mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-08-31 15:51:17 +00:00
Code Issues Projects Releases Wiki Activity
38,374 Commits 64 Branches 0 Tags
wrynose
Commit Graph
9872 Commits
Author SHA1 Message Date
Devansh Patel 4ddd1e3945 python3-httplib2: correct CVE_PRODUCT mapping 
The current product-only "httplib2" mapping generates a wildcard-vendor
product identity instead of the vendor assigned to the packaged project.

Use "httplib2_project:httplib2" for its exact NVD dictionary CPE and NVD
configuration identity. This changes the generated CPE, but sbom-cve-check
1.3.3 with the pinned NVD database snapshot has no current CVE report delta.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0a8f71a643)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 13:03:48 +05:30
Devansh Patel ecbab436e2 python3-web3: add CVE_PRODUCT mapping 
The current inherited "python:web3" mapping does not match the web3.py identities used by NVD and CVE List V5, so its source-aligned CVE is missed.

Use "ethereum:web3.py" for the CNA affected-data identity and "apeworx:web3.py" for the NVD dictionary CPE and configuration identity.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 19ecb40f50)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 13:01:24 +05:30
Devansh Patel edca03fca9 python3-filelock: set CVE_PRODUCT 
The inherited python:filelock mapping does not identify the tox-dev source packaged by this recipe, so filelock CVEs are missed.

Use tox-dev:filelock to match the source identity used by NVD and CNA.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 43fd2c88f1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:59:01 +05:30
Hetvi Thakar 039e0dea33 python3-web3: Fix CVE-2026-40072 
This patch applies the upstream v7 backport for
CVE-2026-40072. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/ApeWorX/web3.py/commit/d62e67d3b636bd4c5a929696c0f5c4167c31625b
[2] https://github.com/advisories/GHSA-5hr4-253g-cpx2

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:54 +05:30
Hetvi Thakar 34800488de python3-ujson: Fix CVE-2026-54911 
This patch applies the upstream fix for CVE-2026-54911 to ujson
5.12.1. The upstream fix commit is referenced in [1], and the
public security advisory is referenced in [2].

[1] https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf
[2] https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:54 +05:30
Wang Mingyu b9fb63c09a python3-httplib2: upgrade 0.31.2 -> 0.32.0 
Changelog:
============
- Python support 3.8+ only
- decompression limited by size and ratio
- decoder foundation to support more compression algorithms

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 69b5baba27)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:53 +05:30
Hetvi Thakar 2fb2b9fb1d python3-twisted: Fix CVE-2026-42304 
This patch applies the upstream 26.4.0rc2 backport for
CVE-2026-42304. The upstream fix merge is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the patch headers.

[1] https://github.com/twisted/twisted/commit/2d196123264efb0027eecfe1b430be4a9babdbd8
[2] https://github.com/advisories/GHSA-grgv-6hw6-v9g4

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:53 +05:30
Hetvi Thakar 8519105eec python3-pyjwt: Fix CVE-2026-48526 
This patch applies the upstream 2.13.0 backport for
CVE-2026-48526. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-xgmm-8j9v-c9wx

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:52 +05:30
Hetvi Thakar 5fd7815f34 python3-pyjwt: Fix CVE-2026-48525 
This patch applies the upstream 2.13.0 backport for
CVE-2026-48525. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-w7vc-732c-9m39

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:52 +05:30
Hetvi Thakar 8a6759f036 python3-pyjwt: Fix CVE-2026-48524 
This patch applies the upstream 2.13.0 backport for
CVE-2026-48524. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-fhv5-28vv-h8m8

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:51 +05:30
Hetvi Thakar 79accf77d2 python3-pyjwt: Fix CVE-2026-48523 
This patch applies the upstream 2.13.0 backport for
CVE-2026-48523. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-jq35-7prp-9v3f

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:51 +05:30
Hetvi Thakar 242530c3e4 python3-pyjwt: Fix CVE-2026-48522 
This patch applies the upstream 2.13.0 backport for
CVE-2026-48522. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-993g-76c3-p5m4

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:51 +05:30
Darsh Kelaiya d070b08b56 python3-aiohttp: fix CVE-2026-54280 
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1].

[1] https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587
[2] https://github.com/advisories/GHSA-9x8q-7h8h-wcw9

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:50 +05:30
Darsh Kelaiya bf97296869 python3-aiohttp: fix CVE-2026-54279 
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1].

[1] https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2
[2] https://github.com/advisories/GHSA-2fqr-mr3j-6wp8

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:50 +05:30
Darsh Kelaiya 813105c96d python3-aiohttp: fix CVE-2026-54278 
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1].

[1] https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232
[2] https://github.com/advisories/GHSA-g3cq-j2xw-wf74

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:49 +05:30
Darsh Kelaiya 45e39122a3 python3-aiohttp: fix CVE-2026-54277 
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1].

[1] https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d
[2] https://github.com/advisories/GHSA-63hw-fmq6-xxg2

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:49 +05:30
Darsh Kelaiya 4061d30051 python3-aiohttp: fix CVE-2026-54276 
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1].

[1] https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa
[2] https://github.com/advisories/GHSA-hpj7-wq8m-9hgp

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:48 +05:30
Darsh Kelaiya 22f7bc5b39 python3-aiohttp: fix CVE-2026-54275 
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1].

[1] https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0
[2] https://github.com/advisories/GHSA-4m7w-qmgq-4wj5

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:48 +05:30
Darsh Kelaiya 81b7b1e1c7 python3-aiohttp: fix CVE-2026-54274 
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1].

[1] https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d
[2] https://github.com/advisories/GHSA-xcgm-r5h9-7989

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:47 +05:30
Darsh Kelaiya 6de7cbdd5b python3-aiohttp: fix CVE-2026-50269 
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1].

[1] https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8
[2] https://github.com/advisories/GHSA-m6qw-4cw2-hm4m

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:47 +05:30
Darsh Kelaiya 1936909624 python3-aiohttp: fix CVE-2026-47265 
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1].

[1] https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478
[2] https://github.com/advisories/GHSA-hg6j-4rv6-33pg

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:46 +05:30
Darsh Kelaiya e389fd34bc python3-aiohttp: fix CVE-2026-34993 
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1].

[1] https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00
[2] https://github.com/advisories/GHSA-jg22-mg44-37j8

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-24 12:58:46 +05:30
Wang Mingyu 8115fe7cfb python3-rarfile: upgrade 4.3 -> 4.4 
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

Changelog:
https://github.com/markokr/rarfile/releases/tag/v4.4

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-07 08:21:21 +05:30
Leon Anavi 4edf8c3ae0 python3-rarfile: Upgrade 4.2 -> 4.3 
- Disallow extraction outside extraction path, in case of existing
  symlink.
- Disallow creating symlinks to outside of extraction path.
- Apply length limit to passwords, so too long password give same
  result as for unrar.

This work was sponsored by GOVCERT.LU.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 250067e217)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-07 08:21:21 +05:30
Ankur Tyagi 3cbfc72cf2 python3-sh: upgrade 2.2.2 -> 2.2.4 
Changelog:
https://github.com/amoffat/sh/releases/tag/2.2.3
https://github.com/amoffat/sh/releases/tag/2.2.4

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-07 08:21:21 +05:30
Ankur Tyagi c54c6315cf python3-faker: upgrade 40.13.0 -> 40.14.1 
Changelog:
https://github.com/joke2k/faker/blob/refs/tags/v40.36.0/CHANGELOG.md#v40140---2026-04-17
https://github.com/joke2k/faker/blob/refs/tags/v40.36.0/CHANGELOG.md#v40141---2026-04-17

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-07 08:21:20 +05:30
Khem Raj 4375ef7d0f python3-mpv: propagate ffmpeg's commercial LICENSE_FLAGS 
python3-mpv RDEPENDS on mpv, which requires ffmpeg (LICENSE_FLAGS =
"commercial"). With "commercial" not in LICENSE_FLAGS_ACCEPTED, parsing
the universe target - which ignores EXCLUDE_FROM_WORLD - reports:

  WARNING: Nothing RPROVIDES 'mpv' (but .../python3-mpv_1.0.8.bb
           RDEPENDS on or otherwise requires it)
  NOTE: Runtime target 'python3-mpv' is unbuildable, removing...

Now that mpv carries LICENSE_FLAGS = "commercial" and is skipped, carry
the same flag here so python3-mpv is likewise skipped cleanly in both
world and universe instead of surfacing as an unbuildable dependency.
The redundant EXCLUDE_FROM_WORLD is dropped.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 2ba9dd8823)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-07 08:21:13 +05:30
mark.yang b19c687a82 python3-h11: set CVE_PRODUCT 
The pypi class default python:h11 doesn't match how h11 is tracked
in the CVE databases. NVD has no CPE for it yet; the only existing
record (CVE-2025-43859) carries python-hyper:h11 in its CNA affected
entry [1], so set that pair.

CVE-2025-43859 (request smuggling) is fixed in 0.16.0, the version
we ship, so it resolves as not affected.

[1] https://www.cve.org/CVERecord?id=CVE-2025-43859

Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a9bfe001bd)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-24 06:11:31 +05:30
Ankur Tyagi edbfc59cb6 python3-django: upgrade 5.2.15 -> 5.2.16 
https://docs.djangoproject.com/en/dev/releases/5.2.16/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-22 06:33:17 +05:30
Ankur Tyagi d07c0e62a0 python3-django: upgrade 6.0.6 -> 6.0.7 
https://docs.djangoproject.com/en/dev/releases/6.0.7/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-22 06:33:16 +05:30
Wang Mingyu f05ea82cd6 python3-tzdata: upgrade 2026.2 -> 2026.3 
License-Update: Copyright year updated to 2026

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit ea00a3bf35)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-22 06:33:14 +05:30
Wang Mingyu c626518243 python3-socketio: upgrade 5.16.2 -> 5.16.3 
Changelog:
 Catch all exceptions in redis and rabbitmq client managers

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 2ffa73965f)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-22 06:33:11 +05:30
Wang Mingyu fed0f3fa73 python3-socketio: upgrade 5.16.1 -> 5.16.2 
Changelog:
===========
- Prevent unnecessary resource allocations
- Add zizmor to CI builds

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 9b8bf4de6f)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-22 06:33:10 +05:30
Wang Mingyu 796c5eef13 python3-sqlalchemy: upgrade 2.0.50 -> 2.0.51 
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 1b4d3a7617)

Changelog:
https://docs.sqlalchemy.org/en/21/changelog/changelog_20.html#change-2.0.51

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-22 06:33:10 +05:30
Wang Mingyu f9e9e33f9e python3-sqlalchemy: upgrade 2.0.49 -> 2.0.50 
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit c419e48aa3)

Changelog:
https://docs.sqlalchemy.org/en/21/changelog/changelog_20.html#change-2.0.50

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-22 06:33:09 +05:30
Wang Mingyu f64cb61c70 python3-elementpath: upgrade 5.1.2 -> 5.1.3 
Changelog:
 Fix protection against type cast errors during the static analysis phase

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 90866b4b09)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-22 06:33:06 +05:30
Wang Mingyu c247e7f560 python3-elementpath: upgrade 5.1.1 -> 5.1.2 
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 4cb8410f9b)

Changelog:
https://github.com/sissaschool/elementpath/releases/tag/v5.1.2

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-22 06:33:06 +05:30
Leon Anavi b03a692c8c python3-tornado: Upgrade 6.5.6 -> 6.5.7 
Upgrade to release 6.5.7:

- CurlAsyncHTTPClient now fully resets the curl object before reusing
  it. This prevents incorrectly reusing options from a previous request,
  specifically including client SSL and credentials used for accessing
  proxies.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 7c11942641)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-22 06:33:06 +05:30
Wang Mingyu 6e0f83c50c python3-tornado: upgrade 6.5.5 -> 6.5.6 
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 7efb03070d)

ReleaseNotes:
https://www.tornadoweb.org/en/stable/releases/v6.5.6.html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-22 06:33:05 +05:30
Peter Marko 15ea815f61 python3-protobuf: set status for CVE-2024-7254 
Version 4.28.2 is correctly set in [1].
Unfortunately also protoc version 28.2 with the same CPE is mentioned
which creates a false positive which needs to be handled.

[1] https://github.com/CVEProject/cvelistV5/blob/main/cves/2024/7xxx/CVE-2024-7254.json

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-22 06:33:02 +05:30
Peter Marko 584a16a0b7 python3-grpcio: set status for CVE-2023-33953 and CVE-2024-37168 
CVE-2023-33953 is fixed since 1.56.2 per [1].
FKIE sets "defaultStatus": "unknown" so it needs to be set explicitly.

CVE-2024-37168 description in [2] says grpc-js.
Even if (like FKIE added) grpc core would be affected, it would be in
old versions (also listed in [2]).

[1] https://nvd.nist.gov/vuln/detail/CVE-2023-33953
[2] https://nvd.nist.gov/vuln/detail/CVE-2024-37168

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-22 06:33:01 +05:30
Ankur Tyagi 7b02248200 python3-django: upgrade 6.0.5 -> 6.0.6 
https://docs.djangoproject.com/en/dev/releases/6.0.6/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 4d1b287447)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-06-18 13:06:44 +05:30
Ankur Tyagi 7dd3328dd8 python3-django: upgrade 5.2.14 -> 5.2.15 
https://docs.djangoproject.com/en/dev/releases/5.2.15/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 18576ace94)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-06-18 13:06:43 +05:30
Wang Mingyu ce5b8f8b22 python3-soupsieve: upgrade 2.8.3 -> 2.8.4 
Changelog:
=============
- FIX: Fix another inefficient attribute pattern
- FIX: Limit total number of selectors processed in a pattern to prevent massive selector requests

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit b25cc6b7a9)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-06-18 13:06:43 +05:30
Wang Mingyu 797f67c613 python3-vector: upgrade 1.8.0 -> 1.8.1 
Changelog:
==========
- fix: get rid of cupy<14 quick fix
- fix: _wrap_results skips momentum equivalents
- ci: bump setup-uv to maintained tag scheme
- ci: enable numba testing in 3.14t

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 9966cea909)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-06-18 13:06:42 +05:30
Anuj Mittal a43f0d532c README: update listed maintainer 
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-05-29 09:29:32 +05:30
Ankur Tyagi 815a038905 python3-django: upgrade 6.0.4 -> 6.0.5 
https://docs.djangoproject.com/en/dev/releases/6.0.5/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 2f64c27b18)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-05-29 09:07:25 +05:30
Ankur Tyagi 9148bf8e3d python3-django: upgrade 5.2.13 -> 5.2.14 
https://docs.djangoproject.com/en/dev/releases/5.2.14/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit ef903fca83)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-05-29 09:07:25 +05:30
Wang Mingyu be10315436 python3-huey: upgrade 3.0.0 -> 3.0.1 
Changelog:
==========
- Fix bug in redis version parsing when using Elasticache or any other that
  sends major/minor. redis-py incorrectly parses these as floats because
  there's only a single decimal, so the version check was breaking.
- Rename max task option --max-tasks (previously was --max_tasks).

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit c14a56b358)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-05-29 09:07:25 +05:30
Wang Mingyu 4dc835862b python3-typeguard: upgrade 4.5.1 -> 4.5.2 
Changelog:
 Fixed IndexError raised from check_signature_compatible when the subject method has no positional parameters

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 537a4c4484)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-05-29 09:07:25 +05:30