tests/test_core.py runs glances with ./conf/glances.conf and reads plugin
test data from ./tests-data, both relative to the ptest directory.
Neither was installed, and tests-data is not part of the pypi sdist, so
four tests failed:
test_023_get_alert: AssertionError: 'DEFAULT' != 'OK_LOG'
test_025_npu: IndexError: list index out of range
test_026_mpp: AssertionError: 0 != 3 : Expected 3 MPP engines
test_108_fs_zfs_: AssertionError: False is not true
Fetch tests-data from the v4.5.6 tag and install it, together with
conf/, next to the tests. Only tests-data/plugins is used by the tests.
With these in place tests/test_core.py passes 52/52 on qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 4.5.6:
Bugs corrected:
- Alert level decided by dict ordering: a failing+slow URL is
downgraded to WARNING, an unscanned URL reports CRITICAL
- GPU plugin duplicates card name and omits N/A for unavailable
metrics in multi-GPU
- GPU plugin duplicates the utilisation value and paints it with
the memory colour in multi-GPU
- IP plugin displays wrong interface: outer loop in get_ip_address()
never breaks
- VideoCore (v3d) memory shows ~93% on Raspberry Pi 5 with
gpu_mem=4M - misleading denominator from drm-total-memory
- CSV export: --stdout-csv data rows desync from header when
network interfaces change count at runtime
- Glances Network plugin with mismatched schema not logging in
TimescaleDB export
Security patches:
- as_dict_secure() Value-Level Bypass Leaks Credentials in URL
Values via /api/4/config - CVE-2026-68520
- --disable-config-exec does not cover on-alert action commands
- CVE-2026-68519
- Command injection bypass of action-template sanitizer via
cross-field shell-operator reconstruction - CVE-2026-68518
- Incomplete fix of CVE-2026-32608: action-template sanitizer is
bypassed by nested stat values - CVE-2026-62982
- REST API CORS Credentials Guard Uses Exact-Match Instead of
Membership Test - CVE-2026-68517
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Khem Raj
Leon Anavi