summaryrefslogtreecommitdiffstats
path: root/meta-python/recipes-devtools/python
Commit message (Collapse)AuthorAgeFilesLines
* python3-protobuf: fix RDEPENDSChen Qi2025-07-021-0/+1
| | | | | | | python3-ctypes is needed as a runtime dependency. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-aiohttp: fix CVE-2024-42367Jiaying Song2025-07-022-0/+66
| | | | | | | | | | | | | | | | | | | | | | | | | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-42367 https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jwhx-xcg6-8xhj Upstream patch: https://github.com/aio-libs/aiohttp/commit/ce2e9758814527589b10759a20783fb03b98339f Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-twisted: Fix CVE-2024-41671Soumya Sambu2025-05-253-0/+232
| | | | | | | | | | | | | | | | | | Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1. References: https://nvd.nist.gov/vuln/detail/CVE-2024-41671 https://ubuntu.com/security/CVE-2024-41671 Upstream patches: https://github.com/twisted/twisted/commit/f1cb4e616e9f23b4dd044a6db44365060950c64f https://github.com/twisted/twisted/commit/ef2c755e9e9d57d58132af790bd2fd2b957b3fb1 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-grpcio(-tools): fix build concurrency issuePeter Marko2025-03-062-0/+8
| | | | | | | | | | | | | | | | | | | Set GRPC_PYTHON_BUILD_EXT_COMPILER_JOBS to limit spawned compiler processes. Without this it uses all available CPUs (via multiprocessing.cpu_count()) and can exhaust build host since there are lot of files to compile (e.g. with 128 cores it manages to spawn 128 gcc processes) Note that this is a general problem for all setuptools based builds with build_ext compilation which can either compile with 1 thread or cpu_count threads. grpcio hot-patches setuptools and allows to set specific build concurrency value. (From master rev: fe582374d3ba474164005942799eb2bddc52a080) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-future: upgrade 0.18.2 -> 0.18.3Wang Mingyu2025-03-061-2/+1
| | | | | | | | | | | | Full changelog: https://github.com/PythonCharmers/python-future/releases (cherry-picked from a10bda8c873e66f0d895cf8065cbc076b2055655) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-h5py: add -Wno-error to allow building native with gcc-14 on hostMartin Jansa2025-02-091-0/+4
| | | | | Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-sqlparse: Fix CVE-2024-4340Soumya Sambu2025-01-222-0/+49
| | | | | | | | | | | | | | Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-4340 Upstream-patch: https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-53907Soumya Sambu2025-01-222-0/+93
| | | | | | | | | | | | | | | | An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-53907 Upstream-patch: https://github.com/django/django/commit/790eb058b0716c536a2f2e8d1c6d5079d776c22b Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-45231Soumya Sambu2025-01-222-0/+121
| | | | | | | | | | | | | | | | | An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing). Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-45231 Upstream-patch: https://github.com/django/django/commit/bf4888d317ba4506d091eeac6e8b4f1fcc731199 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-45230Soumya Sambu2025-01-222-0/+138
| | | | | | | | | | | | | | | | An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-45230 Upstream-patch: https://github.com/django/django/commit/d147a8ebbdf28c17cafbbe2884f0bc57e2bf82e2 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-41991Soumya Sambu2025-01-222-0/+123
| | | | | | | | | | | | | | | | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-41991 Upstream-patch: https://github.com/django/django/commit/efea1ef7e2190e3f77ca0651b5458297bc0f6a9f Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-41990Soumya Sambu2025-01-222-0/+70
| | | | | | | | | | | | | | | | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-41990 Upstream-patch: https://github.com/django/django/commit/d0a82e26a74940bf0c78204933c3bdd6a283eb88 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-41989Soumya Sambu2025-01-225-0/+238
| | | | | | | | | | | | | | | | | | | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-41989 Upstream-patches: https://github.com/django/django/commit/08c5a787262c1ae57f6517d4574b54a5fcaad124 https://github.com/django/django/commit/4b066bde692078b194709d517b27e55defae787c https://github.com/django/django/commit/dcd974698301a38081c141ccba6dcafa5ed2c80e https://github.com/django/django/commit/fc76660f589ac07e45e9cd34ccb8087aeb11904b Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-39614Soumya Sambu2025-01-222-0/+139
| | | | | | | | | | | | | | | An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-39614 Upstream-patch: https://github.com/django/django/commit/17358fb35fb7217423d4c4877ccb6d1a3a40b1c3 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2023-23969Soumya Sambu2025-01-222-0/+109
| | | | | | | | | | | | | | | | In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large. References: https://nvd.nist.gov/vuln/detail/CVE-2023-23969 Upstream-patch: https://github.com/django/django/commit/c7e0151fdf33e1b11d488b6f67b94fdf3a30614a Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 4.2.15 -> 4.2.17Soumya Sambu2025-01-221-2/+2
| | | | | | | | | | | | Fixes CVE-2024-45230, CVE-2024-45231, CVE-2024-53907 and CVE-2024-53908 Release Notes: https://docs.djangoproject.com/en/dev/releases/4.2.16/ https://docs.djangoproject.com/en/dev/releases/4.2.17/ Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-38875Soumya Sambu2025-01-222-0/+162
| | | | | | | | | | | | | | | | An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets. References: https://nvd.nist.gov/vuln/detail/CVE-2024-38875 https://github.com/advisories/GHSA-qg2p-9jwr-mmqf Upstream-patch: https://github.com/django/django/commit/79f368764295df109a37192f6182fb6f361d85b5 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-werkzeug: Fix CVE-2024-49767Soumya Sambu2024-12-312-1/+89
| | | | | | | | | | | | | | | | | | | | Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-49767 Upstream-patch: https://github.com/pallets/werkzeug/commit/8760275afb72bd10b57d92cb4d52abf759b2f3a7 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-werkzeug: Fix CVE-2024-34069Soumya Sambu2024-12-313-1/+272
| | | | | | | | | | | | | | | | | | | | | Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-34069 Upstream-patches: https://github.com/pallets/werkzeug/commit/71b69dfb7df3d912e66bab87fbb1f21f83504967 https://github.com/pallets/werkzeug/commit/890b6b62634fa61224222aee31081c61b054ff01 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-aiohttp: fix ↵Jiaying Song2024-12-086-0/+855
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2023-49081/CVE-2024-30251/CVE-2024-52304/CVE-2023-49082/CVE-2024-27306 CVE-2023-49081: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0. References: https://nvd.nist.gov/vuln/detail/CVE-2023-49081 Upstream patches: https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b CVE-2024-30251: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions. References: https://nvd.nist.gov/vuln/detail/CVE-2024-30251 Upstream patches: https://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19 https://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597 https://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866 CVE-2024-52304: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue. References: https://nvd.nist.gov/vuln/detail/CVE-2024-52304 Upstream patches: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71 CVE-2023-49082: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0. References: https://nvd.nist.gov/vuln/detail/CVE-2023-49082 Upstream patches: https://github.com/aio-libs/aiohttp/pull/7806/commits/a43bc1779892e7014b7723c59d08fb37a000955e CVE-2024-27306: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade. References: https://nvd.nist.gov/vuln/detail/CVE-2024-27306 Upstream patches: https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397 Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-geomet: fix branch parameterMartin Jansa2024-12-081-4/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * drop unused SRC_URI[sha256sum] as this recipe uses git fetcher * release-0.3.0 branch doesn't exist, but the SRCREV is in master branch: geomet $ git branch -a --contains 73ec5ec96cca32f2e2461d3964fc3d4ab80248f9 * master remotes/origin/HEAD -> origin/master remotes/origin/master remotes/origin/release-1.0 remotes/origin/release-1.1.0 * release-0.3.0 branch doesn't exist even the tarball on MIRROR: https://sources.yoctoproject.org/mirror/sources/git2_github.com.geomet.geomet.git.tar.gz not sure when it was removed from upstream git repo, but it was removed: Pruning origin URL: https://github.com/geomet/geomet.git * [pruned] refs/heads/issue_esri_srid * [pruned] refs/pull/74/merge * [pruned] refs/pull/76/merge * [pruned] refs/pull/77/merge * [pruned] refs/heads/release-0.3.0 * master branch is used since mickledore upgrade to 1.0.0 in: https://git.openembedded.org/meta-openembedded/commit/?h=mickledore&id=382f7d51e3b92b8b7a23cd98f9bfc63c51a33dfd Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-lxml: ignore incompatible-pointer-types issues in native buildMartin Jansa2024-12-081-0/+2
| | | | | | | | | | | | | * to allow building native version on hosts with gcc-14 * it's properly fixed in 5.0.2 version sent to oe-core/scarthgap in: https://lists.openembedded.org/g/openembedded-core/message/206391 but for kirkstone we can just demote the issue back to warning * fixes: https://bugs.launchpad.net/lxml/+bug/2045435 Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-smbus2: Fix LIC_FILES_CHKSUMNiko Mauno2024-09-221-1/+1
| | | | | | | | | Change the reference to the MIT license containing LICENSE file in the downloaded archive. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-haversine: Fix LIC_FILES_CHKSUMNiko Mauno2024-09-221-1/+1
| | | | | | | | | Change the reference to the MIT license containing LICENSE file in the downloaded archive. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-googleapis-common-protos: Fix LIC_FILES_CHKSUMNiko Mauno2024-09-221-1/+1
| | | | | | | | | Change the reference to the Apache-2.0 license containing LICENSE file in the downloaded archive. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pycurl: Fix LICENSENiko Mauno2024-09-221-1/+1
| | | | | | | | | | Contents of https://github.com/pycurl/pycurl/blob/REL_7_45_1/COPYING-LGPL correspond to version 2.1 of the license rather than 2.0. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-fann2: Fix LICENSENiko Mauno2024-09-221-1/+1
| | | | | | | | | | | According to https://github.com/FutureLinkCorporation/fann2/tree/1.1.2?tab=readme-ov-file#license and https://github.com/FutureLinkCorporation/fann2/blob/1.1.2/LICENSE this project is subject to LGPL-2.1-only license. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-colorama: Fix LICENSENiko Mauno2024-09-221-1/+1
| | | | | | | | | | https://github.com/tartley/colorama?tab=readme-ov-file#license and https://github.com/tartley/colorama/blob/0.4.4/LICENSE.txt declare that this project is subject to BSD-3-Clause license. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pillow: Fix LICENSE and change SUMMARY to DESCRIPTIONNiko Mauno2024-09-221-2/+2
| | | | | | | | | | | | | According to https://pypi.org/project/pillow/ and https://github.com/python-pillow/Pillow/blob/9.4.0/LICENSE the project is subject to HPND license. Also change SUMMARY to DESCRIPTION as it's value is clearly over 72 characters long. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-parse-type: Fix LICENSENiko Mauno2024-09-221-1/+1
| | | | | | | | | | According to https://pypi.org/project/parse-type/ and https://github.com/jenisys/parse_type/blob/v0.5.2/LICENSE the project is subject to MIT license. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-mock: Fix LICENSENiko Mauno2024-09-221-1/+1
| | | | | | | | | | | According to https://github.com/testing-cabal/mock/blob/4.0.3/LICENSE.txt the project is subject to BSD-2-Clause license. (Also https://pypi.org/project/mock/ states 'BSD License'.) Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-crc32c: Amend LICENSE declarationNiko Mauno2024-09-221-1/+1
| | | | | | | | | | According to https://github.com/ICRAR/crc32c/blob/v2.2.post0/LICENSE and https://github.com/ICRAR/crc32c?tab=readme-ov-file#license change 'LGPL-2.0-or-later' in LICENSE value to 'LGPL-2.1-or-later'. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-cbor2: Fix LICENSE and LIC_FILES_CHKSUMNiko Mauno2024-09-221-2/+2
| | | | | | | | | | | | Both project pypi page: https://pypi.org/project/cbor2/ as well as https://github.com/agronholm/cbor2/blob/5.4.2/LICENSE.txt state that it is subject to MIT rather than Apache-2.0 license. Also update LIC_FILES_CHKSUM value to reference the LICENSE.txt file from the downloaded archive. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-xlsxwriter: Fix LICENSENiko Mauno2024-09-221-1/+1
| | | | | | | | | | | According to homepage https://xlsxwriter.readthedocs.io/license.html and pypi page https://pypi.org/project/XlsxWriter/ as well as https://github.com/jmcnamara/XlsxWriter/blob/RELEASE_3.0.3/LICENSE.txt the module is licensed under BSD-2-Clause. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pybind11: Fix LICENSENiko Mauno2024-09-221-1/+1
| | | | | | | | | The repositorys LICENSE file contains BSD-3-Clause license text, so update the relevant recipe information field to match. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Upgrade 4.2.10 -> 4.2.15Soumya Sambu2024-08-251-2/+2
| | | | | | | | | | | | | | Includes fixes for - CVE-2024-42005, CVE-2024-41991, CVE-2024-41990, CVE-2024-41989 Release Notes: https://docs.djangoproject.com/en/dev/releases/4.2.15/ https://docs.djangoproject.com/en/dev/releases/4.2.14/ https://docs.djangoproject.com/en/dev/releases/4.2.13/ https://docs.djangoproject.com/en/dev/releases/4.2.12/ https://docs.djangoproject.com/en/dev/releases/4.2.11 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-42005Soumya Sambu2024-08-252-0/+85
| | | | | | | | | | | | | | | | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg. References: https://nvd.nist.gov/vuln/detail/CVE-2024-42005 Upstream-patch: https://github.com/django/django/commit/f4af67b9b41e0f4c117a8741da3abbd1c869ab28 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pyyaml-include: support native and nativesdk buildRandy MacLeod2024-06-271-1/+1
| | | | | | | | Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 56e2e5df9bba23c431bed2fa7794d5cc86c08f2f) Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pyyaml-include: Drop pytest --automakeMingli Yu2024-05-222-2/+1
| | | | | | | | | | The python3-unittest-automake-output is not supported [1], so drop "pytest --automake". [1] https://lore.kernel.org/all/20240327072236.2221619-1-mingli.yu@windriver.com/T/#mda91919809cf156aba24f099bef65142067cd318 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* python3-twisted: Add python3-typing-extensions to RDEPENDSHains van den Bosch2024-04-281-0/+1
| | | | | | | | | | | | | To fix crash due to missing module: File "/usr/lib/python3.11/site-packages/twisted/internet/defer.py", line 42, in <module> from typing_extensions import Literal, ParamSpec, Protocol ModuleNotFoundError: No module named 'typing_extensions' Signed-off-by: Hains van den Bosch <hainsvdbosch@ziggo.nl> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Guðni Már Gilbert <gudnimar@noxmedical.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-twisted: Add python3-asyncio to RDEPENDSHains van den Bosch2024-04-281-0/+1
| | | | | | | | | | | | | | To fix crash due to missing module: from twisted.internet import defer File "/usr/lib/python3.11/site-packages/twisted/internet/defer.py", line 14, in <module> from asyncio import AbstractEventLoop, Future, iscoroutine ModuleNotFoundError: No module named 'asyncio' Signed-off-by: Hains van den Bosch <hainsvdbosch@ziggo.nl> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Guðni Már Gilbert <gudnimar@noxmedical.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-aiohttp: Fix CVE-2024-23334Rahul Janani Pandi2024-04-282-0/+225
| | | | | | | | | | | | | | | | | | | | | | | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue. References: https://security-tracker.debian.org/tracker/CVE-2024-23334 https://github.com/aio-libs/aiohttp/releases/tag/v3.9.2 Signed-off-by: Rahul Janani Pandi <RahulJanani.Pandi@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: fix CVE-2024-24680Rahul Janani Pandi2024-04-282-0/+49
| | | | | | | | | | | | | | | | An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings. Since, there is no ptest available for python3-django so have not tested the patch changes at runtime. References: https://security-tracker.debian.org/tracker/CVE-2024-24680 https://docs.djangoproject.com/en/dev/releases/4.2.10/ Signed-off-by: Rahul Janani Pandi <RahulJanani.Pandi@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pillow: Fix CVE-2023-50447Rahul Janani Pandi2024-04-285-0/+186
| | | | | | | | | | | | | Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). References: https://security-tracker.debian.org/tracker/CVE-2023-50447 https://github.com/python-pillow/Pillow/blob/10.2.0/CHANGES.rst Signed-off-by: Rahul Janani Pandi <RahulJanani.Pandi@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pyyaml-include: Upgrade 1.3.2 -> 1.4.1Mingli Yu2024-04-281-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Upgrade to 1.4.1 to make it work with setuptools 59.x as it doesn't support pep 621 [1], so remove pyproject.toml and add setup.cfg back [2]. * Add python3-toml to RDEPENDS to fix below error: self = <yamlinclude.readers.TomlReader object at 0x7faceccdbd30> def __call__(self): if sys.version_info >= (3, 11): with open(self._path, "rb") as fp: return tomllib.load(fp) else: try: import toml except ImportError as err: # pragma: no cover > raise ImportError(f'Un-supported file "{self._path}".\n`pip install toml` should solve the problem.\n\n{err}') E ImportError: Un-supported file "tests/data/include.d/1.toml". E `pip install toml` should solve the problem. E E No module named 'toml' ../../python3.10/site-packages/yamlinclude/readers.py:69: ImportError [1] https://setuptools.pypa.io/en/latest/userguide/pyproject_config.html [2] https://github.com/tanbro/pyyaml-include/issues/43 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pyyaml-include: switch to pytest --automakeTim Orling2024-04-282-4/+5
| | | | | | | | | | * Also replace ${PYTHON_PN} with python3 Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 182f31a182f6572a3538b875cec7ee761e2da1e6) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pyyaml-include: add initial recipe for version 1.3.2Derek Straka2024-04-282-0/+31
| | | | | | | | | | | | Add a recipe for the pyyaml-include package that extends PyYAML to include YAML files within YAML files. Add a ptest to run the unit tests and include the tests as part of the package lists in meta-python Signed-off-by: Derek Straka <derek@asterius.io> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit bf011a9f5e89186b338b6a335d10ef84929be0ce) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade from 4.2.7 to 4.2.10Fathi Boudra2024-02-281-1/+1
| | | | | | | | | | Upgrade to the latest 4.x LTS release. Bugs fixes only. Fix CVE: CVE-2024-24680: Potential denial-of-service in intcomma template filter Signed-off-by: Fathi Boudra <fathi.boudra@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-aiohttp: upgrade 3.8.5 -> 3.8.6Narpat Mali2024-02-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The delta between 3.8.5 & 3.8.6 contains the CVE-2023-47627 fix and other bugfixes. https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg Changelog: ---------- https://docs.aiohttp.org/en/stable/changes.html#id72 The git log --oneline v3.8.5..v3.8.6 shows: 996de262 (tag: v3.8.6) Release v3.8.6 (#7668) 8c128d4f [PR #7651/45f98b7d backport][3.8] Fix BadStatusLine message (#7666) 89b7df15 Allow lax response parsing on Py parser (#7663) (#7664) d5c12ba8 [PR #7661/85713a48 backport][3.8] Update Python parser for RFCs 9110/9112 (#7662) 8a3977ac [PR #7272/b2a7983a backport][3.8] Fix Read The Docs config (#7650) bcc416e5 [PR #7647/1303350e backport][3.8] Upgrade to llhttp 9.1.3 (#7648) b30c0cd2 Remove chardet/charset-normalizer. (#7589) 5946c743 CookieJar - return 'best-match' and not LIFO (#7577) (#7588) 8c4ec62f [PR #7518/8bd42e74 backport][3.8] Fix GunicornWebWorker max_requests_jitter not work (#7519) a0d234df Use lenient headers for response parser (#7490) (#7492) f92b27b0 Update to LLHTTP 9 (#7485) (#7487) 8129d26f [PR #7480/1fb06bbc backport][3.8] Fix error pointer on linebreaks (#7482) 8d701c3d Fix PermissionError when loading .netrc (#7237) (#7378) (#7395) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pillow: Fix CVE-2023-44271dnyandev2024-01-122-0/+157
| | | | | | | | | | Add patch to fix CVE-2023-44271 Reference: https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7 Signed-off-by: Dnyandev Padalkar <padalkards17082001@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-23 21:38:40 +0000