From dab0de6277c484998842f4617a9730ce2ae3b050 Mon Sep 17 00:00:00 2001 From: Yegor Yefremov Date: Tue, 9 Jun 2026 12:05:15 +0200 Subject: [PATCH] package/python-webpy: bump to version 0.76 Change log since v0.60: https://github.com/webpy/webpy/releases/tag/0.61 https://github.com/webpy/webpy/releases/tag/0.62 https://github.com/webpy/webpy/releases/tag/v0.76 Remove the upstreamed patch and add a license file. This commit adds the new python-multipart runtime dependency, needed since upstream commit: https://github.com/webpy/webpy/commit/f7540bef650bce7227af796728136d41e44cdd0e Signed-off-by: Yegor Yefremov [Julien: - move the "v" from _VERSION to _SITE - select new BR2_PACKAGE_PYTHON_MULTIPART runtime dependency - add links to all release notes in commit log ] Signed-off-by: Julien Olivain --- .../0001-Address-CVE-2025-3818.patch | 42 ------------------- package/python-webpy/Config.in | 1 + package/python-webpy/python-webpy.hash | 3 +- package/python-webpy/python-webpy.mk | 5 ++- 4 files changed, 6 insertions(+), 45 deletions(-) delete mode 100644 package/python-webpy/0001-Address-CVE-2025-3818.patch diff --git a/package/python-webpy/0001-Address-CVE-2025-3818.patch b/package/python-webpy/0001-Address-CVE-2025-3818.patch deleted file mode 100644 index d8373cbac6..0000000000 --- a/package/python-webpy/0001-Address-CVE-2025-3818.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 3ba1b40e5a828a26a1df1b49cdc87395f3274c81 Mon Sep 17 00:00:00 2001 -From: Mek -Date: Wed, 7 May 2025 15:14:44 -0400 -Subject: [PATCH] Address CVE-2025-3818 (#807) - -* Address CVE-2025-3818 - -Co-authored-by: Scott Barnes - -Upstream: https://github.com/webpy/webpy/commit/3ba1b40e5a828a26a1df1b49cdc87395f3274c81 - -Fixes CVE-2025-3818: https://github.com/advisories/GHSA-9g47-36rw-gjh2 - -Signed-off-by: Bernd Kuhls ---- - web/db.py | 10 +++++++++- - 1 file changed, 9 insertions(+), 1 deletion(-) - -diff --git a/web/db.py b/web/db.py -index 5284f8d0..ba3e12c5 100644 ---- a/web/db.py -+++ b/web/db.py -@@ -1198,10 +1198,18 @@ def _process_insert_query(self, query, tablename, seqname): - seqname = None - - if seqname: -- query += "; SELECT currval('%s')" % seqname -+ query += self.get_sequence_query(seqname) - - return query - -+ def get_sequence_query(self, seqname): -+ import re -+ # Ensure the sequence name is valid -+ if not re.match(r'^[a-zA-Z_][a-zA-Z0-9_$]*$', seqname): -+ raise ValueError(f"Invalid sequence name: {seqname}") -+ return SQLQuery("; SELECT currval(%s)", seqname) -+ -+ - def _get_all_sequences(self): - """Query postgres to find names of all sequences used in this database.""" - if self._sequences is None: diff --git a/package/python-webpy/Config.in b/package/python-webpy/Config.in index ed78409572..12920a7b32 100644 --- a/package/python-webpy/Config.in +++ b/package/python-webpy/Config.in @@ -2,6 +2,7 @@ config BR2_PACKAGE_PYTHON_WEBPY bool "python-webpy" select BR2_PACKAGE_PYTHON_CHEROOT # runtime select BR2_PACKAGE_PYTHON_MARKDOWN # runtime + select BR2_PACKAGE_PYTHON_MULTIPART # runtime help web.py is a web framework for Python that is as simple as it is powerful. diff --git a/package/python-webpy/python-webpy.hash b/package/python-webpy/python-webpy.hash index 0fb39170c7..a3f9122258 100644 --- a/package/python-webpy/python-webpy.hash +++ b/package/python-webpy/python-webpy.hash @@ -1,2 +1,3 @@ # Locally computed -sha256 eee36e423b5e85463145159d94735e3c3a4c1c8078555042d8139348350b0022 python-webpy-0.70.tar.gz +sha256 c5d5df8b95c22cacb6be580cee88459922ff114894fe4e146da634ab3d1f9185 python-webpy-0.76.tar.gz +sha256 791bf6e9419435f114a19fc6519ff33738021eb3c41b18490943230ab0894df9 LICENSE.txt diff --git a/package/python-webpy/python-webpy.mk b/package/python-webpy/python-webpy.mk index 62b2331c08..5127873677 100644 --- a/package/python-webpy/python-webpy.mk +++ b/package/python-webpy/python-webpy.mk @@ -4,9 +4,10 @@ # ################################################################################ -PYTHON_WEBPY_VERSION = 0.70 -PYTHON_WEBPY_SITE = $(call github,webpy,webpy,webpy-$(PYTHON_WEBPY_VERSION)) +PYTHON_WEBPY_VERSION = 0.76 +PYTHON_WEBPY_SITE = $(call github,webpy,webpy,v$(PYTHON_WEBPY_VERSION)) PYTHON_WEBPY_SETUP_TYPE = setuptools PYTHON_WEBPY_LICENSE = Public Domain +PYTHON_WEBPY_LICENSE_FILES = LICENSE.txt $(eval $(python-package))