summaryrefslogtreecommitdiffstats
path: root/meta-python
Commit message (Collapse)AuthorAgeFilesLines
* python3-werkzeug: ignore CVE-2026-27199Gyorgy Sarvari2026-02-271-1/+1
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-27199 The vulnerability affects only the application on Windows operating system. Due to this, ignore this CVE. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-cbor2: patch CVE-2025-68131Hitendra Prajapati2026-02-272-0/+508
| | | | | | | | | | | | | | Backport the patch[1] which fixes this vulnerability as mentioned in the comment[2]. Details: https://nvd.nist.gov/vuln/detail/CVE-2025-68131 [1] https://github.com/agronholm/cbor2/commit/f1d701cd2c411ee40bb1fe383afe7f365f35abf0 [2] https://github.com/agronholm/cbor2/pull/268#issuecomment-3719179000 Dropped changes to the changelog from the original commit. Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: upgrade 4.2.27 -> 4.2.28Gyorgy Sarvari2026-02-152-1/+1
| | | | | | | Contains fixes for CVE-2025-13473, CVE-2025-14550, CVE-2026-1207, CVE-2026-1285, CVE-2026-1287 and CVE-2026-1312 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-protobuf: patch CVE-2026-0994Peter Marko2026-02-032-0/+48
| | | | | | | | | | Pick patch from PR in NVD report. It is the only code change in 33.5 release. Skip the test file change as it's not shipped in python module sources. Resolve formatting-only conflict. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-pymongo: upgrade 4.1.0 -> 4.1.1zhengruoqin2026-01-301-1/+1
| | | | | | | | | Release notes: https://www.mongodb.com/community/forums/t/pymongo-4-1-1-released/157895 Signed-off-by: Zheng Ruoqin <zhengrq.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 5bfe98cb4074baa6b9a81e9a205eacf0d898db41) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-pymongo: patch CVE-2024-5629Gyorgy Sarvari2026-01-302-0/+50
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-5629 Backport the patch that is indicated to solve the issue based on the upstream project's Jira ticket[1] (which comes from the NVD report). [1]: https://jira.mongodb.org/browse/PYTHON-4305 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-ecdsa: ignore CVE-2024-23342Gyorgy Sarvari2026-01-301-0/+3
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-23342 The issue won't be fixed, because it is not in the scope of the project. See also the discussion in the relevant Github issue[1]. [1]: https://github.com/tlsfuzzer/python-ecdsa/issues/330 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-twitter: mark CVE-2012-5825 patchedGyorgy Sarvari2026-01-301-0/+3
| | | | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2012-5825 The Debian bugtracker[1] indicated that the issue is tracked by upstream in github[2] (with a difference CVE ID, but same issue), where the vulnerability was confirmed. Later in the same github issue the solution is confirmed: the project switched to use the requests library, which doesn't suffer from this vulnerability. Due to this mark the CVE as patched. [1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692444 [2]: https://github.com/tweepy/tweepy/issues/279 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 3ee544e7591b36a49550a263a0ec4d64b5e490e8) Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-paramiko: upgrade 2.10.3 -> 2.10.6Gyorgy Sarvari2026-01-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bugfix releases. Changelog: 2.10.4: - Servers offering certificate variants of hostkey algorithms (eg ssh-rsa-cert-v01@openssh.com) could not have their host keys verified by Paramiko clients, as it only ever considered non-cert key types for that part of connection handshaking. This has been fixed. - PKey instances’ __eq__ did not have the usual safety guard in place to ensure they were being compared to another PKey object, causing occasional spurious BadHostKeyException (among other things). This has been fixed. - Update camelCase method calls against the threading module to be snake_case; this and related tweaks should fix some deprecation warnings under Python 3.10. 2.10.5: - Windows-native SSH agent support as merged in 2.10 could encounter Errno 22 OSError exceptions in some scenarios (eg server not cleanly closing a relevant named pipe). This has been worked around and should be less problematic. - OpenSSH 7.7 and older has a bug preventing it from understanding how to perform SHA2 signature verification for RSA certificates (specifically certs - not keys), so when we added SHA2 support it broke all clients using RSA certificates with these servers. This has been fixed in a manner similar to what OpenSSH’s own client does: a version check is performed and the algorithm used is downgraded if needed. - Align signature verification algorithm with OpenSSH re: zero-padding signatures which don’t match their nominal size/length. This shouldn’t affect most users, but will help Paramiko-implemented SSH servers handle poorly behaved clients such as PuTTY. 2.10.6: - Raise SSHException explicitly when blank private key data is loaded, instead of the natural result of IndexError. This should help more bits of Paramiko or Paramiko-adjacent codebases to correctly handle this class of error. - Update SSHClient so it explicitly closes its wrapped socket object upon encountering socket errors at connection time. This should help somewhat with certain classes of memory leaks, resource warnings, and/or errors (though we hasten to remind everyone that Client and Transport have their own .close() methods for use in non-error situations!). https://www.paramiko.org/changelog.html Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-blivet: upgrade 3.4.3 -> 3.4.4Gyorgy Sarvari2026-01-301-1/+1
| | | | | | | | | | | | | | | Bugfix release. Changelog: - Use LVM PV format current_size in LVMVolumeGroupDevice._remove - Correctly set vg_name after adding/removing a PV from a VG - Do not crash when changing disklabel on disks with active devices - ActionDestroyDevice should not obsolete ActionRemoveMember - Correctly set compression and deduplication for existing VDO pools - Correctly cancel configure actions in cancel() - Set partition flags after setting parted filesystem Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-croniter: upgrade 1.3.5 -> 1.3.7wangmy2026-01-301-1/+1
| | | | | | | | | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 546ccc4a5bf3f6f7f7703e73651d4a7c9e2ade3b) Changelog: - fix tests - Fix croniter_range infinite loop Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-croniter: upgrade 1.3.4 -> 1.3.5Xu Huan2026-01-301-1/+1
| | | | | | | | | | | Signed-off-by: Xu Huan <xuhuan.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 94f564fc96e8754d11fe9932dd4c44076592ed1c) Changelog: Add Python 3.10 support. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-smpplib: upgrade 2.2.2 -> 2.2.3Wang Mingyu2026-01-301-1/+1
| | | | | | | | | | Changelog: Fix: correct UCS2 part length following #184 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d4cb5d585ddf970e575dc71a9175a541c3c02269) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-smpplib: upgrade 2.2.1 -> 2.2.2Wang Mingyu2026-01-301-1/+1
| | | | | | | | | | | | | | | Changelog: ========== Added python 3.10 tests to CircleCI fix socket recv error being silently ignored Refactored Client.read_pdu() Refactored Client.send_pdu() increment sequence of commands as spec (fixes #214) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 50bbe6ab5f49cc525fb85a985dd5981e1c86815e) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-werkzeug: upgrade 2.1.1 -> 2.1.2Xu Huan2026-01-303-7/+6
| | | | | | | | | | | | | | | | Changelog: ========== The development server does not set Transfer-Encoding: chunked for 1xx, 204, 304, and HEAD responses. Response HTML for exceptions and redirects starts with <!doctype html> and <html lang=en>. Fix ability to set some cache_control attributes to False. Disable keep-alive connections in the development server, which are not supported sufficiently by Python’s http.server. Signed-off-by: Xu Huan <xuhuan.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 0704ebad0d31eec1737e0313b0f221085a9e8166) Rebased patches in Kirkstone. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-bidict: upgrade 0.22.0 -> 0.22.1Wang Mingyu2026-01-301-1/+1
| | | | | | | | | | | | | Changelog: ========== -Only include the source code in the source distribution. This reduces the size of the source distribution from 200kB to 30kB. -Fix the return type hint of bidict.inverted() to return an Iterator, rather than an Iterable. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-twisted: patch CVE-2022-24801Gyorgy Sarvari2026-01-2010-3/+618
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-24801 Pick the commits from the pull request that is referenced by the NVD report. (The full set is consisting of 13 patches, but the ones that only updated news/readme/typo fixes in comments were not backported) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-werkzeug: ignore CVE-2026-21860Gyorgy Sarvari2026-01-201-1/+1
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-21860 The issue affects only Windows operating systems. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-eventlet: patch CVE-2025-58068Gyorgy Sarvari2026-01-202-0/+42
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-58068 Pick the patch mentioned in the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-eventlet: upgrade 0.33.0 -> 0.33.3Gyorgy Sarvari2026-01-201-1/+1
| | | | | | | | | | | | | | | | | | Bugfix releases. Changelog: 0.33.3: * dnspython 2.3.0 raised AttributeError: module 'dns.rdtypes' has no attribute 'ANY' https://github.com/eventlet/eventlet/issues/781 0.33.2: * greenio: GreenPipe/fdopen() with 'a' in mode raised io.UnsupportedOperation: File or stream is not writable https://github.com/eventlet/eventlet/pull/758 0.33.1: * Prevent deadlock on logging._lock https://github.com/eventlet/eventlet/issues/742 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: (4.2.27) add back setuptools3 supportGyorgy Sarvari2026-01-192-2/+182
| | | | | | | | | | | | | | | | | | | | | | | The upstream project has switched to build_meta build backend with version 4.2.21, and when the recipe was update to 4.2.26, the build backend was changed in the layer also. Even though the recipe compilation didn't fail, it didn't install the required files (it pretty much produced empty folders), because the build backend required a much newer setuptools version than the one provided by oe-core, it errored out silently. This problem may be hidden by other layers that ship a newer version of setuptools, like the kirkstone-rust branch in meta-lts-mixins layer. To be able to install the recipe (without adding extra layers), this patch partially reverts the build backend change from upstream, and adds back setuptools build support. Ptest summary after this patch: Ran 16377 tests in 353.124s OK (skipped=1287, expected failures=5) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: upgrade 4.2.26 -> 4.2.27Gyorgy Sarvari2026-01-171-2/+2
| | | | | | | | | | | | | Changelog: - Fix CVE-2025-13372 - Fix CVE-2025-64460 - Fixed a regression in Django 4.2.26 where DisallowedRedirect was raised by HttpResponseRedirect and HttpResponsePermanentRedirect for URLs longer than 2048 characters. The limit is now 16384 characters https://docs.djangoproject.com/en/6.0/releases/4.2.27/ Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2023-36053 patchGyorgy Sarvari2026-01-172-0/+44
| | | | | | | | | | | | | This change is for python3-django_2.2.28. The patch was accidentally backported incorrectly. The patch in general introduces a field-length restrictrion on the email input fields, however the patch was backported in a way that the restriction was applied on file input fields instead of email fields. This change amends the patch in a way to restrict the email field. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: (v3.2.25) fix testsGyorgy Sarvari2026-01-173-0/+71
| | | | | | | | | | | | | | | | | | | | These patches are for python3-django_3.2.25 These patches only touch the tests folder, which is normally not installed. Most of these changes are backported patches, that adapt tests to modern(er) Python environment than they were written for, and some other just fix a bug in the tests that were always present. 0001-Fix-tag_strip-tests.patch: The html parser's behavior in Python has changed, making this testcase fail. This is a partial backport of the patch, which handles only the Python version that is shipped with oe-core (The original patch handles both old and new versions) 0001-Fixed-test_utils.tests.HTMLEqualTests.test_parsing_e.patch: this backported patch makes a test-verification conform to html5 standard. Previously the test failed. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: (v3.2.25) fix ipv6 validationGyorgy Sarvari2026-01-172-0/+57
| | | | | | | | | | | | This patch is only for python3-django_3.2.25. The URL validator didn't detect invalid IPv6 addresses, treating them as correct ones, making a testcase fail. (Also, according to the comment, it could also crash in some cases, though I haven't encountered that) This backported patch mitigates this behavior. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: (v2.2.28) fix testsGyorgy Sarvari2026-01-176-0/+209
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These patches are for python3-django_2.2.28 These patches only touch the tests folder, which is normally not installed. Most of these changes are backported patches, that adapt tests to modern(er) Python environment than they were written for, and some other just fix a bug in the tests that were always present. 0001-Fix-tag_strip-tests.patch: The html parser's behavior in Python has changed since 3.9, making this testcase fail. This is a partial backport of the patch, which handles only the Python version that is shipped with oe-core (The original patch handles both old and new versions) 0001-Fixed-inspectdb.tests.InspectDBTestCase.test_custom_.patch: SQLite3's behavior has changed also since the tests were written, making some testcases fail. This backported patch fixes that. 0001-Fixed-test_utils.tests.HTMLEqualTests.test_parsing_e.patch: this backported patch makes a test-verification conform to html5 standard. Previously the test failed. 0001-Made-RemoteTestResultTest.test_pickle_errors_detecti.patch: This backported patch once again adapts a test to an evolved library. tblib's behavior has changed in a way that the tests couldn't pickle the exceptions from the library, and the tests that verify exceptions were failing due to this. 0001-fix-quote-type-in-expected-error-message.patch: This is not a backported patch. Error messages are localized, and a test verifies an error message that contains a quote. The test expects double quotes, but the default locale used with the testimage is using single quotes. Since the test and the expected error message are correct otherwise, just changed this expected quote in the test. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: (v2.2.28) fix ipv6 validationGyorgy Sarvari2026-01-162-0/+58
| | | | | | | | | | | | This patch is only for python3-django_2.2.28. The URL validator didn't detect invalid IPv6 addresses, treating them as correct ones, making a testcase fail. (Also, according to the comment, it could also crash in some cases, though I haven't encountered that) This backported patch mitigates this behavior. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix hostname length validation in URLvalidatorGyorgy Sarvari2026-01-152-0/+31
| | | | | | | | | | This patch is for python3-django_2.2.28 The hostname's length has been incorrectly validated, it was checking an incorrect section of the URL, this made a testcase fail. This backported patch mitigates this issue. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: handle non-existing import from CVE patchGyorgy Sarvari2026-01-152-1/+36
| | | | | | | | | | | | This change is for python3-django_2.2.28. During backporting a patch for CVE-2024-56374, an import got into the patch for v2.2.28 that does not exist yet in that version. This patch handles this import with a fallback to prevent throwing and ImportError. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: implement group method for FakeMatchGyorgy Sarvari2026-01-152-0/+43
| | | | | | | | | | | | | | This change is for python3-django_2.2.28. This patch is an extension for CVE-2024-27351.patch. The class that patch introduced wasn't completely suitable for this version of the recipe, because it was accessing a function of it that was not implemented (the upstream version that introduced this class did not use that function, it is specific to this old version). This patch adds the missing implementation to avoid errors. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix regression from CVE-2024-24680 patchGyorgy Sarvari2026-01-152-0/+31
| | | | | | | | | | | This change is for python3-django_2.2.28. The patch that mitigated CVE-2024-246680 accidentally also brought a regression, some numbers were converted to (human-friendly) string incorrectly. This backported patch mitigates this problem. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix intendation error in CVE patchGyorgy Sarvari2026-01-151-9/+9
| | | | | | | | | This change is for python3-django_2.2.28. This patch contains an incorrect intendation, making the tests fail. This change fixes that. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: Fix missing JSONField in django.db.modelsHaixiao Yan2026-01-152-0/+78
| | | | | | | | | | | | | | | | Fix the following error introduced by CVE-2024-42005.patch: AttributeError: module 'django.db.models' has no attribute 'JSONField' The patch assumes JSONField is available from django.db.models, which is not the case for this Django version. Revert the changes in the following files to restore compatibility: tests/expressions/models.py tests/expressions/test_queryset_values.py Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: Fix undefined _lazy_re_compileHaixiao Yan2026-01-152-0/+50
| | | | | | | | | | Fix the following error introduced by CVE-2024-27351.patch and CVE-2025-32873.patch: NameError: name '_lazy_re_compile' is not defined Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-tqdm: patch CVE-2024-34062Gyorgy Sarvari2026-01-082-0/+65
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-34062 Pick the patch mentioned by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-tornado: patch CVE-2024-52804Gyorgy Sarvari2026-01-082-1/+145
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-52804 Pick the patch mentioned by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-tornado: patch CVE-2023-28370Gyorgy Sarvari2026-01-082-0/+40
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-28370 The NVD advisory mentions that the vulnerability was fixed in v6.3.2. I checked the commits in that tag, and picked the only one that's commit message described the same vulnerability as the NVD report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-m2crypto: ignore CVE-2009-0127Gyorgy Sarvari2026-01-081-0/+3
| | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2009-0127 The vulnerability is disputed[1] by upstream: "There is no vulnerability in M2Crypto. Nowhere in the functions are the return values of OpenSSL functions interpreted incorrectly. The functions provide an interface to their users that may be considered confusing, but is not incorrect, nor it is a vulnerability." [1]: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-0127 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-waitress: patch CVE-2024-49769Gyorgy Sarvari2026-01-087-0/+406
| | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-49769 Pick the patch that is referenced in the NVD report (which is a merge commit. The patches here are the individual patches from that merge). Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-waitress: patch CVE-2024-49768Gyorgy Sarvari2026-01-085-0/+350
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-49768 Pick the patch mentioned in the NVD report (which is a merge commit, and the patches here are the individual commits from that merge) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-werkzeug: ignore CVE-2024-49766 and CVE-2025-66221Gyorgy Sarvari2026-01-081-0/+3
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-49766 https://nvd.nist.gov/vuln/detail/CVE-2025-66221 Both vulnerabilities affect Windows only - ignore them. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-waitress: upgrade 2.1.1 -> 2.1.2wangmy2026-01-081-1/+1
| | | | | | | | | | | | Remove change of default for clear_untrusted_proxy_headers Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit ef4e48c7a06b16755181a11d1d2d0d823353a95d) Contains fix for CVE-2022-31015 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-mpmath: patch CVE-2021-29063Gyorgy Sarvari2026-01-082-0/+52
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2021-29063 Pick the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-pyjwt: patch CVE-2022-29217Gyorgy Sarvari2026-01-082-0/+296
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-29217 Pick the patch referenced by the NVD advsory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-joblib: upgrade 1.1.0 -> 1.1.1Gyorgy Sarvari2026-01-081-1/+1
| | | | | | The only change is a fix for CVE-2022-21797 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-ipython: patch CVE-2023-24816Gyorgy Sarvari2026-01-082-0/+95
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-24816 Pick the patch referenced by the NVD report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-flask: patch CVE-2023-30861Gyorgy Sarvari2026-01-082-0/+95
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-30861 Pick the patch referenced by the NVD report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-configobj: patch CVE-2023-26112Gyorgy Sarvari2026-01-082-1/+27
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-26112 Pick the patch that resolves the issue referenced in the NVD report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-cbor2: ignore CVE-2025-64076Gyorgy Sarvari2026-01-081-0/+3
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-64076 The vunerability was introduced in v5.6.0[1], the recipe version doesn't contain the vulnerable piece of code. [1]: https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-protobuf: set CVE_PRODUCTPeter Marko2026-01-081-0/+2
| | | | | | | | | Similarly to c++ protobuf, add products matching historical entries. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit ae7556a737f7d21b0e345226fdab4a286d2f85db) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-05-10 04:54:31 +0000