Mirror of packages feed https://git.openwrt.org/feed/packages/atom?h=master 2026-07-31T06:46:08Z 2026-07-31T06:46:08Z Alexandru Ardelean 2026-05-26T11:15:12Z urn:sha1:1f5fdd78eca67ca26081d72f66fbc2fe3b60dd64 0.12.x is EOL upstream and accumulating CVEs. Bump to the current stable 13.0.6, which carries the fix from security advisory 2026-04-29 / prosody.im/security/advisory_735dd9d3 that first shipped in 13.0.5. Prosody 13 requires Lua >= 5.2 (configure rejects 5.1). Switch the build and runtime to Lua 5.4 and depend on the new luafilesystem5.4 / luaexpat5.4 / luasec5.4 / luasocket5.4 variants. Drop the now-unused luabitop dependency: bit operations are built in since Lua 5.3. Other notes: - configure now needs an explicit --lua-version=5.4 and --runwith=lua5.4 because the wrapper script defaults to '/usr/bin/lua' (5.1 on OpenWrt). - Install the new mod_debug_stanzas plugin directory. The commented-out fallbacks/*.lua install is dropped rather than revived: upstream's 'make install' never copies that directory, and fallbacks/lxp.lua is Lua 5.1 code using module(), which does not even load on 5.4. - util-src/hashes.c now calls EVP_blake2{s256,b512}(), which libopenssl does not provide unless OPENSSL_WITH_BLAKE2 is set, so compile those two hashes out when libcrypto lacks them. Selecting the symbol instead is not enough: the resulting util/hashes.so still fails to relocate against a stock libcrypto, and prosody aborts at startup. Only the COMPAT util.hmac table references them, and it tolerates nil entries. - Install loader.lua. 13.x moved every internal require() to the 'prosody.*' namespace, and loader.lua is what maps those names back onto the installed layout. It is the first file prosodyctl looks for, so both prosody and prosodyctl abort at startup without it. Refs: https://github.com/openwrt/packages/issues/29252 Release notes: https://blog.prosody.im/prosody-13.0.6-released/ Security: https://prosody.im/security/advisory_735dd9d3/ Signed-off-by: Alexandru Ardelean <alex@shruggie.ro> 2016-01-25T12:29:55Z heil 2016-01-25T12:29:55Z urn:sha1:39bc4992a1faf70afb406bac57b841e72e113ce3 fixes: * path traversal vulnerability in mod_http_files (CVE-2016-1231) * use of weak PRNG in generation of dialback secrets (CVE-2016-1232) Signed-off-by: heil <heil@terminal-consulting.de> 2015-01-02T19:22:54Z W. Michael Petullo 2015-01-02T19:22:54Z urn:sha1:9bcbcdfbc13f14fb843c64fa62143980fd4e238a Signed-off-by: W. Michael Petullo <mike@flyn.org>