Take RUST_ARCH_DEPENDS of the build system for python3-pymysql-sha-pwd,
which installs python3-cryptography.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Include rust-values.mk of the build system and take its build
dependencies. The PyPI archive vendors its crates already.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Include rust-values.mk of the build system, take its build dependencies,
and build from a vendor tarball generated from the PyPI archive with the
crates of src/_bcrypt, so that cargo builds offline.
setuptools-rust sets RUSTFLAGS for musl targets, which makes cargo
ignore the target rustflags of the build system, and with them the
sysroot of libstd-rust. Pass those rustflags in RUSTFLAGS, which
setuptools-rust keeps next to its own.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Include rust-values.mk of the build system, take its build dependencies,
and build from a vendor tarball generated from the PyPI archive, so that
cargo builds offline.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Include rust-values.mk of the build system, take its build dependencies,
and build from a vendor tarball generated from the PyPI archive, so that
cargo builds offline.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Include rust-values.mk of the build system and build from a vendor
tarball generated from the PyPI archive, so that cargo builds offline.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
setuptools-rust runs no Rust itself. Its host build depends on rust/host
for the packages that use it, which is needed only while the build
system has no Rust toolchain.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
python3-host.mk includes the Rust values of lang/rust for every Python
package. The build system's cmake.mk and meson.mk react to Rust
variables, so packages without any Rust in them get Rust settings, and a
Python package moving to the build system's Rust toolchain would get
both sets of values.
Include rust-values.mk in the six packages that use its variables. The
variables in PYTHON3_VARS and HOST_PYTHON3_VARS are expanded late, so
the place of the include does not matter.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The build system can provide a Rust toolchain of its own. Its packages
then use that, and rust/host of this feed must not be built next to it.
Make RUST_ARCH_DEPENDS depend on USE_RUST_TOOLCHAIN being unset, and add
the same condition to pdns-recursor and python3-setuptools-rust, which
use rust/host without RUST_ARCH_DEPENDS. Without the symbol in the build
system nothing changes, as Kconfig takes an unknown symbol for n.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Upstream has deprecated netdisco: "This library is deprecated. We will
no longer release new versions, fix bugs or accept pull requests."
The last release, 3.0.0, dates from October 2021, and the upstream
repository (https://github.com/home-assistant-libs/netdisco) was
archived on 1 October 2021 and is now read-only.
Nothing in the feeds depends on it.
Signed-off-by: Sander van Deijck <sander@vandeijck.com>
The libcamera Mojom parser imports PLY directly. Restore the package for
host builds so libcamera can declare it as a build dependency instead
of installing it through pip.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
1.32 declares a tomlkit dependency, which the host build rejects as
unmet. It is only reached by the "hatchling version" CLI, not by the
PEP 517 backend the feed uses, so patch it out rather than package
tomlkit for an unreachable code path.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream lists a single change for this release, support for Python
3.15, so this only keeps the package current; the free-threading fixes
to the C lookup caches are queued for 8.7 and are not in it.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
0.5.7 renames the sdist's top directory from python-gnupg-0.5.7 to
python_gnupg-0.5.7, so set PYPI_SOURCE_NAME to make PKG_BUILD_DIR match
what the tarball extracts to. pypi.mk then derives the same PKG_SOURCE
that the explicit line held, so drop it.
Add 001-relax-setuptools-constraint.patch: 0.5.7 tightens its build
requirement to "setuptools >= 68,<75", which the feed's setuptools
84.0.0 does not satisfy, so the build fails with an unmet
"setuptools<75,>=68" dependency. The cap is precautionary and the
package builds unchanged without it.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
1.2.1 fixes a SQL injection via wrongly escaped bytes parameters on the
big5, gbk, sjis, cp932 and gb18030 charsets (GHSA-x4f8-9hx9-hpp9).
Drop the pymysql.converters assertions from test.sh: escape_dict is now
a non-callable placeholder kept only for aiomysql, and upstream states
the module is internal with no compatibility guarantee.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Picks up the 3.18.2 security fixes: GHSA-33wh-fxxf-88vv hardens content
negotiation against large Accept headers, GHSA-3547-9m27-7rxg refuses
non-text encoding charsets, and GHSA-xw6w-gcfp-cf8m makes deleting a
TokenProxy actually delete the token. 3.18.3 then reverts the
order_by_precedence() return value, which 3.18.2 had changed by
mistake.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Security release: CVE-2026-77050 (denial of service in
get_supported_language_variant()), CVE-2026-84429 (denial of service in
parse_header_parameters(), reachable through the Accept and
Content-Type headers), CVE-2026-87890 (request forgery via spatial
lookup byte values) and CVE-2026-87975 (privilege abuse in model
formsets with editable primary keys). It also completes an
insufficient mitigation of CVE-2026-15307 shipped in 6.1.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Single fix: the precision defaults for the e/E format types, added in
2.3.0, were processed wrongly and the formatter emitted its own format
string instead of a number -- format(sin(1), ".10De") returned
"%.10.6RDe" rather than "8.4147098480e-01".
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Hardens the reader against crafted databases: decoding now caps a
record at 65536 values, 512 levels of nesting and 2 MiB of string and
bytes payload, rejects unsigned integers over 16 bytes and signed ones
over 4 bytes before reading their payload, and rejects an invalid
search tree size when opening a database. Those, and the truncated
reads that used to surface as IndexError or struct.error, all raise
InvalidDatabaseError now.
Upstream vendors libmaxminddb 1.14.0 for the same limits in the C
extension; this package links the feed's libmaxminddb instead, so that
half arrives with a libmaxminddb bump.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
4.15.1 raises the typing_extensions requirement marker from
python_version < "3.13" to < "3.15", so it is now a real runtime
dependency on python 3.14 and importing anyio fails without it.
Add python3-typing-extensions to DEPENDS.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The single change is a new "towncrier-fragments-zerover" version
scheme: like towncrier-fragments, but while the last tag is still 0.x a
breaking or removal fragment bumps the minor version and only a major
fragment proposes 1.0.0. Nothing else moves; this keeps the package in
step with setuptools-scm, which shares its repository.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The 10.3.x series is a chain of fixes to one regression: 10.3.0 let
version inference return before discovering a workdir, and the egg_info
mixin read that missing workdir as "looked and found no checkout",
which suppressed the setuptools.file_finders chain. Builds then
succeeded with the right version and an sdist and wheel missing every
SCM-tracked file that setuptools' own package discovery does not find.
10.3.3 fixed it for a pretended version, 10.3.4 for projects whose
pyproject.toml sits in a subdirectory of the checkout.
10.3.4 also raises the vcs-versioning floor to 2.5.0, which the feed
already ships.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The feed reverted python-flit-core to 3.12.0, which satisfies the
upstream "flit_core >=3.11,<4" build requirement, so the relaxation
patch is no longer needed.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The feed reverted python-flit-core to 3.12.0, which satisfies the
upstream "flit_core<4,>=3.11" build requirement, so the relaxation
patch is no longer needed.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream now caps flit_core at <5, which the feed's 3.12.0 satisfies, so
drop 010-relax-flit-core-constraint.patch.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream now caps flit_core at <5, which the feed's 3.12.0 satisfies, so
drop 010-relax-flit-core-constraint.patch.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update to the latest upstream release and drop
001-cffi-build-rs-derive-include-from-pyo3-cross.patch, which is
part of this release.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
cryptography 50.0.2 requires "maturin>=1.14.1,<2" as its build
backend, which 1.13.1 does not satisfy.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Refresh sha256 from the PyPI sdist.
26.4.0 drops OpenSSL.crypto.X509Req and dump_certificate_request, so
test.sh can no longer import them; remove them and the CSR block. CSR
handling now lives in cryptography.x509, which is not this package.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The override lists every python3 package by name, so it has to change
whenever the package set does, and it cannot be used as is on branches
that build a different set, like libpython3-3.13 and python3-email on
openwrt-25.12.
Check the interpreter, python3-dev and libpython3-X.Y against the
version, and accept the standard library modules and -src packages by
pattern, since they ship no executables. python3-dev now gets a real
check through python3-config and patchlevel.h, because python3-config
prints no version.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Daniel Golle
Sander van Deijck
Eneas U de Queiroz
Alexandru Ardelean
Josef Schlehofer
Austin Lane