summaryrefslogtreecommitdiff
path: root/www
AgeCommit message (Collapse)AuthorFilesLines
2020-03-13Pullup ticket #6146 - requested by niabsiegert2-371/+371
www/firefox68-l10n: dependent update Revisions pulled up: - www/firefox68-l10n/Makefile 1.9 - www/firefox68-l10n/distinfo 1.7 --- Module Name: pkgsrc Committed By: nia Date: Thu Mar 12 19:54:45 UTC 2020 Modified Files: pkgsrc/www/firefox68-l10n: Makefile distinfo Log Message: firefox68-l10n: Update to 68.6.0 Sync with firefox68
2020-03-13Pullup ticket #6145 - requested by niabsiegert13-631/+55
www/firefox68: security fix Revisions pulled up: - www/firefox68/Makefile 1.15 - www/firefox68/PLIST 1.5 - www/firefox68/distinfo 1.11 - www/firefox68/mozilla-common.mk 1.7 - www/firefox68/options.mk 1.8 - www/firefox68/patches/patch-aa 1.2 - www/firefox68/patches/patch-build_moz.configure_old.configure deleted - www/firefox68/patches/patch-dom_media_CubebUtils.cpp 1.2 - www/firefox68/patches/patch-media_libcubeb_src_cubeb.c 1.2 - www/firefox68/patches/patch-media_libcubeb_src_cubeb__oss.c deleted - www/firefox68/patches/patch-media_libcubeb_src_moz.build 1.2 - www/firefox68/patches/patch-media_libcubeb_update.sh 1.2 - www/firefox68/patches/patch-toolkit_library_moz.build 1.2 --- Module Name: pkgsrc Committed By: nia Date: Thu Mar 12 19:39:35 UTC 2020 Modified Files: pkgsrc/www/firefox68: Makefile PLIST distinfo mozilla-common.mk options.mk pkgsrc/www/firefox68/patches: patch-aa patch-dom_media_CubebUtils.cpp patch-media_libcubeb_src_cubeb.c patch-media_libcubeb_src_moz.build patch-media_libcubeb_update.sh patch-toolkit_library_moz.build Removed Files: pkgsrc/www/firefox68/patches: patch-build_moz.configure_old.configure patch-media_libcubeb_src_cubeb__oss.c Log Message: firefox68: Update to 68.6.0 While here, - Remove OSS support now that cubeb_sun has been stable for a long while - Appease pkglint Security fixes in this release: #CVE-2020-6805: Use-after-free when removing data about origins #CVE-2020-6806: BodyStream::OnInputStreamReady was missing protections #CVE-2020-6807: Use-after-free in cubeb during stream destruction #CVE-2020-6811: Devtools' 'Copy as cURL' feature did not fully escape #CVE-2019-20503: Out of bounds reads in sctp_load_addresses_from_init #CVE-2020-6812: The names of AirPods with personally identifiable #CVE-2020-6814: Memory safety bugs fixed in Firefox 74 and Firefox ESR 68.6
2020-03-08Pullup ticket #6144 - requested by tacabsiegert2-7/+7
www/ruby-puma: security fix Revisions pulled up: - www/ruby-puma/Makefile 1.21-1.22 - www/ruby-puma/distinfo 1.16-1.17 --- Module Name: pkgsrc Committed By: taca Date: Sat Feb 29 02:19:55 UTC 2020 Modified Files: pkgsrc/www/ruby-puma: Makefile distinfo Log Message: www/ruby-puma: update to 4.3.2 Update ruby-puma to 4.3.2. ## 4.3.2 and 3.12.3 / 2020-02-27 * Security * Fix: Prevent HTTP Response splitting via CR/LF in header values. CVE-2020-5247. --- Module Name: pkgsrc Committed By: taca Date: Sun Mar 1 02:52:25 UTC 2020 Modified Files: pkgsrc/www/ruby-puma: Makefile distinfo Log Message: www/ruby-puma: update to 4.3.3 Update ruby-puma to 4.3.3. ## 4.3.3 and 3.12.4 / 2020-02-28 * Bugfixes * Fix: Fixes a problem where we weren't splitting headers correctly on newlines (#2132) * Security * Fix: Prevent HTTP Response splitting via CR in early hints.
2020-02-23Pullup ticket #6139 - requested by morrbsiegert3-9/+16
www/wordpress: security fix Revisions pulled up: - www/wordpress/Makefile 1.91 - www/wordpress/PLIST 1.42 - www/wordpress/distinfo 1.73 --- Module Name: pkgsrc Committed By: morr Date: Sun Feb 23 09:59:42 UTC 2020 Modified Files: pkgsrc/www/wordpress: Makefile PLIST distinfo Log Message: Update to version 5.3.2. Changes: Version 5.3.2: Maintenance updates - Date/Time: Ensure that get_feed_build_date() correctly handles a modified post object with invalid date. - Uploads: Fix file name collision in wp_unique_filename() when uploading a file with upper case extension on non case-sensitive file systems. - Media: Fix PHP warnings in wp_unique_filename() when the destination directory is unreadable. - Administration: Fix the colors in all color schemes for buttons with the .active class. - Tests/build tools: In wp_insert_post(), when checking the post date to set future or publish status, use a proper delta comparison. Version 5.3.1: Security fixes - Props to Daniel Bachhuber for finding an issue where an unprivileged user could make a post sticky via the REST API. - Props to Simon Scannell of RIPS Technologies for finding and disclosing an issue where cross-site scripting (XSS) could be stored in well-crafted links. - Props to the WordPress.org Security Team for hardening wp_kses_bad_protocol() to ensure that it is aware of the named colon attribute. - Props to Nguyen The Duc for discovering a stored XSS vulnerability using block editor content. Maintenance updates - Administration: improvements to admin form controls height and alignment standardization (see related dev note), dashboard widget links accessibility and alternate color scheme readability issues (see related dev note). - Block editor: fix Edge scrolling issues and intermittent JavaScript issues. - Bundled themes: add customizer option to show/hide author bio, replace JS based smooth scroll with CSS (see related dev note) and fix Instagram embed CSS. - Date/time: improve non-GMT dates calculation, fix date format output in specific languages and make get_permalink() more resilient against PHP timezone changes. - Embeds: remove CollegeHumor oEmbed provider as the service doesn’t exist anymore. - External libraries: update sodium_compat. - Site health: allow the remind interval for the admin email verification to be filtered. - Uploads: avoid thumbnails overwriting other uploads when filename matches, and exclude PNG images from scaling after upload. - Users: ensure administration email verification uses the user’s locale instead of the site locale.
2020-02-23Pullup ticket #6135 - requested by niabsiegert2-371/+371
www/firefox68-l10n: dependent update Revisions pulled up: - www/firefox68-l10n/Makefile 1.7 - www/firefox68-l10n/distinfo 1.6 --- Module Name: pkgsrc Committed By: nia Date: Sat Feb 15 12:55:12 UTC 2020 Modified Files: pkgsrc/www/firefox68-l10n: Makefile distinfo Log Message: firefox68-l10n: Update to 68.5.0 Sync with firefox68.
2020-02-23Pullup ticket #6134 - requested by niabsiegert3-14/+21
www/firefox68: security fix Revisions pulled up: - www/firefox68/Makefile 1.12 - www/firefox68/PLIST 1.4 - www/firefox68/distinfo 1.10 --- Module Name: pkgsrc Committed By: nia Date: Sat Feb 15 12:48:22 UTC 2020 Modified Files: pkgsrc/www/firefox68: Makefile PLIST distinfo Log Message: firefox68: Update to 68.5.0 Security Vulnerabilities fixed in Firefox ESR68.5 # CVE-2020-6796: Missing bounds check on shared memory read in the parent process # CVE-2020-6797: Extensions granted downloads.open permission could open arbitrary applications on Mac OSX # CVE-2020-6798: Incorrect parsing of template tag could result in JavaScript injection # CVE-2020-6799: Arbitrary code execution when opening pdf links from other applications, when Firefox is configured as default pdf reader Note: This issue only affects Windows operating systems and when Firefox is configured as the default handler for non-default filetypes. Other operating systems are unaffected. # CVE-2020-6800: Memory safety bugs fixed in Firefox 73 and Firefox ESR 68.5
2020-02-09Pullup ticket #6132 - requested by minskimbsiegert3-18/+33
www/py-feedgen: security fix Revisions pulled up: - www/py-feedgen/Makefile 1.3 - www/py-feedgen/PLIST 1.2 - www/py-feedgen/distinfo 1.2 --- Module Name: pkgsrc Committed By: minskim Date: Tue Feb 4 00:18:02 UTC 2020 Modified Files: pkgsrc/www/py-feedgen: Makefile PLIST distinfo Log Message: www/py-feedgen: Update to 0.9.0 This version fixes a DoS vulnerability (CVE-2020-5227).
2020-01-27Pullup ticket #6126 - requested by tacabsiegert6-62/+52
www/awstats: security fix Revisions pulled up: - www/awstats/Makefile 1.64 - www/awstats/distinfo 1.38 - www/awstats/patches/patch-aa deleted - www/awstats/patches/patch-ab deleted - www/awstats/patches/patch-ad deleted - www/awstats/patches/patch-tools_awstats__configure.pl 1.1 - www/awstats/patches/patch-wwwroot_cgi-bin_awstats.pl 1.1 - www/awstats/patches/patch-wwwroot_cgi-bin_lib_search__engines.pm 1.1 --- Module Name: pkgsrc Committed By: adam Date: Tue Jan 7 18:21:02 UTC 2020 Modified Files: pkgsrc/www/awstats: Makefile distinfo Added Files: pkgsrc/www/awstats/patches: patch-tools_awstats__configure.pl patch-wwwroot_cgi-bin_awstats.pl patch-wwwroot_cgi-bin_lib_search__engines.pm Removed Files: pkgsrc/www/awstats/patches: patch-aa patch-ab patch-ad Log Message: awstats: updated to 7.7 7.7: Security fix: CVE-2017-1000501 Security fix: Missing sanitizing of parameters Fix LogFormat=4 with url containing spaces. Fix to window.opener vulnerability in external referral site links. Add methodurlprot in key to define log format. Add Dynamic DNS Lookup. Fix edge support.
2020-01-27Pullup ticket #6120 - requested by kimbsiegert2-1/+25
www/nginx: security fix Revisions pulled up: - www/nginx/Makefile 1.87 - www/nginx/distinfo 1.71-1.72 - www/nginx/patches/patch-src_http_ngx__http__special__response.c 1.1-1.2 --- Module Name: pkgsrc Committed By: kim Date: Sun Jan 19 07:28:36 UTC 2020 Modified Files: pkgsrc/www/nginx: Makefile distinfo Added Files: pkgsrc/www/nginx/patches: patch-src_http_ngx__http__special__response.c Log Message: Add patch from upstream to address CVE-2019-20372. Bump revision. --- Module Name: pkgsrc Committed By: kim Date: Sun Jan 19 07:42:42 UTC 2020 Modified Files: pkgsrc/www/nginx: distinfo pkgsrc/www/nginx/patches: patch-src_http_ngx__http__special__response.c Log Message: Mention CVE-2019-20372 in the patch file as well.
2020-01-18Pullup ticket #6116 - requested by ryoonbsiegert2-371/+371
www/firefox68-l10n: dependent update Revisions pulled up: - www/firefox68-l10n/Makefile 1.5 - www/firefox68-l10n/distinfo 1.4 --- Module Name: pkgsrc Committed By: ryoon Date: Sat Jan 11 02:40:53 UTC 2020 Modified Files: pkgsrc/www/firefox68-l10n: Makefile distinfo Log Message: firefox68-l10n: Update to 68.4.1 * Sync with www/firefox68-l10n.
2020-01-10Pullup ticket #6113 - requested by niabsiegert3-185/+8
www/firefox68: security fix (zero-day) Revisions pulled up: - www/firefox68/Makefile 1.7-1.8 - www/firefox68/distinfo 1.6-1.7 - www/firefox68/patches/patch-rust-1.39.0 deleted --- Module Name: pkgsrc Committed By: nia Date: Wed Jan 8 21:49:32 UTC 2020 Modified Files: pkgsrc/www/firefox68: Makefile distinfo Removed Files: pkgsrc/www/firefox68/patches: patch-rust-1.39.0 Log Message: firefox68: Update to 68.4.0 Security Vulnerabilities fixed in Firefox ESR 68.4: # CVE-2019-17015: Memory corruption in parent process during new content process initialization on Windows # CVE-2019-17016: Bypass of @namespace CSS sanitization during pasting # CVE-2019-17017: Type Confusion in XPCVariant.cpp # CVE-2019-17021: Heap address disclosure in parent process during content process initialization on Windows # CVE-2019-17022: CSS sanitization does not escape HTML tags # CVE-2019-17024: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4 --- Module Name: pkgsrc Committed By: nia Date: Thu Jan 9 20:51:59 UTC 2020 Modified Files: pkgsrc/www/firefox68: Makefile distinfo Log Message: firefox68: Update to 68.4.1 This release fixes one zero-day vulnerability: CVE-2019-17026: IonMonkey type confusion with StoreElementHole and FallibleStoreElement Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw
2019-12-28Update to 68.3.0ryoon2-371/+371
* Sync with www/firefox68-68.3.0
2019-12-28Update to 60.9.0ryoon2-383/+383
* Sync with www/firefox60-60.9.0
2019-12-28Update to 60.9.0ryoon8-10/+25208
* Fix build with rust-1.39.0 Changelog: #CVE-2019-11746: Use-after-free while manipulating video #CVE-2019-11744: XSS by breaking out of title and textarea elements using innerHTML #CVE-2019-11742: Same-origin policy violation with SVG filters and canvas to steal cross-origin images #CVE-2019-11753: Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location #CVE-2019-11752: Use-after-free while extracting a key value in IndexedDB #CVE-2019-9812: Sandbox escape through Firefox Sync #CVE-2019-11743: Cross-origin access to unload event attributes #CVE-2019-11740: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9
2019-12-27www/ruby-sass-rails: drop ruby24taca1-1/+2
Accept ruby25 and ruby26 but not ruby24 any more.
2019-12-26www/ruby-sass-rails: fix dependencytaca1-2/+5
Relax dependency to sprockets-rails. Bump PKGREVISION.
2019-12-25ruby-sprockets no longer supports Ruby 2.4. Mark as incompatible andjoerg3-3/+6
recurse to reverse dependencies.
2019-12-25Fix kqueue fallout on NetBSD current.joerg2-1/+16
2019-12-25Don't force LTO. At least with Clang, the linker also needs to supportjoerg2-7/+16
it.
2019-12-24Update HOMEPAGE.schmonz1-2/+2
2019-12-22firefox68: Uncomment SUPPORTED_OPTIONS for PLIST fixnia1-2/+2
2019-12-22www/firefox68: Resolve pkg-build-options/not-bl3 issuegdt2-9/+9
firefox68 tries to use pkg-build-options to find out if gtk3 was (or will be) built with wayland, as that affects the PLIST. The current code works for some and causes failures for others, including failures of thunderbird. pkg-build-options insists on only being called from bl3, but the use in Makefile (to manage PLIST changes) seems sensible. This commit removes the use of pkg-build-options, resolving the build issues on netbsd-8, and adds a default-off wayland option to firefox68 that merely adjusts the PLIST, so that people building firefox68 with a wayland-enabled gtk3 have an easier time. I don't believe that any default-option binary packages will change, so no PKGREVISION++. A proper fix is deferred until after the branch. This could involve allowing pkg-build-options to be used in Makefile* instead of only bl3, or adding wayland detection and setting some variable to gtk3's bl3. As discussed on pkgsrc-users and offlist with nia@.
2019-12-22go-parse: fix build.bsiegert11-2/+107
The buffer package specifies a canonical import path, but elsewhere in the code of the package, it is imported with a different path (containing /v2/). This has been broken since Go 1.12.
2019-12-21Fix build with various Python versions.joerg3-1/+46
2019-12-21Adjust for kqueue interface change on NetBSD.joerg2-1/+26
2019-12-19Specify correct name of rst2xxx binaries.joerg1-3/+3
2019-12-19Needs py-requests.joerg1-1/+3
2019-12-19Spell include path correctly, even though it is not actually used.joerg2-4/+4
2019-12-19py-django2: updated to 2.2.9adam2-7/+7
Django 2.2.9 fixes a security issue and a data loss bug in 2.2.8. CVE-2019-19844: Potential account hijack via password reset form By submitting a suitably crafted email address making use of Unicode characters, that compared equal to an existing user email when lower-cased for comparison, an attacker could be sent a password reset token for the matched account. In order to avoid this vulnerability, password reset requests now compare the submitted email using the stricter, recommended algorithm for case-insensitive comparison of two identifiers from Unicode Technical Report 36, section 2.11.2(B)(2). Upon a match, the email containing the reset token will be sent to the email address on record rather than the submitted address. Bugfixes * Fixed a data loss possibility in SplitArrayField. When using with ArrayField(BooleanField()), all values after the first True value were marked as checked instead of preserving passed values
2019-12-19py-django: updated to 1.11.27adam2-7/+7
Django 1.11.27 fixes a security issue and a data loss bug in 1.11.26. CVE-2019-19844: Potential account hijack via password reset form By submitting a suitably crafted email address making use of Unicode characters, that compared equal to an existing user email when lower-cased for comparison, an attacker could be sent a password reset token for the matched account. In order to avoid this vulnerability, password reset requests now compare the submitted email using the stricter, recommended algorithm for case-insensitive comparison of two identifiers from Unicode Technical Report 36, section 2.11.2(B)(2). Upon a match, the email containing the reset token will be sent to the email address on record rather than the submitted address. Bugfixes * Fixed a data loss possibility in SplitArrayField. When using with ArrayField(BooleanField()), all values after the first True value were marked as checked instead of preserving passed values
2019-12-19www/drupal8: update to 8.7.11taca3-8/+9
Update durpal8 to 8.7.11, security release. 8.7.11 (2019-12-18) Release notes Maintenance and security release of the Drupal 8 series. This release fixes security vulnerabilities. Sites are urged to upgrade immediately after reading the notes below and the security announcement.
2019-12-19www/drupal7: update to 7.69taca3-8/+11
Update drupal7 to 7.69, security release. 7.69 (2019-12-18) Release notes Maintenance and security release of the Drupal 7 series. This release fixes security vulnerabilities. Sites are urged to upgrade immediately after reading the notes below and the security announcement.
2019-12-18py-django != py-djangorestframeworkjoerg1-2/+2
2019-12-18Fix missing dependency.joerg1-1/+2
2019-12-18Use external libuv.joerg3-2/+36
2019-12-17py-publicsuffix2: Reset USE_LANGUAGESleot1-1/+3
(No `c' compiler is needed to build this module.)
2019-12-17www: Add py-publicsuffix2leot1-1/+2
2019-12-17py-publicsuffix2: Import py-publicsuffix2-2.20190812 as www/py-publicsuffix2leot4-0/+35
This module allows you to get the public suffix, as well as the registrable domain, of a domain name using the Public Suffix List from http://publicsuffix.org
2019-12-16Update patch to more portablenros2-7/+11
a patch caused crashes, use suggestions by upstream that makes it more portable
2019-12-16www/ruby-puma: update to 4.3.1taca3-14/+14
## 4.3.1 and 3.12.2 / 2019-12-05 * Security * Fix: a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. CVE-2019-16770. ## 4.3.0 / 2019-11-07 * Features * Strip whitespace at end of HTTP headers (#2010) * Optimize HTTP parser for JRuby (#2012) * Add SSL support for the control app and cli (#2046, #2052) * Bugfixes * Fix Errno::EINVAL when SSL is enabled and browser rejects cert (#1564) * Fix pumactl defaulting puma to development if an environment was not specified (#2035) * Fix closing file stream when reading pid from pidfile (#2048) * Fix a typo in configuration option `--extra_runtime_dependencies` (#2050) ## 4.2.1 / 2019-10-07 * 3 bugfixes * Fix socket activation of systemd (pre-existing) unix binder files (#1842, #1988) * Deal with multiple calls to bind correctly (#1986, #1994, #2006) * Accepts symbols for `verify_mode` (#1222) ## 4.2.0 / 2019-09-23 * 6 features * Pumactl has a new -e environment option and reads `config/puma/<environment>.rb` config files (#1885) * Semicolons are now allowed in URL paths (MRI only), useful for Angular or Redmine (#1934) * Allow extra dependencies to be defined when using prune_bundler (#1105) * Puma now reports the correct port when binding to port 0, also reports other listeners when binding to localhost (#1786) * Sending SIGINFO to any Puma worker now prints currently active threads and their backtraces (#1320) * Puma threads all now have their name set on Ruby 2.3+ (#1968) * 4 bugfixes * Fix some misbehavior with phased restart and externally SIGTERMed workers (#1908, #1952) * Fix socket closing on error (#1941) * Removed unnecessary SIGINT trap for JRuby that caused some race conditions (#1961) * Fix socket files being left around after process stopped (#1970) * Absolutely thousands of lines of test improvements and fixes thanks to @MSP-Greg ## 4.1.1 / 2019-09-05 * 3 bugfixes * Revert our attempt to not dup STDOUT/STDERR (#1946) * Fix socket close on error (#1941) * Fix workers not shutting down correctly (#1908) ## 4.1.0 / 2019-08-08 * 4 features * Add REQUEST_PATH on parse error message (#1831) * You can now easily add custom log formatters with the `log_formatter` config option (#1816) * Puma.stats now provides process start times (#1844) * Add support for disabling TLSv1.1 (#1836) * 7 bugfixes * Fix issue where Puma was creating zombie process entries (#1887) * Fix bugs with line-endings and chunked encoding (#1812) * RACK_URL_SCHEME is now set correctly in all conditions (#1491) * We no longer mutate global STDOUT/STDERR, particularly the sync setting (#1837) * SSL read_nonblock no longer blocks (#1857) * Swallow connection errors when sending early hints (#1822) * Backtrace no longer dumped when invalid pumactl commands are run (#1863) * 5 other * Avoid casting worker_timeout twice (#1838) * Removed a call to private that wasn't doing anything (#1882) * README, Rakefile, docs and test cleanups (#1848, #1847, #1846, #1853, #1859, #1850, #1866, #1870, #1872, #1833, #1888) * Puma.io has proper documentation now (https://puma.io/puma/) * Added the Contributor Covenant CoC * 1 known issue * Some users are still experiencing issues surrounding socket activation and Unix sockets (#1842) ## 4.0.1 / 2019-07-11 * 2 bugfixes * Fix socket removed after reload - should fix problems with systemd socket activation. (#1829) * Add extconf tests for DTLS_method & TLS_server_method, use in minissl.rb. Should fix "undefined symbol: DTLS_method" when compiling against old OpenSSL versions. (#1832) * Removed unnecessary RUBY_VERSION checks. (#1827) ## 4.0.0 / 2019-06-25 9 features * Add support for disabling TLSv1.0 (#1562) * Request body read time metric (#1569) * Add out_of_band hook (#1648) * Re-implement (native) IOBuffer for JRuby (#1691) * Min worker timeout (#1716) * Add option to suppress SignalException on SIGTERM (#1690) * Allow mutual TLS CA to be set using `ssl_bind` DSL (#1689) * Reactor now uses nio4r instead of `select` (#1728) 9 x bugfixes * Do not accept new requests on shutdown (#1685, #1808) * Fix 3 corner cases when request body is chunked (#1508) * Change pid existence check's condition branches (#1650) * Don't call .stop on a server that doesn't exist (#1655) * Implemented NID_X9_62_prime256v1 (P-256) curve over P-521 (#1671) * Fix @notify.close can't modify frozen IOError (RuntimeError) (#1583) * Fix Java 8 support (#1773) * Fix error `uninitialized constant Puma::Cluster` (#1731) * Fix `not_token` being able to be set to true (#1803) ## 3.12.1 / 2019-01-08 * 1 features * Internal strings are frozen (#1649) * 3 bugfixes * Fix chunked ending check (#1607) * Rack handler should use provided default host (#1700) * Better support for detecting runtimes that support `fork` (#1630)
2019-12-16www/php-ja-wordpress: update to 5.3.1taca4-231/+782
Update php-ja-wordpress from 4.5.3 to 5.3.1. This release contains these security fixes. * Props to Daniel Bachhuber for finding an issue where an unprivileged user could make a post sticky via the REST API. * Props to Simon Scannell of RIPS Technologies for finding and disclosing an issue where cross-site scripting (XSS) could be stored in well-crafted links. * Props to the WordPress.org Security Team for hardening wp_kses_bad_protocol() to ensure that it is aware of the named colon attribute. * Props to Nguyen The Duc for discovering a stored XSS vulnerability using block editor content. For more detail about version 5.3.1, please refer <https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/> And changes from 4.5.3 to 5.3.0, please refer HOMEPAGE and <https://wordpress.org/>.
2019-12-16Drop php71 supporttaca9-18/+18
Drop php71 support mechanically.
2019-12-16www/libmicrohttpd: Update to version 0.9.69ng02-7/+7
Changelog: Sun 15 Dec 2019 02:12:02 PM CET Fix send() call (affects Mac OS X). #5977 -CG/fbrault Releasing libmicrohttpd 0.9.69. -CG Fri 29 Nov 2019 11:22:25 PM CET If application suspends a connection before we could send 100 CONTINUE, give application another shot at queuing a reply before the upload begins. -CG
2019-12-15py-django-sql-explorer: updated to 1.1.3adam3-10/+13
1.1.3: - URL-friendly parameter encoding - Updating dependency reference for Python 3 compatibility - Include database views in list of tables - Fix unicode issue when generating migration with py2 or py3 - Do not use "message" attribute on exception - Update EXPLORER_SCHEMA_EXCLUDE_TABLE_PREFIXES - Minor Changes - release checklist included in repo - readme updated with new screenshots - python dependencies/optional-dependencies updated to latest - six, xlsxwriter, factory-boy, sqlparse
2019-12-15py-django-filter: updated to 2.2.0adam2-7/+7
Version 2.2: Added DjangoFilterBackend.get_schema_operation_parameters() for DRF 3.10+ OpenAPI schema generation. Added lookup_expr to MultipleChoiceFilter Dropped support for EOL Python 3.4
2019-12-15py-djangorestframework: updated to 3.11.0adam3-8/+9
Django REST framework 3.11 The 3.11 release adds support for Django 3.0. Our supported Python versions are now: 3.5, 3.6, 3.7, and 3.8. Our supported Django versions are now: 1.11, 2.0, 2.1, 2.2, and 3.0. This release will be the last to support Python 3.5 or Django 1.11. * OpenAPI Schema Generation Improvements * Validator / Default Context
2019-12-15py-django-cors-headers: updated to 3.2.0adam2-7/+7
3.2.0: Converted setuptools metadata to configuration file. This meant removing the __version__ attribute from the package. If you want to inspect the installed version, use importlib.metadata.version("django-cors-headers") (docs / backport). Support Python 3.8.
2019-12-15www/fengoffice: update to 3.7.2.16taca4-47/+166
Now PHP 7 and later are supported. Changes are too many to write here, please refer readme.txt in detail.
2019-12-15www/typo3_62: it supports php56 onlytaca1-1/+3
typo3_62 package only supports php56.
2019-12-15www: mark packages do not support php74taca3-7/+8
Explicitly specify supporting versions of PHP.
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-30 16:10:08 +0000