This includes fix for CVE-2026-114550.
Added a patch for reproducibility issue from this release.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This is a bug-fix release addressing a couple more build issues after the
conversion to meson. Not really necessary for meta-openembedded but
let's upgrade for consistency with upstream.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The generated softhsm2.conf only sets directories.tokendir and
objectstore.backend. SoftHSM warns about every other key it falls back to
the default for, and it logs through syslog(), so every process loading
the module during a build (rauc, extract-cert, ...) puts three
"Missing ... in configuration" lines into the build host's journal.
Set log.level, slots.removable and slots.mechanisms explicitly. The latter
two keep their defaults; log.level = ERROR keeps SoftHSM's INFO/WARNING
chatter out of the host journal while errors are still logged.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2026.10:
- meson: Disable tests build by default
- Define attr dependency
- Test if merged overlay is usable after mounting
- Remove trusted xattrs from upperdir metacopies before copying
attributes
- Add Option To Use rsync for merge Operation
- Support merge metacopy file
Since version 2026.10, meson.build wraps the tests build in
"if get_option('tests')", so the tests are disabled by default and
do_configure:prepend is no longer needed. Keeping it also breaks
the build with:
ERROR: Expecting endif got eof.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2026.09.22:
- generic: test bdev freeze count leak on nested thaw
- btrfs/255: add _cleanup function to kill the balance stress
process
- common/btrfs: exercise all algorithms in _btrfs_stress_defrag()
- common/btrfs: exercise all algorithms in
_btrfs_stress_remount_compress()
- btrfs: test that we don't create pointless compressed inline
extents
- overlay/081: add missing _require_scratch check
- btrfs/273: add missing _require_scratch check
- common/btrfs: require scratch before checking encoded reads
- f2fs/015,016: add missing _require_scratch checks
- generic/590,735,795: add missing _require_scratch check
- common: strip attr 2.6.0 --restore safety warnings
- generic/760: enable sub-block reads
- generic/263: enable sub-block reads
- generic/091: enable sub-block reads
- min_dio_alignment: add a -r option to query read alignment
- statx.h: update to latest kernel UAPI
- generic: test corruption detection using T10 protection
information
- generic: test I/O on devices with T10 protection information
- add a "pi" group
- common: add a _sysfs_block_integrity_path helper
- common: factor out a _bdev_disk_name helper
- common/scsi_debug: don't slow down I/O
- f2fs/009: fix race condition in orphan inode test
- common/rc: remove trailing space from _mread() default map_len
- common: fix spelling of SCRATCH_DEV_POOL
- f2fs/024: add missing execute permission
Upgrade to v2026.09.22, not v2026.10.15 because the latter's
commits are still on branch for-next and have not yet merged to
branch master.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
OpenSSL 4.1 deprecates ASN1_STRING_length(), which the OpenSSL 4 ASN1
opaque fix uses, and the build uses -Werror:
openssl_helper.c:1255:21: error: 'ASN1_STRING_length' is deprecated:
Since OpenSSL 4.1; use ASN1_STRING_get_length() [-Werror,-Wdeprecated-declarations]
Use ASN1_STRING_get_length() when building against OpenSSL 4.1 or newer.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
tests/test_sequence_docs.py executes the code examples embedded in
docs/usage.rst, resolved relative to the tests directory. The file was
not installed, so all 26 tests in it failed with:
FileNotFoundError: [Errno 2] No such file or directory:
'/usr/lib/python3-cbor2/ptest/docs/usage.rst'
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Regenerate python3-cbor2-crates.inc to match the bundled Cargo.lock.
The previous crates list was stale (bigdecimal 0.4.10 vs 0.4.11 locked),
which made cargo metadata fail in do_compile with:
failed to select a version for the requirement `bigdecimal = "^0.4.10"`
(locked to 0.4.11)
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2.112 2019-12-13
- Added the change log from any prior source that could be found. Formatted
the log to fit metacpan.org loose standards.
- Added .mailmap to correctly attribute all commits to Dianne Skoll when
using: git shortlog -s -e
- Added .gitattributes and .gitignore to assist with keeping the repo clean
- Change use vars qw() to our $whatever instead. 'our'
- Hide IO::WrapTie subclasses from PAUSE
- Rebuild Makefile.PL to contain all of the prerequisites. Make use of the
stub from Dist::Zilla
- Convert README to README.md
- Fix the documentation in the main module, IO::Stringy to better indicate
where to get info and how to use the module
- Fix the dist's META information to indicate the original author and license
- Add a LICENSE file
- Get rid of the set-version.pl file as it's no longer needed
- Add AppVeyor CI testing
- Add Travis CI testing
- update t/IO_InnerFile.t to use Test::More and a proper TEMP file (RT #103895)
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
- Fix panics in thin_dump when btree nodes point beyond the metadata device
- Fix overflows in IoEngine block range tracking and offset calculation,
which caused panics or reads at wrong offsets on damaged metadata in
thin_check, cache_check and other tools.
- Fix integer overflow in space map boundary checks
- Remove redundant leaf insertions in LeafWalker
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Dropped patch that is part of the upstream version.
Changelog:
- Support building with OpenSSL 4.0.0 and later.
- Bug fix; UTF-7 encoding mailbox conversion problems.
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 3.3.2:
What's Changed:
- chore(deps): Bump the "dependencies" group with 1 update across
multiple ecosystems
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2.5.2:
- The special methods added to the class generated for an
wrapt.AutoObjectProxy, and adjusted when __wrapped__ was
reassigned, were determined by inspecting the wrapped object
itself, rather than the type of the wrapped object. As special
methods are only ever looked up on the type of an object, this
gave the wrong result in several cases. When the wrapped object
was a class, the special methods it defined for its instances
were added to the proxy class, so a proxy for a class defining
__set_name__() raised TypeError when assigned to an attribute in
a class body, a proxy for a class defining __get__() was bound as
a descriptor on attribute access, and a proxy for a class
defining __await__() or __iter__() was reported as awaitable or
iterable by inspect.isawaitable() and collections.abc checks,
even though the class itself was not. Special methods provided by
the metaclass of a wrapped class, such as __iter__(), were not
added to the proxy class. When the wrapped object was an
instance, instance attributes shadowing the dunder names were
treated as special methods of the wrapped object, and special
methods which a __dir__() method of the wrapped object did not
report were missed. The special methods are now always determined
from the type of the wrapped object, so a proxy behaves the same
as the object it wraps. This also covers a wrapt.LazyObjectProxy
whose factory returns an object, as resolving the wrapped object
reassigns __wrapped__. With thanks to ybai08 for pull request
#361 which identified the issue.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 26.10.0:
Security fixes:
- CVE-2026-83813 (GHSA-jj36-9pvh-vj5r)
- CVE-2023-44487 (GHSA-vpp8-g58w-m8mp)
- CVE-2026-115778 (GHSA-cwm5-jh59-mwxr)
- CVE-2026-115775 (GHSA-3476-c5c2-fr73)
- CVE-2026-115877 (GHSA-q7qq-6mhp-9rc4)
- CVE-2026-115774 (GHSA-2qrf-pqgx-qh9v)
- CVE-2026-115776 (GHSA-53xc-49m8-p798)
Features:
- It is now possible to set the SO_REUSEPORT and SO_REUSEADDR TCP
socket flags from user code.
- Python 3.14 is now supported.
- twisted.internet.defer.Deferred.__iter__, used when awaiting a
Deferred, is now about 2-3% faster.
Bugfixes:
- twisted.internet.tcp.Port.startListening() now closes the socket
when raising CannotListenError.
- Initiating a TCP connection with an address literals and a port
outside of the 1-65535 range in twisted.internet.tcp.BaseClient
and twisted.internet.iocpreactor.tcp.Client now triggers an
errback instead of an unhandled error. This change might also fix
other unhandled errors occurred while connecting using address
literals.
- twisted.logger.LoggingFile.fileno now raises
io.UnsupportedOperation instead of returning -1. This fixes an
interoperability issue with multiprocessing.
- twistd now exits with a non-zero status when given an unknown
subcommand.
- twisted.internet.testing.MemoryReactor.removeAll() now returns
what was removed to comply with IReactorFDSet.removeAll()
- twisted.internet.asyncioreactor.AsyncioSelectorReactor.callLater
now has the same signature as
twisted.internet.interfaces.IReactorTime.callLater.
twisted.internet.asyncioreactor.AsyncioSelectorReactor.callFromThread
now has the same signature as
twisted.internet.interfaces.IReactorFromThreads.callFromThread.
- twisted.protocols.ftp.FTPClient now uses ip address of the
original ftp server to open passive data connections by default,
instead of trusting PASV responses.
Improved Documentation:
- The "Writing Servers" and "UDP Networking" documentation pages
have been updated to remove obsolete references to persisting the
reactor (a feature gone from Twisted for several decades now),
and to better explain the factory and protocol setup and teardown
lifecycle.
- Twisted's policy documentation now includes a prominently
featured, clear explanation of our AI policy: to wit, including
the outputs of generative AI systems is forbidden.
Deprecations and Removals:
- twisted.internet.tcp.Connection no longer supports returning a
non-None value from a protocol's dataReceived method, deprecated
since Twisted 11.0.0.
- twisted.internet.error.PotentialZombieWarning, deprecated since
Twisted 10.0, has been removed.
- Implementations of twisted.internet.interfaces.IProcessProtocol
are now required to provide a processExited method. Omitting this
method was deprecated in Twisted 8.2.
- twisted.internet.ssl.protocolNegotiationMechanisms and
twisted.internet.ssl.ProtocolNegotiationSupport are deprecated
because all supported TLS backends provide ALPN. Callers can
configure ALPN without checking for support.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 0.35.0:
- Mark that Trio supports 3.15.
- Ensure that Trio consistently encodes all hostnames using IDNA
2008.
- Avoid erroring when running in a CPython built for an Android API
version less than 24.
- Ensure trio.lowlevel.notify_closing works even on events that
have been deleted, e.g. because they were registered as one shot
events.
- trio.Process no longer emits an EncodingWarning on Linux when
Python runs with -X warn_default_encoding
(or PYTHONWARNDEFAULTENCODING=1).
- The typing for async-file-objects is now consistent about what it
exposes based on what is exposed by the underlying object.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 0.0.33:
This release lets you cap URL-encoded form fields as they stream in, and
fixes several upload and decoding edge cases. It also drops Python 3.10
and adds Python 3.15.
- Limit URL-encoded fields while streaming. The new opt-in
MAX_FIELDS and MAX_FIELD_SIZE options for FormParser raise
FormParserError before oversized data is buffered. Both default
to no limit, and multipart forms are unaffected.
- Nameless uploads no longer crash when spilled to disk.
Uploads without a filename used to raise AttributeError when
UPLOAD_KEEP_EXTENSIONS or UPLOAD_KEEP_FILENAME was set.
- UPLOAD_DIR accepts str with UPLOAD_KEEP_FILENAME. A str
upload directory used to fail on the first write to disk.
- Decoded data is complete before callbacks run (#336, #355).
Content-Transfer-Encoding decoders are finalized at the end of
each part, and quoted-printable escapes split across writes
decode correctly.
- parse_options_header lowercases content types with parameters
. Multipart/Form-Data; boundary=abc now returns
multipart/form-data, the same as headers without parameters.
- Faster opening boundary matching. Complete boundaries are
matched in one step.
- Faster parser state lookups. Parser states are
module-level enum members, so their repr is now multipart.END
instead of <MultipartState.END: 12>.
- Faster querystring callback dispatch.
- Python 3.10 is no longer supported. Python 3.11 is now the
minimum.
- Python 3.15 is supported.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 5.0.4:
- Support pytest 9.2: pytest --codspeed no longer crashes at
session start when pytest-benchmark is installed
- build: pin -std=c11 for instrument-hooks core.c
- docs(readme): bump action version to v5
- feat: warn when running on an unsupported Python version
- ci: migrate to github default arm runners
- ci: use 26.04 image instead of latest
- ci: test against stable python 3.15 and 3.15t
- docs: add Python 3.15 to README version badge
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.4.1.post1:
Changed:
- Removed the upper version bound on the pytest dependency.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 4.0.1:
- CVE-2026-49272 / GHSA-3jp2-3mrg-2vxc: The device code flow token
endpoint did not validate the device_code parameter. A request
with a known client_id and a bogus device_code could obtain a
bearer token. DeviceCodeGrant.validate_token_request now calls
DeviceCodeGrant.validate_device_code(), which rejects missing or
unknown device codes (invalid_request / invalid_grant) and
delegates the code's authorization status to the new
RequestValidator.validate_device_code() hook, per RFC 8628
Section 3.5.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.12.0:
- feat(nodeenv): print shell completion scripts with shtab
- fix(nodeenv): point npm_config_prefix at the env in activate.bat
and Activate.ps1
- fix(nodeenv): install npm from the registry tarball on Windows
- fix(nodeenv): read quoted config values and mirror credentials
- fix: stop putting ^/dev/null on PATH in activate.fish
- fix(nodeenv): retry broken node downloads and stop hanging on
stalls
- fix: do not require python2 to build node from source
- fix(nodeenv): do not put the venv bin on PATH twice with -p
- fix(nodeenv): skip node.js pre-releases for latest and ranges
- fix: preserve fish activation environment
- fix(nodeenv): read a config value raw when interpolation fails
- fix(nodeenv): ignore source trees during prebuilt installs
- fix(nodeenv): escape glob characters in prebuilt paths
- fix(nodeenv): raise on bad config references again
- Make tox configuration more flexible
- chore(tests): port the Makefile test targets to pytest
- Align Python support metadata and runtime with Python 3.10+
- perf(nodeenv): unpack the node.js zip archive in parallel
- docs(site): new landing page for ekalinin.github.io/nodeenv
- docs(site): show GitHub stars and PyPI downloads badges
- docs: update isolated installation instructions
- docs(contributing): add contributing guide and templates
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.39:
- Test that the code examples in the docs run and match their
output
- Raise JsonPatchConflict when removing from immutable containers
- docs: explain copy and in-place behavior when a patch fails
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 9.18.1:
- The main change in this release is that themes are now JSON data:
you can install a theme by putting a file in your IPython
directory, or from a package, without writing any code.
- The release also fixes a number of completion regressions, fixes
WebP handling in ~IPython.display.Image, stops get_tail from
wiping the history database when ipykernel asks for n=None, and
adds ~IPython.core.formatters.DisplayFormatter.register_formatter.
- theme_table can no longer be mutated, and the individual theme
objects are no longer importable from IPython.utils.PyColorize.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 3.5.4:
- Fix possible hang if worker holding the stop flag was killed
while holding it.
- Lots of refactoring/cleanup.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Peter Marko
Bartosz Golaszewski
Johannes Schneider
Leon Anavi
Khem Raj
Jason Schonberg
Ankur Tyagi