* [Buildroot] [PATCH 2/4] package/python-magic-wormhole: security bump to version 0.23.0
2026-04-21 17:26 [Buildroot] [PATCH 1/4] package/python-magic-wormhole: add CPE ID Julien Olivain via buildroot
@ 2026-04-21 17:26 ` Julien Olivain via buildroot
2026-05-04 14:48 ` Thomas Perale via buildroot
2026-04-21 17:26 ` [Buildroot] [PATCH 3/4] package/python-magic-wormhole-mailbox-server: bump to version 0.6.0 Julien Olivain via buildroot
` (3 subsequent siblings)
4 siblings, 1 reply; 8+ messages in thread
From: Julien Olivain via buildroot @ 2026-04-21 17:26 UTC (permalink / raw)
To: buildroot; +Cc: James Hilliard, Julien Olivain
See NEWS:
https://github.com/magic-wormhole/magic-wormhole/blob/0.23.0/NEWS.md
This commit also updates _SITE to use a stable URL which will redirect
to the package archive, to reduce future maintenance.
Fixes:
https://nvd.nist.gov/vuln/detail/CVE-2026-32116
Signed-off-by: Julien Olivain <ju.o@free.fr>
---
Patch series tested in:
https://gitlab.com/jolivain/buildroot/-/jobs/14023074896
---
package/python-magic-wormhole/python-magic-wormhole.hash | 4 ++--
package/python-magic-wormhole/python-magic-wormhole.mk | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/package/python-magic-wormhole/python-magic-wormhole.hash b/package/python-magic-wormhole/python-magic-wormhole.hash
index b0f32e2d13..2f03594cc1 100644
--- a/package/python-magic-wormhole/python-magic-wormhole.hash
+++ b/package/python-magic-wormhole/python-magic-wormhole.hash
@@ -1,5 +1,5 @@
# md5, sha256 from https://pypi.org/pypi/magic-wormhole/json
-md5 e57bac643bbc691e94919be496813a4c magic_wormhole-0.22.0.tar.gz
-sha256 52a3ae2f0c56d0d4cd52188e50f10d2fe14bfd46e287dd50b72e7f7e851434ac magic_wormhole-0.22.0.tar.gz
+md5 23f71fc6d6f78b93d419cee6d4af4d94 magic_wormhole-0.23.0.tar.gz
+sha256 4cd8f48a5c47f70578be7063f892988177681ab66845f4d6ad2d5eb03ce82acf magic_wormhole-0.23.0.tar.gz
# Locally computed sha256 checksums
sha256 4a9cc2415c52cef591b6822eee68fed36d7e6d80284b09638cff61d762d99060 LICENSE
diff --git a/package/python-magic-wormhole/python-magic-wormhole.mk b/package/python-magic-wormhole/python-magic-wormhole.mk
index 7b74113df1..9f3b4dfe1c 100644
--- a/package/python-magic-wormhole/python-magic-wormhole.mk
+++ b/package/python-magic-wormhole/python-magic-wormhole.mk
@@ -4,9 +4,9 @@
#
################################################################################
-PYTHON_MAGIC_WORMHOLE_VERSION = 0.22.0
+PYTHON_MAGIC_WORMHOLE_VERSION = 0.23.0
PYTHON_MAGIC_WORMHOLE_SOURCE = magic_wormhole-$(PYTHON_MAGIC_WORMHOLE_VERSION).tar.gz
-PYTHON_MAGIC_WORMHOLE_SITE = https://files.pythonhosted.org/packages/65/34/08813891da57999cf953e9c553193c900ff363c4cdfdd48a74f65536a883
+PYTHON_MAGIC_WORMHOLE_SITE = https://files.pythonhosted.org/packages/source/m/magic_wormhole
PYTHON_MAGIC_WORMHOLE_SETUP_TYPE = setuptools
PYTHON_MAGIC_WORMHOLE_LICENSE = MIT
PYTHON_MAGIC_WORMHOLE_LICENSE_FILES = LICENSE
--
2.53.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [Buildroot] [PATCH 2/4] package/python-magic-wormhole: security bump to version 0.23.0
2026-04-21 17:26 ` [Buildroot] [PATCH 2/4] package/python-magic-wormhole: security bump to version 0.23.0 Julien Olivain via buildroot
@ 2026-05-04 14:48 ` Thomas Perale via buildroot
0 siblings, 0 replies; 8+ messages in thread
From: Thomas Perale via buildroot @ 2026-05-04 14:48 UTC (permalink / raw)
To: Julien Olivain; +Cc: Thomas Perale, buildroot
In reply of:
> See NEWS:
> https://github.com/magic-wormhole/magic-wormhole/blob/0.23.0/NEWS.md
>
> This commit also updates _SITE to use a stable URL which will redirect
> to the package archive, to reduce future maintenance.
>
> Fixes:
> https://nvd.nist.gov/vuln/detail/CVE-2026-32116
>
> Signed-off-by: Julien Olivain <ju.o@free.fr>
Applied to 2026.02.x. Thanks
> ---
> Patch series tested in:
> https://gitlab.com/jolivain/buildroot/-/jobs/14023074896
> ---
> package/python-magic-wormhole/python-magic-wormhole.hash | 4 ++--
> package/python-magic-wormhole/python-magic-wormhole.mk | 4 ++--
> 2 files changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/package/python-magic-wormhole/python-magic-wormhole.hash b/package/python-magic-wormhole/python-magic-wormhole.hash
> index b0f32e2d13..2f03594cc1 100644
> --- a/package/python-magic-wormhole/python-magic-wormhole.hash
> +++ b/package/python-magic-wormhole/python-magic-wormhole.hash
> @@ -1,5 +1,5 @@
> # md5, sha256 from https://pypi.org/pypi/magic-wormhole/json
> -md5 e57bac643bbc691e94919be496813a4c magic_wormhole-0.22.0.tar.gz
> -sha256 52a3ae2f0c56d0d4cd52188e50f10d2fe14bfd46e287dd50b72e7f7e851434ac magic_wormhole-0.22.0.tar.gz
> +md5 23f71fc6d6f78b93d419cee6d4af4d94 magic_wormhole-0.23.0.tar.gz
> +sha256 4cd8f48a5c47f70578be7063f892988177681ab66845f4d6ad2d5eb03ce82acf magic_wormhole-0.23.0.tar.gz
> # Locally computed sha256 checksums
> sha256 4a9cc2415c52cef591b6822eee68fed36d7e6d80284b09638cff61d762d99060 LICENSE
> diff --git a/package/python-magic-wormhole/python-magic-wormhole.mk b/package/python-magic-wormhole/python-magic-wormhole.mk
> index 7b74113df1..9f3b4dfe1c 100644
> --- a/package/python-magic-wormhole/python-magic-wormhole.mk
> +++ b/package/python-magic-wormhole/python-magic-wormhole.mk
> @@ -4,9 +4,9 @@
> #
> ################################################################################
>
> -PYTHON_MAGIC_WORMHOLE_VERSION = 0.22.0
> +PYTHON_MAGIC_WORMHOLE_VERSION = 0.23.0
> PYTHON_MAGIC_WORMHOLE_SOURCE = magic_wormhole-$(PYTHON_MAGIC_WORMHOLE_VERSION).tar.gz
> -PYTHON_MAGIC_WORMHOLE_SITE = https://files.pythonhosted.org/packages/65/34/08813891da57999cf953e9c553193c900ff363c4cdfdd48a74f65536a883
> +PYTHON_MAGIC_WORMHOLE_SITE = https://files.pythonhosted.org/packages/source/m/magic_wormhole
> PYTHON_MAGIC_WORMHOLE_SETUP_TYPE = setuptools
> PYTHON_MAGIC_WORMHOLE_LICENSE = MIT
> PYTHON_MAGIC_WORMHOLE_LICENSE_FILES = LICENSE
> --
> 2.53.0
>
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Buildroot] [PATCH 3/4] package/python-magic-wormhole-mailbox-server: bump to version 0.6.0
2026-04-21 17:26 [Buildroot] [PATCH 1/4] package/python-magic-wormhole: add CPE ID Julien Olivain via buildroot
2026-04-21 17:26 ` [Buildroot] [PATCH 2/4] package/python-magic-wormhole: security bump to version 0.23.0 Julien Olivain via buildroot
@ 2026-04-21 17:26 ` Julien Olivain via buildroot
2026-04-21 23:16 ` Marcus Hoffmann via buildroot
2026-04-21 17:26 ` [Buildroot] [PATCH 4/4] package/python-magic-wormhole-transit-relay: bump to version 0.5.0 Julien Olivain via buildroot
` (2 subsequent siblings)
4 siblings, 1 reply; 8+ messages in thread
From: Julien Olivain via buildroot @ 2026-04-21 17:26 UTC (permalink / raw)
To: buildroot; +Cc: James Hilliard, Julien Olivain
See NEWS:
https://github.com/magic-wormhole/magic-wormhole-mailbox-server/blob/0.6.0/NEWS.md
The upstream source archive name changed (dash '-' changed to
underscore '_'). This commit updates _SOURCE to reflect that change.
This commit also updates _SITE to use a stable URL which will redirect
to the package archive, to reduce future maintenance.
This package has been broken at runtime since Buildroot commit [1]
"package/python-setuptools: bump to version 82.0.0", which removed
the python module 'pkg_resources' which was deprecated. This new
version removes those usage and fixes this issue.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/13904071794
Note: this commit fixes only the runtime invocation of
wormhole-mailbox, the complete fix for the test_python_magic_wormhole
runtime test also requires the update of
python-magic-wormhole-transit-relay.
[1] https://gitlab.com/buildroot.org/buildroot/-/commit/51365ff06379aaf6fcc9a751e8ff32ac694f3e92
Signed-off-by: Julien Olivain <ju.o@free.fr>
---
.../python-magic-wormhole-mailbox-server.hash | 4 ++--
.../python-magic-wormhole-mailbox-server.mk | 6 +++---
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/package/python-magic-wormhole-mailbox-server/python-magic-wormhole-mailbox-server.hash b/package/python-magic-wormhole-mailbox-server/python-magic-wormhole-mailbox-server.hash
index fd02bcc758..d701edfc72 100644
--- a/package/python-magic-wormhole-mailbox-server/python-magic-wormhole-mailbox-server.hash
+++ b/package/python-magic-wormhole-mailbox-server/python-magic-wormhole-mailbox-server.hash
@@ -1,5 +1,5 @@
# md5, sha256 from https://pypi.org/pypi/magic-wormhole-mailbox-server/json
-md5 bb9f84e7ecddc43413b4287b7b20d285 magic-wormhole-mailbox-server-0.5.1.tar.gz
-sha256 a007a03672293204657681dbf502045d6d5817c57f9aae2f2226e6ea1a008ca1 magic-wormhole-mailbox-server-0.5.1.tar.gz
+md5 29a3ab90583e6858a74f11c3f485a77c magic_wormhole_mailbox_server-0.6.0.tar.gz
+sha256 b1bf145f3a26d905ebff6820407976d57614f1ad8b9806210e9c4e36579a1f79 magic_wormhole_mailbox_server-0.6.0.tar.gz
# Locally computed sha256 checksums
sha256 4a9cc2415c52cef591b6822eee68fed36d7e6d80284b09638cff61d762d99060 LICENSE
diff --git a/package/python-magic-wormhole-mailbox-server/python-magic-wormhole-mailbox-server.mk b/package/python-magic-wormhole-mailbox-server/python-magic-wormhole-mailbox-server.mk
index 7525054167..616d72dfbf 100644
--- a/package/python-magic-wormhole-mailbox-server/python-magic-wormhole-mailbox-server.mk
+++ b/package/python-magic-wormhole-mailbox-server/python-magic-wormhole-mailbox-server.mk
@@ -4,9 +4,9 @@
#
################################################################################
-PYTHON_MAGIC_WORMHOLE_MAILBOX_SERVER_VERSION = 0.5.1
-PYTHON_MAGIC_WORMHOLE_MAILBOX_SERVER_SOURCE = magic-wormhole-mailbox-server-$(PYTHON_MAGIC_WORMHOLE_MAILBOX_SERVER_VERSION).tar.gz
-PYTHON_MAGIC_WORMHOLE_MAILBOX_SERVER_SITE = https://files.pythonhosted.org/packages/9d/5c/71566147af3f28017035ebe69ce7253ea26917225ae7c39b964578541bff
+PYTHON_MAGIC_WORMHOLE_MAILBOX_SERVER_VERSION = 0.6.0
+PYTHON_MAGIC_WORMHOLE_MAILBOX_SERVER_SOURCE = magic_wormhole_mailbox_server-$(PYTHON_MAGIC_WORMHOLE_MAILBOX_SERVER_VERSION).tar.gz
+PYTHON_MAGIC_WORMHOLE_MAILBOX_SERVER_SITE = https://files.pythonhosted.org/packages/source/m/magic_wormhole_mailbox_server
PYTHON_MAGIC_WORMHOLE_MAILBOX_SERVER_SETUP_TYPE = setuptools
PYTHON_MAGIC_WORMHOLE_MAILBOX_SERVER_LICENSE = MIT
PYTHON_MAGIC_WORMHOLE_MAILBOX_SERVER_LICENSE_FILES = LICENSE
--
2.53.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 8+ messages in thread* [Buildroot] [PATCH 4/4] package/python-magic-wormhole-transit-relay: bump to version 0.5.0
2026-04-21 17:26 [Buildroot] [PATCH 1/4] package/python-magic-wormhole: add CPE ID Julien Olivain via buildroot
2026-04-21 17:26 ` [Buildroot] [PATCH 2/4] package/python-magic-wormhole: security bump to version 0.23.0 Julien Olivain via buildroot
2026-04-21 17:26 ` [Buildroot] [PATCH 3/4] package/python-magic-wormhole-mailbox-server: bump to version 0.6.0 Julien Olivain via buildroot
@ 2026-04-21 17:26 ` Julien Olivain via buildroot
2026-04-21 23:14 ` [Buildroot] [PATCH 1/4] package/python-magic-wormhole: add CPE ID Marcus Hoffmann via buildroot
2026-05-04 14:47 ` Thomas Perale via buildroot
4 siblings, 0 replies; 8+ messages in thread
From: Julien Olivain via buildroot @ 2026-04-21 17:26 UTC (permalink / raw)
To: buildroot; +Cc: James Hilliard, Julien Olivain
See NEWS:
https://github.com/magic-wormhole/magic-wormhole-transit-relay/blob/0.5.0/NEWS.md
The upstream source archive name changed (dash '-' changed to
underscore '_'). This commit updates _SOURCE to reflect that change.
This commit also updates _SITE to use a stable URL which will redirect
to the package archive, to reduce future maintenance.
This package has been broken at runtime since Buildroot commit [1]
"package/python-setuptools: bump to version 82.0.0", which removed
the python module 'pkg_resources' which was deprecated. This new
version removes those usage and fixes this issue.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/13904071794
Note: this commit fixes only the runtime invocation of transitrelay,
the complete fix for the test_python_magic_wormhole runtime test
also requires the update of python-magic-wormhole-mailbox-server.
[1] https://gitlab.com/buildroot.org/buildroot/-/commit/51365ff06379aaf6fcc9a751e8ff32ac694f3e92
Signed-off-by: Julien Olivain <ju.o@free.fr>
---
.../python-magic-wormhole-transit-relay.hash | 4 ++--
.../python-magic-wormhole-transit-relay.mk | 6 +++---
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/package/python-magic-wormhole-transit-relay/python-magic-wormhole-transit-relay.hash b/package/python-magic-wormhole-transit-relay/python-magic-wormhole-transit-relay.hash
index 3f038728be..286f2766ae 100644
--- a/package/python-magic-wormhole-transit-relay/python-magic-wormhole-transit-relay.hash
+++ b/package/python-magic-wormhole-transit-relay/python-magic-wormhole-transit-relay.hash
@@ -1,5 +1,5 @@
# md5, sha256 from https://pypi.org/pypi/magic-wormhole-transit-relay/json
-md5 73be034b4a57e9d190cfb658cbaa5fbf magic-wormhole-transit-relay-0.4.0.tar.gz
-sha256 912d835da21b11266c77111dc9b5e5800263fc0b98f0a179962267df41819e8c magic-wormhole-transit-relay-0.4.0.tar.gz
+md5 8305bee7b0307e485c42ac933cbc6ddd magic_wormhole_transit_relay-0.5.0.tar.gz
+sha256 a2c2e777cafcd843a2f22f0a4b3c3bd3cae85cc2303fead1646d1763ad6d1a4a magic_wormhole_transit_relay-0.5.0.tar.gz
# Locally computed sha256 checksums
sha256 d70f6469bb210c2aa4c0dfd74f498ef5f0467a137d8296479088e7243c5884eb LICENSE
diff --git a/package/python-magic-wormhole-transit-relay/python-magic-wormhole-transit-relay.mk b/package/python-magic-wormhole-transit-relay/python-magic-wormhole-transit-relay.mk
index 03a2d416db..4f83c6fc51 100644
--- a/package/python-magic-wormhole-transit-relay/python-magic-wormhole-transit-relay.mk
+++ b/package/python-magic-wormhole-transit-relay/python-magic-wormhole-transit-relay.mk
@@ -4,9 +4,9 @@
#
################################################################################
-PYTHON_MAGIC_WORMHOLE_TRANSIT_RELAY_VERSION = 0.4.0
-PYTHON_MAGIC_WORMHOLE_TRANSIT_RELAY_SOURCE = magic-wormhole-transit-relay-$(PYTHON_MAGIC_WORMHOLE_TRANSIT_RELAY_VERSION).tar.gz
-PYTHON_MAGIC_WORMHOLE_TRANSIT_RELAY_SITE = https://files.pythonhosted.org/packages/d0/87/cb71073e53ea7e1b6f892c52e4114caea81b887a7d34e665b15dc81d669e
+PYTHON_MAGIC_WORMHOLE_TRANSIT_RELAY_VERSION = 0.5.0
+PYTHON_MAGIC_WORMHOLE_TRANSIT_RELAY_SOURCE = magic_wormhole_transit_relay-$(PYTHON_MAGIC_WORMHOLE_TRANSIT_RELAY_VERSION).tar.gz
+PYTHON_MAGIC_WORMHOLE_TRANSIT_RELAY_SITE = https://files.pythonhosted.org/packages/source/m/magic_wormhole_transit_relay
PYTHON_MAGIC_WORMHOLE_TRANSIT_RELAY_SETUP_TYPE = setuptools
PYTHON_MAGIC_WORMHOLE_TRANSIT_RELAY_LICENSE = MIT
PYTHON_MAGIC_WORMHOLE_TRANSIT_RELAY_LICENSE_FILES = LICENSE
--
2.53.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [Buildroot] [PATCH 1/4] package/python-magic-wormhole: add CPE ID
2026-04-21 17:26 [Buildroot] [PATCH 1/4] package/python-magic-wormhole: add CPE ID Julien Olivain via buildroot
` (2 preceding siblings ...)
2026-04-21 17:26 ` [Buildroot] [PATCH 4/4] package/python-magic-wormhole-transit-relay: bump to version 0.5.0 Julien Olivain via buildroot
@ 2026-04-21 23:14 ` Marcus Hoffmann via buildroot
2026-05-04 14:47 ` Thomas Perale via buildroot
4 siblings, 0 replies; 8+ messages in thread
From: Marcus Hoffmann via buildroot @ 2026-04-21 23:14 UTC (permalink / raw)
To: Julien Olivain, buildroot; +Cc: James Hilliard
Hi Julien
On 4/21/26 19:26, Julien Olivain via buildroot wrote:
> The CPE ID `magic_wormhole_project:magic_wormhole` is valid for
> magic-wormhole. See:
> https://nvd.nist.gov/products/cpe/detail/591D7832-786D-4BBD-A16A-04CBDE20333B
>
> This commit adds the information.
>
> Signed-off-by: Julien Olivain <ju.o@free.fr>
> ---
Series applied to master, with a fixup for commit 3/4, thanks!
Marcus
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [Buildroot] [PATCH 1/4] package/python-magic-wormhole: add CPE ID
2026-04-21 17:26 [Buildroot] [PATCH 1/4] package/python-magic-wormhole: add CPE ID Julien Olivain via buildroot
` (3 preceding siblings ...)
2026-04-21 23:14 ` [Buildroot] [PATCH 1/4] package/python-magic-wormhole: add CPE ID Marcus Hoffmann via buildroot
@ 2026-05-04 14:47 ` Thomas Perale via buildroot
4 siblings, 0 replies; 8+ messages in thread
From: Thomas Perale via buildroot @ 2026-05-04 14:47 UTC (permalink / raw)
To: Julien Olivain; +Cc: Thomas Perale, buildroot
In reply of:
> The CPE ID `magic_wormhole_project:magic_wormhole` is valid for
> magic-wormhole. See:
> https://nvd.nist.gov/products/cpe/detail/591D7832-786D-4BBD-A16A-04CBDE20333B
>
> This commit adds the information.
>
> Signed-off-by: Julien Olivain <ju.o@free.fr>
Applied to 2025.02.x & 2026.02.x. Thanks
> ---
> package/python-magic-wormhole/python-magic-wormhole.mk | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/package/python-magic-wormhole/python-magic-wormhole.mk b/package/python-magic-wormhole/python-magic-wormhole.mk
> index 11d4a8867e..7b74113df1 100644
> --- a/package/python-magic-wormhole/python-magic-wormhole.mk
> +++ b/package/python-magic-wormhole/python-magic-wormhole.mk
> @@ -10,6 +10,8 @@ PYTHON_MAGIC_WORMHOLE_SITE = https://files.pythonhosted.org/packages/65/34/08813
> PYTHON_MAGIC_WORMHOLE_SETUP_TYPE = setuptools
> PYTHON_MAGIC_WORMHOLE_LICENSE = MIT
> PYTHON_MAGIC_WORMHOLE_LICENSE_FILES = LICENSE
> +PYTHON_MAGIC_WORMHOLE_CPE_ID_VENDOR = magic_wormhole_project
> +PYTHON_MAGIC_WORMHOLE_CPE_ID_PRODUCT = magic_wormhole
> PYTHON_MAGIC_WORMHOLE_DEPENDENCIES = host-python-versioneer
>
> $(eval $(python-package))
> --
> 2.53.0
>
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 8+ messages in thread