the atexit module (subtle API change: getcurrent unavailable once
atexit fires)
- Fixed multiple race conditions in free-threaded (no-GIL) builds when
greenlets are accessed from multiple threads, some causing assertion
failures or interpreter crashes
- Several minor correctness fixes from automated code audit
3.19.0: Added ECDH support via Crypto.Protocol.DH; TupleHash128/256
update() can now hash multiple items at once; fixed cffi bug on Windows
with Python 3.12+.
3.19.1 (security): Patched side-channel leakage in OAEP decryption that
could enable a Manger attack.
3.20.0: Added TurboSHAKE128 and TurboSHAKE256; added Crypto.Hash.new()
factory; AES-GCM support for PBES2/PKCS#8 containers; SHA-2/SHA-3 support
in PBKDF2 for key containers.
3.21.0: Added Curve25519/X25519 and Curve448/X448 support; added
PYCRYPTODOME_DISABLE_GMP env var; RSA keys for PSS can now be imported;
fixed Ed25519 point negation; dropped Python 3.5 support.
3.22.0: Added HPKE (RFC 9180) support; CCM cipher now enforces
nonce-length data limits; fixed RC4 infinite loop for data >4GB; fixed
invalid PEM file handling; dropped Python 3.6 support.
3.23.0: Added Key Wrap (KW/KWP, RFC 3394/5649/NIST SP 800-38F) cipher
modes; Windows ARM wheels; fixed HashEdDSA/Ed448 sign/verify mutating
XOF state.
Refresh 001-fix-libgmp-loading.patch and 002-omit-tests.patch for the
updated source (hunk offsets shifted by 2-4 lines due to new functions).
kea: add support synthesizing imported config files
Configuring Kea JSON files is not trivial, and this might impede
the adoption of Kea as a DHCP server. There are, however, many
users who used its predecessor ISC-DHCP, at least for DHCPv4.
A filter could ingest the legacy UCI and synthesize a JSON config
file for Kea DHCPv4.
* fixed a parsing issue in the DNS reporting,
see https://github.com/openwrt/packages/pull/29063 for details
* optimized the CGI/Adblock Remote Allow
* optimized the TLD function
* optimized the mail include
* removed needless forks
* various code-cleanups & small fixes
* updated the readme
* LuCI: small fixes & optimizations
Multiple minor releases since 2.4.1 adding new record types,
improved DNSSEC support, and bug fixes.
Add test.sh to verify DNS name parsing and rdatatype lookups.
Multiple minor/patch releases since 3.7.2 with bug fixes and
Python 3.13+ compatibility improvements. Resets PKG_RELEASE to 1.
Add test.sh to verify async_to_sync and sync_to_async adapters.
Refresh all patches for pip 26.0.1:
- 001 (pyproject-hooks-pyc-fix): vendored pyproject_hooks switched
from single to double quotes and multiline block format; restructure
to minimal diff (keep unchanged context lines as context)
- 002 (pip-runner-pyc-fix): get_runnable_pip() shifted ~20 lines;
Set[str] -> set[str] in trailing context; refresh offsets
- 003 (disable-pip-version-check): option definition moved ~174 lines;
refresh line number
pip 26 also dropped the version-specific binary (e.g. pip3.14).
Update the install rule to use pip3 as the primary binary and
symlink pip/pip$(VERSION) to it.
Update to 3.11.8 to fix the build error with Python 3.14
```
--- stderr
error: the configured Python interpreter version (3.14) is newer than PyO3's maximum supported version (3.13)
= help: please check if an updated version of PyO3 is available. Current version: 0.23.0-dev
= help: set PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1 to suppress this check and build anyway using the stable ABI
warning: build failed, waiting for other jobs to finish...
💥 maturin failed
```
orjson imports uuid.py at module init to look up uuid.UUID type;
python3-uuid is a separate package not included in python3-light,
causing a segfault when python3-uuid is absent. Add it as an explicit
dependency to fix the crash on all architectures.
Crash is:
```
importing orjson...
Fatal Python error: Segmentation fault
Current thread 0xecf37c64 [python3] (most recent call first):
File "<frozen importlib._bootstrap>", line 491 in _call_with_frames_removed
File "<frozen importlib._bootstrap_external>", line 1061 in exec_module
File "<frozen importlib._bootstrap>", line 938 in _load_unlocked
File "<frozen importlib._bootstrap>", line 1342 in _find_and_load_unlocked
File "<frozen importlib._bootstrap>", line 1371 in _find_and_load
File "/usr/lib/python3.14/site-packages/orjson/__init__.py", line 8 in <module>
File "<frozen importlib._bootstrap>", line 491 in _call_with_frames_removed
File "<frozen importlib._bootstrap_external>", line 759 in exec_module
File "<frozen importlib._bootstrap>", line 938 in _load_unlocked
File "<frozen importlib._bootstrap>", line 1342 in _find_and_load_unlocked
File "<frozen importlib._bootstrap>", line 1371 in _find_and_load
File "<stdin>", line 5 in <module>
Current thread's C stack trace (most recent call first):
<cannot get C stack on this system>
Segmentation fault (core dumped)
Test failed
```
Mateusz Jończyk [Sun, 1 Feb 2026 19:00:24 +0000 (20:00 +0100)]
bind: prevent mismatch of bind-libs version
When upgrading specific packages manually, like:
apk upgrade bind-dig
the bind-libs package is not upgraded automatically, which results in
problems when running the program, for example:
root@OpenWrt:~# dig
Error loading shared library libisc-9.20.10.so: No such file or directory (needed by /usr/bin/dig)
Error loading shared library libdns-9.20.10.so: No such file or directory (needed by /usr/bin/dig)
Error loading shared library libisccfg-9.20.10.so: No such file or directory (needed by /usr/bin/dig)
Error relocating /usr/bin/dig: cfg_map_getname: symbol not found
Error relocating /usr/bin/dig: irs_resconf_getndots: symbol not found
Error relocating /usr/bin/dig: isc_managers_destroy: symbol not found
Error relocating /usr/bin/dig: dns_fixedname_init: symbol not found
Error relocating /usr/bin/dig: isc_nm_read: symbol not found
Error relocating /usr/bin/dig: dns_rdata_init: symbol not found
Error relocating /usr/bin/dig: isc_random_uniform: symbol not found
[...]
This has happened to me twice on OpenWRT 24.10.
To fix this, enforce that the version of bind-libs matches the version
of any dependent packages. Use the same approach as in
net/knot/Makefile: make the dependency be present twice, once in the
DEPENDS variable, the other one in the EXTRA_DEPENDS variable.
Also, add an explicit EXTRA_DEPENDS variable to other internal
dependencies. For example, versions of the bind-server-filter-aaaa and
bind-server packages must match.
* removed needless fork/exec calls (#29010)
* removed needless eval calls
* added parallel country and ASN feed downloads (#29010)
* rework the IP monitor:
* IP extraction, counting, and threshold detection now run
entirely inside a single gawk process
* added a dynamic cache management and a three-tier IP deduplication
* added asynchronous/non-blocking RDAP requests
* hardend the cgi script and mail template
* fixed #28998
* LuCI: added more status information
* LuCI: more fixes & optimizations (e.g. #8486)
* readme update
Co-authored-by: Colin Brown <redacted> Signed-off-by: Dirk Brenken <redacted>
Major version bump from 11.0.3 to 16.0. The legacy API
(websockets.legacy.*) was removed in 14.0; the current public
API (connect/serve in websockets.asyncio.*) is stable and
backward-compatible since 12.0. Add test.sh that verifies core
imports (frames, http11, datastructures).
Changelog: https://websockets.readthedocs.io/en/stable/changelog.html Signed-off-by: Alexandru Ardelean <redacted>
Current description is getting
cut off and is formatted incorrectly
in LuCI when viewing packages.
Rewrote description to shorten,
correct and provide a more
concise description that will
work in LuCI.
This is a security release.
Notable Changes
* (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High
* (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High
* (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium
* (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium
* (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
* (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low
* (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low
The 0001-distutils-use-python-sysroot.patch was written against an
older setuptools where the build_ext LIBDIR yield had less indentation.
In 82.0.1, a z/OS platform check wrapped the code adding an extra
indentation level. Regenerate the patch against the actual 82.0.1 source.
Signed-off-by: Alexandru Ardelean <redacted> Signed-off-by: Alexandru Ardelean <redacted>
Starting with 46.x, cryptography switched its build backend from
setuptools-rust to maturin. Update PKG_BUILD_DEPENDS accordingly:
replace python-setuptools-rust/host with python-maturin/host and
python-setuptools/host (setuptools is still required by cffi).
Drop 001-Update-ouroboros.patch: the ouroboros crate is no longer a
dependency in 46.x, so the patch (which bumped it from 0.15 to 0.18
to fix RUSTSEC-2023-0042) no longer applies.
python-setuptools: re-introduce patch from python3
When Python3 was updated via commit 97a92f2e7 , distutils was
disappeared from Python3 and moved to setuptools.
So that patch should have moved here as well.
This should fix all packages which still use the 'build_ext'
module from setuptools.
As we're seeing in various test.sh scrip runs, importing 'email' fails
with not finding 'urllib' and vice-versa.
Then via a7e96ec91 ("python3-email: add python3-urllib as dependency")
I created a circular dependency.
So, might as well merge the two packages into one (named python3-urllib)
and updates all dependencies to pull python3-urllib.
The python3-pkg-resources package does not exist in OpenWrt.
The only distutils/setuptools usage in fail2ban 1.1.0 is in
filterpyinotify.py and filtersystemd.py, both of which are
optional backends not available on OpenWrt. They are loaded
lazily via ImportError-guarded calls and the default auto
backend falls through to polling without them.
Also add test.sh with basic import and CLI smoke test.
Fix dependency with python3-pkg-resources (it got removed).
And add test.sh
- Bump from 4.5.1 to 4.6.0
- Drop python3-pkg-resources dependency: setools uses
'from importlib import resources as pkg_resources' which is stdlib,
not the external pkg_resources package
- Update 010-no-gui.patch: pyproject.toml now manages script-files and
package-data (was setup.py in 4.5.1); rewrite patch to target it
- Update 030-remove-host-paths.patch: lib_dirs now uses list[str] type
hint; fix hunk header line numbers to match new upstream layout
- Add test.sh: verify core query classes (SELinuxPolicy, BoolQuery,
TypeQuery, RoleQuery, UserQuery) are accessible
Fabrice Fontaine [Tue, 17 Mar 2026 22:07:10 +0000 (23:07 +0100)]
utils/beep: assign PKG_CPE_ID
cpe:/a:beep_project:beep is the correct CPE ID for beep:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:beep_project:beep
Indeed, spkr-beep is a fork of https://github.com/johnath/beep as
clearly stated in README.md: "This version of beep has been forked from
Johnathan Nightingales' original beep when johnath/beep#11 required
fixes in 2018, while Johnathan Nightingales' github.com/johnath/beep/
and johnath.com/beep/ was only maintained from around 2000 until around
2013.
So, it is still appropriate to use beep_project:beep CPE ID since the
code base remains the same and no new CPE has been assigned to the fork
(as there have been no new CVEs since 2018).
Michał Kępień [Thu, 2 Apr 2026 14:07:11 +0000 (16:07 +0200)]
lmdb: set SONAME for liblmdb.so
The LMDB shared library (liblmdb.so) does not currently have a SONAME
set, which can cause issues when linking against it. Specifically, when
an object is linked against the library using its absolute path (for
example, in Meson builds), that path (as seen in the build environment)
is stored in the resulting object's DT_NEEDED entry. This can prevent
the library from being found during runtime linking. Set the SONAME to
liblmdb.so to ensure proper runtime linking.
python-urllib3: relax setuptools-scm version constraint
urllib3 2.6.3 pyproject.toml pins setuptools-scm<10 but
python-setuptools-scm was recently bumped to 10.0.3, breaking
the build. Drop the upper bound via patch to allow building
with setuptools-scm 10.x.
Also add test.sh to verify core API imports, Retry/Timeout
configuration, and PoolManager creation.
git.99rst.org / openwrt-packages.git / log