The current inherited "python:web3" mapping does not match the web3.py identities used by NVD and CVE List V5, so its source-aligned CVE is missed.
Use "ethereum:web3.py" for the CNA affected-data identity and "apeworx:web3.py" for the NVD dictionary CPE and configuration identity.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
UTscapy writes its detailed report, including the traceback of every
failing test, to a file under ${PTEST_PATH}. Under testimage that path
only exists inside the ephemeral image, which is discarded as soon as the
run finishes, so a failure left nothing behind but a bare
FAIL: 000.01s Emulate interact()
line and diagnosing it required rebuilding the image by hand.
Pass -F so the report expands only the failed tests, and cat it to stdout
when there is one, where ptest-runner records it. A clean run is
unaffected.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The "Emulate interact()" UTScapy regression test failed:
IPython requested but not found !
Using the default Python shell: History is disabled.
Traceback (most recent call last):
File "/usr/lib/python3.14/site-packages/scapy/main.py", line 857, in interact
banner += "\n"
UnboundLocalError: cannot access local variable banner where it is
not associated with a value
scapy.main.interact() only binds "banner" in the branches handling the
ipython, ptipython, ptpython and bpython shells. The test asks for
ipython, which is not in the image, so scapy falls back to the plain
Python shell and leaves "banner" unbound while still running the
unconditional "banner += \n" for the caller-supplied mybanner.
The test is correct and the bug is in scapy, which still has it in
master, so carry a patch initializing banner from banner_text before the
shell-specific chain.
meta-networking-image-ptest-python3-scapy now reports PASSED=319
FAILED=0, up from PASSED=318 FAILED=1.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
ptest.bbclass pulls ptest-runner into the -ptest package with
RRECOMMENDS:${PN}-ptest += "ptest-runner"
but the recipe then used a hard assignment for its own recommendation,
which overwrote that and left openl2tp-ptest recommending only
kernel-module-l2tp-ppp. ptest-runner was therefore never installed in
the ptest image, and meta-networking-image-ptest-openl2tp skipped the
whole run with "Test requires ptest-runner to be installed" instead of
executing any test.
Append instead of assigning, so both recommendations survive. The
openl2tp ptest now runs and passes.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The product-only cbor2 mapping uses a wildcard vendor. Use
agronholm:cbor2, the NVD identity for the packaged source.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- a11y: add aria-labels to copy-to-clipboard buttons
- a11y: add skip-to-operations link, banner and main landmarks
- a11y: close Authorization popup with Escape key and backdrop click
- a11y: name and state for dark-mode toggle button
- a11y: restore icon visibility in Windows High Contrast Mode
- a11y: topbar logo and dark-mode toggle visible in HCM
- a11y: use for model titles to convey emphasis semantically
- ci: bump cycjimmy/semantic-release-action to v6.0.0
- ci: fix Trivy security scan and add dependency vulnerability scan
- style: reduce padding on inline code blocks in markdown
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
License-Update: Copyright year updated to 2026
Changelog:
===========
- Breaking change: Drop support for Python 3.8, require Python >= 3.9
- Breaking change: Remove deprecated xxhash.VERSION_TUPLE
- Breaking change: The input keyword argument is renamed to data in
constructors and one-shot functions. update() additionally gains a data
keyword argument (it accepted no keyword arguments before).
- Breaking change: str input is no longer accepted and raises TypeError:
Strings must be encoded before hashing; encode to bytes before hashing
- Upgrade xxHash from v0.8.2 to v0.8.3. Note: on GCC/Clang source builds that
target AVX2 (e.g. -march=x86-64-v3), upstream v0.8.3 autovectorizes
XXH64_update() and makes the xxh64 streaming path about 2x slower. The shipped
wheels are built for baseline x86-64 and are unaffected. Source builds can work
around it by adding -fno-tree-vectorize to the compiler flags.
- Add per-object locking for thread safety, with sub-interpreter and
free-threaded (no-GIL) Python support. The GIL is now released only while
hashing inputs larger than 64 KiB; previously update() released it
unconditionally and one-shot functions always held it.
- Speed up hash constructors by switching them to tp_vectorcall.
- Build pyodide wasm32 wheels
- Add s390x big-endian test job
- Add Python 3.15 classifier
- CI: shard the PyPI upload into parallel groups and create the GitHub Release
automatically
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- fix(type): cast set value in _render_options
- docs: fix typo 'set the the' -> 'set then the' in config reference
- ci: pin coverage to the ctrace core
- chore: remove the misc changelog category
- test: seed the virtualenv wheel image up front
- feat(plugin): type the plugin and internal API surfaces
- test: raise timeout for missing-interpreter discovery tests
- docs: mark the INI configuration format as deprecated
- docs: publish llms.txt from the docs build
- Provision before loading env_list
- docs: repoint nine dead source links in the onboarding guide
- Add {home} and {tox_root_name} substitutions
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- Form-encoded ''POST'' bodies are now subject to a limit of 1000 arguments by default. This
prevents a CPU and memory denial of service attack. This limit can be overridden via the
'.set_parse_body_config' function.
- Multipart parsing now rejects requests with an excessive number of parts earlier in the parsing
process, limiting memory consumption.
- The deprecated mixed-case arguments to '.RequestHandler.set_cookie' now enforce the same
restrictions on invalid characters that were introduced in Tornado 6.5.5 for the standard
lowercase arguments.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
==========
- FIX: Fix issue where :is() and :where() were not accounting for empty selectors in the max selector count as they should
- FIX: Fix issue where :has() was allowing empty selectors in some circumstances even though it is not forgiving.
- FIX: Reduce selector object size when :is() and :where() contain empty selectors.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
==========
- build(deps): bump actions/checkout from 6 to 7
- build(deps): bump actions/setup-python from 6 to 7
- build(deps): bump codecov/codecov-action from 6 to 7
- fix: block distribution fields on default galaxy clusters
- Add no_sightings option to get_event
- Fix data reference in galaxy cluster fork request
- fix: [openioc] require both search-contexts before merging a composite
- feat: Add fetchFromAllFeeds
- make build_complex_query a staticmethod
- build(deps): bump github/codeql-action from 4 to 4.37.3
- build(deps): bump github/codeql-action from 4.37.3 to 4.37.4
- fix: accept datetime objects for MISPEvent timestamps in from_dict
- fix: Support in-memory STIX uploads
- fix: Correct deleted search parameter type
- build(deps): bump github/codeql-action from 4.37.4 to 4.37.6
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- Use uv instead of pip-tools
- Move dev extras to dev dependency group
- Drop support for Python 3.8, 3.9, 3.10 and 3.11
- BUGFIX: Remove all listeners only for specified event
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
License-Update: Copyright year updated to 2026
Changelog:
===========
- Speed-up translation on aarch64
- Fix invalid data successfully decoded when using altchars (slice ends with padding)
- Fix thread safety selecting codec
- Add padded and wrapcol parameters to b64encode
- Add padded parameter to urlsafe_b64encode
- Add padded parameter to b64decode & urlsafe_b64decode
- urlsafe_b64decode now defaults to padded=False to align with Python 3.15 behavior
- Add ignorechars and canonical parameters to b64decode
- Handle excess padding with the same behavior as CPython 3.15
- Reject non-ASCII strings in b64decode when validate=False
- Deprecate accepting the + and / characters with an alternative alphabet when decoding
- Use ValueError instead of AssertionError on altchars length validation
- Add SBOM to PyPI wheels
- Publish python 3.15 wheels
- Drop python 3.8 support
- Stop publishing python 3.13t wheels
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
* added support for an additional AIS Application Specific Message (Message Type 8)
* US environmental reports (DAC = 367 FID = 33)
* significantly improved decoding performance
* optimized AIS payload decoding using a base64-backed bit unpacker
* reduced NMEA parsing overhead through caching and parser optimizations
* improved enum lookup performance
* added support for additional AIS Application Specific Messages (Message Type 8)
* environmental reports (DAC = 1 FID = 26)
* area notices (DAC = 1 FID = 22/23)
* route information (DAC = 1 FID = 27/28)
* VTS and synthetic target reports
* added new enums for SOLAS equipment status and vessel ice class
* improved support for decoding application-specific AIS payloads
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- docs: wrap Chat-80 HOWTO output
- Sandbox Stanford JAR execution to nltk_data directories
- Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU +
shared-temp squat, lock the cluster with a living audit (CWE-22/59/377)
- Extend algorithmic-complexity DoS hardening: repo-wide sweep + two-string
distances (CWE-407/CWE-400)
- Bound unbounded-work DoS in parsers and grammar transforms (CWE-407/674/835)
- fix(security): sandbox MaltParser's Java execution (CVE-2026-12252,
CVE-2026-12841)
- fix(security): trust the system temp dir only when it is private
(CWE-377/CWE-378)
- fix(security): validate corpus-reader roots against the data sandbox (CWE-73)
- fix(security): validate per-call java() options and replace the -XX:/-D
allowlist with a minimal one (CWE-88)
- Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, CWE-59,
CWE-776, CWE-918)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
============
- Improve hall effect calibration
Fine calibration of hall transition point within the electrical cycle
Sweep through 3 electrical cycles in forward and reverse direction
If a hall sensor transition happens to be right on a sample point and oscillates, do something reasonable
- Support firmware ABI 1.1.0
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- If by_value is enabled on an enum with a None value allow_none now defaults to True.
- marshmallow.validate.URL accepts a fragment that follows an empty path
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
==========
- defer unavailable ENGINE constant lookup
- fixes problematic behaviour of pkcs11-provider
- support TLS 1.0 contexts with modern OpenSSL
- use Python 3 C APIs in handwritten SWIG code
- feat: Add AES-GCM (AEAD) support to M2Crypto
- remove Black configuration from setup.cfg
- release X509V3 config with its context
- keep IOBuffer chains alive until destruction
- test: free low-level OpenSSL objects in leak tests
- avoid leaking X509V3 extension config
- free RSA exponent on modulus conversion failure
- free replaced EVP digest contexts
- wrap created X509 name entries with ownership
- own ASN1 values created from Python data
- own PKCS7 certificate stack copies
- release BIOs on explicit close
- Add AuthorityKeyIdentifier extension support
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
============
- fix: define datetime resolution attribute
- Adapt to Ruff v0.16 defaults
- fix: preserve instance locale in datetime.astimezone()
- fix(datetime.dst): pass Gregorian to tzinfo.dst()
- typing: use int for fold
- Fix %I/%-I strftime directives to use the 12-hour clock
- Fix Windows Persian locale test
- Add pyright type checking to CI workflow
- Fix Windows test failure for %-I strftime
- migrate tests to pytest
- Add date.strptime and match stdlib subclass behavior
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
==========
- Prevented --inline-snapshot=trim from changing snapshots when a test body
fails or pytest is limited with -k, a test path, or a test node ID. Skipped
tests and fixture teardown errors do not prevent trimming. A message now
explains why trimming was disabled when it was requested implicitly. An
explicit --inline-snapshot=trim overrides this safeguard.
- Fixed a crash during session finalization when pytest's capture plugin is
disabled.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
==========
- Forward the Django database OPTIONS when setting up the stats recorder
connection.
- Remove accidental sqlite3 access at module scope,
- Use DoubleField for the stats ts, duration and started columns. On PG & MySQL
the old FloatField was a 32-bit-shitter which lost a lot of seconds of
precision. Existing PG/MySQL tables will need to run the SQL below to migrate
OR just drop the tables and allow them to be rebuilt next run. SQLite was not
affected.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
=============
- Add support for running on WebAssembly / Emscripten via Pyodide, using a
JavaScript fetch-based transport defined in httpx2-jsfetch.
- Add max_event_size to cap SSE event buffering.
- Add RFC 9110 status code constants.
- Add support for Python 3.15.
- Improve SSE chunk buffering performance.
- Skip cookie extraction for responses without Set-Cookie headers.
- Return str | None instead of Any from Headers.get.
- Enforce the WebSocket max message size across fragmented messages.
- Ignore unsolicited and duplicate WebSocket Pong frames.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
- Link the C++ runtime statically into the Windows wheels again, as the
Appveyor builds did through 3.3.0. Since 3.3.1 _greenlet.pyd imported
MSVCP140.dll, which no Windows CPython distribution ships, so importing
greenlet failed on machines without the Visual C++ redistributable.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
==========
* Fixed wrong results of anyOf, oneOf, not, if/then/else, contains and propertyNames when 'fast_fail' is off
* Fixed collecting errors from subschemas behind '$ref' when 'fast_fail' is off
* Fixed escaping property name in boolean 'dependencies' validation (prevents schema-controlled code injection)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Devansh Patel
Khem Raj
Ankur Tyagi
Wang Mingyu