The product-only "pymongo" value emits a wildcard-vendor identity and
omits the second authoritative name for the packaged MongoDB Python
driver.
Use "mongodb:python_driver" for its NVD dictionary CPE family and
"mongodb:pymongo" for its NVD dictionary CPE and configuration identity.
With sbom-cve-check 1.3.3 and the pinned database snapshots, the
generated product identity changes; the current CVE report is unchanged.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current product-only "m2crypto" mapping generates a wildcard-vendor
identity instead of the two vendors used for the packaged source.
Use "heikkitoivonen:m2crypto" and "m2crypto_project:m2crypto" for their
exact NVD dictionary CPE and NVD configuration identities. This changes
the generated CPE set, but sbom-cve-check 1.3.3 with the pinned NVD
snapshot has no current CVE report delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The product-only "py" mapping generates a wildcard-vendor identity
instead of the exact NVD identity for the packaged pytest-dev py
source. Use "pytest:py" for its NVD dictionary CPE and configuration
matches.
This changes the generated product identity. With sbom-cve-check 1.3.3,
the current CVE report is unchanged using the pinned database snapshots;
both mappings report CVE-2020-29651 and CVE-2022-42969.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current inherited "python:simpleeval" mapping is wrong for the
packaged danthedeckie SimpleEval source and misses its vulnerability
record.
Use "danthedeckie:simpleeval" for the source-aligned NVD dictionary
CPE, NVD configuration identity, and CNA affected-data identity.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The inherited python:filelock mapping does not identify the tox-dev source packaged by this recipe, so filelock CVEs are missed.
Use tox-dev:filelock to match the source identity used by NVD and CNA.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Fast serialization and validation library for JSON, MessagePack, YAML and
TOML. Added as a runtime dependency of the forthcoming python3-max recipe,
but useful on its own.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The current product-only "httplib2" mapping generates a wildcard-vendor
product identity instead of the vendor assigned to the packaged project.
Use "httplib2_project:httplib2" for its exact NVD dictionary CPE and NVD
configuration identity. This changes the generated CPE, but sbom-cve-check
1.3.3 with the pinned NVD database snapshot has no current CVE report delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current inherited "python:web3" mapping does not match the web3.py identities used by NVD and CVE List V5, so its source-aligned CVE is missed.
Use "ethereum:web3.py" for the CNA affected-data identity and "apeworx:web3.py" for the NVD dictionary CPE and configuration identity.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The product-only cbor2 mapping uses a wildcard vendor. Use
agronholm:cbor2, the NVD identity for the packaged source.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
License-Update: Copyright year updated to 2026
Changelog:
===========
- Breaking change: Drop support for Python 3.8, require Python >= 3.9
- Breaking change: Remove deprecated xxhash.VERSION_TUPLE
- Breaking change: The input keyword argument is renamed to data in
constructors and one-shot functions. update() additionally gains a data
keyword argument (it accepted no keyword arguments before).
- Breaking change: str input is no longer accepted and raises TypeError:
Strings must be encoded before hashing; encode to bytes before hashing
- Upgrade xxHash from v0.8.2 to v0.8.3. Note: on GCC/Clang source builds that
target AVX2 (e.g. -march=x86-64-v3), upstream v0.8.3 autovectorizes
XXH64_update() and makes the xxh64 streaming path about 2x slower. The shipped
wheels are built for baseline x86-64 and are unaffected. Source builds can work
around it by adding -fno-tree-vectorize to the compiler flags.
- Add per-object locking for thread safety, with sub-interpreter and
free-threaded (no-GIL) Python support. The GIL is now released only while
hashing inputs larger than 64 KiB; previously update() released it
unconditionally and one-shot functions always held it.
- Speed up hash constructors by switching them to tp_vectorcall.
- Build pyodide wasm32 wheels
- Add s390x big-endian test job
- Add Python 3.15 classifier
- CI: shard the PyPI upload into parallel groups and create the GitHub Release
automatically
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- fix(type): cast set value in _render_options
- docs: fix typo 'set the the' -> 'set then the' in config reference
- ci: pin coverage to the ctrace core
- chore: remove the misc changelog category
- test: seed the virtualenv wheel image up front
- feat(plugin): type the plugin and internal API surfaces
- test: raise timeout for missing-interpreter discovery tests
- docs: mark the INI configuration format as deprecated
- docs: publish llms.txt from the docs build
- Provision before loading env_list
- docs: repoint nine dead source links in the onboarding guide
- Add {home} and {tox_root_name} substitutions
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- Form-encoded ''POST'' bodies are now subject to a limit of 1000 arguments by default. This
prevents a CPU and memory denial of service attack. This limit can be overridden via the
'.set_parse_body_config' function.
- Multipart parsing now rejects requests with an excessive number of parts earlier in the parsing
process, limiting memory consumption.
- The deprecated mixed-case arguments to '.RequestHandler.set_cookie' now enforce the same
restrictions on invalid characters that were introduced in Tornado 6.5.5 for the standard
lowercase arguments.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
==========
- FIX: Fix issue where :is() and :where() were not accounting for empty selectors in the max selector count as they should
- FIX: Fix issue where :has() was allowing empty selectors in some circumstances even though it is not forgiving.
- FIX: Reduce selector object size when :is() and :where() contain empty selectors.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
==========
- build(deps): bump actions/checkout from 6 to 7
- build(deps): bump actions/setup-python from 6 to 7
- build(deps): bump codecov/codecov-action from 6 to 7
- fix: block distribution fields on default galaxy clusters
- Add no_sightings option to get_event
- Fix data reference in galaxy cluster fork request
- fix: [openioc] require both search-contexts before merging a composite
- feat: Add fetchFromAllFeeds
- make build_complex_query a staticmethod
- build(deps): bump github/codeql-action from 4 to 4.37.3
- build(deps): bump github/codeql-action from 4.37.3 to 4.37.4
- fix: accept datetime objects for MISPEvent timestamps in from_dict
- fix: Support in-memory STIX uploads
- fix: Correct deleted search parameter type
- build(deps): bump github/codeql-action from 4.37.4 to 4.37.6
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- Use uv instead of pip-tools
- Move dev extras to dev dependency group
- Drop support for Python 3.8, 3.9, 3.10 and 3.11
- BUGFIX: Remove all listeners only for specified event
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
License-Update: Copyright year updated to 2026
Changelog:
===========
- Speed-up translation on aarch64
- Fix invalid data successfully decoded when using altchars (slice ends with padding)
- Fix thread safety selecting codec
- Add padded and wrapcol parameters to b64encode
- Add padded parameter to urlsafe_b64encode
- Add padded parameter to b64decode & urlsafe_b64decode
- urlsafe_b64decode now defaults to padded=False to align with Python 3.15 behavior
- Add ignorechars and canonical parameters to b64decode
- Handle excess padding with the same behavior as CPython 3.15
- Reject non-ASCII strings in b64decode when validate=False
- Deprecate accepting the + and / characters with an alternative alphabet when decoding
- Use ValueError instead of AssertionError on altchars length validation
- Add SBOM to PyPI wheels
- Publish python 3.15 wheels
- Drop python 3.8 support
- Stop publishing python 3.13t wheels
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
* added support for an additional AIS Application Specific Message (Message Type 8)
* US environmental reports (DAC = 367 FID = 33)
* significantly improved decoding performance
* optimized AIS payload decoding using a base64-backed bit unpacker
* reduced NMEA parsing overhead through caching and parser optimizations
* improved enum lookup performance
* added support for additional AIS Application Specific Messages (Message Type 8)
* environmental reports (DAC = 1 FID = 26)
* area notices (DAC = 1 FID = 22/23)
* route information (DAC = 1 FID = 27/28)
* VTS and synthetic target reports
* added new enums for SOLAS equipment status and vessel ice class
* improved support for decoding application-specific AIS payloads
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
============
- Improve hall effect calibration
Fine calibration of hall transition point within the electrical cycle
Sweep through 3 electrical cycles in forward and reverse direction
If a hall sensor transition happens to be right on a sample point and oscillates, do something reasonable
- Support firmware ABI 1.1.0
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- If by_value is enabled on an enum with a None value allow_none now defaults to True.
- marshmallow.validate.URL accepts a fragment that follows an empty path
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
==========
- defer unavailable ENGINE constant lookup
- fixes problematic behaviour of pkcs11-provider
- support TLS 1.0 contexts with modern OpenSSL
- use Python 3 C APIs in handwritten SWIG code
- feat: Add AES-GCM (AEAD) support to M2Crypto
- remove Black configuration from setup.cfg
- release X509V3 config with its context
- keep IOBuffer chains alive until destruction
- test: free low-level OpenSSL objects in leak tests
- avoid leaking X509V3 extension config
- free RSA exponent on modulus conversion failure
- free replaced EVP digest contexts
- wrap created X509 name entries with ownership
- own ASN1 values created from Python data
- own PKCS7 certificate stack copies
- release BIOs on explicit close
- Add AuthorityKeyIdentifier extension support
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
============
- fix: define datetime resolution attribute
- Adapt to Ruff v0.16 defaults
- fix: preserve instance locale in datetime.astimezone()
- fix(datetime.dst): pass Gregorian to tzinfo.dst()
- typing: use int for fold
- Fix %I/%-I strftime directives to use the 12-hour clock
- Fix Windows Persian locale test
- Add pyright type checking to CI workflow
- Fix Windows test failure for %-I strftime
- migrate tests to pytest
- Add date.strptime and match stdlib subclass behavior
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
==========
- Prevented --inline-snapshot=trim from changing snapshots when a test body
fails or pytest is limited with -k, a test path, or a test node ID. Skipped
tests and fixture teardown errors do not prevent trimming. A message now
explains why trimming was disabled when it was requested implicitly. An
explicit --inline-snapshot=trim overrides this safeguard.
- Fixed a crash during session finalization when pytest's capture plugin is
disabled.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
==========
- Forward the Django database OPTIONS when setting up the stats recorder
connection.
- Remove accidental sqlite3 access at module scope,
- Use DoubleField for the stats ts, duration and started columns. On PG & MySQL
the old FloatField was a 32-bit-shitter which lost a lot of seconds of
precision. Existing PG/MySQL tables will need to run the SQL below to migrate
OR just drop the tables and allow them to be rebuilt next run. SQLite was not
affected.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
=============
- Add support for running on WebAssembly / Emscripten via Pyodide, using a
JavaScript fetch-based transport defined in httpx2-jsfetch.
- Add max_event_size to cap SSE event buffering.
- Add RFC 9110 status code constants.
- Add support for Python 3.15.
- Improve SSE chunk buffering performance.
- Skip cookie extraction for responses without Set-Cookie headers.
- Return str | None instead of Any from Headers.get.
- Enforce the WebSocket max message size across fragmented messages.
- Ignore unsolicited and duplicate WebSocket Pong frames.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
- Link the C++ runtime statically into the Windows wheels again, as the
Appveyor builds did through 3.3.0. Since 3.3.1 _greenlet.pyd imported
MSVCP140.dll, which no Windows CPython distribution ships, so importing
greenlet failed on machines without the Visual C++ redistributable.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
==========
* Fixed wrong results of anyOf, oneOf, not, if/then/else, contains and propertyNames when 'fast_fail' is off
* Fixed collecting errors from subschemas behind '$ref' when 'fast_fail' is off
* Fixed escaping property name in boolean 'dependencies' validation (prevents schema-controlled code injection)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- Fix: in the HTML report, a source file name containing a double quote (legal
on POSIX) wasn't escaped where it's dropped into the href of the index and
prev/next links, so it could close the attribute early and inject markup. Page
URLs are now escaped.
- Fix: the LCOV report wrote file names and other fields into its line-oriented
records without neutralizing control characters. A measured file whose name
contained a newline (legal on POSIX) could forge extra records, inflating the
coverage seen by tools that read the report. Control characters in a field are
now replaced.
- Wheels are now provided for Python 3.15.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Devansh Patel
Khem Raj
Wang Mingyu