3 files changed, 48 insertions, 5 deletions

diff --git a/meta-python/recipes-devtools/python/python3-aiohttp_3.13.4.bb b/meta-python/recipes-devtools/python/python3-aiohttp_3.13.5.bb
index 7416b87347..f3a0fbf557 100644
--- a/meta-python/recipes-devtools/python/python3-aiohttp_3.13.4.bb
+++ b/meta-python/recipes-devtools/python/python3-aiohttp_3.13.5.bb
@@ -4,9 +4,14 @@ HOMEPAGE = "https://github.com/aio-libs/aiohttp"
 LICENSE = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=748073912af33aa59430d3702aa32d41"
 
-SRC_URI[sha256sum] = "d97a6d09c66087890c2ab5d49069e1e570583f7ac0314ecf98294c1b6aaebd38"
+SRC_URI[sha256sum] = "9d98cc980ecc96be6eb4c1994ce35d28d8b1f5e5208a23b421187d1209dbb7d1"
 
 CVE_PRODUCT = "aiohttp"
+CVE_STATUS_GROUPS = "CVE_AIOHTTP_FIX_3_13_4"
+CVE_AIOHTTP_FIX_3_13_4[status] = "fixed-version: fixed in 3.13.4"
+CVE_AIOHTTP_FIX_3_13_4 = "CVE-2026-22815 CVE-2026-34513 CVE-2026-34514 \
+CVE-2026-34515 CVE-2026-34516 CVE-2026-34517 CVE-2026-34518 CVE-2026-34519 \
+CVE-2026-34520 CVE-2026-34525"
 
 inherit python_setuptools_build_meta pypi 
 
diff --git a/meta-python/recipes-devtools/python/python3-stopit/0001-Drop-the-deprecated-pkg_resources.patch b/meta-python/recipes-devtools/python/python3-stopit/0001-Drop-the-deprecated-pkg_resources.patch
new file mode 100644
index 0000000000..4252386384
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-stopit/0001-Drop-the-deprecated-pkg_resources.patch
@@ -0,0 +1,38 @@
+From b72825c89724c2c3b4c9c60d90c9d4ad597eead0 Mon Sep 17 00:00:00 2001
+From: "Bai, Haiqing" <Haiqing.Bai@windriver.com>
+Date: Thu, 2 Apr 2026 08:40:26 +0000
+Subject: [PATCH] Drop the deprecated pkg_resources
+
+pkg_resources is deprecated as an API. The pkg_resources package
+is slated for removal, so the way of obtaining the version needs
+to be updated.
+
+Upstream-Status: Inactive-Upstream [lastcommit: Jan/2024 lastrelease: Feb/2018]
+
+Signed-off-by: Bai, Haiqing <Haiqing.Bai@windriver.com>
+---
+ src/stopit/__init__.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/stopit/__init__.py b/src/stopit/__init__.py
+index 6ca0180..5ddfa4a 100644
+--- a/src/stopit/__init__.py
++++ b/src/stopit/__init__.py
+@@ -7,7 +7,7 @@ stopit
+ Public resources from ``stopit``
+ """
+ 
+-import pkg_resources
++from importlib.metadata import version
+ 
+ from .utils import LOG, TimeoutException
+ from .threadstop import ThreadingTimeout, async_raise, threading_timeoutable
+@@ -15,7 +15,7 @@ from .signalstop import SignalTimeout, signal_timeoutable
+ 
+ # PEP 396 style version marker
+ try:
+-    __version__ = pkg_resources.get_distribution(__name__).version
++    __version__ = version(__name__)
+ except:
+     LOG.warning("Could not get the package version from pkg_resources")
+     __version__ = 'unknown'
diff --git a/meta-python/recipes-devtools/python/python3-stopit_1.1.2.bb b/meta-python/recipes-devtools/python/python3-stopit_1.1.2.bb
index a952722619..2cf7742a90 100644
--- a/meta-python/recipes-devtools/python/python3-stopit_1.1.2.bb
+++ b/meta-python/recipes-devtools/python/python3-stopit_1.1.2.bb
@@ -2,7 +2,6 @@ SUMMARY = "Raise asynchronous exceptions in other threads, control the timeout o
 HOMEPAGE = "https://pypi.org/project/stopit/"
 SECTION = "devel/python"
 
-SRC_URI += " file://LICENSE "
 LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://${UNPACKDIR}/LICENSE;md5=497c556f42b1355b64190da2f3d88f93"
 
@@ -10,8 +9,9 @@ SRC_URI[sha256sum] = "f7f39c583fd92027bd9d06127b259aee7a5b7945c1f1fa56263811e1e7
 
 inherit pypi setuptools3
 
-RDEPENDS:${PN} += "\
-    python3-setuptools \
-    "
+SRC_URI += "\
+    file://LICENSE \
+    file://0001-Drop-the-deprecated-pkg_resources.patch \
+"
 
 BBCLASSEXTEND = "native nativesdk"