linux/meta-openembedded.git/meta-python, branch kirkstone

python3-soupsieve: fix tests with Python 3.10.20

2026-05-04T13:59:37+00:00

The latest Python upgrade in oe-core has broken some ptests. This backported patch fixes them, they should work with both the latest and previous versions. Signed-off-by: Gyorgy Sarvari

python3-cbor2: more patch indent and test fixes

2026-04-13T15:30:24+00:00

Similar to a previous patch, the CVE-2025-68131 patch contained some more indentation errors, in the tests. Also, the backported tests were inserted between an existing test and its parameters - a new patch corrects that. Signed-off-by: Gyorgy Sarvari

python3-cbor2: return correct error code from run-ptest

2026-04-13T14:46:40+00:00

In case the test fails to even start executing, and there is no output on stdout, there are no logs stored of the test run, so the test log parser will not report a failure. Also, since the run-ptest command is a piped script, by default the last command's return code is set as the exit code, which is always 0. To report the result correctly return the test executions's return code as the exit code (instead of the last command in the pipe), and redirect the error output to standard out, to create a logfile that can be parsed after the execution. Signed-off-by: Gyorgy Sarvari

python3-cbor2: Fix CVE-2025-68131 CVE patch error

2026-04-13T14:30:11+00:00

The patch for CVE-2025-68131 does not actually match https://github.com/agronholm/cbor2/commit/f1d701cd2c411ee40bb1fe383afe7f365f35abf0 Specifically, the indenting in decode_from_bytes This is causing an error in trusted-firmware-m of | Traceback (most recent call last): | File "/builder/meta-arm/build/tmp/work/corstone1000_fvp-poky-linux-musl/trusted-firmware-m/1.5.0+gitAUTOINC+f8c7e5361b-r0/git/tfm/bl2/ext/mcuboot/scripts/wrapper/wrapper.py", line 21, in | import imgtool.main | File "/builder/meta-arm/build/tmp/work/corstone1000_fvp-poky-linux-musl/trusted-firmware-m/1.5.0+gitAUTOINC+f8c7e5361b-r0/git/mcuboot/scripts/imgtool/main.py", line 25, in | from imgtool import image, imgtool_version | File "/builder/meta-arm/build/tmp/work/corstone1000_fvp-poky-linux-musl/trusted-firmware-m/1.5.0+gitAUTOINC+f8c7e5361b-r0/git/mcuboot/scripts/imgtool/image.py", line 24, in | from .boot_record import create_sw_component_data | File "/builder/meta-arm/build/tmp/work/corstone1000_fvp-poky-linux-musl/trusted-firmware-m/1.5.0+gitAUTOINC+f8c7e5361b-r0/git/mcuboot/scripts/imgtool/boot_record.py", line 21, in | from cbor2 import dumps | File "/builder/meta-arm/build/tmp/work/corstone1000_fvp-poky-linux-musl/trusted-firmware-m/1.5.0+gitAUTOINC+f8c7e5361b-r0/recipe-sysroot-native/usr/lib/python3.10/site-packages/cbor2/__init__.py", line 1, in | from .decoder import load, loads, CBORDecoder # noqa | File "/builder/meta-arm/build/tmp/work/corstone1000_fvp-poky-linux-musl/trusted-firmware-m/1.5.0+gitAUTOINC+f8c7e5361b-r0/recipe-sysroot-native/usr/lib/python3.10/site-packages/cbor2/decoder.py", line 215 | with BytesIO(buf) as fp: | ^ | IndentationError: expected an indented block after 'with' statement on line 214 Indenting to match the original patch fixes this. Also, because this version of cbor2 is older, it doesn't include commit 53e21063ed1d72ac8f911044dd598a7f9ef72406, which adds 'Any' to encode.py Because that is missing, we see the following error: | File "/builder/meta-arm/build/tmp/work/corstone1000_fvp-poky-linux-musl/trusted-firmware-m/1.5.0+gitAUTOINC+f8c7e5361b-r0/recipe-sysroot-native/usr/lib/python3.10/site-packages/cbor2/__init__.py", line 2, in | from .encoder import dump, dumps, CBOREncoder, shareable_encoder # noqa | File "/builder/meta-arm/build/tmp/work/corstone1000_fvp-poky-linux-musl/trusted-firmware-m/1.5.0+gitAUTOINC+f8c7e5361b-r0/recipe-sysroot-native/usr/lib/python3.10/site-packages/cbor2/encoder.py", line 68, in | class CBOREncoder: | File "/builder/meta-arm/build/tmp/work/corstone1000_fvp-poky-linux-musl/trusted-firmware-m/1.5.0+gitAUTOINC+f8c7e5361b-r0/recipe-sysroot-native/usr/lib/python3.10/site-packages/cbor2/encoder.py", line 266, in CBOREncoder | def _encode_value(self, obj: Any) -> None: To get around this issue, remove the "Any" from the encoder.py. The logic behind this (instead of importing typing) is that this is the only instance, and since this is not something that will be updated frequently with patches from upstream. Signed-off-by: Jon Mason Signed-off-by: Gyorgy Sarvari

python3-protobuf: ignore CVE-2024-7254

2026-04-03T10:40:37+00:00

CVE-2024-7254 is a stack overflow vulnerability caused by unbounded recursion, specifically within the Java Protobuf Lite and Full runtimes (including Kotlin and JRuby bindings). The python3-protobuf recipe builds the Python implementation using the C++ backend (--cpp_implementation). This implementation does not contain the vulnerable Java-specific parsing logic (such as DiscardUnknownFieldsParser or ArrayDecoders). Authoritative security sources, including Red Hat and GitHub Advisory have confirmed that non-Java implementations (Python/C++) are not affected by this specific flaw. Reference: https://access.redhat.com/security/cve/cve-2024-7254 Signed-off-by: Naman Jain Signed-off-by: Gyorgy Sarvari

python3-werkzeug: ignore CVE-2026-27199

2026-02-27T13:28:50+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-27199 The vulnerability affects only the application on Windows operating system. Due to this, ignore this CVE. Signed-off-by: Gyorgy Sarvari

python3-cbor2: patch CVE-2025-68131

2026-02-27T13:28:43+00:00

Backport the patch[1] which fixes this vulnerability as mentioned in the comment[2]. Details: https://nvd.nist.gov/vuln/detail/CVE-2025-68131 [1] https://github.com/agronholm/cbor2/commit/f1d701cd2c411ee40bb1fe383afe7f365f35abf0 [2] https://github.com/agronholm/cbor2/pull/268#issuecomment-3719179000 Dropped changes to the changelog from the original commit. Signed-off-by: Hitendra Prajapati Signed-off-by: Gyorgy Sarvari

python3-django: upgrade 4.2.27 -> 4.2.28

2026-02-15T14:30:54+00:00

Contains fixes for CVE-2025-13473, CVE-2025-14550, CVE-2026-1207, CVE-2026-1285, CVE-2026-1287 and CVE-2026-1312 Signed-off-by: Gyorgy Sarvari

python3-protobuf: patch CVE-2026-0994

2026-02-03T18:53:58+00:00

Pick patch from PR in NVD report. It is the only code change in 33.5 release. Skip the test file change as it's not shipped in python module sources. Resolve formatting-only conflict. Signed-off-by: Peter Marko Signed-off-by: Gyorgy Sarvari

python3-pymongo: upgrade 4.1.0 -> 4.1.1

2026-01-30T17:59:29+00:00

Release notes: https://www.mongodb.com/community/forums/t/pymongo-4-1-1-released/157895 Signed-off-by: Zheng Ruoqin Signed-off-by: Khem Raj (cherry picked from commit 5bfe98cb4074baa6b9a81e9a205eacf0d898db41) Signed-off-by: Gyorgy Sarvari