Django 5.0.7 fixes the following CVEs:
* CVE-2024-38875: Potential denial-of-service vulnerability in django.utils.html.urlize()
* CVE-2024-39329: Username enumeration through timing difference for users with unusable passwords
* CVE-2024-39330: Potential directory-traversal via Storage.save()
* CVE-2024-39614: Potential denial-of-service vulnerability in get_supported_language_variant()
Django 5.0.8 fixes the following CVEs:
* CVE-2024-41989: Memory exhaustion in django.utils.numberformat.floatformat()
* CVE-2024-41990: Potential denial-of-service vulnerability in django.utils.html.urlize()
* CVE-2024-41991: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget
* CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list()
Further release Notes: https://docs.djangoproject.com/en/5.0/releases/
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Patch 0001 is upstream, this is also the only change
in this release.
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
host-swipl fails to configure with CMake error message:
Could NOT find ZLIB (missing: ZLIB_LIBRARY ZLIB_INCLUDE_DIR)
This commit fixes the issue by adding the missing host-zlib
dependency.
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Commit 9696d27756 "package/gpsd: condition python stuff to the proper
kconfig option" changed the condition in which the gpsd python scripts
are installed. After that change, the "gpsfake" command (which is a
python script) is no longer found and the runtime test is failing.
This commit fixes the issue by reflecting the change in the runtime
test Buildroot configuration.
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This is a helper class providing a template for testing audio codec
programs such as lame mp3 encoder, flac tools, ogg vorbis-tools, ...
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
python-configobj package was removed in commit
8d264a9617 because of the missing
support for Python 3.x.
Meanwhile, this problem was fixed, hence readd the package.
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This commit adds a test case for the recently added swipl package. It
should have been part of commit
69710addd1 ("package/swipl: new
package") but was forgotten.
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
SWI-Prolog offers a comprehensive free Prolog environment. Since its
start in 1987, SWI-Prolog development has been driven by the needs of
real world applications. SWI-Prolog is widely used in research and
education as well as commercial applications.
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This didn't work out as planned, neither the restriction of muting
unregistered users, nor the exception for matrix users worked as planned.
The channel mode has been reverted to +R (meaning only registered users
are allowed to join) and an exception for *that* has been introduced for
matrix users via +e. The channel modes are documented in [1].
[1] https://www.oftc.net/ChannelModes/
This reverts commit d1e6d7845b.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
autoconf has an implicit dependency on HOST_XZ due to extracting a
tar.xz archive. By enabling XZ_AUTORECONF we create a reverse dependency
for xz on autoconf. This is fine for target builds, but it won't work
for host builds, as the two packages now depend on each other.
This problem only occurs if host tools are being built by Buildroot. If
the build relies on host tools provided by the distro, there is no
circular dependency problem.
Fixes:
4703a7ae91 package/xz: fix musl static build
Signed-off-by: Markus Mayer <mmayer@broadcom.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
The release notes for version 1.1.0 mention fixes for memory handling
issues and bugs found out by fuzzing, which is the reason why this may
be considered a security update, despite them not having CVEs assigned:
https://github.com/AOMediaCodec/libavif/releases/tag/v1.1.0https://github.com/AOMediaCodec/libavif/releases/tag/v1.1.1
The change checksum for the LICENSE file is caused by a path change for
one of the submodules, and the addition of the licensing terms for the
bundled libyuv sources. The latter are never built from the libavif tree
as there is a separate libyuv package, so BSD-3-Clause does not need to
be added to LIBAVIF_LICENSE.
Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Removing backported patch and introducing new dependency
setuptools-scm.
As setuptools-scm doesn't work with github release tarballs, also
switching back to download the tarball from pypi...
Signed-off-by: Zoltan Gyarmati <zgyarmati@zgyarmati.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
--prefix influences the default of --sysconfdir, so we need to specify
--sysconfdir=/etc explicitly.
Fixes: 17deaf60f6 ("tipidee: new package")
Signed-off-by: J. Neuschäfer <j.neuschaefer@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
After the recent addition to -Wl,-z,text to TARGET_LDFLAGS in case of
musl-libc and dynamic linking, it was found that some packages pass
TARGET_LDFLAGS directly to ld, but the -Wl syntax only works with
compiler drivers (gcc/clang). This commit changes the flag to -z text,
which the gcc and clang also understand and pass to the linker.
Reported-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: J. Neuschäfer <j.neuschaefer@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This new version requires libglib2 as a dependency, which itself is
detected using pkg-config, so we need host-pkgconf as a dependency.
The patch 0001-atop.h-include-time.h.patch can be removed, it was
applied upstream as
03c5c4dd29.
A new patch (submitted upstream) is also needed to be able to provide
additional CFLAGS/LDFLAGS, without overriding the ones defined in the
upstream Makefile.
Signed-off-by: Kadambini Nema <kadambini.nema@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
`libspdm 3.3.0` and later support the SPDM event capability, however
this patch disables support for EVENT_CAP as it is optional,
and requires additional functionality implemented at link time.
`libspdm 3.4.0` also introduces SPDM1.3 measurement extention log (MEL).
Leave this off by default for the same reason as above.
The license file has changed, for two reasons:
- The copyright years have been updated
- The license was simplified to be really a pure BSD 3 Clause license,
instead of a modified license that had some special patent
disclaimer/clauses. See https://github.com/DMTF/libspdm/issues/2682
for more details. We don't need to change LIBSPDM_LICENSE because it
was already only saying BSD-3-Clause (which was slightly wrong)
Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Those defconfigs were recently bumped to NXP BSP lf-6.6.23-2.0.0.
NXP BSP U-Boot version lf-6.6.23-2.0.0 is based on upstream
version 2024.04. This version now requires OpenSSL and GnuTLS for
that configuration.
Those defconfigs are failing in uboot build, with output:
In file included from tools/imagetool.h:24,
from tools/imagetool.c:8:
include/image.h:1471:12: fatal error: openssl/evp.h: No such file or directory
1471 | # include <openssl/evp.h>
| ^~~~~~~~~~~~~~~
and:
tools/mkeficapsule.c:20:10: fatal error: gnutls/gnutls.h: No such file or directory
20 | #include <gnutls/gnutls.h>
| ^~~~~~~~~~~~~~~~~
This commit fixes the issue by adding BR2_TARGET_UBOOT_NEEDS_GNUTLS=y
and BR2_TARGET_UBOOT_NEEDS_OPENSSL=y in those defconfigs.
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This defconfig was recently bumped to NXP BSP lf-6.6.23-2.0.0.
NXP BSP U-Boot version lf-6.6.23-2.0.0 is based on upstream
version 2024.04. This version now requires OpenSSL.
This defconfig is failing in uboot build, with output:
In file included from tools/imagetool.h:24,
from tools/imagetool.c:8:
include/image.h:1471:12: fatal error: openssl/evp.h: No such file or directory
1471 | # include <openssl/evp.h>
| ^~~~~~~~~~~~~~~
This commit fixes the issue by adding
BR2_TARGET_UBOOT_NEEDS_OPENSSL=y in the defconfig.
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Those defconfigs were recently bumped to NXP BSP lf-6.6.23-2.0.0.
NXP BSP U-Boot version lf-6.6.23-2.0.0 is based on upstream
version 2024.04. This version now requires OpenSSL.
Those defconfigs are failing in uboot build, with output:
In file included from tools/imagetool.h:24,
from tools/imagetool.c:8:
include/image.h:1471:12: fatal error: openssl/evp.h: No such file or directory
1471 | # include <openssl/evp.h>
| ^~~~~~~~~~~~~~~
This commit fixes the issue by adding
BR2_TARGET_UBOOT_NEEDS_OPENSSL=y in all the impacted defconfigs.
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Those defconfigs were recently bumped to NXP BSP lf-6.6.23-2.0.0.
NXP BSP U-Boot version lf-6.6.23-2.0.0 is based on upstream
version 2024.04. This version now requires OpenSSL.
Those defconfigs are failing in uboot build, with output:
In file included from tools/imagetool.h:24,
from tools/imagetool.c:8:
include/image.h:1471:12: fatal error: openssl/evp.h: No such file or directory
1471 | # include <openssl/evp.h>
| ^~~~~~~~~~~~~~~
This commit fixes the issue by adding
BR2_TARGET_UBOOT_NEEDS_OPENSSL=y in all the impacted defconfigs.
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
The new procps-ng uses modern top layout by default which doesn't
provide detailed cpu usage info, so let's add an option for nostalgic
users that allows to get the original layout back.
Signed-off-by: Xiang Lin <myd.xia@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Requires GCC 8.3 due to the introduction of the charconv header.
However, as there is no BR2_TOOLCHAIN_GCC_AT_LEAST_8_3, we round up to
BR2_TOOLCHAIN_GCC_AT_LEAST_9.
Note the `COPYING` file has changed due to copyright year bumps.
See also: https://github.com/jtv/libpqxx/blob/master/NEWS
Signed-off-by: James Knight <james.d.knight@live.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
