- Disallow extraction outside extraction path, in case of existing
symlink.
- Disallow creating symlinks to outside of extraction path.
- Apply length limit to passwords, so too long password give same
result as for unrar.
This work was sponsored by GOVCERT.LU.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 250067e217)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
python3-mpv RDEPENDS on mpv, which requires ffmpeg (LICENSE_FLAGS =
"commercial"). With "commercial" not in LICENSE_FLAGS_ACCEPTED, parsing
the universe target - which ignores EXCLUDE_FROM_WORLD - reports:
WARNING: Nothing RPROVIDES 'mpv' (but .../python3-mpv_1.0.8.bb
RDEPENDS on or otherwise requires it)
NOTE: Runtime target 'python3-mpv' is unbuildable, removing...
Now that mpv carries LICENSE_FLAGS = "commercial" and is skipped, carry
the same flag here so python3-mpv is likewise skipped cleanly in both
world and universe instead of surfacing as an unbuildable dependency.
The redundant EXCLUDE_FROM_WORLD is dropped.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 2ba9dd8823)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The pypi class default python:h11 doesn't match how h11 is tracked
in the CVE databases. NVD has no CPE for it yet; the only existing
record (CVE-2025-43859) carries python-hyper:h11 in its CNA affected
entry [1], so set that pair.
CVE-2025-43859 (request smuggling) is fixed in 0.16.0, the version
we ship, so it resolves as not affected.
[1] https://www.cve.org/CVERecord?id=CVE-2025-43859
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a9bfe001bd)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Upgrade to release 6.5.7:
- CurlAsyncHTTPClient now fully resets the curl object before reusing
it. This prevents incorrectly reusing options from a previous request,
specifically including client SSL and credentials used for accessing
proxies.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 7c11942641)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
==========
- Fix bug in redis version parsing when using Elasticache or any other that
sends major/minor. redis-py incorrectly parses these as floats because
there's only a single decimal, so the version check was breaking.
- Rename max task option --max-tasks (previously was --max_tasks).
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit c14a56b358)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
============
- Fixed snapshot comparison for dicts where keys are dataclass instances (or
other custom objects used as dict keys), which previously caused corrupted
snapshots - either collapsing multiple entries into one or appending duplicate
keys on subsequent runs
- Fixed tuple snapshot updates to compare elements positionally rather than
using sequence alignment, so existing expressions (e.g. 3 + 3) are preserved
when elements are removed from or added to a tuple.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit fe086de31a)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
==========
- Fix encoding ref leak with non-English character
- Fix memory leak when ujson.dump() is unable to write to its file
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 6887661fec)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Upgrade to release 0.3.100:
- python: Fix compatibility with older python versions
- Add configurable faults for position or velocity tracking error
- Work around a linker warning with newer gcc
- tview: Suppress warnings about importing Axes3D
- moteus_gui: Include registernoop.py in our generated wheel
- Replace setup.py with pyproject.toml for Python package builds
- Use ::isfinite for Arduino compatibility
- Implement support for the RLS Orbis encoder over SPI
Fixes:
WARNING: python3-moteus-0.3.100-r0 do_check_backend: QA Issue:
inherits setuptools3 but has pyproject.toml with setuptools.build_meta,
use the correct class [pep517-backend]
License-Update: Use PKG-INFO
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 3.0.0:
- Add chord() (map -> reduce) and group() (map) primitives.
- Add timeout (using SIGALRM for process and gevent.Timeout for
greenlet) to control task running time. For threads, unfortunately,
there's no good mechanism so instead APIs for cooperatively
checking timeout are provided on the Task instance.
- Add simple fixed-window rate_limit() for tasks.
- Add Result.is_ready() method for checking result readiness.
- New option for low-latency result fetching, available for RedisHuey.
To use, pass notify_result=True when initializing your Huey instance.
- Add new incr(key, amount=1) to storage API for atomic increment
primitive. This is used by chord().
- Add new wait_result() method to storage APIs for efficiently waiting
for a result to become ready. The default implementation uses the
exponential backoff from the previous implementation of a blocking
Result.get() - so no changes are needed. However if you have a custom
storage implementation, this provides a mechanism for pub/sub or
other notification of result readiness.
- Remove Python 2.x compatibility.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 0.44.0:
- Implement websocket keepalive pings for websockets-sansio
From 0.43.0:
- Emit http.disconnect ASGI receive() event on server shutting down
for streaming responses
- Use native context parameter for create_task on Python 3.11+
- Drop cast in ASGI types
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Hetvi Thakar
Darsh Kelaiya
Wang Mingyu
Leon Anavi
Ankur Tyagi
Khem Raj
mark.yang
Peter Marko
Zhang Xiao
Bartosz Golaszewski
Gyorgy Sarvari