From c0f1ddc31d49263a7bdf8a89ec077103f8cf3fe9 Mon Sep 17 00:00:00 2001 From: Devansh Patel Date: Tue, 25 Aug 2026 22:30:18 -0700 Subject: [PATCH] python3-cbor2: use exact CVE_PRODUCT mapping The inherited "python:cbor2" mapping does not identify the packaged source. Use "agronholm:cbor2", its NVD dictionary CPE and NVD configuration identity, restoring the source-aligned records. Backport note: master replaces a product-only mapping in version 6.1.4; Scarthgap 5.6.4 has no recipe-local override, so this is an addition. Signed-off-by: Devansh Patel Signed-off-by: Khem Raj (cherry picked from commit 7f59d247eea101ad62ded8e2e0bd5419dd65eb79) Signed-off-by: Devansh Patel Signed-off-by: Anuj Mittal --- meta-python/recipes-devtools/python/python3-cbor2_5.6.4.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-python/recipes-devtools/python/python3-cbor2_5.6.4.bb b/meta-python/recipes-devtools/python/python3-cbor2_5.6.4.bb index f6296571a6..0c1020aa46 100644 --- a/meta-python/recipes-devtools/python/python3-cbor2_5.6.4.bb +++ b/meta-python/recipes-devtools/python/python3-cbor2_5.6.4.bb @@ -39,4 +39,6 @@ RDEPENDS:${PN} += " \ python3-datetime \ " +CVE_PRODUCT = "agronholm:cbor2" + BBCLASSEXTEND = "native nativesdk"