Commit Graph
10678 Commits
Author SHA1 Message Date
Leon Anavi 7e47f3e37e python3-anyio: Upgrade 4.14.2 -> 4.15.1
Upgrade to release 4.15.1:

- Implemented a compatibility fix for supporting direct access of
  anyio.* submodules from the main package even when those
  submodules were not directly imported first.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-18 12:39:52 -07:00
Leon Anavi 16b75e0446 python3-alembic: Upgrade 1.19.1 -> 1.20.0
Upgrade to release 1.20.0:

usecase:

- [usecase] [batch] Added a warning for the case where an unnamed
  CHECK constraint on a reflected table is omitted from a batch
  "recreate" operation.  An unnamed CHECK constraint can't be
  reliably carried over in a batch recreate as it may refer to
  columns that are being dropped or changed.  This omission was
  previously a silent operation.   The presence of any
  ~sqlalchemy.schema.CheckConstraint in
  Operations.batch_alter_table.table_args is taken to indicate that
  the case has been accommodated, and no warning is emitted.

- [usecase] [autogenerate] Autogenerate now renders a warning
  comment above any rendered Operations.drop_constraint() directive
  for which the constraint name is None, as is the case when a
  constraint that has no name in the model is dropped, most
  typically within the downgrade() function of a migration that
  adds an unnamed constraint.  A warning is also emitted on the
  console when the migration script is generated. The directive
  requires a non-None name in order to be able to emit a "DROP
  CONSTRAINT" command.

bug:

- [bug] [batch] Fixed bug in batch mode where adding a column with
  a type that generates its own CHECK constraint, such as
  ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum with
  ~sqlalchemy.types.Boolean.create_constraint set to True, would
  emit the constraint twice when the table was recreated, once
  under the name generated by the naming convention in use and once
  under the name given to the type.  The constraint is now emitted
  once, using the same name that would be used outside of batch
  mode.

- [bug] [batch] Fixed bug in batch mode where a CHECK constraint
  generated by a type such as ~sqlalchemy.types.Boolean or
  ~sqlalchemy.types.Enum would lose the name established for it by
  the naming convention in use when the table was recreated, as the
  constraint was regenerated against the temporary table used for
  the recreate operation.  The naming convention is now resolved
  against the name of the table being replaced.

As part of this change, a type that generates a CHECK constraint
but has no name of its own, used in conjunction with a naming
convention that includes the %(constraint_name)s token, now emits a
warning, as the convention has no name to interpolate; the
constraint continues to be emitted without a name.  As noted at
batch_check_constraints, these datatypes should be given a name in
order to participate fully in batch mode.

- [bug] [batch] Fixed bug in batch mode where the
  Operations.batch_alter_table.naming_convention parameter would
  re-generate the names of constraints that already had a name when
  reflected, in the case where the convention included the
  %(constraint_name)s token, leading to a name that included the
  convention's own prefix twice.  The convention is now applied
  only to those constraints that are reflected without a name,
  which is the use case the parameter is documented for.

- [bug] [mysql] Fixed bug where autogenerate with
  EnvironmentContext.configure.compare_server_default would report
  a persistent server default change for Float, Numeric and other
  decimal columns on MySQL. MySQL reports a literal server default
  for such a column either in quoted form, e.g. '1', or, when the
  value is fractional, as a parenthesized expression, e.g. (2.5);
  neither form was accommodated for columns other than those of
  Integer affinity, so that a default such as server_default="1" on
  a sqlalchemy.Float column would never compare as equal to the
  reflected value.

- [bug] [mysql] Fixed bug where autogenerate with
  EnvironmentContext.configure.compare_server_default would report
  a persistent server default change for an expression server
  default such as (rand()). MySQL reports such a default with the
  surrounding parenthesis included whereas MariaDB reports it
  without them, so that the parenthesis are now disregarded when
  comparing.

misc:

- [change] [general] Support for SQLAlchemy 1.4 is dropped as of
  Alembic 1.20.0; SQLAlchemy 2.0.0 is now the minimum required
  version. SQLAlchemy 1.4 has no support for Python 3.13 and above,
  and the version-conditional code paths it required throughout
  Alembic have been removed in favor of the SQLAlchemy 2.0 API.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-18 12:39:52 -07:00
Leon Anavi 36dcb28f2d python3-pybase64: Upgrade 1.5.0 -> 1.5.1
Upgrade to release 1.5.1:

- fix: swap PyBuffer_Release and PyErr_Format to prevent
  Use-After-Release

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-18 12:39:52 -07:00
Leon Anavi 3afa4ec562 python3-unidiff: Upgrade 1.0.0 -> 1.0.1
Upgrade to release 1.0.1:

- Parse consecutive added files sharing /dev/null source
- Handle empty (incl. DOS) context lines in metadata_only parsing
- Expose git submodule file mode via is_submodule
- Raise UnidiffParseError on target header without source
- Handle binary diffs without a target filename

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-18 12:39:51 -07:00
Leon Anavi 2be82b113e python3-wrapt: Upgrade 2.5.0 -> 2.5.1
Upgrade to release 2.5.1:

- A LazyObjectProxy created with an interface argument that declared
  a path-like type, such as os.PathLike or pathlib.Path, did not
  define the __fspath__() special method on the class it generated.
  Because os.fspath() looks up __fspath__() on the type of the
  object, passing such a proxy to os.fspath(), the builtin open()
  or other standard library functions accepting paths raised
  TypeError before the factory callable had been invoked to create
  the wrapped object. The __fspath__() special method is now added
  when the declared interface provides it, in the same way as is
  already done for the other special methods looked up on the type,
  so the first path conversion triggers creation of the wrapped
  object and succeeds. With thanks to Muneeb Sheikh.
- A callback passed to wrapt.WeakFunctionProxy which was callable
  but evaluated as false, such as an event emitter object which
  reports its number of subscribers via __len__() and is empty when
  first created, was passed the underlying weak reference object
  instead of the proxy when the wrapped function expired. Where the
  wrapped function was a bound method, such a callback could also
  be called twice, once each when the instance and the function
  expired. Only None is now treated as meaning no callback was
  supplied, which mirrors the behaviour of weakref.ref() and
  weakref.proxy() in the standard library, so these callbacks now
  receive the proxy and are called only once, as for any other
  callback. With thanks to Huanyi Xie.
- A wrapt.AdapterFactory instance passed as the adapter argument
  to wrapt.decorator was ignored, and so never called, if the
  instance evaluated as false, such as when the factory class
  defined __bool__() or __len__(). The decorated function then
  retained its original signature instead of that produced by the
  factory. Whether an adapter factory was supplied is now
  determined by type before the truth value of the adapter is
  considered, so such factories are always called. As a consequence
  of this change a factory can now also return None, or any other
  false value, to indicate that no adapter should be used for a
  particular function, where previously this failed with an obscure
  error. With thanks to Luochenchen.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-18 12:39:51 -07:00
Khem Raj 53c0b99a78 python3-posix-ipc: fix feature probing instead of forcing -lrt
posix_ipc decides at build time whether it needs librt and whether
message queues are available by compiling small probe programs in
build_support/discover_system_info.py. Its does_build_succeed() splices
the linker option into the compiler argv verbatim, so when no extra
library is wanted the compiler is called with a literal empty argument:

  $CC -Wall -o foo foo.c '' -lpthread

GNU ld treats '' as an input file and fails ("cannot find : No such
file or directory"); lld ignores it. With the gcc toolchain every probe
without -lrt therefore fails, the prober wrongly decides librt is
required, and on a C library without a usable librt message queue
support is dropped - which is how posix_ipc.MessageQueue went missing
(issue #916). The result depends on the linker rather than on what the
C library provides.

The previous LDFLAGS += "-lrt" workaround only papered over this, and
is itself libc specific: it forces linking librt even where mq_* live
in libc (glibc >= 2.34, musl).

Fix the prober to split linker_options with shlex, like it already does
for CC, so an empty value adds no argument, and drop the forced -lrt so
the probes decide per C library.

Verified on qemux86-64 for glibc and musl, each with the clang and gcc
toolchains: src/system_info.h defines MESSAGE_QUEUE_SUPPORT_EXISTS,
SEM_GETVALUE_EXISTS and SEM_TIMEDWAIT_EXISTS, and the extension module
imports all mq_* from libc with no librt NEEDED entry.

Fixes: https://github.com/openembedded/meta-openembedded/issues/916

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-16 09:50:39 -07:00
Ankur Tyagi 0fd1d3c996 python3-simpleeval: upgrade 1.0.7 -> 1.0.8
Changelog:
https://github.com/danthedeckie/simpleeval/releases/tag/1.0.8

PTEST pass:

root@qemux86-64:~# ptest-runner python3-simpleeval
START: ptest-runner
2026-10-16T03:38
BEGIN: /usr/lib/python3-simpleeval/ptest
...
Testsuite summary
# TOTAL: 164
# PASS: 164
# SKIP: 0
# XFAIL: 0
# FAIL: 0
# XPASS: 0
# ERROR: 0
DURATION: 12
END: /usr/lib/python3-simpleeval/ptest
2026-10-16T03:38
STOP: ptest-runner
TOTAL: 1 FAIL: 0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:32:08 -07:00
Ankur Tyagi 077a9459c5 python3-setproctitle: upgrade 1.3.7 -> 1.3.8
Changelog:
https://github.com/dvarrazzo/py-setproctitle/releases/tag/version-1.3.8

PTEST pass:

root@qemux86-64:~# ptest-runner python3-setproctitle
START: ptest-runner
2026-10-16T03:19
BEGIN: /usr/lib/python3-setproctitle/ptest
...
...
Testsuite summary
# TOTAL: 27
# PASS: 24
# SKIP: 3
# XFAIL: 0
# FAIL: 0
# XPASS: 0
# ERROR: 0
DURATION: 40
END: /usr/lib/python3-setproctitle/ptest
2026-10-16T03:20
STOP: ptest-runner
TOTAL: 1 FAIL: 0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:32:08 -07:00
Ankur Tyagi a78362fc9c python3-pyjwt: upgrade 2.13.0 -> 2.14.0
Changelog:
https://github.com/jpadilla/pyjwt/blob/2.14.0/CHANGELOG.rst

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:32:08 -07:00
Ankur Tyagi c771201a90 python3-coverage: upgrade 7.16.1 -> 7.16.2
Changelog:
https://coverage.readthedocs.io/en/7.16.2/changes.html#version-7-16-2-2026-09-27

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:32:07 -07:00
Ankur Tyagi 31b87d86eb python3-configargparse: upgrade 1.7.7 -> 1.8.0
Changelog:
https://github.com/bw2/ConfigArgParse/releases/tag/v1.8.0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:32:07 -07:00
Ankur Tyagi 77b5122f82 python3-charset-normalizer: upgrade 3.5.1 -> 3.5.2
Changelog:
https://github.com/jawah/charset_normalizer/releases/tag/3.5.2

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:32:07 -07:00
Ankur Tyagi 6b247627d7 python3-cbor2: upgrade 6.1.4 -> 6.1.5
Changelog:
https://github.com/agronholm/cbor2/releases/tag/6.1.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:32:07 -07:00
Ankur Tyagi 287e84e95c python3-bitarray: upgrade 3.11.0 -> 3.12.2
Changelog:
https://github.com/ilanschnell/bitarray/blob/3.12.2/CHANGE_LOG

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:32:07 -07:00
Ankur Tyagi 7548d46b09 python3-astroid: upgrade 4.3.3 -> 4.3.4
Changelog:
https://github.com/pylint-dev/astroid/releases/tag/v4.3.4

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:32:07 -07:00
Ankur Tyagi a2692a051c python3-aiohttp: upgrade 3.14.4 -> 3.14.5
Changelog:
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:32:06 -07:00
Khem Raj 56e7d0bd84 meta-python-image-ptest: Give pint and pydantic-core ptests 2G of memory
Both ptests get killed by the OOM killer with the default 1G:

  Out of memory: Killed process 390 (python3) total-vm:946408kB, anon-rss:909840kB

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:27:00 -07:00
Khem Raj e52b68f598 python3-arrow: Add python3-zoneinfo to RDEPENDS
arrow/parser.py imports zoneinfo, falling back to backports.zoneinfo
which is not available either, so importing arrow fails on target:

  ModuleNotFoundError: No module named 'zoneinfo'

Seen in python3-construct ptests.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:27:00 -07:00
Khem Raj ae297b5d0a python3-cucumber-expressions: Fix build with uv >= 0.13
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:27:00 -07:00
Khem Raj dca840f69d python3-pytest-benchmark: add missing runtime dependencies
The plugin imports modules from the datetime, json, misc, netclient,
numbers, profile and statistics python3 packages, so ptests of recipes
using it fail on images that don't pull those in otherwise.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:22:02 -07:00
Khem Raj d3265eaeb4 python3-parse-type: fix test_numbered ptest with parse 1.22.2
parse 1.22.2 made {:f} also accept nan/inf, which changed the generated
regex. Update the copied parse test expectation to match.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:22:02 -07:00
Khem Raj d7e3363539 python3-dnspython: seed resolv.conf from /proc/net/pnp in run-ptest
The live resolver tests use the system resolver configuration. When the
network is configured by the kernel ip= parameter and nothing in userspace
writes /etc/resolv.conf, the nameserver is only available in /proc/net/pnp
and the tests fail with "no nameservers". Seed resolv.conf from it when
it has no nameserver entry.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:22:02 -07:00
Alex Kiernan 57918219f8 python3-asyncvarlink: upgrade 0.3.2 -> 0.3.3
Alex Kiernan (2):
      VarlinkTransport: stop reading after a failed peek
      VarlinkTransport: treat a failed read as a lost connection

Colin Watson (1):
      types: return NotImplemented from __eq__ for type errors

Helmut Grohne (37):
      varlinkmethod: allow overriding the return type
      reduce contents of the main import and avoid star imports
      CI: tune certification socket timeout
      CI: fixup certification timeout change
      document that it is uploaded to PyPI
      docs/structure.rst: finish truncated paragraph on file descriptors
      pyproject.toml: document development packages
      VarlinkTransport: send correct data on partial send
      validate_interface: fix acceptance of garbage at end
      create_unix_server: actually make the socket non-inheritable
      docs: adapt documentation to pause_reading/resume_reading rename
      __init__.py: improve language of initial __doc__ string
      GenericVarlinkErrorReply: provide a __str__ method
      connect_unix_varlink: fix resource leak in error path
      VarlinkTransport: delay eof_received call
      VarlinkTransport: remember the readable handler function
      VarlinkTransport: turn a magic number into a class attribute
      expand ci coverage to Python 3.15
      VarlinkTransport: fix association of messages and file descriptors
      correctly determine whether typing.override exists
      fix result type of wrapped varlinkmethod
      github: allow manually scheduling workflows
      test_protocol.py: fix missing import
      VarlinkTransport: tighten assertion
      test_protocol.py: close the transport, not the connections
      VarlinkTransport: harden resume_reading against concurrent closing
      TransportTests.test_send_socket: avoid exceptions in callbacks
      VarlinkClientProtocol.call: avoid failing future with no consumers
      test_certification.py: delete unused import
      test_protocol.py: delete unused import again
      tests: add StrictAsyncioTestCase helper class and use it
      tests: another type hint improvement
      test_conversion.py: increase precsion of two type annotations
      varlinkmethod: clarify that the type annotation must signal generators
      add a HACKING.md file clarifying development processes
      add the justfile promised in HACKING.md
      upload to pypi as version 0.3.3

Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-13 18:57:12 -07:00
Peter Marko c387452547 python3-thrift: upgrade 0.22.0 -> 0.25.0
This upgrade includes fix for 61 CVEs, many of them are for python.
Add a dependency missing at least since 0.20.0 for code:

lib/py/src/server/TProcessPoolServer.py:from multiprocessing import Process, Value, Condition

Release announcement: [1]
Release notes: [2]

[1] https://lists.apache.org/thread/prryfzdozvt6t02c9k5jf46or3m7ctzy
[2] https://github.com/apache/thrift/blob/v0.25.0/CHANGES.md

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-13 12:30:07 -07:00
Alex Kiernan cbf3962ed4 python3-yarl: upgrade 1.24.5 -> 1.25.1
aiohttp 3.14.4 requires yarl >= 1.25.1 and imports query_to_pairs,
which 1.24.5 does not have, so importing aiohttp.web fails with:

  ImportError: cannot import name 'query_to_pairs' from 'yarl'

AI-Generated: Claude Opus 5.5 (Claude Code)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-13 12:30:07 -07:00
Leon Anavi cae9015e84 python3-wrapt: Upgrade 2.4.0 -> 2.5.0
Upgrade to release 2.5.0:

- Added with_doc, a decorator for overriding the docstring that
  help(), pydoc and other introspection tools see for a wrapped
  callable without mutating the wrapped function itself. It is the
  companion of with_signature. The docstring can be supplied
  directly, or as a factory callable that derives it from the
  wrapped function at decoration time. When stacked above
  with_signature the factory sees the overridden signature and can
  embed it in the docstring. Assigning to __doc__ on the resulting
  wrapper replaces the override, and deleting it restores
  delegation to the wrapped function. Previously the only option
  was to assign to __doc__ on a wrapper, which writes through to
  the wrapped function since __doc__ on every proxy delegates to
  the wrapped object, and so changed what was reported for the
  wrapped function everywhere. The override is handled for instance
  methods, class methods and static methods, and propagates through
  outer wrapt decorators stacked on top. See the "Docstring
  Override" section of Bundled Decorators for details.
- with_signature now accepts a doc argument for overriding the
  docstring at the same time as the signature, and the factory
  callable may return a tuple of (signature_or_prototype,
  docstring) so that a single factory can derive both from the
  wrapped function in one pass. When doc is supplied, the docstring
  from the tuple is ignored. When neither is given, __doc__
  continues to delegate to the wrapped function as before,
  including for assignment and deletion.
- A class derived from wrapt.BaseObjectProxy may now define __doc__
  as a property, or other descriptor, in its class body, and that
  is used for instances of the class in place of the default
  delegation of __doc__ to the wrapped object. This works with both
  the pure Python implementation and the C extension, and the
  descriptor is inherited by further derived classes. Previously
  the pure Python metaclass overwrote such a descriptor with the
  default delegating property, and the C extension forwarded
  __doc__ to the wrapped object before consulting the type, so it
  was never used. Only __doc__ is affected, with __module__ always
  delegating to the wrapped object. This is the mechanism with_doc
  relies on.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-13 12:30:06 -07:00
Leon Anavi a593dc46ec python3-texttable: Upgrade 1.7.0 -> 1.7.1
Upgrade to release 1.7.1:

- Consume Python 3 row iterators when reading table headers
- Invalidate horizontal lines when characters or widths change

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-13 12:30:06 -07:00
Ankur Tyagi 96cedce046 python3-eventlet: mark CVE-2023-29483 fixed
Fix[1] for the CVE is part of the upstream version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2023-29483

[1]https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4

(cherry picked from commit 47b2ce9cc7)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 21:57:13 -07:00
Martin Jansa ced616944a Revert "python3-google-api-core, python3-googleapis-common-protos: set PYPI_PACKAGE_SDIST"
This reverts commit b9cc78ed6b.

The same issue was resolved in:
https://git.openembedded.org/meta-openembedded/diff/meta-python/recipes-devtools/python/python3-google-api-core_2.19.1.bb?id=0a583b35021692dac485c16d85b3f9a9f5601da0
with the only difference of using PYPI_PACKAGE variable
instead of another hardcoded pypi name.

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:35:57 -07:00
Ankur Tyagi ed7807e83b python3-gunicorn: mark CVE-2024-1135 patched
Debian[1] also identified the commit.

Details:
https://nvd.nist.gov/vuln/detail/cve-2024-1135

[1]https://security-tracker.debian.org/tracker/CVE-2024-1135

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-11 21:45:41 -07:00
Ross Burton 4d617d1b20 python3-pytz: add recipe (from oe-core)
This recipe is being removed from core as it is now deprecated and no
longer needed with Python 3.9 onwards, which integrated the zoneinfo
module.

All users of pytz in meta-python should be reviewed as the dependencies
may be obsolete.

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-09 10:01:43 -07:00
Ankur Tyagi 1b1057cf48 python3-cmake: upgrade 4.4.3 -> 4.4.4
Changelog:
https://github.com/scikit-build/cmake-python-distributions/releases/tag/4.4.4

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-09 10:01:40 -07:00
Ankur Tyagi 486ef820db python3-astroid: upgrade 4.3.2 -> 4.3.3
Changelog:
https://github.com/pylint-dev/astroid/releases/tag/v4.3.3

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-09 10:01:40 -07:00
Ankur Tyagi 91320f5638 python3-aiohttp: upgrade 3.14.3 -> 3.14.4
Refer to changelog for removals and backward incompatible breaking changes.

Changelog:
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-09 10:01:39 -07:00
Ankur Tyagi c39562d398 python3-django: upgrade 6.0.8 -> 6.0.9
Changelog:
https://docs.djangoproject.com/en/dev/releases/6.0.9/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-09 10:01:39 -07:00
Ankur Tyagi 0640fa901d python3-django: upgrade 5.2.17 -> 5.2.18
Changelog:
https://docs.djangoproject.com/en/dev/releases/5.2.18/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-09 10:01:39 -07:00
Ankur Tyagi 01bd918ea8 python3-tzdata: upgrade 2026.4 -> 2026.5
Changelog:
https://github.com/python/tzdata/releases/tag/2026.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-09 10:01:39 -07:00
Ankur Tyagi 92fff73409 python3-zeroconf: upgrade 0.151.3 -> 0.151.5
Changelog:
https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.151.4
https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.151.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-09 10:01:39 -07:00
Ankur Tyagi 0d101e1633 python3-werkzeug: upgrade 3.1.8 -> 3.1.9
Changelog:
https://github.com/pallets/werkzeug/releases/tag/3.1.9

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-09 10:01:39 -07:00
Martin Jansa b9cc78ed6b python3-google-api-core, python3-googleapis-common-protos: set PYPI_PACKAGE_SDIST
Avoid replace("-", "_") from:
https://git.openembedded.org/openembedded-core/commit/?id=98049bf86b615b10c43b3ceb9dbc73580cb76952

Otherwise do_fetch will fail due to different source archive and expected WORKDIR won't match.

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-09 10:01:38 -07:00
Ross Burton 0a583b3502 recipes: update for PYPI_PACKAGE change
The pypi class has slightly changed the semantics of the PYPI_PACKAGE
variable[1], now PYPI_PACKAGE is the normalised package name and the new
variable PYPI_PACKAGE_SDIST is used when the source tarball doesn't match.

Update recipes as appropriate: this is mostly deleting now-redundant
assignments but some assignments are still needed where packages are not
uploaded using the modern standards.

[1] oe-core 98049bf86b6 ("classes/pypi: change PYPI_PACKAGE to be normalised")

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-08 22:27:01 -07:00
Leon Anavi 8fa14064ef python3-msgspec: Upgrade 0.21.1 -> 0.22.0
Upgrade to release 0.22.0:

- BREAKING: Setting gc=False on a struct type that has a weakref
  slot, whether from weakref=True or from a base class, now raises
  ValueError. On CPython 3.12 and later the weakref slot is stored
  in a pre-header in front of the instance, so releasing an instance
  of a gc=False type with that slot corrupted memory, in most builds
  crashing the interpreter outright. The combination worked on 3.10
  and 3.11, and the restriction applies there as well, so that the
  same class definition behaves the same way on every supported
  version.
- Add frozendict support on Python 3.15+.
- Support passing a callable as decimal_format to
  msgspec.json.Encoder and msgspec.msgpack.Encoder for custom
  Decimal encoding.
- Support Literal[True] and Literal[False] types.
- Publish CPython 3.15 wheels, including freethreaded builds.
- Publish Linux riscv64 wheels.
- Support the PyEmscripten (Pyodide) platform.
- Fix handling of PEP 695 type parameter syntax (class Foo[T]) and
  of types.GenericAlias instances in type annotations.
- Fix NameError when creating a Struct with an unquoted forward
  reference on Python 3.14.
- Fix a crash on incorrect typing.ClassVar annotations (#1097).
- Fix an AttributeError when converting to a Struct type defined in
  a namespace without a __name__ (#1072).
- Fix overriding an inherited field alias back to the field's own
  name.
- Raise ValidationError instead of SystemError when convert receives
  an out-of-range int for a float target (#1162).
- Report raw rather than the misleading any as the expected type
  when a non-Raw value is given for a Raw field in convert, and
  therefore in yaml.decode and toml.decode.
- Fix an empty expected-type name in validation errors for a
  required Raw field in a TypedDict, or a Raw field with a
  default_factory on a dataclass or an attrs class.
- Correct the error messages for out-of-range Meta length bounds.
- Fix a reference leak when decoding msgpack Ext payloads.
- Fix backing type declaration of Ext.code.
- Fix a reference leak in msgspec.to_builtins, and therefore in
  yaml.encode, for array_like=True structs.
- Fix reference leaks in typenode_collect_literal,
  Meta.__rich_repr__, ms_decode_bigint, and Encoder.__init__.
- Fix msgspec.inspect.type_info and msgspec.json.schema crashing
  on mixed-type Literals such as Literal[1, None].
- Place null last in the anyOf generated for optional unions in
  JSON schemas.
- Fix minItems in the JSON schema for array_like=True structs whose
  fields are all optional.
- Use [] or "" rather than a Python set or bytearray object as the
  JSON schema default for Struct fields with a set or bytearray
  default_factory.
- Preserve JSON Schema metadata and string constraints in
  propertyNames for annotated dictionary key types.
- Fix msgspec.json.encode raising TypeError for a dict keyed by a
  plain enum.Enum with str values.
- Fix missing GC traversal and clearing of some module state
  members.
- Ensure an exception is always set on allocation failures.
- Fix compilation warnings on Python 3.15.
- Report the leading argument of the encode and decode functions
  and methods as positional-only in inspect.signature and the
  rendered docs, matching runtime behavior.
- Add overloads to the Meta type stub, so type checkers reject
  mixing gt with ge or lt with le.
- Many type stub improvements and fixes.
- Document the differences between msgspec.structs.asdict/astuple
  and msgspec.to_builtins.
- Document that omit_defaults ignores fields with a custom
  default_factory.
- Fix the msgspec.json.decode docstring to say dec_hook should
  raise NotImplementedError for unsupported types, not TypeError.
- msgspec moved to the msgspec GitHub organization.
- documentation now lives at msgspec.dev.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-01 09:27:50 -07:00
Leon Anavi 375b926f58 python3-ping3: Upgrade 5.1.5 -> 5.1.6
Upgrade to release 5.1.6:

- Use Datagram icmp_id and seq_id to match time exceeded messages
- docs: add Russian translation and fix typo in README
- docs: add Russian translation and cross-links
- Also use datagram icmp_id and seq to match destination
  unreachable messages

License-Update: Remains MIT

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-01 09:27:50 -07:00
Ross Burton 2838a98341 python3-cheetah: upgrade 3.2.6.post1 -> 3.4.0.post5
The package name changed from Cheetah3 to ct3[1], so we didn't get any
upgrade notices from AUH.  Update the PYPI_PACKAGE, and upgrade to the
latest release.

Remove the RDEPENDS on legacy-cgi, this is no longer needed[2].

License-Update: Copyright years updated.

[1] cheetah3 673259b ("The project is renamed to ``CT3`` at PyPI")
[2] cheetah3 02a4076 ("Fix(webInput): Use `parse_qs` instead of `cgi`")

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-29 09:57:21 -07:00
Leon Anavi 35c75d8978 python3-crc: Upgrade 7.1.0 -> 8.0.0
Upgrade to release 8.0.0:

- Remove Python 3.8 - 3.10 support
- Fix parameter name in documentation
- Switch from poetry to uv

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-29 07:59:04 -07:00
Leon Anavi 646b897669 python3-pika: Upgrade 1.4.2 -> 1.4.4
Upgrade to release 1.4.4:

- Revert "Fix callLater typing by passing keyword arguments"

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-29 07:59:03 -07:00
Leon Anavi 3a5f28bb16 python3-pydantic: Minor improvements
Apply minor improvements:

- Do not explicitly set PV
- Use oe.utils.trim_version('${PV}', 2) in the SRC_URI

This work was sponsored by GOVCERT.LU.

Suggested-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-29 07:59:03 -07:00
Alex Kiernan 9ba7936d93 python3-ping3: add recipe
Pure Python ICMP ping.

AI-Generated: Claude Opus 5 (Claude Code)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-29 06:49:21 -07:00
Alex Kiernan ba7f26d4e4 python3-varlink: add recipe
Reference Python Varlink binding. Fetched from git as 32.1.0 was never
published to PyPI (latest there is 31.0.0 from 2021).

AI-Generated: Claude Opus 5 (Claude Code)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-29 06:49:21 -07:00
Alex Kiernan ede527b9db python3-asyncvarlink: add recipe
asyncio Varlink binding with file-descriptor passing; interfaces are
derived from annotated Python classes.

AI-Generated: Claude Opus 5 (Claude Code)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-29 06:49:21 -07:00