linux/poky.git/meta/recipes-devtools/python, branch mickledore

python3-urllib3: update to v1.26.18

2023-11-11T18:23:01+00:00

https://github.com/urllib3/urllib3/releases/tag/1.26.18 Major changes in python3-urllib3 1.26.18: - Made body stripped from HTTP requests changing the request method to GET after HTTP 303 "See Other" redirect responses. (CVE-2023-45803) (From OE-Core rev: 74da05b63634c248910594456dae286947f33da5) Signed-off-by: Tan Wen Yan Signed-off-by: Steve Sakoman

python3-urllib3: 1.26.15 -> 1.26.17

2023-10-25T14:51:01+00:00

1.26.17 (2023-10-02) Added the Cookie header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect. (CVE-2023-43804) 1.26.16 (2023-05-23) Fixed thread-safety issue where accessing a PoolManager with many distinct origins would cause connection pools to be closed while requests are in progress (#2954) (From OE-Core rev: 7466db00ca2f884cf58504c3910b858a87f33128) Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman

python3-git: upgrade 3.1.32 -> 3.1.37

2023-09-29T14:33:43+00:00

The delta between 3.1.32 & 3.1.37 contains the CVE-2023-40590 and CVE-2023-41040 fixes and other bugfixes. Changelog: ========== - WIP Quick doc by @LeoDaCoda in #1608 - Partial clean up wrt mypy and black by @bodograumann in #1617 - Disable merge_includes in config writers by @bodograumann in #1618 - feat: full typing for "progress" parameter in Repo class by @madebylydia in #1634 - Fix CVE-2023-40590 by @EliahKagan in #1636 - #1566 Creating a lock now uses python built-in "open()" method to work arou… by @HageMaster3108 in #1619 - util: close lockfile after opening successfully by @skshetry in #1639 - Bump actions/checkout from 3 to 4 by @dependabot in #1643 - Fix 'Tree' object has no attribute '_name' when submodule path is normal path by @CosmosAtlas in #1645 - Fix CVE-2023-41040 by @facutuesca in #1644 - Only make config more permissive in tests that need it by @EliahKagan in #1648 - Added test for PR #1645 submodule path by @CosmosAtlas in #1647 - Fix Windows environment variable upcasing bug by @EliahKagan in #1650 - Improve Python version and OS compatibility, fixing deprecations by @EliahKagan in #1654 - Better document env_case test/fixture and cwd by @EliahKagan in #1657 - Remove spurious executable permissions by @EliahKagan in #1658 - Fix up checks in Makefile and make them portable by @EliahKagan in #1661 - Fix URLs that were redirecting to another license by @EliahKagan in #1662 - Assorted small fixes/improvements to root dir docs by @EliahKagan in #1663 - Use venv instead of virtualenv in test_installation by @EliahKagan in #1664 - Omit py_modules in setup by @EliahKagan in #1665 - Don't track code coverage temporary files by @EliahKagan in #1666 - Configure tox by @EliahKagan in #1667 - Format tests with black and auto-exclude untracked paths by @EliahKagan in #1668 - Upgrade and broaden flake8, fixing style problems and bugs by @EliahKagan in #1673 - Fix rollback bug in SymbolicReference.set_reference by @EliahKagan in #1675 - Remove @NoEffect annotations by @EliahKagan in #1677 - Add more checks for the validity of refnames by @facutuesca in #1672 Note that the changes to the license file are just removal of excess whitespace (the extra blank line at the end, and spaces appearing at the end of lines). References: https://github.com/gitpython-developers/GitPython/releases https://github.com/gitpython-developers/GitPython/blob/main/doc/source/changes.rst https://github.com/gitpython-developers/GitPython/commit/e1af18377fd69f9c1007f8abf6ccb95b3c5a6558 (From OE-Core rev: 931af3758a2d79aea534ab6d23db392ede7cc1bb) Signed-off-by: Narpat Mali Signed-off-by: Steve Sakoman

python3: update to 3.11.5

2023-09-13T16:21:25+00:00

upgrade include fix for CVE-2023-40217 Release notes: https://docs.python.org/3/whatsnew/changelog.html#python-3-11-5-final (From OE-Core rev: 4a3e3042a0cef3a215d286b0f32be293c3948d1e) Signed-off-by: Chee Yang Lee Signed-off-by: Steve Sakoman

python3: update 3.11.3 -> 3.11.4

2023-09-13T16:21:25+00:00

upgrade include fix for CVE-2023-24329 (cherry picked from commit f7f163ebe8c53de4314d04595c1fbcc7af2deccc ) (From OE-Core rev: 8687de9f20bde7aba118a50342848031adfb7641) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie Signed-off-by: Chee Yang Lee Signed-off-by: Steve Sakoman

python3: upgrade 3.11.2 -> 3.11.3

2023-09-13T16:21:25+00:00

(cherry picked from commit 7d5bb3a4690ef61a1fee21773b4717e829789e32) (From OE-Core rev: a991fe85dca51ddf36994666e14e69839dd694b2) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie Signed-off-by: Chee Yang Lee Signed-off-by: Steve Sakoman

python3-pygments: fix for CVE-2022-40896

2023-09-04T14:13:24+00:00

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer. The CVE issue is fixed by these 3 different commits in different version: 1. Improve the Smithy metadata matcher (These changes are already available as part of current python3-pygments_2.14.0 version): https://github.com/pygments/pygments/commit/dd52102c38ebe78cd57748e09f38929fd283ad04 (2.14.0) 2. SQL+Jinja: use a simpler regex in analyse_text: https://github.com/pygments/pygments/commit/97eb3d5ec7c1b3ea4fcf9dee30a2309cf92bd194 (2.15.0) 3. Improve Java properties lexer (#2404): https://github.com/pygments/pygments/commit/fdf182a7af85b1deeeb637ca970d31935e7c9d52 (2.15.1) References: https://nvd.nist.gov/vuln/detail/CVE-2022-40896 https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2/ (From OE-Core rev: 5a02307af5e593be864423a9f3ab309703d61dbf) Signed-off-by: Narpat Mali Signed-off-by: Steve Sakoman

python3-git: upgrade 3.1.31 -> 3.1.32

2023-08-30T14:52:35+00:00

The delta between 3.1.31 & 3.1.32 contains the CVE-2023-40267 fix and other bugfixes. Changelog: https://github.com/gitpython-developers/GitPython/releases/tag/3.1.32 - Bump cygwin/cygwin-install-action from 3 to 4 by @dependabot in #1572 - Fix up the commit trailers functionality by @itsluketwist in #1576 - Name top-level exceptions as private variables by @Hawk777 in #1590 - fix pypi long description by @eUgEntOptIc44 in #1603 - Don't rely on del by @r-darwish in #1606 - Block insecure non-multi options in clone/clone_from by @Beuc in #1609 (From OE-Core rev: fd38c8d91f95b44ea7b833772b9a07e1f1d74479) Signed-off-by: Narpat Mali Signed-off-by: Steve Sakoman

python3-certifi: upgrade 2022.12.7 -> 2023.7.22

2023-08-15T16:18:48+00:00

python3-certifi 2023.7.22 contains the CVE-2023-37920 fix. No changelog provided. Commits: 8fb96ed (tag: 2023.07.22) 2023.07.22 afe7722 Bump actions/setup-python from 4.6.1 to 4.7.0 (#230) 2038739 Bump dessant/lock-threads from 3.0.0 to 4.0.1 (#229) 44df761 Hash pin Actions and enable dependabot (#228) 8b3d7ba (tag: 2023.05.07) 2023.05.07 53da240 ci: Add Python 3.12-dev to the testing (#224) c2fc3b1 Create a Security Policy (#222) c211ef4 Set up permissions to github workflows (#218) 2087de5 Don't let deprecation warning fail CI (#219) e0b9fc5 remove paragraphs about 1024-bit roots from README 9427a5a fix CI fed4048 get CI passing again 9e9e840 (tag: 2022.12.07) 2022.12.07 (From OE-Core rev: ec5e5ae6b304dee9b323bd20f3db25152a083398) Signed-off-by: Narpat Mali Signed-off-by: Steve Sakoman

python3: fix missing comma in get_module_deps3.py

2023-08-01T16:17:28+00:00

Wes Tarro noticed a missing comma in a preplace() call, add it. That said, calling replace() with one argument results in a TypeError, so this is obviously dead code. (From OE-Core rev: f24236b7b52dd753d7170bac9c38dff1133db76e) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit 9b2e2c8d809e7ca34451ec9702b029a00dfb410b) Signed-off-by: Steve Sakoman