From 166a07306b8795714f032b7ccc195fd37bd6bc93 Mon Sep 17 00:00:00 2001 From: Leon Anavi Date: Thu, 12 Nov 2026 23:58:50 +0200 Subject: [PATCH] python3-cmd2: Upgrade 4.4.1 -> 4.4.2 Upgrade to release 4.4.2 with security fixes: - Fixed shell command injection through file names in the edit command and Cmd.run_editor(). A file name containing shell syntax such as $(...) or backticks was interpreted by the shell instead of being passed to the editor as-is. On Windows, run_editor() now raises ValueError for an editor or file path containing a double quote, which cannot be passed safely to cmd.exe. - The persistent history file is now readable and writable only by its owner (mode 0600 on POSIX), since history can contain secrets typed as command arguments. The permissions of an existing history file are tightened the next time history is saved. Signed-off-by: Leon Anavi Signed-off-by: Khem Raj --- .../python/{python3-cmd2_4.4.1.bb => python3-cmd2_4.4.2.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-cmd2_4.4.1.bb => python3-cmd2_4.4.2.bb} (87%) diff --git a/meta-python/recipes-devtools/python/python3-cmd2_4.4.1.bb b/meta-python/recipes-devtools/python/python3-cmd2_4.4.2.bb similarity index 87% rename from meta-python/recipes-devtools/python/python3-cmd2_4.4.1.bb rename to meta-python/recipes-devtools/python/python3-cmd2_4.4.2.bb index e3e8d075e6..577eaff41c 100644 --- a/meta-python/recipes-devtools/python/python3-cmd2_4.4.1.bb +++ b/meta-python/recipes-devtools/python/python3-cmd2_4.4.2.bb @@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=f2a861642858e0858af9dd4e4716bae0" DEPENDS += "python3-setuptools-scm-native" -SRC_URI[sha256sum] = "e8ef3f9bf2fb8f72acddaf934b97c49d14c6ae2be7271c547b97593abdea6c1e" +SRC_URI[sha256sum] = "677696e293a1a6a310425d3d52e470518078918585d650fa7eff10635ef4256a" inherit pypi python_setuptools_build_meta python3native