packages/lang/python/python3/Makefile, branch master

python3: update to 3.14.10

2026-11-07T06:09:54Z

Refresh PKG_HASH from the python.org release tarball, and bump PYTHON3_PIP_VERSION to 26.2.2 to match the pip wheel bundled in 3.14.10's ensurepip. Refresh the patches. Only the hunk offsets shift, except for 026, which also gains the git am header that the formality check requires on a changed patch. The header comes from 02eb5c100c, the commit that restored that patch. 3.14.10 also moves the bundled mimalloc from 2.1.2 to 2.5.2. Security fixes, which come along with regular bug fixes: 3.14.8: - CVE-2026-19445: ssl use-after-free when sni_callback switches context - CVE-2026-19553: ssl wrap_bio() does not validate server_hostname - CVE-2026-15310: zipfile unbounded bzip2, LZMA, Zstandard decompression - CVE-2026-19672: tarfile filter bypass creates directories outside dest - CVE-2026-15806: urllib HTTPS credentials sent over HTTP - CVE-2026-17084: stringprep uses attributes beyond Unicode 3.2.0 - bundled expat 2.8.5 (from 2.8.2), CVE-2026-66046, CVE-2026-76641, CVE-2026-76957 and CVE-2026-93990 3.14.9: - CVE-2026-12345: tempfile.TemporaryDirectory cleanup race - CVE-2026-87910: tarfile link fallback ignores filter rejecting a member - bundled expat 2.9.0, CVE-2026-102633 and CVE-2026-77214 - bundled pip 26.2.2 with certifi 2026.10.19, eMudhra / emSign incident 3.14.10: - CVE-2026-115557: ssl distrusts compromised eMudhra intermediate keys - CVE-2026-114583: tar_filter allows links replacing the destination The Expat fixes for CVE-2026-72522 and CVE-2026-76956 do not apply to the bundled build. CVE-2024-3220 from the release notes only changes behavior on Windows. Release notes: https://www.python.org/downloads/release/python-3148/ https://www.python.org/downloads/release/python-3149/ https://www.python.org/downloads/release/python-31410/ Signed-off-by: Josef Schlehofer

python3: use ATOMIC64_DEPENDS

2026-09-16T15:35:19Z

libatomic is only needed where the compiler does not inline 64-bit atomics, but the package depends on it on every target. ATOMIC64_DEPENDS restricts the dependency to those targets. Signed-off-by: Daniel Golle

python3: update to 3.14.7

2026-08-24T17:05:34Z

Refresh PKG_HASH from the python.org release tarball, and bump PYTHON3_PIP_VERSION to 26.2.1 to match the pip wheel bundled in 3.14.7's ensurepip (it already matches the python-pip package version). Refresh the patches against the new source; only the hunk offsets shift. Signed-off-by: Alexandru Ardelean

python3: stop forcing the ncursesw/{ncurses,panel}.h checks to "no"

2026-08-22T00:40:54Z

d883c02a4106 ("python3: pin host curses to the SDK's narrow ncurses", 2026-05-28) forced every curses header check Python's configure.ac runs to "no", specifically to keep host ncurses's (then narrow-only) build from being shadowed by whatever curses headers the build host's own distro happened to ship under /usr/include. That assumption broke when openwrt/openwrt@18725c45a33a ("ncurses: bump to 6.6.20260801") switched host ncurses to track ncurses' git snapshots rather than the old 6.4 tarball: ncurses 6.6+ defaults to building wide-character support for ABI 6 (cf_dft_widec, gated on cf_cv_abi_default which is just the major version - this is a policy change accumulated in ncurses' own git history since 6.4 was tagged, not something OpenWrt or ncurses deliberately changed for wide-char specifically). Host ncurses now produces ncursesw.pc/panelw.pc, which Python 3.14's configure.ac finds independently via its own PKG_CHECK_MODULES(CURSES, ncursesw)-style pkg-config probe ("checking for ncursesw... yes") - a check that was never gated by these ac_cv_* overrides in the first place. That flips on the wide-character code paths in Modules/_cursesmodule.c, while the ac_cv_header_ncursesw_*=no overrides still force the *header* checks to fail, so the actual #include falls through to the stale narrow ncurses/ncurses.h. The result is a mismatch between what pkg-config says is available and what header actually got included, producing: ./Modules/_cursesmodule.c: error: implicit declaration of function 'unget_wch'; did you mean 'ungetch'? (and similarly for wget_wch, wins_nwstr, mvwins_nwstr - every wide-character-only curses function). Fix this at the python3/ncurses integration boundary rather than by touching ncurses' own host build behaviour globally (see openwrt/openwrt#24811, which tried --disable-widec on host ncurses and had to be reverted: it also drops extended colors from host tic, shrinking MAX_ENTRY_SIZE 32768->4096 so tic can no longer process the xterm/xterm-256color terminfo entries needed to assemble the target terminfo package). Since host ncurses's own -I.../include/ncursesw already gets added via pkg-config's Cflags substitution regardless of these overrides, stop forcing ac_cv_header_ncursesw_{ncurses,panel}_h to "no" - configure now genuinely finds ncursesw/ncurses.h in staging_dir/hostpkg, consistent with what its own pkg-config check already reports, and both detection paths agree. ac_cv_header_ncursesw_curses_h stays forced, along with the bare (non-w) curses.h/ncurses.h/panel.h checks: host ncurses is configured with --without-curses-h, so staging_dir/hostpkg/include/ncursesw/ has no curses.h of its own to genuinely detect - a real "yes" here could only ever come from the build host's own /usr/include/ncursesw/ curses.h (e.g. Fedora's ncurses-devel), the exact distro-shadowing this override block exists to prevent. Verified end to end: clean host python3 rebuild against unmodified current ncurses compiles Modules/_cursesmodule.c and Modules/_curses_panel.c without error, and the resulting staging_dir/hostpkg python3.14 successfully `import curses` with unget_wch present. Fixes: d883c02a4106 ("python3: pin host curses to the SDK's narrow ncurses") Signed-off-by: Daniel Golle

python3: fix host PGO build failure on deep build paths

2026-06-15T08:39:24Z

Python 3.14 made "forkserver" the default multiprocessing start method on Linux, which binds an AF_UNIX socket under $TMPDIR during the PGO profile-run. OpenWrt points TMPDIR at the deeply nested build tree, so the socket path can exceed the 108-byte AF_UNIX limit and abort the host build with "AF_UNIX path too long" in test_re (cpython#149527). Pin TMPDIR=/tmp for the host build. Signed-off-by: Alexandru Ardelean

python3: pin host curses to the SDK's narrow ncurses

2026-05-30T06:28:30Z

Removing the ncursesw path from include avoids seeing the wide-char version of ncurses, so the host build picks up the narrow static lib that the OpenWrt SDK stages. To keep that pin from leaking back in through other curses headers the build host may have under /usr/include, also force every header check in Python's configure.ac AC_CHECK_HEADERS(curses.h ncurses.h ncursesw/ncurses.h ncursesw/curses.h ncursesw/panel.h panel.h) line to "no" via cached ac_cv_header_* variables. The narrow ncursesw_* trio was enough on the original reporter's host; Jan Kardell's review of the first cut hit a build where `/usr/include/curses.h` and `/usr/include/ncurses.h` from the distro's libncurses-dev were still being picked up. Adding the non-wide entries (and panel.h for symmetry, in case a host also ships /usr/include/panel.h alone) makes the override insensitive to whichever curses dev packages the host distro happens to provide. Reported-by: Jan Kardell Signed-off-by: Alexandru Ardelean

python3: bump to 3.14.5

2026-05-29T15:40:28Z

This is the latest 3.14.x point release with assorted bug fixes from upstream. PYTHON3_PIP_VERSION is bumped from 26.0.1 to 26.1.1 to match the pip wheel bundled in the 3.14.5 source tarball; the host build's ensurepip lookup of pip-$(PYTHON3_PIP_VERSION).whl otherwise fails. The set of OpenWrt-side patches still applies against the new source; only quilt context-line offsets needed refreshing for the patches that touch Makefile.pre.in. Signed-off-by: Alexandru Ardelean

python3: bump to version 3.14.4

2026-04-16T18:48:56Z

Also add no-mips16 to PKG_BUILD_FLAGS. Should fix mipsel_24kc_24kf builds. Signed-off-by: Alexandru Ardelean

python3: merge python3-email into python3-urllib

2026-04-04T15:27:26Z

As we're seeing in various test.sh scrip runs, importing 'email' fails with not finding 'urllib' and vice-versa. Then via a7e96ec91 ("python3-email: add python3-urllib as dependency") I created a circular dependency. So, might as well merge the two packages into one (named python3-urllib) and updates all dependencies to pull python3-urllib. Signed-off-by: Alexandru Ardelean

python3-email: add python3-urllib as dependency

2026-04-01T07:29:21Z

In recent versions of Python, trying to include 'email' also pulls in urllib from CPython. So just add it as dependency. Signed-off-by: Alexandru Ardelean