linux/poky.git/meta/recipes-devtools/python/python3, branch scarthgap

python3: upgrade 3.12.12 -> 3.12.13

2026-05-04T12:57:31+00:00

Drop upstreamed patches. Release information: * https://www.python.org/downloads/release/python-31213/ * The release you're looking at is Python 3.12.13, a security bugfix release for the legacy 3.12 series. Handles CVE-2024-6923 CVE-2025-12084 CVE-2025-13836 CVE-2025-13837 CVE-2025-15282 CVE-2025-59375 CVE-2026-0865 CVE-2026-24515 CVE-2026-25210 (From OE-Core rev: 8b0c626633a1e443cfb6e5f73c6120bff5f6a5ef) Signed-off-by: Vijay Anusuri [YC: Full changelog: https://docs.python.org/release/3.12.13/whatsnew/changelog.html#python-3-12-13] Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

python3: patch CVE-2025-13837

2026-02-16T09:52:35+00:00

Pick patch from 3.12 branch per NVD report. (From OE-Core rev: 37936e0e93ab5c236d8cc8e709ba1faf8380577c) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

python3: patch CVE-2025-13836

2026-01-26T09:45:38+00:00

Pick commit from branch 3.12 mentioned in [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-13836 (From OE-Core rev: 05aa143fb5f63de0f53e916daa3392917da46131) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

python3: patch CVE-2025-12084

2026-01-26T09:45:38+00:00

Pick patch from 3.12 branch according to [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-12084 (From OE-Core rev: c3ed0dfa3a7b8716008968b0d7f80885b2f61a84) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

python3: fix CVE-2025-6075

2025-12-05T15:13:42+00:00

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-6075 Upstream-patch: https://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742 (From OE-Core rev: 5313fa5236cd3943f90804de2af81358971894bc) Signed-off-by: Praveen Kumar Signed-off-by: Steve Sakoman

python3: upgrade 3.12.11 -> 3.12.12

2025-10-24T13:23:40+00:00

Drop upstreamed patch and refresh remaining patches. Release information: * https://www.python.org/downloads/release/python-31212/ * The release you're looking at is Python 3.12.12, a security bugfix release for the legacy 3.12 series. Handles CVE-2025-59375. (From OE-Core rev: f1234b8451ba843b5f9ec1d2066c21f54d6bc3b8) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3: patch CVE-2025-8194

2025-08-20T14:37:19+00:00

Pick commit from 3.12 branch mentioned in NVD report. https://nvd.nist.gov/vuln/detail/CVE-2025-8194 (From OE-Core rev: 34f1b4877a0601d2057453c159c76a54754f229a) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3: upgrade 3.12.9 -> 3.12.11

2025-06-13T15:58:01+00:00

Drop upstreamed patch and refresh remaining patches. * https://www.python.org/downloads/release/python-31210/ Python 3.12.10 is the latest maintenance release of Python 3.12, and the last full maintenance release. Subsequent releases of 3.12 will be security-fixes only. * https://www.python.org/downloads/release/python-31211/ Security content in this release * gh-135034: [CVE 2024-12718] [CVE 2025-4138] [CVE 2025-4330] [CVE 2025-4435] [CVE 2025-4517] Fixes multiple issues that allowed tarfile extraction filters (filter="data" and filter="tar") to be bypassed using crafted symlinks and hard links. * gh-133767: Fix use-after-free in the “unicode-escape” decoder with a non-“strict” error handler. * gh-128840: Short-circuit the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service. gh-133767 got meawhile CVE-2025-4516 assigned. (From OE-Core rev: 6cca08b2857efd5481e837ecd6bb295cb8a99ee1) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3: upgrade 3.12.8 -> 3.12.9

2025-02-14T14:38:54+00:00

Release notes: https://docs.python.org/release/3.12.9/whatsnew/changelog.html#python-3-12-9 Solves CVE-2025-0938, CVE-2024-12254 and 3 other vulnerabilities without CVE number assigment. Add a patch to fix failure of a new test. (From OE-Core rev: 685b2719ae9b44c238e63942efabe52e5df7d640) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3: upgrade 3.12.7 -> 3.12.8

2025-01-09T14:25:36+00:00

Changelog: https://docs.python.org/release/3.12.8/whatsnew/changelog.html#python-3-12-8 (From OE-Core rev: db5081254adacf6c87269fd43af7199267ad535c) Signed-off-by: Guðni Már Gilbert Signed-off-by: Steve Sakoman