The zsh/db/gdbm module is link=dynamic only, so add a PACKAGECONFIG for
it that conflicts with static.
When static is disabled, preset the dynamic loading checks configure
can't run when cross compiling.
AI-Generated: Uses Claude Code
Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Allow building zsh with dynamically loadable modules by moving
--disable-dynamic into a PACKAGECONFIG named static, enabled by
default to keep the current behaviour.
Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The zsh/pcre module is link=dynamic only, and the recipe configures
with --disable-dynamic, so the module is not built. pcre is also
disabled by default in configure.
Drop libpcre2 from DEPENDS to avoid pulling in an unused library.
Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
gdbm support is disabled by default in zsh's configure, so
--disable-gdbm is redundant and gdbm in DEPENDS is unused.
Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add -M30% -C --find-copies-harder to the git send-email example in
README.md so that git format-patch detects renames and copies more
aggressively.
Patches that move or copy files then show only the changed lines
instead of full file deletions and additions, which makes them
smaller and easier to review.
Suggested-by: Khem Raj <khem.raj@oss.qualcomm.com>
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 6.1.0:
- No functional changes, only in binary wheels released to PyPI
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 0.4.5:
- Improve performance of get_literal_values()
- Expand chained type aliases in get_literal_values()
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2.3.3:
Security:
- The limit on <use> expansions added in 2.3.1 counted expansions,
not their size. Each expansion copies and renders the whole
element it refers to, so a few kilobytes of nested <use> groups
with a large group at the bottom could still take minutes and
gigabytes to render (CWE-400, GHSA-xpfm-fw4h-qxwv, an incomplete
fix of GHSA-555j-qj3j-c8jv). The elements copied by all
expansions of a document, external SVGs included, are now limited
too (MAX_USE_CLONED_ELEMENTS, 20,000); once it is spent the
remaining <use> elements are skipped and an error is logged.
Thanks to Adrian Korwel for the report.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 4.0:
- BREAK: The contents of an HTML template are no longer treated as
part of the document. Selectors do not descend into a template,
and elements inside one can't see beyond it, which also applies
to pseudo-classes such as :lang(), :disabled, and :default.
select and filter will still reach the contents of a template
when they are called on the template itself, for example
soup.template.select('p'). See the FAQ for more information.
- BREAK: The contents of an iframe are no longer treated as a
separate document, as they are not one in a browser. Elements in
an iframe are normal children, so :root does not match them, and
:default, :indeterminate, :checked, :dir(), :lang(), and
:read-write treat them like any other element. Recent versions of
html.parser, lxml, and html5lib all escape the contents of an
iframe like a browser does, so this mostly affects XHTML, Python
versions that still don't escape such content in their specific
html.parser, and elements added to an iframe by hand.
:-soup-contains() now also includes the escaped text in an
iframe. See the FAQ for more information.
- NEW: Update :disabled and :enabled to treat option and optgroup
elements inside a disabled select as disabled, following a recent
HTML specification update.
- FIX: Fix the subsequent-sibling combinator and :has(~ ...) never
matching top level elements of a fragment that has no root
element, unless caching was disabled.
- FIX: :indeterminate now treats a radio button group without a
form as extending across the whole document instead of the top
level element that contains it, and it no longer ignores radio
buttons at the top level.
- FIX: Fix :default to treat a button with a missing or invalid
type, and an input with type="image", as submit buttons.
- FIX: Fix :in-range and :out-of-range raising TypeError when the
document contains an input without a type attribute.
- FIX: :read-write (and :read-only) now treat
contenteditable="plaintext-only" elements as editing hosts and
match the editable elements inside an editing host, following the
nearest contenteditable state.
- FIX: :read-write (and :read-only) now ignore contenteditable on
non-HTML elements, such as an SVG foreignObject, as the attribute
only applies to HTML elements. Such elements inherit the state of
their parent.
- FIX: :checked now only matches the last radio button with a
checked attribute in a radio button group, as in a browser, where
a group is the radio buttons with the same name and form,
including the form attribute. :default still matches all of them,
and the contents of a template are unaffected as they are not
connected.
- FIX: :dir() and :defined no longer affect the rest of the
selector list they are in. Previously, a selector list that used
either of them could not have its combinators cross an iframe,
ignored the specified namespaces, and matched nothing in XML, not
even the parts that didn't use them. They still do not match in
XML, but :not(:dir(ltr)) and :not(:defined) now do.
- FIX: :default and :indeterminate now honor the form attribute,
which can associate a submit button or radio button with a form
it is not in, or leave it without a form. It is ignored in a
template, as in the HTML specification. Submit buttons outside of
a form can now be its default button.
- FIX: :default, :checked, and :indeterminate now handle a form
inside a form like a browser. In HTML, a browser ignores the
nested form and takes its end tag for that of the parent, which
matters for parsers that keep the nested form, such as
html.parser. In XHTML and in a template, nested forms are real
forms.
- FIX: :checked now matches the option that a browser would select.
Without multiple, that is only the last option with a selected
attribute in a select, and if there are none and the select shows
a single option, the first option that is not disabled. :default
still only considers the selected attribute.
- FIX: Fix [attribute!=value] excluding values that only start with
the specified value, and in XML documents, type values that
contain a newline.
- FIX: Match the values of every attribute that the HTML
specification lists as ASCII case insensitive (rel, method, lang,
dir, ...) without ASCII case sensitivity on HTML elements in HTML
documents, not just type. Non-HTML elements are matched case
sensitively.
- FIX: :dir() now matches non-HTML elements, such as SVG and
MathML, by the direction they inherit from their parent (the dir
attribute only applies to HTML elements), and HTML elements
inside them, such as in an SVG foreignObject, by the direction of
their ancestors.
- FIX: Fix :dir() ignoring the value of an input with dir="auto"
and a missing or empty type.
- FIX: :dir() now uses a table generated from Unicode 18 instead of
unicodedata, so results no longer depend on the Unicode version
of the Python in use, and unassigned code points use their
default direction.
- FIX: :dir() now uses the value of an input with dir="auto" when
type is hidden, password, submit, reset, or button, as the HTML
specification does.
- FIX: dir="auto" and bdi now analyze the text of non-HTML
elements, such as SVG and MathML, and only ignore HTML elements
such as script, style, and bdi. The text directly in an iframe is
analyzed as well, and the contents of a template, which are not
part of the document, are not.
- FIX: :dir() no longer lets the contents of a template inherit
direction from the template or its ancestors, as they are not
part of the document. They are left to right unless they specify
otherwise.
- FIX: :dir() now matches a bdi element that is the root by its
text instead of assuming left to right.
- FIX: :dir() now treats any element without a parent element as
left to right, not just the root. Before, all but the first top
level element of a fragment parsed with html.parser never
matched.
- FIX: :dir() now accepts any identifier, as CSS requires,
including escaped ones. Values other than ltr and rtl do not
match anything.
- FIX: Respect namespaces provided by the parser when the root is
not an HTML element, such as an svg element extracted from an
html5lib document. Previously every element in such a tree was
treated as an HTML element, which affected namespace selectors,
namespaced attributes, and HTML specific pseudo-classes.
- FIX: Fix :lang() treating an element with an empty lang or
xml:lang attribute as having the language of a tagged ancestor.
- FIX: Cache forms without a default button when matching :default
to avoid quadratic time on forms with many non-default submit
candidates.
- FIX: Fix :in-range and :out-of-range matching elements whose
value, min, or max has a trailing newline; per HTML, such values
are not valid, so they are treated like a missing value and
cannot be out of range.
- FIX: Fix :in-range and :out-of-range raising ValueError when a
date, month, week, or local date and time input has a year with
more digits than Python will convert; such a year is now treated
as invalid.
- FIX: Fix :in-range and :out-of-range not recognizing a
datetime-local value, min, or max that uses a single space
instead of T to separate the date and time.
- FIX: Search a form only once for checked radio buttons when
matching :indeterminate to avoid quadratic time on forms with
many radio button groups.
- FIX: :lang() now uses the lang attribute of SVG elements, as the
HTML specification does (with xml:lang taking precedence).
Previously only xml:lang was considered for elements outside the
HTML namespace.
- FIX: :defined no longer matches HTML elements with an is
attribute (customized built-in elements), which, like custom
elements, are undefined until they are registered.
- FIX: Cache the index of each child when matching the general
sibling combinator (a ~ b and :has(~ b)) to avoid quadratic time
when the first matching sibling is far into a long list of
siblings.
- FIX: Match attribute values with the i modifier using ASCII case
insensitivity.
- FIX: Treat an input with an unknown type, such as type="foo", as
a text input in :placeholder-shown, :read-write, :read-only and
:dir(), as an invalid type is in the Text state in the HTML
specification.
- FIX: Fix :enabled and :disabled never matching input elements
with type="hidden".
- FIX: :required no longer matches input elements of types the
required attribute does not apply to (hidden, range, color,
submit, image, reset and button). Like in browsers, they match
:optional.
- FIX: Cache whether an element is or has a matching ancestor when
matching the descendant combinator (a b) to avoid time that grows
with the depth of the document to the power of the number of
combinators.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 5.18.1:
- Fix enter/leave room in connect handler, when a message queue is
used (regression introduced in v5.18.0)
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 7.5.1:
- Type aliases with list of types in values crash execution
- Performance regression in Grep File
- Execution crashes if library import argument cannot be converted
- Tests in Markdown files get line numbers relative to the code
blocks, not to the file
- Argument conversion failing unexpectedly causes bad error
messages with keywords and crashes elsewhere (e.g. with listeners)
- --parseinclude with multiple data sources fails with "Suite '...'
contains no tests or tasks"
For more details, see the full release notes.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 3.16.2:
- Discard the late response of a cancelled request
- Fix missed buffered serial replies after a delayed wakeup
- Test case for cancelling request.
- Test wrong response gets discarded.
- Answer ILLEGAL_VALUE for a Write Single Coil value other than
0x0000/0xFF00
- Partial solve ext. cancel sideeffects.
- Correct CI for PR runs.
- Report bad file record frames as undecodable
- Wait for data when an RTU request arrives split
- return ILLEGAL_VALUE for out-of-range counts
- Correct doc of write_coils / readwrite_registers
- Isolate PDU methods (using decoder).
- Fix decoders.decode()
- Fix convert_to_registers mutate value.
- add fixtures for PDU, socket and content.
- Combine decode in pdu.
- Allow multiple frames with bad decoding.
- Echo transaction id and device id in exception for undecodable
request.
- Remove rtu_byte_count_pos from pdu.
- Remove packet when MDAP is wrong.
- Correct fc in exception response.
- Multiple frames in one packet.
- Remove rtu_frame_size from pdu.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.5.0:
Breaking changes:
- DateData.period can take the new values "quarter" and
"part_of_day", and with RETURN_TIME_AS_PERIOD enabled a relative
date with hours, minutes or seconds, such as "2 hours ago", now
has the "time" period instead of "day" (#1417, #1437, #1473)
- Stop caching and sharing Settings instances: creating one with
the same settings twice now gives two different objects, and the
Settings.registry_key attribute no longer exists
- Remove the leftovers of fastText support from dateparser_cli: the
fasttext_manager and exceptions modules and
utils.create_data_model_home(); utils.dateparser_model_home and
utils.DEFAULT_WINDOWS_CACHE_DIR are now pathlib.Path objects
- Remove Locale.to_parserinfo() and HijriDate.weekday(), which
always raised an exception (#1406, #1457)
Deprecations:
- Deprecate dateparser.timezone_parser.convert_to_local_tz()
and dateparser.timezone_parser.build_tz_offsets()
- Emit a FutureWarning naming the TZ value from parse(),
DateDataParser and search_dates() when the local timezone cannot
be determined; a future version will raise RuntimeError instead
of failing to parse the date (#1403, #1556)
- Deprecate dateparser.utils.registry() and Settings.get_key(),
which now emit a FutureWarning (#1442, #1556)
- Deprecate get_week_start() and get_week_end() in
dateparser.utils.time_spans, and calling generate_time_span()
without base_date or settings; all of them now emit a
FutureWarning (#1393, #1556)
- Deprecate dateparser.date.RE_TRIM_COLONS (GHSA-fmxc-97cw-ph6p
<https://github.com/scrapinghub/dateparser/security/advisories/GHSA-fmxc-97cw-ph6p>_)
Security fixes:
- Make sentence splitting in search_dates() linear on long
punctuation runs, to prevent quadratic backtracking (ReDoS) for
Arabic, Bengali, Cantonese, Chinese, Hindi, Japanese and Persian
(GHSA-rx9v-94ff-9cc2
<https://github.com/scrapinghub/dateparser/security/advisories/GHSA-rx9v-94ff-9cc2>_)
- Prevent quadratic regex matching (ReDoS) on long digit runs in
Cantonese, Chinese and Japanese, and a ValueError on runs of more
than 4,300 digits on Python 3.10.7 and later (GHSA-g8fh-jxm9-6qfx
<https://github.com/scrapinghub/dateparser/security/advisories/GHSA-g8fh-jxm9-6qfx>_)
- Bound the lookahead of the Chinese month simplification, to
prevent quadratic parsing time on long runs of numbers followed
by 月 (GHSA-q7fp-xwcm-6x9f
<https://github.com/scrapinghub/dateparser/security/advisories/GHSA-q7fp-xwcm-6x9f>_)
- Prevent quadratic regex matching (ReDoS) on long runs of digits
or whitespace (GHSA-gqj4-wf6c-wmcg
<https://github.com/scrapinghub/dateparser/security/advisories/GHSA-gqj4-wf6c-wmcg>_)
- Strip trailing colons in linear time, to prevent quadratic
backtracking (ReDoS) on long colon runs (GHSA-fmxc-97cw-ph6p
<https://github.com/scrapinghub/dateparser/security/advisories/GHSA-fmxc-97cw-ph6p>_)
- Split strings into known words in linear time, to prevent
quadratic parsing time on long runs of words like month names
(GHSA-jxmm-w6rw-32ch
<https://github.com/scrapinghub/dateparser/security/advisories/GHSA-jxmm-w6rw-32ch>_)
New features:
- Add a STRICT_DATE_ORDER setting that turns an explicit DATE_ORDER
from a preference into a requirement: "year" reads a two-digit
year only from the position DATE_ORDER gives it, and "all" also
keeps the day and month where the order puts them
- Add a TIMEZONE_ABBREVIATIONS setting to override the offset of
timezone abbreviations, e.g. to read IST as India Standard Time
instead of Israel Standard Time
- Parse parts of the day, such as "tomorrow morning", "this
evening" or "8 in the evening", at the times set by the new
PARTS_OF_DAY setting; the new DateData.part_of_day attribute
tells which one was found
- Add DateData.parts, which lists the date parts (day, month, year,
time…) read from the input rather than filled in from defaults
- Add an add_period argument to search_dates() to also return the
period of each date
- Add a date_formats argument to search_dates(), to find dates
written in the given formats; it requires strategy="ngram" and
raises ValueError with the default "split" strategy
- Add the French Republican calendar and the Minguo (Taiwanese)
calendar (#1483, #1489)
- Parse calendar quarters, such as "2025Q1", "2025-Q3" or "Q4
2025", as a month of that quarter picked by PREFER_MONTH_OF_YEAR
(by default, the month as far into the quarter as the current
month is into its own)
- Parse "last", "this" and "next" before a weekday in English, e.g.
"next Friday", as the closest occurrence of that weekday before,
on or after, and after the current date, whatever
PREFER_DATES_FROM is, except for the abbreviations "wed", "sat"
and "sun"; search_dates() now includes the word in its matches
- Parse "the Nth of last/this/next month" as a day of that month
- Parse Roman numeral years written in capitals, e.g. "5 March
MDCCLXXVI"; a short one such as "MMX" is read as a year only next
to a month name, e.g. "April MMX"
- Parse dates with a bare UTC offset, such as "+03"
- Parse AM/PM written before the time, e.g. "PM 2:26" or "下午
02:26:26"
- Parse ISO 8601 fractional seconds written with a decimal comma,
e.g. "12:30:45,123"
- Parse English number words from thirteen to ninety-nine, e.g.
"forty-five seconds ago"
- Parse "fortnight" and "century" in English relative dates, and
read "a decade from now" as the future instead of the past
- Match month and weekday names in date_formats in the given
languages, so formats with literal text work, e.g. "el %d de %B
de %Y" for "el 15 de junio de 2020" with languages=["es"]
- When a date does not parse, try the other meanings of ambiguous
words, such as Spanish "mar" (martes or marzo), and read
a token that is both a weekday and a month abbreviation as the
weekday when that is what fits
- In search_dates(), find dates written:
- right after a label and a colon in Chinese or Japanese, e.g.
"日期：2020年12月28日"
- next to a relative date without a comma
- joined by words that search skips, like "and"
- inside parentheses, square brackets or straight quotes, e.g.
'He said "May 5, 2020"' or "(Friday)"
Fixes:
- Take the current date, used to fill in the missing parts of a
date such as "12:30" or "Nov" and to apply PREFER_DATES_FROM,
from the TIMEZONE setting (the local time zone by default)
instead of UTC
- Keep the %z offset when parsing with date_formats, and return a
timezone-aware date for it unless RETURN_AS_TIMEZONE_AWARE is
False
- Read year-first dates, such as "2021-01-13", as YMD unless
DATE_ORDER starts with the year
- Swap the day and the month when they do not fit an explicit
DATE_ORDER, whatever its value, e.g. "01/13/2021" with DMY
- Read a lone number next to a four-digit year as the month under
any DATE_ORDER
- Apply PREFER_DAY_OF_MONTH before PREFER_DATES_FROM picks the year
, and apply PREFER_DAY_OF_MONTH and PREFER_MONTH_OF_YEAR
to relative dates such as "last year"
- Apply an explicit DATE_ORDER to every date that search_dates()
finds, not only to the first one
- Stop dropping extra numbers when parsing dates: a string with
more numbers than a date has, such as "5 10 Jan 2020" or
"03/04/2021 5", now returns None instead of a date built from
some of them
- Stop reading two adjacent numbers of a Russian numeric date as
one compound ordinal, so parse("20 03 2021", languages=["ru"])
returns 20 March 2021 instead of the 23rd of the current month
- Return None for strings with only skipped words, such as "year"
or "hour minute", instead of today, which also stops
search_dates() from returning them (#1440, #1564)
- Stop ignoring numbers without a unit in relative dates, so
"03/06/2020 hour", "03/06/2020 day" or "01.02.2011 godz. 08:39"
no longer parse as a number of hours or days ago
- Stop reading "Nth day" as a number of days, e.g. "the 1st day of
March 2015"
- Parse "at 22h" and "à 22h" as a time of day, not as hours ago; a
bare "à 22h" is still read as English hours ago unless
languages=["fr"] is given or the text has other French words,
such as "demain à 22h"
- Keep the future direction of a relative expression that
search_dates() finds next to punctuation, e.g. "in 2 hours,
thanks"
- Stop French "sept" being read as 7 when it means September, e.g.
"1 sept 2024" with languages=["fr"] and "le 3 sept à 10h" with or
without languages; "sept" now means 7 only before a duration unit
or a clock time ("sept jours", "sept heures", "sept:30"), so a
day written as a word, as in "sept mai 2020", no longer parses,
and a bare "sept" is read as September
- Parse dates with a numeric offset followed by a redundant
timezone abbreviation, e.g. "-0500 (CDT)", or with an
abbreviation glued to the time, e.g. "2019-09-28WIB19:17:34"
- Recognize UTC offsets written with Unicode dash-like characters,
such as "−05:00"
- Keep complete week dates (year, week number and weekday) when
parsing with date_formats, including %G ISO week years
- Fix negative timestamps with subseconds
- Keep AM when searching for dates after a time
- Keep full stops between digits in search_dates() sentences
- Fix search_dates() dropping text next to a standalone accent mark
- Fix search_dates() raising IndexError for the zh-Hans, zh-Hant
and yue locales, including when it detects one of them in the
text, e.g. "聽日"
- In search_dates(), include the closing bracket in the matched
text, e.g. "8 May 2020 (16:05)", and stop including separators
such as "/" or "|"
- Split a relative date from a numeric date that follows it in
search_dates(), e.g. "3 days later on 2010-05-10"
- Stop growing internal caches with every distinct RELATIVE_BASE
value
- Fix parse() and DateDataParser returning None when region does
not match the language of the text, e.g. parse("12 mars 2020",
languages=["fr"], region="MX") or parse("5 de marzo de 2020",
region="US")
- Fix dateparser.utils.get_logger() raising AttributeError when
logging.config had not been imported
Improvements:
- Speed up parse() by about 35%, skip locales that cannot
change the outcome of a failed parse, and speed up import
by compiling the timezone regexes lazily
- Arabic: parse relative dates that use قبل for "ago",
Egyptian and informal ة→ه spellings, numbered Levantine
month names such as "كانون 2" in the ar-SY, ar-JO, ar-LB, ar-PS
and ar-IQ locales only, e.g. locales=["ar-SY"] or region="SY"
, Arabic dates typed with Persian yeh and kaf and Persian
dates typed with Arabic ones, and Arabic month names and
Arabic-Indic digits in Hijri dates
- Chinese: add the supplementary data of zh to zh-Hans and zh-Hant
, and parse 后天, 大后天 and 大前天 as relative days
- Chinese and Japanese: parse dates with spaces around 年, 月 and 日
- French: parse "midi" as noon, e.g. "demain à midi" ("après-midi"
and "avant midi" are still not read as noon); this also applies
when no languages are given, so search_dates() can return "MIDI"
in an English text as 12:00
- Indonesian: add old-style month abbreviations, such as "Djan" or
"Peb"
- Korean: parse absolute dates written with 년, 월, 일, 시 and 분
- Slovak: parse "pozajtra"
- Swedish: parse ordinal day suffixes like "24:e" and "1:a"
- Thai: parse relative dates with spaced ago/in words
- Vietnamese: parse dates with zero-padded months
- Add type hints
- Document search_dates() in the API reference, add a
performance section, explain how DEFAULT_LANGUAGES
relates to the languages argument and how date_formats
falls back to the other parsers
- Show the whole README on PyPI
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.2.0:
- Add i8, u64, u32 and u16 native integer types
- Drop support for Python 3.8 and 3.9, officially support 3.14 and
3.15
- Permit building with flit core 4
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 5.7.2:
- Proper routing of an event called * in the catch-all handler
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 6.1.3:
Security fixes:
- CVE-2026-108147: Potential memory exhaustion in MultiPartParser
via base64-encoded file upload
- CVE-2026-111211: Potential log injection via unescaped geometry
form values
- CVE-2026-111362: Server-side request forgery via crs member of
GeoJSON geometrie
- CVE-2026-113593: Potential exposure of private data via empty
and missing Vary headers
- CVE-2026-113733: Password hash disclosure to “view only” admin
users with custom user models
- CVE-2026-114582: Server-side request forgery via
SpatialReference string input
Bug fixes:
- Fixed a bug in Django 6.1 where accessing a deferred field with
the FETCH_PEERS fetch mode overwrote values that peer instances
had already modified locally or loaded via refresh_from_db() with
an explicit fields argument. The fix also addresses a KeyError
when a peer's row had been deleted
- Fixed a regression in Django 6.1 where the YAML serializer
crashed if passed the sort_keys option
- Fixed a regression in Django 6.1 where a Value expression with a
None value and an output field other than JSONField crashed on
SQLite when used in a top-level JSONField in lookup. Using such an
expression in an IN lookup is likely unintended, since SQL NULL
cannot match any value.
- Fixed a regression in Django 6.1 where legend_tag() with a
custom attrs could add the required_css_class more than once.
- Added compatibility for oracledb 26.0.0+
- Fixed a crash in makemessages on Windows when processing files
with non-ASCII names on Python 3.15+, or with UTF-8 mode enabled
on older Python versions.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 7.17.1:
- Fix: a one-line class or function body immediately followed by
another statement (such as class Foo: ... on its own line) was
incorrectly reported as a missing branch when using the
sys.monitoring core. This is now fixed.
- Fix: the HTML report only rewrites a file's page when the file or
its data has changed, but each page also links to the previous
and next files. When the set of reported files changed, unchanged
pages kept their old links. For example, with skip_covered, a
file that became 100% covered had its page deleted, but the pages
next to it still linked to it. Now a page is also rewritten when
its neighbors change.
- Fix: --fail-under now uses at least the decimal precision of the
threshold for both the comparison and failure message. With
precision=0, a total of 0.4 now passes --fail-under=0.3 and fails
--fail-under=0.5 with the message "total of 0.4 is less than
fail-under=0.5". Previously, the comparison rounded the total to
zero and the message could claim "1 is less than 0".
- Fix: the HTML report escaped file names twice, so a name with &,
<, or quotes in it was shown with entities like &. Now they
are properly escaped only once.
- Fix: --source=/ measured no files. A file system root can't be a
source directory, so now it is an error.
- In an abundance of caution, prevent forged SQLite journal files
from deleting files they shouldn't.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 4.4.1:
- Size the relay test's payload from the pipe capacity
- Publish releases from GitHub Actions with PyPI provenance
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 26.11.1:
- Security: parse the HTTP headers of the WebSocket opening
handshake strictly (RFC 9112, RFC 9110). The header block was
split with str.splitlines(), which also splits on VT, FF, FS, GS,
RS, NEL and on a bare CR or LF, so a peer could make autobahn see
header lines that a front proxy treats as part of a header value,
for example an X-Forwarded-For used with trustXForwardedFor.
Lines are now separated by CRLF only. ⚠ behaviour change — a
header block with a bare CR or LF, obs-fold, whitespace before
the colon, an invalid header name, a header line without a colon
(was skipped), or a control character in a header value or the
status line is rejected: the server fails the handshake with HTTP
400, the client fails the handshake or the proxy CONNECT. A bare
LF is rejected deliberately, although RFC 9112 allows accepting
it as a line end. obs-text (0x80-0xFF) in header values is still
allowed, and header values are trimmed of SP and HTAB only. This
fixes advisory GHSA-2gqc-mwv3-66rp
- Security: raise the floors of the compress extra (and so all)
to brotli>=1.2.1 (CPython) and brotlicffi>=1.2.1.0 (PyPy), the
releases with the fix for CVE-2026-111497, an out-of-bounds write
in the brotli decoder that permits remote code execution.
permessage-brotli decodes data sent by the WebSocket peer; it is
not used unless an application offers or accepts it. The brotli
1.0.10 and 1.1.1 backports of the fix are not enough, since the
permessage-brotli receive path needs the decompression limit of
brotli 1.2. New tests check the declared floors and the installed
version
- Add tests for the HTTP header parsing of the WebSocket opening
handshake, on the server, the client and the explicit proxy
CONNECT, run on Twisted and asyncio
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 6.10.1:
- Recognize trace operations defined in view docstrings, instead
of silently dropping them
- Fix intersect OneOf and Equal choices in field2choices
- Drop support for marshmallow 3, which is EOL
- Drop support for Python 3.10
- Test against Python 3.15
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Tries to call sphinx-build during clean in docs directory and fails when
not installed on host nor included in HOSTTOOLS
Fixes do_configure failure when re-executed in existing WORKDIR
...
rm -f ./*.gcov
make[2]: Entering directory '/OE/tmp/work/x86_64-linux/ctags-native/6.2.20261011.0/sources/ctags-6.2.20261011.0/docs'
/bin/sh: 1: sphinx-build: not found
make[2]: Leaving directory '/OE/tmp/work/x86_64-linux/ctags-native/6.2.20261011.0/sources/ctags-6.2.20261011.0/docs'
make[2]: *** [Makefile:20: clean] Error 127
make[1]: *** [Makefile:8218: clean-local] Error 2
make[1]: Leaving directory '/OE/tmp/work/x86_64-linux/ctags-native/6.2.20261011.0/sources/ctags-6.2.20261011.0'
make: *** [Makefile:7175: clean-recursive] Error 1
ERROR: oe_runmake failed
WARNING: exit code 1 from a shell command.
The issue was introduced in p6.2.20260802.0 version with:
https://github.com/universal-ctags/ctags/commit/05a8061a581f626deada11da5300822bee20e458
which replaced "rm -rf $(BUILDDIR) $(EXTDIR)/__pycache__" in clean with
sphinx-build clean:
@$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The test is parametrized over gateway types; it imports "remote" from
its tmp_path and then deletes that directory, but the module stays in
sys.modules. Every run after the first got the stale module back and
failed with "OSError: could not get source code". Drop the cached
module before importing it.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
1.7.5 replaced py.process.ForkedFunc with multiprocessing, so swap the
python3-py runtime dependency for python3-multiprocessing. The sdist is
now named pytest_forked, the pypi class default, so drop
PYPI_PACKAGE_SDIST.
Backport the pending upstream fix for pytest 9.2, where TestReport
carries a NodeId object in _id that marshal cannot serialize; every
forked test crashed with "ValueError: unmarshallable object". This made
python3-starlette ptests report no results at all; all of them pass
now on qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The project dropped setup.py, switch to python_setuptools_build_meta.
The sdist is now named pytest_benchmark, which is the pypi class
default, so drop PYPI_PACKAGE_SDIST. License checksum change is due
to the copyright year update.
5.1.0 broke every test with pytest 9.2 and Python 3.14:
AttributeError: 'Function' object has no attribute '_nodeid'
PendingDeprecationWarning: FileType is deprecated.
which made ptests fail in python3-pint, python3-fastjsonschema,
python3-portion, python3-tblib, python3-construct and
python3-pydantic-core. These now all pass on qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
4.2.9 needs hatch-fancy-pypi-readme as a build backend plugin, add
it to DEPENDS.
This also fixes ptest failures seen with 4.2.4, e.g.
test_post_open_failure_closes_fd[fstat] and the soft lock
lease/stale tests; all ptests pass now on qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This includes fix for CVE-2026-114550.
Added a patch for reproducibility issue from this release.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This is a bug-fix release addressing a couple more build issues after the
conversion to meson. Not really necessary for meta-openembedded but
let's upgrade for consistency with upstream.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The generated softhsm2.conf only sets directories.tokendir and
objectstore.backend. SoftHSM warns about every other key it falls back to
the default for, and it logs through syslog(), so every process loading
the module during a build (rauc, extract-cert, ...) puts three
"Missing ... in configuration" lines into the build host's journal.
Set log.level, slots.removable and slots.mechanisms explicitly. The latter
two keep their defaults; log.level = ERROR keeps SoftHSM's INFO/WARNING
chatter out of the host journal while errors are still logged.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2026.10:
- meson: Disable tests build by default
- Define attr dependency
- Test if merged overlay is usable after mounting
- Remove trusted xattrs from upperdir metacopies before copying
attributes
- Add Option To Use rsync for merge Operation
- Support merge metacopy file
Since version 2026.10, meson.build wraps the tests build in
"if get_option('tests')", so the tests are disabled by default and
do_configure:prepend is no longer needed. Keeping it also breaks
the build with:
ERROR: Expecting endif got eof.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2026.09.22:
- generic: test bdev freeze count leak on nested thaw
- btrfs/255: add _cleanup function to kill the balance stress
process
- common/btrfs: exercise all algorithms in _btrfs_stress_defrag()
- common/btrfs: exercise all algorithms in
_btrfs_stress_remount_compress()
- btrfs: test that we don't create pointless compressed inline
extents
- overlay/081: add missing _require_scratch check
- btrfs/273: add missing _require_scratch check
- common/btrfs: require scratch before checking encoded reads
- f2fs/015,016: add missing _require_scratch checks
- generic/590,735,795: add missing _require_scratch check
- common: strip attr 2.6.0 --restore safety warnings
- generic/760: enable sub-block reads
- generic/263: enable sub-block reads
- generic/091: enable sub-block reads
- min_dio_alignment: add a -r option to query read alignment
- statx.h: update to latest kernel UAPI
- generic: test corruption detection using T10 protection
information
- generic: test I/O on devices with T10 protection information
- add a "pi" group
- common: add a _sysfs_block_integrity_path helper
- common: factor out a _bdev_disk_name helper
- common/scsi_debug: don't slow down I/O
- f2fs/009: fix race condition in orphan inode test
- common/rc: remove trailing space from _mread() default map_len
- common: fix spelling of SCRATCH_DEV_POOL
- f2fs/024: add missing execute permission
Upgrade to v2026.09.22, not v2026.10.15 because the latter's
commits are still on branch for-next and have not yet merged to
branch master.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
OpenSSL 4.1 deprecates ASN1_STRING_length(), which the OpenSSL 4 ASN1
opaque fix uses, and the build uses -Werror:
openssl_helper.c:1255:21: error: 'ASN1_STRING_length' is deprecated:
Since OpenSSL 4.1; use ASN1_STRING_get_length() [-Werror,-Wdeprecated-declarations]
Use ASN1_STRING_get_length() when building against OpenSSL 4.1 or newer.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
tests/test_sequence_docs.py executes the code examples embedded in
docs/usage.rst, resolved relative to the tests directory. The file was
not installed, so all 26 tests in it failed with:
FileNotFoundError: [Errno 2] No such file or directory:
'/usr/lib/python3-cbor2/ptest/docs/usage.rst'
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Regenerate python3-cbor2-crates.inc to match the bundled Cargo.lock.
The previous crates list was stale (bigdecimal 0.4.10 vs 0.4.11 locked),
which made cargo metadata fail in do_compile with:
failed to select a version for the requirement `bigdecimal = "^0.4.10"`
(locked to 0.4.11)
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2.112 2019-12-13
- Added the change log from any prior source that could be found. Formatted
the log to fit metacpan.org loose standards.
- Added .mailmap to correctly attribute all commits to Dianne Skoll when
using: git shortlog -s -e
- Added .gitattributes and .gitignore to assist with keeping the repo clean
- Change use vars qw() to our $whatever instead. 'our'
- Hide IO::WrapTie subclasses from PAUSE
- Rebuild Makefile.PL to contain all of the prerequisites. Make use of the
stub from Dist::Zilla
- Convert README to README.md
- Fix the documentation in the main module, IO::Stringy to better indicate
where to get info and how to use the module
- Fix the dist's META information to indicate the original author and license
- Add a LICENSE file
- Get rid of the set-version.pl file as it's no longer needed
- Add AppVeyor CI testing
- Add Travis CI testing
- update t/IO_InnerFile.t to use Test::More and a proper TEMP file (RT #103895)
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
- Fix panics in thin_dump when btree nodes point beyond the metadata device
- Fix overflows in IoEngine block range tracking and offset calculation,
which caused panics or reads at wrong offsets on damaged metadata in
thin_check, cache_check and other tools.
- Fix integer overflow in space map boundary checks
- Remove redundant leaf insertions in LeafWalker
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Sean Nyekjaer
Leon Anavi
Martin Jansa
Khem Raj
Peter Marko
Bartosz Golaszewski
Johannes Schneider
Jason Schonberg
Ankur Tyagi