The inherited python:filelock mapping does not identify the tox-dev source packaged by this recipe, so filelock CVEs are missed.
Use tox-dev:filelock to match the source identity used by NVD and CNA.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Fast serialization and validation library for JSON, MessagePack, YAML and
TOML. Added as a runtime dependency of the forthcoming python3-max recipe,
but useful on its own.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
SuiteSparse adds -Wl,-rpath=$(INSTALL_LIB) while linking shared
libraries on Linux. In the OpenEmbedded build this value can resolve to
a build or install path under TMPDIR, so installed ELF files can keep an
absolute build path and fail buildpaths QA.
The packaged libraries do not need this install-tree rpath. Runtime
resolution is handled through normal package dependencies and the target
library search path. Keep the librt link and drop only the rpath entry.
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
SuiteSparse 5.10.1 still carries bundled CMake entry points with
2.x minimum versions. CMake 4 rejects projects which request
compatibility with versions older than 3.5, so configure fails before
SuiteSparse can build.
Backport the upstream SuiteSparse change which raises the bundled
Mongoose, METIS and GKlib minimum version to 3.13. This version also
reaches two bundled GraphBLAS CMake entry points with the same old
minimum, so update those in the backport as well.
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
samba package also installs LDB command line tools and python LDB
module. libldb package installs the same tools and pyldb module from
standalone LDB source.
pkgdata shows the conflict clearly:
samba: /usr/bin/ldbadd
libldb: /usr/bin/ldbadd
samba-python3: site-packages/ldb.so
pyldb: site-packages/ldb.so
So when both samba and libldb are added in same image, rootfs can fail
because package manager sees same files from two different packages.
Both package sets are not expected to be installed together.
Add RCONFLICTS for samba/libldb and samba-python3/pyldb. This makes the
conflict explicit during dependency resolution instead of failing later
as file install conflict.
Older meta-networking had similar conflict handling for samba/libldb in
commit: https://git.openembedded.org/meta-openembedded/commit/?id=8e641e28f630dac61a03373ad70c72a2370ad11e
This change adds the same handling again with current python3 package names.
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current product-only "httplib2" mapping generates a wildcard-vendor
product identity instead of the vendor assigned to the packaged project.
Use "httplib2_project:httplib2" for its exact NVD dictionary CPE and NVD
configuration identity. This changes the generated CPE, but sbom-cve-check
1.3.3 with the pinned NVD database snapshot has no current CVE report delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The current inherited "python:web3" mapping does not match the web3.py identities used by NVD and CVE List V5, so its source-aligned CVE is missed.
Use "ethereum:web3.py" for the CNA affected-data identity and "apeworx:web3.py" for the NVD dictionary CPE and configuration identity.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
UTscapy writes its detailed report, including the traceback of every
failing test, to a file under ${PTEST_PATH}. Under testimage that path
only exists inside the ephemeral image, which is discarded as soon as the
run finishes, so a failure left nothing behind but a bare
FAIL: 000.01s Emulate interact()
line and diagnosing it required rebuilding the image by hand.
Pass -F so the report expands only the failed tests, and cat it to stdout
when there is one, where ptest-runner records it. A clean run is
unaffected.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The "Emulate interact()" UTScapy regression test failed:
IPython requested but not found !
Using the default Python shell: History is disabled.
Traceback (most recent call last):
File "/usr/lib/python3.14/site-packages/scapy/main.py", line 857, in interact
banner += "\n"
UnboundLocalError: cannot access local variable banner where it is
not associated with a value
scapy.main.interact() only binds "banner" in the branches handling the
ipython, ptipython, ptpython and bpython shells. The test asks for
ipython, which is not in the image, so scapy falls back to the plain
Python shell and leaves "banner" unbound while still running the
unconditional "banner += \n" for the caller-supplied mybanner.
The test is correct and the bug is in scapy, which still has it in
master, so carry a patch initializing banner from banner_text before the
shell-specific chain.
meta-networking-image-ptest-python3-scapy now reports PASSED=319
FAILED=0, up from PASSED=318 FAILED=1.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
ptest.bbclass pulls ptest-runner into the -ptest package with
RRECOMMENDS:${PN}-ptest += "ptest-runner"
but the recipe then used a hard assignment for its own recommendation,
which overwrote that and left openl2tp-ptest recommending only
kernel-module-l2tp-ppp. ptest-runner was therefore never installed in
the ptest image, and meta-networking-image-ptest-openl2tp skipped the
whole run with "Test requires ptest-runner to be installed" instead of
executing any test.
Append instead of assigning, so both recommendations survive. The
openl2tp ptest now runs and passes.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The product-only cbor2 mapping uses a wildcard vendor. Use
agronholm:cbor2, the NVD identity for the packaged source.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- a11y: add aria-labels to copy-to-clipboard buttons
- a11y: add skip-to-operations link, banner and main landmarks
- a11y: close Authorization popup with Escape key and backdrop click
- a11y: name and state for dark-mode toggle button
- a11y: restore icon visibility in Windows High Contrast Mode
- a11y: topbar logo and dark-mode toggle visible in HCM
- a11y: use for model titles to convey emphasis semantically
- ci: bump cycjimmy/semantic-release-action to v6.0.0
- ci: fix Trivy security scan and add dependency vulnerability scan
- style: reduce padding on inline code blocks in markdown
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
License-Update: Copyright year updated to 2026
Changelog:
===========
- Breaking change: Drop support for Python 3.8, require Python >= 3.9
- Breaking change: Remove deprecated xxhash.VERSION_TUPLE
- Breaking change: The input keyword argument is renamed to data in
constructors and one-shot functions. update() additionally gains a data
keyword argument (it accepted no keyword arguments before).
- Breaking change: str input is no longer accepted and raises TypeError:
Strings must be encoded before hashing; encode to bytes before hashing
- Upgrade xxHash from v0.8.2 to v0.8.3. Note: on GCC/Clang source builds that
target AVX2 (e.g. -march=x86-64-v3), upstream v0.8.3 autovectorizes
XXH64_update() and makes the xxh64 streaming path about 2x slower. The shipped
wheels are built for baseline x86-64 and are unaffected. Source builds can work
around it by adding -fno-tree-vectorize to the compiler flags.
- Add per-object locking for thread safety, with sub-interpreter and
free-threaded (no-GIL) Python support. The GIL is now released only while
hashing inputs larger than 64 KiB; previously update() released it
unconditionally and one-shot functions always held it.
- Speed up hash constructors by switching them to tp_vectorcall.
- Build pyodide wasm32 wheels
- Add s390x big-endian test job
- Add Python 3.15 classifier
- CI: shard the PyPI upload into parallel groups and create the GitHub Release
automatically
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- fix(type): cast set value in _render_options
- docs: fix typo 'set the the' -> 'set then the' in config reference
- ci: pin coverage to the ctrace core
- chore: remove the misc changelog category
- test: seed the virtualenv wheel image up front
- feat(plugin): type the plugin and internal API surfaces
- test: raise timeout for missing-interpreter discovery tests
- docs: mark the INI configuration format as deprecated
- docs: publish llms.txt from the docs build
- Provision before loading env_list
- docs: repoint nine dead source links in the onboarding guide
- Add {home} and {tox_root_name} substitutions
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- Form-encoded ''POST'' bodies are now subject to a limit of 1000 arguments by default. This
prevents a CPU and memory denial of service attack. This limit can be overridden via the
'.set_parse_body_config' function.
- Multipart parsing now rejects requests with an excessive number of parts earlier in the parsing
process, limiting memory consumption.
- The deprecated mixed-case arguments to '.RequestHandler.set_cookie' now enforce the same
restrictions on invalid characters that were introduced in Tornado 6.5.5 for the standard
lowercase arguments.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
==========
- FIX: Fix issue where :is() and :where() were not accounting for empty selectors in the max selector count as they should
- FIX: Fix issue where :has() was allowing empty selectors in some circumstances even though it is not forgiving.
- FIX: Reduce selector object size when :is() and :where() contain empty selectors.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Devansh Patel
Zheng Ruoqin
Ankur Tyagi
Khem Raj
Jaipaul Cheernam
Himanshu Jadon
Wang Mingyu
Khem Raj