linux/poky.git/meta/recipes-devtools/python, branch yocto-4.0.14

python3-urllib3: 1.26.15 -> 1.26.17

2023-10-18T15:13:24+00:00

1.26.17 (2023-10-02) Added the Cookie header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect. (CVE-2023-43804) 1.26.16 (2023-05-23) Fixed thread-safety issue where accessing a PoolManager with many distinct origins would cause connection pools to be closed while requests are in progress (#2954) (From OE-Core rev: 27a1de55a46b7b313eb2a6370e9d779a7cd49154) Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman

python3-urllib3: upgrade 1.26.14 -> 1.26.15

2023-10-18T15:13:24+00:00

Changelog: ========== * Fix socket timeout value when "HTTPConnection" is reused ('#2645 '__) * Remove "!" character from the unreserved characters in IPv6 Zone ID parsing ('#2899 '__) * Fix IDNA handling of '\x80' byte ('#2901 '__) (From OE-Core rev: a335ccbcc9913e79bfe958c41690b7efa189ae93) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie (cherry picked from commit 8e062efbac29a81831c3060bcae601dc533d65dd) Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman

python3-urllib3: upgrade 1.26.13 -> 1.26.14

2023-10-18T15:13:24+00:00

https://github.com/urllib3/urllib3/blob/1.26.14/CHANGES.rst#12614-2023-01-11 1.26.14 (2023-01-11) Fixed parsing of port 0 (zero) returning None, instead of 0. (#2850) Removed deprecated getheaders() calls in contrib module. (From OE-Core rev: aefb7af6b56269d45170beb99e6c878bf2448b78) Signed-off-by: Tim Orling Signed-off-by: Richard Purdie (cherry picked from commit 55ab1bf20e6893088acb6460e9004dac8e205559) Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman

python3-urllib3: upgrade 1.26.12 -> 1.26.13

2023-10-18T15:13:24+00:00

(From OE-Core rev: e8ae3247795d9333f6252bbec85a8e09c0c9cb48) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit b18552f69a2eb8900981a10ba386dc4f862b29c3) Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman

python3-urllib3: upgrade 1.26.11 -> 1.26.12

2023-10-18T15:13:24+00:00

(From OE-Core rev: 69a610b440b5e9e92931e43bd1c75230bb99f03e) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni (cherry picked from commit cb05578af3ace6e3983f93e16d9ad1ac2a65fbe2) Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman

python3-urllib3: upgrade 1.26.10 -> 1.26.11

2023-10-18T15:13:24+00:00

(From OE-Core rev: d83b4afc17839b6c11b540aabf056647ddacb587) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit dbe07ff87e2cb1a8276e69a43c7cdbb9ae6e5493) Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman

python3-urllib3: upgrade 1.26.9 -> 1.26.10

2023-10-18T15:13:24+00:00

Add dependence python3-logging. Changelog: ========= * Removed support for Python 3.5 * Fixed an issue where a "ProxyError" recommending configuring the proxy as HTTP instead of HTTPS could appear even when an HTTPS proxy wasn't configured. (From OE-Core rev: d9f200b931e48d957b721005f0140ef3fff55af3) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie (cherry picked from commit a8a26a92dfe367472daf086a33a1b30ff6d17540) Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman

python3-jinja2: fix for the ptest result format

2023-10-06T01:48:49+00:00

The output of python3-jinja2 ptest should follow a unified format as below result: testname Reference: https://wiki.yoctoproject.org/wiki/Ptest (From OE-Core rev: edfed23716e6240a65f53630bbaf8b7319f0d1ce) Signed-off-by: Narpat Mali Signed-off-by: Steve Sakoman

python3-git: upgrade 3.1.32 -> 3.1.37

2023-09-30T19:43:59+00:00

The delta between 3.1.32 & 3.1.37 contains the CVE-2023-40590 and CVE-2023-41040 fixes and other bugfixes. Changelog: ========== - WIP Quick doc by @LeoDaCoda in #1608 - Partial clean up wrt mypy and black by @bodograumann in #1617 - Disable merge_includes in config writers by @bodograumann in #1618 - feat: full typing for "progress" parameter in Repo class by @madebylydia in #1634 - Fix CVE-2023-40590 by @EliahKagan in #1636 - #1566 Creating a lock now uses python built-in "open()" method to work arou… by @HageMaster3108 in #1619 - util: close lockfile after opening successfully by @skshetry in #1639 - Bump actions/checkout from 3 to 4 by @dependabot in #1643 - Fix 'Tree' object has no attribute '_name' when submodule path is normal path by @CosmosAtlas in #1645 - Fix CVE-2023-41040 by @facutuesca in #1644 - Only make config more permissive in tests that need it by @EliahKagan in #1648 - Added test for PR #1645 submodule path by @CosmosAtlas in #1647 - Fix Windows environment variable upcasing bug by @EliahKagan in #1650 - Improve Python version and OS compatibility, fixing deprecations by @EliahKagan in #1654 - Better document env_case test/fixture and cwd by @EliahKagan in #1657 - Remove spurious executable permissions by @EliahKagan in #1658 - Fix up checks in Makefile and make them portable by @EliahKagan in #1661 - Fix URLs that were redirecting to another license by @EliahKagan in #1662 - Assorted small fixes/improvements to root dir docs by @EliahKagan in #1663 - Use venv instead of virtualenv in test_installation by @EliahKagan in #1664 - Omit py_modules in setup by @EliahKagan in #1665 - Don't track code coverage temporary files by @EliahKagan in #1666 - Configure tox by @EliahKagan in #1667 - Format tests with black and auto-exclude untracked paths by @EliahKagan in #1668 - Upgrade and broaden flake8, fixing style problems and bugs by @EliahKagan in #1673 - Fix rollback bug in SymbolicReference.set_reference by @EliahKagan in #1675 - Remove @NoEffect annotations by @EliahKagan in #1677 - Add more checks for the validity of refnames by @facutuesca in #1672 Note that the changes to the license file are just removal of excess whitespace (the extra blank line at the end, and spaces appearing at the end of lines). References: https://github.com/gitpython-developers/GitPython/releases https://github.com/gitpython-developers/GitPython/blob/main/doc/source/changes.rst https://github.com/gitpython-developers/GitPython/commit/e1af18377fd69f9c1007f8abf6ccb95b3c5a6558 (From OE-Core rev: 35cb21d6c8076428c0c60f03bb1b8f6945e2a07c) Signed-off-by: Narpat Mali Signed-off-by: Steve Sakoman

python3-pygments: Fix CVE-2022-40896

2023-09-18T14:28:03+00:00

CVE-2022-40896: A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer. The CVE issue is fixed by 3 different commits between the releases 2.14.0 (for Smithy lexer), 2.15.0 (for SQL+Jinja lexers) and 2.15.1 (for Java properties) as per: https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2/ 1. Smithy lexer commit from 2.14.0 release applies successfully on 2.11.2 version. Commit: https://github.com/pygments/pygments/commit/dd52102c38ebe78cd57748e09f38929fd283ad04 Hence, backported the patch as CVE-2022-40896.patch. 2. SQL+Jinja lexers commit from 2.15.0 release doesn't apply on 2.11.2 version. Commit: https://github.com/pygments/pygments/commit/97eb3d5ec7c1b3ea4fcf9dee30a2309cf92bd194 Actually, this code doesn't exist in 2.11.2 version and it has been introduce by python3-pygments 2.13.0 version. Hence, this is not vulnerable for 2.11.2 version. SQL+Jinja lexers is introduced by: https://github.com/pygments/pygments/commit/0bdbd5992baca32d18e01f0ec65337e06abf9456 3. Java properties commit from 2.15.1 release also doesn't apply on 2.11.2 version. Commit: https://github.com/pygments/pygments/commit/fdf182a7af85b1deeeb637ca970d31935e7c9d52 Actually, this code also doesn't exist in 2.11.2 version as the code has been modified in python3-pygments 2.14.0 by: https://github.com/pygments/pygments/commit/a38cb38e93c9635240b3ae89d78d38cf182745da Hence, this is also not vulnerable for 2.11.2 version. (From OE-Core rev: ebb224e65a7e1402ccf0d9517bd72748c18e012e) Signed-off-by: Narpat Mali Signed-off-by: Steve Sakoman