linux/poky.git/meta/recipes-devtools/python, branch walnascar-5.2.2

python3: drop old nis module dependencies

2025-07-04T14:50:16+00:00

libnsl2 and libtirpc were build dependencies for the nis module. The nis module was deprecated in Python 3.11 and removed in Python 3.13 (From OE-Core rev: cbc7b1ed7747ef69d8bcbaee27c90560ded713d6) Signed-off-by: Guðni Már Gilbert Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

python3-setuptools: fix CVE-2025-47273

2025-07-04T14:50:16+00:00

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-47273 Upstream-patch: https://github.com/pypa/setuptools/commit/d8390feaa99091d1ba9626bec0e4ba7072fc507a https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b (From OE-Core rev: cfb2d77f841ae21cae0ba7d6263dc3e1e0280400) Signed-off-by: Praveen Kumar Signed-off-by: Steve Sakoman

python3-urllib3: fix CVE-2025-50182

2025-07-04T14:50:16+00:00

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-50182 Upstream patch: https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f (From OE-Core rev: 082b865d9814e7e7aca4466551a035199aa8b563) Signed-off-by: Yogita Urade Signed-off-by: Steve Sakoman

python3-urllib3: fix CVE-2025-50181

2025-07-04T14:50:16+00:00

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-50181 Upstream patch: https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857 (From OE-Core rev: 819273b5b8b9279c01035cb72377fd8cbb51a198) Signed-off-by: Yogita Urade Signed-off-by: Steve Sakoman

python3-requests: upgrade 2.32.3 -> 2.32.4

2025-06-20T16:21:27+00:00

Changelog: https://requests.readthedocs.io/en/latest/community/updates/#release-history (From OE-Core rev: 27a860d7b34250326daede0ade382db47e22c114) Signed-off-by: Jiaying Song Signed-off-by: Steve Sakoman

python3: upgrade 3.13.3 -> 3.13.4

2025-06-13T16:01:26+00:00

Refresh patches. * https://www.python.org/downloads/release/python-3134/ Security content in this release * gh-135034: [CVE 2024-12718] [CVE 2025-4138] [CVE 2025-4330] [CVE 2025-4435] [CVE 2025-4517] Fixes multiple issues that allowed tarfile extraction filters (filter="data" and filter="tar") to be bypassed using crafted symlinks and hard links. * gh-133767: Fix use-after-free in the “unicode-escape” decoder with a non-“strict” error handler. * gh-128840: Short-circuit the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service. gh-133767 got meawhile CVE-2025-4516 assigned. (From OE-Core rev: 55a9cd748531c75d46f5d6d53af692a38c6b6716) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3: upgrade 3.13.2 -> 3.13.3

2025-06-13T16:01:26+00:00

This adds some security fixes and many new changes to the library. Changelog: https://docs.python.org/3/whatsnew/changelog.html#python-3-13-3-final Modify 0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch to remove 'test_types' from the pgo-wrapper call, since that fails now under qemu. Reproducibility looks OK. ptest results OK: |== Tests result: SUCCESS == | |29 tests skipped: | test.test_asyncio.test_windows_events | test.test_asyncio.test_windows_utils test.test_gdb.test_backtrace | test.test_gdb.test_cfunction test.test_gdb.test_cfunction_full | test.test_gdb.test_misc test.test_gdb.test_pretty_print | test_android test_apple test_asdl_parser test_clinic test_devpoll | test_free_threading test_generated_cases test_idle test_ioctl | test_kqueue test_launcher test_msvcrt test_startfile test_tcl | test_tkinter test_ttk test_ttk_textonly test_turtle test_winapi | test_winconsoleio test_winreg test_wmi | |9 tests skipped (resource denied): | test_curses test_peg_generator test_pyrepl test_smtpnet | test_socketserver test_urllib2net test_urllibnet test_winsound | test_zipfile64 | |442 tests OK. | |Total duration: 2 min 48 sec |Total tests: run=43,896 skipped=2,268 |Total test files: run=471/480 skipped=29 resource_denied=9 |Result: SUCCESS |DURATION: 169 |END: /usr/lib/python3/ptest |2025-05-12T12:34 |STOP: ptest-runner |TOTAL: 1 FAIL: 0 |root@qemux86-64:~# (From OE-Core rev: 063d5a5fb2f71b523f378b95167553b28804c3ad) (From OE-Core rev: 6587dc1fc62de79c4599761af59ebd385244cb57) Signed-off-by: Trevor Gamblin Signed-off-by: Richard Purdie Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3: backport the full fix for importlib scanning invalid distributions

2025-06-13T16:01:26+00:00

Even with our fixes in deterministic_imports.patch the importlib.metadata package scan was still returning Distribution objects for empty directories. This interacts badly with rebuilds when recipes are changing as when a recipe is removed from the sysroot directories are not removed[1]. In particular this breaks python3-meson-python-native rebuilds when Meson upgrades from 1.7 to 1.8: the site-packages directory has an empty meson-1.7.dist-info/ and populated meson-1.8.dist-info/. Whilst it's deterministic to return the empty 1.7 first, this breaks pypa/build as it looks through the distributions in order. We had discussed this with upstream previously and there's a more comprehensive fix upstream (actually in importlib_metadata, not cpython) which ensures that valid distribution objects are listed first. So we can drop our patch and replace it with a backport to fix these rebuilds. [1] oe-core 4f94d929639 ("sstate/staging: Handle directory creation race issue") (From OE-Core rev: 73de8daa6293403f5b92d313af32882c47bce396) (From OE-Core rev: 1c1b651038e15445c495d87c38beeb92f00d9919) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3: remove obsolete deletion of non-deterministic .pyc files

2025-06-13T16:01:26+00:00

These .pyc files were non-deterministic because they used frozensets[1], but this has been fixed in 3.11 onwards. [1] https://github.com/python/cpython/issues/81777 [2] https://github.com/python/cpython/commit/51999c960e7fc45feebd629421dec6524a5fc803 (From OE-Core rev: c8c391ed3e0598a3bea7bc0981126d870315063d) (From OE-Core rev: 75758dc92003892edc32cccb3c830926b5c4942a) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3-pygobject: RDEPENDS on gobject-introspection

2025-06-02T17:26:30+00:00

Since 3.51.0, python3-pygobject depends on libgirepository 2.0 provided by glib-2.0 instead of libgirepository 1.0 provided by gobject-introspection[1]. It still needs the typelib files from libgirepository-1.0 package. Add gobject-introspection as a runtime dependency. Fixes: $ python3 Python 3.13.2 (main, Feb 4 2025, 14:51:09) [GCC 14.2.0] on linux Type "help", "copyright", "credits" or "license" for more information. >>> import gi >>> from gi.repository import Gtk Traceback (most recent call last): File "/usr/lib64/python3.13/site-packages/gi/importer.py", line 139, in create_module introspection_module = get_introspection_module(namespace) File "/usr/lib64/python3.13/site-packages/gi/module.py", line 243, in get_introspection_module module = IntrospectionModule(namespace, version) File "/usr/lib64/python3.13/site-packages/gi/module.py", line 111, in __init__ repository.require(namespace, version) ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ gi.RepositoryError: Typelib file for namespace 'xlib', version '2.0' not found The above exception was the direct cause of the following exception: Traceback (most recent call last): File "", line 1, in from gi.repository import Gtk File "/usr/lib64/python3.13/site-packages/gi/importer.py", line 141, in create_module raise ImportError(e) from e ImportError: Typelib file for namespace 'xlib', version '2.0' not found [1] https://gitlab.gnome.org/GNOME/pygobject/-/merge_requests/320 (From OE-Core rev: 6f9e02292c9305e795f2651c3bb6ef5b671e1c74) (From OE-Core rev: e3fa9ef3239e8bc113e211f5258f84d08284872a) Signed-off-by: Yi Zhao Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie Signed-off-by: Yi Zhao Signed-off-by: Steve Sakoman