AIOHTTP is an asynchronous HTTP client/server framework for asyncio and
Python. Prior to version 3.12.14, the Python parser is vulnerable to a
request smuggling vulnerability due to not parsing trailer sections of
an HTTP request. If a pure Python version of aiohttp is installed (i.e.
without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled,
then an attacker may be able to execute a request smuggling attack to
bypass certain firewalls or proxy protections. Version 3.12.14 contains
a patch for this issue.
References:
https://nvd.nist.gov/vuln/detail/CVE-2025-53643
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
pycares is a Python module which provides an interface to c-ares. c-ares
is a C library that performs DNS requests and name resolutions
asynchronously. Prior to version 4.9.0, pycares is vulnerable to a
use-after-free condition that occurs when a Channel object is garbage
collected while DNS queries are still pending. This results in a fatal
Python error and interpreter crash. The vulnerability has been fixed in
pycares 4.9.0 by implementing a safe channel destruction mechanism.
References:
https://nvd.nist.gov/vuln/detail/CVE-2025-48945
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Add a submitted patch to support the reproducible generation of
intermediate file ecodes.c, then, use it to fix the buildpaths errors.
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Commit 01ebfecf1c ("python3-evdev: switch to PEP-517 build backend")
did not update the way build arguments are passed to the build making
them unused. In python3-evdev case that meant that the build used host
kernel headers instead of Yocto's.
When host's and Yocto's headers were different (currently the case on
Debian 12 as seen on AB[0]), that triggered:
| src/evdev/ecodes.c:542:29: error: 'KEY_LINK_PHONE' undeclared (first use in this function); did you mean 'KEY_PICKUP_PHONE'?
| 542 | PyModule_AddIntMacro(m, KEY_LINK_PHONE);
| | ^~~~~~~~~~~~~~
[...]
ERROR: Task (.../../../layers/meta-openembedded/meta-python/recipes-devtools/python/python3-evdev_1.9.1.bb:do_compile) failed with exit code '1'
To fix this, use PEP517_BUILD_OPTS with the working (but weird looking) escaping.
Now that correct headers are used, their paths end up in the ecode.c
file which lead to a buildpaths error, skip the check for this patch.
This will be fixed in a following patch.
[0]: https://autobuilder.yoctoproject.org/valkyrie/#/builders/87/builds/40/steps/40/logs/stdio
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
python3-can 4.4.y requires msgpack~=1.0.0, but openembedded-core
versions newer than scarthgap provide msgpack 1.1.0 [1], causing
"pip check" to fail with the following error:
python-can 4.4.2 has requirement msgpack~=1.0.0; platform_system != "Windows", but you have msgpack 1.1.0.
This patch resolves the issue by updating python3-can to 4.5.0.
[1] https://layers.openembedded.org/layerindex/recipe/66997/
(cherry picked from commit f048d118f2)
Cc: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Leitner <dev@g0hl1n.net>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
python3-moteus <= 0.3.87 requires numpy<2 [1], but openembedded-core
versions newer than styhead provide numpy 2.x [2], causing "pip check" to
fail with the following error:
moteus 0.3.87 has requirement numpy<2, but you have numpy 2.3.0.
This patch resolves the issue by updating python3-moteus to 0.3.88.
[1] https://github.com/mjbots/moteus/issues/89
[2] https://layers.openembedded.org/layerindex/recipe/51338/
(cherry picked from commit 9af65f1680)
(cherry picked from commit 7414d1147e)
(cherry picked from commit 980f7e5da4)
(cherry picked from commit c2c4428c31)
(all cherry-picks were squashed to this commit)
Cc: Leon Anavi <leon.anavi@konsulko.com>
Cc: Wang Mingyu <wangmy@fujitsu.com>
Cc: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Leitner <dev@g0hl1n.net>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
* fixes:
https://lists.openembedded.org/g/openembedded-devel/message/117255
DEBUG: Executing shell function do_compile
* Getting build dependencies for wheel...
/usr/lib/ld-linux-aarch64.so.1: No such file or directory
Traceback (most recent call last):
File "TOPDIR/BUILD/work/raspberrypi4_64-webos-linux/python3-posix-ipc/1.2.0/recipe-sysroot-native/usr/lib/python3.13/site-packages/pyproject_hooks/_in_process/_in_process.py",
line 389, in <module>
main()
~~~~^^
File "TOPDIR/BUILD/work/raspberrypi4_64-webos-linux/python3-posix-ipc/1.2.0/recipe-sysroot-native/usr/lib/python3.13/site-packages/pyproject_hooks/_in_process/_in_process.py",
line 373, in main
json_out["return_val"] = hook(**hook_input["kwargs"])
~~~~^^^^^^^^^^^^^^^^^^^^^^^^
File "TOPDIR/BUILD/work/raspberrypi4_64-webos-linux/python3-posix-ipc/1.2.0/recipe-sysroot-native/usr/lib/python3.13/site-packages/pyproject_hooks/_in_process/_in_process.py",
line 143, in get_requires_for_build_wheel
return hook(config_settings)
File "TOPDIR/BUILD/work/raspberrypi4_64-webos-linux/python3-posix-ipc/1.2.0/recipe-sysroot-native/usr/lib/python3.13/site-packages/setuptools/build_meta.py",
line 334, in get_requires_for_build_wheel
return self._get_build_requires(config_settings, requirements=[])
~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "TOPDIR/BUILD/work/raspberrypi4_64-webos-linux/python3-posix-ipc/1.2.0/recipe-sysroot-native/usr/lib/python3.13/site-packages/setuptools/build_meta.py",
line 304, in _get_build_requires
self.run_setup()
~~~~~~~~~~~~~~^^
File "TOPDIR/BUILD/work/raspberrypi4_64-webos-linux/python3-posix-ipc/1.2.0/recipe-sysroot-native/usr/lib/python3.13/site-packages/setuptools/build_meta.py",
line 320, in run_setup
exec(code, locals())
~~~~^^^^^^^^^^^^^^^^
File "<string>", line 23, in <module>
File "TOPDIR/BUILD/work/raspberrypi4_64-webos-linux/python3-posix-ipc/1.2.0/posix_ipc-1.2.0/build_support/discover_system_info.py",
line 409, in discover
d["QUEUE_PRIORITY_MAX"] = sniff_mq_prio_max()
~~~~~~~~~~~~~~~~~^^
File "TOPDIR/BUILD/work/raspberrypi4_64-webos-linux/python3-posix-ipc/1.2.0/posix_ipc-1.2.0/build_support/discover_system_info.py",
line 238, in sniff_mq_prio_max
if max_priority < 0:
^^^^^^^^^^^^^^^^
TypeError: '<' not supported between instances of 'str' and 'int'
ERROR Backend subprocess exited when trying to invoke
get_requires_for_build_wheel
WARNING: TOPDIR/BUILD/work/raspberrypi4_64-webos-linux/python3-posix-ipc/1.2.0/temp/run.do_compile.2736023:168
exit 1 from 'nativepython3 -m build --no-isolation --wheel --outdir
TOPDIR/BUILD/work/raspberrypi4_64-webos-linux/python3-posix-ipc/1.2.0/dist
TOPDIR/BUILD/work/raspberrypi4_64-webos-linux/python3-posix-ipc/1.2.0/posix_ipc-1.2.0'
WARNING: Backtrace (BB generated script):
On some hosts.
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
0001-Use-default-cc-from-environment-variable.patch
removed since it's not available in 1.2.0
License-Update: Reorg and rename files; add pyproject.toml
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
* Current SRCREV is v2.2a1, update to v2.2
* pyyaml-include use setuptools_scm to get package version, but it not
works well with git shallow clone, and will return a invalid version
like 0.1.dev1+gc5be2b7, make pyyaml-include is installed to a wrong
path: /usr/lib/python3.13/site-packages/pyyaml_include-0.1.dev1+gc5be2b7.dist-info,
and also version in PKG-INFO is wrong.
export SETUPTOOLS_SCM_PRETEND_VERSION to get correct package version.
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
America/Coyhaique has changed recently and unless the tzdata is sync'ed
this will fail, so disable for now.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade python-blivet from 3.9.2 to 3.12.1:
* rebase 0002-run_program-support-timeout.patch
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Switch to use python_setuptools_build_meta after the commit [1]
introduced in the new version.
Changelog:
https://github.com/pydot/pydot/blob/main/ChangeLog
[1] d1627c95cb
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
