From ff180c63595661f21131d96c0163e32b14f1ac19 Mon Sep 17 00:00:00 2001 From: Leon Anavi Date: Tue, 3 Nov 2026 12:23:31 +0200 Subject: [PATCH] python3-cbor2: Upgrade 6.1.5 -> 6.2.0.post1 Upgrade to release 6.2.0.post1: - Build Pyodide (pyemscripten) wheels for Python 3.14 From 6.2.0: - Added the strict_hashable_types parameter to CBORDecoder, load() and loads() which, when enabled, restricts map keys and set elements to text strings and byte strings in order to prevent denial-of-service attacks via hash collisions (GHSA-p6xp-9h6j-r278) - Documented decoding concatenated CBOR objects with EOF checks between objects - Fixed CBOREncoder.encode_to_bytes() sharing the string reference namespace of the enclosing encode operation when called from a default hook - Fixed the encoder writing the repr() of a bytes regular expression pattern (tag 35) instead of the pattern itself, so the regular expression decoded back as the text pattern b'...' and no longer matched the same input - Fixed shared references (tag 29) allowing the decoder to construct object graphs nested deeper than max_depth, which could crash the interpreter with a segmentation fault when such an object was hashed (as a map key or set member) (GHSA-55vx-2phh-7grr) - Fixed mission conversion of date values (tags 100 and 1004) to JSON as ISO formatted strings - Fixed a PanicException on Python 3.10 when decoding a string-form datetime (tag 0) whose fractional seconds part contains a multi-byte Unicode numeric character, as the microsecond padding treated those as digits and then truncated the part on a byte index inside one of them - Fixed the decoder accepting a set (tag 258) whose payload is not an array, folding a text string, byte string or map into a set of its characters, bytes or keys instead of rejecting it - Fixed the decoder accepting a non-integer exponent or mantissa in a decimal fraction (tag 4) or a bigfloat (tag 5) Signed-off-by: Leon Anavi Signed-off-by: Khem Raj --- .../{python3-cbor2_6.1.5.bb => python3-cbor2_6.2.0.post1.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-cbor2_6.1.5.bb => python3-cbor2_6.2.0.post1.bb} (87%) diff --git a/meta-python/recipes-devtools/python/python3-cbor2_6.1.5.bb b/meta-python/recipes-devtools/python/python3-cbor2_6.2.0.post1.bb similarity index 87% rename from meta-python/recipes-devtools/python/python3-cbor2_6.1.5.bb rename to meta-python/recipes-devtools/python/python3-cbor2_6.2.0.post1.bb index 94d3f30dbb..aa5839a932 100644 --- a/meta-python/recipes-devtools/python/python3-cbor2_6.1.5.bb +++ b/meta-python/recipes-devtools/python/python3-cbor2_6.2.0.post1.bb @@ -3,7 +3,7 @@ LICENSE = "MIT" LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=a79e64179819c7ce293372c059f1dbd8" DEPENDS += "python3-setuptools-scm-native" -SRC_URI[sha256sum] = "6eb06160c42315ac0c4ded461c7d84d92fa18c69d13d17fc1dfc1fae96580c95" +SRC_URI[sha256sum] = "2465ecef686b61e9feee840f506ef1cc15fa568825344c7b0af504b8230b698c" inherit pypi python_setuptools3_rust cargo-update-recipe-crates ptest-python-pytest