packages/lang, branch master

rust: build soft-float on soft-float PowerPC subtargets

2026-08-16T06:15:03Z

RUSTC_TARGET_ARCH comes from the GNU triple, so every 32-bit PowerPC subtarget gets powerpc-unknown-linux-musl. That triple is hard-float and mpc85xx is not: its e500v2 has no floating-point unit, and the toolchain reports _SOFT_FLOAT and calls __divdf3 for a division. So rustc emits lfd, stfd and fdiv for a core with no floating-point registers, and passes doubles in a way nothing else in the image does. It does not fail outright — a speed test reported negative throughput, and formatting one of those values tripped an assertion inside core. Pass -Ctarget-feature=-hard-float where CONFIG_SOFT_FLOAT says so. The same flag has to reach the std that rust/host builds, or std and the packages linked against it disagree about how a double is passed. Signed-off-by: Josef Schlehofer

rust: fix compare_exchange_weak never succeeding on mpc85xx

2026-08-16T06:13:23Z

LLVM places the release fence of a cmpxchg between the load-linked and the store-conditional. On e500v2 that clears the reservation, so the store-conditional always fails. The strong form retries and re-reserves; the weak form has no retry and can never succeed. fetch_update in core is a weak retry loop, so it spins forever and anything using it hangs. A tokio reactor livelocks on its first I/O event, burning CPU without issuing a syscall, which makes async Rust unusable on the subtarget. Carry the fix as a patch until it reaches a rustc release. It adds a TargetLowering hook, defaulting to false, so only PowerPC changes. Signed-off-by: Josef Schlehofer

luajit2: update to 2026-07-31

2026-08-15T10:26:13Z

Also refresh 020-riscv64-support.patch from the current state of openresty/luajit2#236. The previous snapshot defined asm_tail_prep(ASMState *as), but since openresty/luajit2 commit 68354f44 the callers pass a second TraceNo argument, so the riscv64 build failed with: lj_asm.c:2559:5: error: too many arguments to function 'asm_tail_prep' The refreshed patch carries the upstream adaptation and restores the build. The other four patches apply unchanged. Signed-off-by: Josef Schlehofer

luajit2: fix build and runtime on powerpc

2026-08-15T09:29:16Z

luajit2 currently fails to link for powerpc: lj_vm.o emits PLT calls that force BSS-PLT, which the inline-PLT relocations emitted by GCC 12 and newer do not support. Add the same GOT-based fix that lang/lua/luajit has carried as 060-ppc-musl.patch since 2019. With that in place the package builds, but ipairs() and pairs() turn out to be broken on 32-bit big-endian soft-float targets. Both are regressions in luajit2's PPC64 patch and do not affect upstream LuaJIT. To be submitted to openresty/luajit2 as well. Signed-off-by: Josef Schlehofer

golang: bump 1.26 to 1.26.6

2026-08-14T12:36:45Z

Fixes: CVE-2026-33818 Fixes: CVE-2026-39821 Fixes: CVE-2026-46600 Fixes: CVE-2026-56853 Fixes: CVE-2026-56858 Fixes: CVE-2026-56859 Fixes: CVE-2026-56860 Fixes: CVE-2026-56862 Fixes: CVE-2026-56864 Fixes: CVE-2026-56865 Changes: https://github.com/golang/go/issues?q=milestone%3AGo1.26.6+label%3ACherryPickApproved Signed-off-by: George Sapkin

python-typing-extensions: bump to 4.16.0

2026-08-11T11:39:47Z

Refresh sha256 from PyPI sdist. Signed-off-by: Alexandru Ardelean

python-pyasn1: bump to 0.6.4

2026-08-11T11:39:47Z

Refresh sha256 from PyPI sdist. Signed-off-by: Alexandru Ardelean

python-greenlet: bump to 3.5.4

2026-08-11T10:45:28Z

Refresh sha256 from PyPI sdist. Signed-off-by: Alexandru Ardelean

python-cython: bump to 3.2.9

2026-08-11T10:45:28Z

Refresh sha256 from PyPI sdist. Signed-off-by: Alexandru Ardelean

python-cffi: bump to 2.1.1

2026-08-11T10:45:28Z

Refresh sha256 from PyPI sdist. Drop the macOS cross-compile patch; 2.1.1 already carries the sysconfig.get_platform() fix upstream. Add test-version.sh: 2.1.1 ships the cffi-gen-src console tool, a subcommand CLI with no version flag, so the generic per-executable version probe fails the package ("No executables in the package provided version"). test-version.sh skips that probe, and test.sh now asserts cffi.__version__ against the packaged version. Signed-off-by: Alexandru Ardelean