{"action":"created","issue":{"url":"https://api.github.com/repos/openwrt/packages/issues/2142","repository_url":"https://api.github.com/repos/openwrt/packages","labels_url":"https://api.github.com/repos/openwrt/packages/issues/2142/labels{/name}","comments_url":"https://api.github.com/repos/openwrt/packages/issues/2142/comments","events_url":"https://api.github.com/repos/openwrt/packages/issues/2142/events","html_url":"https://github.com/openwrt/packages/pull/2142","id":122970864,"number":2142,"title":"seafile: Depends on EOL and CVE-ridden Django 1.5, therefore remove","user":{"login":"dfc-d","id":5790165,"avatar_url":"https://avatars.githubusercontent.com/u/5790165?v=3","gravatar_id":"","url":"https://api.github.com/users/dfc-d","html_url":"https://github.com/dfc-d","followers_url":"https://api.github.com/users/dfc-d/followers","following_url":"https://api.github.com/users/dfc-d/following{/other_user}","gists_url":"https://api.github.com/users/dfc-d/gists{/gist_id}","starred_url":"https://api.github.com/users/dfc-d/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dfc-d/subscriptions","organizations_url":"https://api.github.com/users/dfc-d/orgs","repos_url":"https://api.github.com/users/dfc-d/repos","events_url":"https://api.github.com/users/dfc-d/events{/privacy}","received_events_url":"https://api.github.com/users/dfc-d/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-12-18T15:42:28Z","updated_at":"2016-04-18T15:39:42Z","closed_at":"2016-03-13T01:43:47Z","pull_request":{"url":"https://api.github.com/repos/openwrt/packages/pulls/2142","html_url":"https://github.com/openwrt/packages/pull/2142","diff_url":"https://github.com/openwrt/packages/pull/2142.diff","patch_url":"https://github.com/openwrt/packages/pull/2142.patch"},"body":"Django 1.5 is EOL and has a number of CVE's.  PIL also has a major CVE.\r\nseafile-seahub (without which there is not point to the other seafile packages)\r\ndepends on Django 1.5, and, through Djblets 0.6 (old djblets is required because\r\nof old Django) depends on PIL.\r\n\r\nTherefore until seafile gets updated to newer Django, remove seafile from packages feed.\r\n\r\nWe also remove deprecated libevhtp-1.1 for which seafile is the only consumer, as\r\nwell as libsearpc which is seafile-specific library.\r\n\r\nSigned-off-by: Daniel Dickinson <openwrt@daniel.thecshore.com>"},"comment":{"url":"https://api.github.com/repos/openwrt/packages/issues/comments/211436857","html_url":"https://github.com/openwrt/packages/pull/2142#issuecomment-211436857","issue_url":"https://api.github.com/repos/openwrt/packages/issues/2142","id":211436857,"user":{"login":"kissg1988","id":5032340,"avatar_url":"https://avatars.githubusercontent.com/u/5032340?v=3","gravatar_id":"","url":"https://api.github.com/users/kissg1988","html_url":"https://github.com/kissg1988","followers_url":"https://api.github.com/users/kissg1988/followers","following_url":"https://api.github.com/users/kissg1988/following{/other_user}","gists_url":"https://api.github.com/users/kissg1988/gists{/gist_id}","starred_url":"https://api.github.com/users/kissg1988/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kissg1988/subscriptions","organizations_url":"https://api.github.com/users/kissg1988/orgs","repos_url":"https://api.github.com/users/kissg1988/repos","events_url":"https://api.github.com/users/kissg1988/events{/privacy}","received_events_url":"https://api.github.com/users/kissg1988/received_events","type":"User","site_admin":false},"created_at":"2016-04-18T15:39:41Z","updated_at":"2016-04-18T15:39:41Z","body":"@dfc-d As the maintainer of seafile packages, I'm really grateful for your comments while I feel pretty disappointed about seeing several days (weeks?) of my hard work thrown away without noticing me or simply asking about my plans to upgrade the packages to the latest upstream version. I know I've been inactive for quite some time but I have my reasons. Sorry about it.\r\n\r\nI'd like to have a few comments, please:\r\n\r\n* The latest version of Seafile server (5.1.1) has been [released](https://github.com/haiwen/ccnet/releases/tag/v5.1.1-server) 21 days ago and the 5.x branch is still under active development. While the 4.x branch is not very active these days, the project itself is not dead. I don't see any reason to drop these packages as many people might need them and would be glad to see them upgraded one day... :)\r\n* The 5.x branch uses django 1.8 LTS which is supported until April 2018 (at least)\r\n* PIL and djblets is not required for the 5.x branch of Seafile\r\n* Not sure what native code you mean but I'll take extra care about that while packaging the latest version\r\n* I've never been a \"hardcore packager\" nor a professional software developer and packaging seafile (and its dependencies) was my first contribution to the openwrt project. Sorry if my work looked squirrely, I'll do my best to create more professional package definitions in the future.\r\n* The reason I used easy_install to fetch python dependencies was to meet version requirements without affecting packages globally installed. While this is not very elegant, I didn't want to use the latest versions of the dependencies and see how well they perform. I hate bugs and unexpected behaviour more than anyone else. :)\r\n* libevhtp 1.1 is a requirement for Seafile. While the latest version works, too, it used to have [compatibility issues](https://github.com/openwrt/packages/pull/1368) with the 4.1 branch of seafile. I'm going to make some tests to see how the 5.x branch performs with the latest version of libevhtp.\r\n\r\nA few months ago I tried upgrading the packages to the latest version but I got stuck as quite a few things have changed between the 4.x and the 5.x branch. My plan is to create brand new package definitions for the 5.x branch in case there is interest to accommodate my work. Is there?"}}