linux/meta-openembedded.git/meta-python/recipes-devtools, branch kraj/dunfell

python3-django: upgrade 2.2.23 -> 2.2.24

2021-07-05T22:25:06+00:00

Version 2.2.24 contains a fix for CVE-2021-33571 and is the latest LTS release. Signed-off-by: Trevor Gamblin Signed-off-by: Khem Raj (cherry picked from commit fa2d3338fb87a38a66d11735b876ce2320045b0d) Signed-off-by: Armin Kuster (cherry picked from commit c51e79dd854460c6f6949a187970d05362152e84) Signed-off-by: Armin Kuster

python3-django: upgrade 2.2.22 -> 2.2.23

2021-07-05T21:54:58+00:00

2.2.23 is a bugfix release: - Fixed a regression in Django 2.2.21 where saving FileField would raise a SuspiciousFileOperation even when a custom upload_to returns a valid file path (#32718). Signed-off-by: Trevor Gamblin Signed-off-by: Khem Raj Signed-off-by: Trevor Gamblin (cherry picked from commit f07a8c1376fe9f5eb4fc0ddff8ca1a1b3c3f173b) Signed-off-by: Armin Kuster (cherry picked from commit b2716ef06a76854497de80c642bf7f63b07f7a6c) Signed-off-by: Armin Kuster

python3-django: upgrade 2.2.20 -> 2.2.22

2021-07-05T21:54:49+00:00

Version 2.2.22 includes a fix for CVE-2021-32052. Signed-off-by: Trevor Gamblin Signed-off-by: Khem Raj Signed-off-by: Trevor Gamblin (cherry picked from commit b26099fc156961ba252c3b6281f09799e91347ba) Signed-off-by: Armin Kuster (cherry picked from commit f3758cb44486ce87c96b803efb2b5417a8e90708) Signed-off-by: Armin Kuster

python3-django: upgrade to 2.2.20

2021-07-05T21:54:40+00:00

2.2.x is LTS, so upgrade to latest release 2.2.20. This upgrade fixes several CVEs such as CVE-2021-3281. Also, CVE-2021-28658.patch is dropped as it's already in 2.2.20. Signed-off-by: Chen Qi Signed-off-by: Khem Raj Signed-off-by: Trevor Gamblin Signed-off-by: Armin Kuster (cherry picked from commit e705d4932a57d0dc3a961fed73ae5ad2e0313429) Signed-off-by: Armin Kuster

python3-django: fix CVE-2021-28658

2021-07-05T21:54:38+00:00

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability. References: https://nvd.nist.gov/vuln/detail/CVE-2021-28658 Upstream patches: https://github.com/django/django/commit/4036d62bda0e9e9f6172943794b744a454ca49c2 Signed-off-by: Stefan Ghinea Signed-off-by: Khem Raj Signed-off-by: Trevor Gamblin Signed-off-by: Armin Kuster (cherry picked from commit aef354a0c29a4c6aad4ace53190b5573c78d881b) Signed-off-by: Armin Kuster

python3-django: upgrade 2.2.13 -> 2.2.16

2021-07-05T21:53:48+00:00

Summary of release notes from https://docs.djangoproject.com/en/2.2/releases/ 2.2.14 release notes: - Fixed messages of InvalidCacheKey exceptions and CacheKeyWarning warnings raised by cache key validation (#31654). 2.2.15 release notes: - Allowed setting the SameSite cookie flag in HttpResponse.delete_cookie() (#31790). - Fixed crash when sending emails to addresses with display names longer than 75 chars on Python 3.6.11+, 3.7.8+, and 3.8.4+ (#31784). 2.2.16 release notes: - Fixed CVE-2020-24583: Incorrect permissions on intermediate-level directories on Python 3.7+ - Fixed CVE-2020-24584: Permission escalation in intermediate-level directories of the file system cache on Python 3.7+ - Fixed a data loss possibility in the select_for_update(). When using related fields pointing to a proxy model in the of argument, the corresponding model was not locked (#31866). - Fixed a data loss possibility, following a regression in Django 2.0, when copying model instances with a cached fields value (#31863). Signed-off-by: Trevor Gamblin Signed-off-by: Khem Raj (cherry picked from commit eb69aad33fc06f06544589ec483f9b76464f6c5f) Signed-off-by: Armin Kuster

python3-django: upgrade 2.2.7 -> 2.2.13

2021-07-05T21:53:33+00:00

Upgrade from 2.2.7 for: - Bugfixes, including CVE-2020-13254, CVE-2020-13596, many others; - Official support for Python 3.8 (as of Django 2.2.8) Signed-off-by: Trevor Gamblin Signed-off-by: Khem Raj (cherry picked from commit 8c4e201c6288e5fee7eef8f6eba576d4c426109c) Signed-off-by: Armin Kuster

python3-pykwalify: Do not unset _PYTHON_SYSCONFIGDATA_NAME

2021-02-19T15:17:12+00:00

its been shoved out of setuptools3 in oe-core now Signed-off-by: Khem Raj Acked-by: Trevor Gamblin (cherry picked from commit 50bbf80abf570d1d652ec2f4bc5878e939c688d3) Signed-off-by: Armin Kuster (cherry picked from commit fbe2e79ab0dd4e0b2fd6433d0cfe10d66c7c7181) Signed-off-by: Armin Kuster

python3-aiohttp: added missing RDEPENDs

2021-02-16T15:38:15+00:00

aiohttp implicitly RDEPENDs on html, json, and socketserver modules, which are part of python3 recipe. They can't be properly imported if they are missing from RDEPENDS Signed-off-by: Vyacheslav Yurkov Acked-by: Trevor Gamblin Signed-off-by: Khem Raj (cherry-picked from commit 8e7c57bd8f8250251e54fcbe149dc81743c0e30a) Signed-off-by: Enrico Jorns Acked-by: Trevor Gamblin Signed-off-by: Armin Kuster

python-grpcio-tools: Add missing space for append

2021-02-15T16:43:04+00:00

Signed-off-by: Khem Raj Acked-by: Trevor Gamblin (cherry picked from commit 6b3e3bdaf878881bd6dee09ae369e379fd7b8149) Signed-off-by: Armin Kuster (cherry picked from commit c3a9e5b9907279043bb7b270e9c6b4e587881d9a) Signed-off-by: Armin Kuster