A vulnerability in corydolphin/flask-cors version 4.0.1 allows the
`Access-Control-Allow-Private-Network` CORS header to be set to true
by default, without any configuration option. This behavior can expose
private network resources to unauthorized external access, leading to
significant security risks such as data breaches, unauthorized access
to sensitive information, and potential network intrusions.
References:
https://nvd.nist.gov/vuln/detail/CVE-2024-6221
Upsteam-Patch:
7ae310c56a
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Twisted is an event-based framework for internet applications, supporting
Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process
pipelined HTTP requests out-of-order, possibly resulting in information
disclosure. This vulnerability is fixed in 24.7.0rc1.
References:
https://nvd.nist.gov/vuln/detail/CVE-2024-41671
Upstream-patches:
046a164f894a930de12f
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Frank de Brabander <debrabander@gmail.com>
Add missing RDEPENDS for ptest:
- python3-zoneinfo
- tzdata
Similar to fixes in Styhead 110b636836 but for 2.18.4
and without needing to add the python3-tzdata recipe.
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
The recipe for pydantic currently is at version 2.7.3. This
project specifies in its pyproject.toml that it depends on
pydantic-core version 2.18.4. Because an older 2.16.3 version
of pydantic-core was used now, a simple bit of code will break.
from enum import Enum
from pydantic import BaseModel
class Color(str, Enum):
RED = "RED"
BLUE = "BLUE"
class Car(BaseModel):
color: Color
print(Car(color=Color.RED))
This will upgrade the python3-pydantic-core recipe to make it
compatible with python3-pydantic, so that the above snippet of
code will no longer fail.
Two patches are removed, these backports are now included in the
upstream code. A new patch is added to set the required rust
compiler from 1.76 to 1.75. Version 1.76 is not actually needed.
File python3-pydantic-core-crates.inc is regenerated by running
'bitbake -c update_crates python3-pydantic-core'.
The recipes RDEPENDS now includes python3-compression. The pydantic
schema validator imports 'importlib.metadata' which wants to import
'zipfile'.
The buildpaths QA check is skipped. This should be fixed at some
point, but it was already failing before this change.
Signed-off-by: Frank de Brabander <debrabander@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Backport from Styhead bee8b9bbc4 as part of the overall scarthgap fix
Fix typo in python3-pydantic version, it was 2.7.3 not 2.7.2
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Changelog:
============
-Bump pydantic-core to v2.18.2
-Ftp and Websocket connection strings support
-Use field description for RootModel schema description when there is no docstring
-Fix validation_alias behavior with model_construct for AliasChoices and AliasPath
-Revert typing.Literal and import it outside the TYPE_CHECKING block
-Fix Secret serialization schema, applicable for unions
-Fix strict application to function-after with use_enum_values
-Address case where model_construct on a class which defines model_post_init fails with AttributeError
-Fix model_json_schema with config types
-Support multiple zeros as an int
-Fix validation of ints with leading unary plus
-Fix interaction between extra != 'ignore' and from_attributes=True
-Handle error from Enum's missing function as ValidationError
-Fix memory leak with Iterable validation
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Backport from Styhead 6112eb064c as part of the overall scarthgap fix
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
* crypto: use _Generic only if !defined(__cplusplus)
* fixes build with gcc-14 which has __builtin_addc and __builtin_subc
with gcc-13 it was already using the #else branch because of missing builtins
* fixes
https://github.com/grpc/grpc/issues/35945http://errors.yoctoproject.org/Errors/Details/766916/
* _Generic was introduced in boringssl with:
https://boringssl.googlesource.com/boringssl/+/70ca6bc24be103dabd68e448cd3af29b929b771d%5E%21/#F4
* but e.g. third_party/boringssl-with-bazel/src/ssl/d1_both.cc includes
this internal.h and from the .cc extension gcc will process it as C++
where _Generic isn't available, causing:
In file included from third_party/boringssl-with-bazel/src/ssl/d1_both.cc:125:
third_party/boringssl-with-bazel/src/ssl/../crypto/internal.h: In function 'uint32_t CRYPTO_addc_u32(uint32_t, uint32_t, uint32_t, uint32_t*)':
third_party/boringssl-with-bazel/src/ssl/../crypto/internal.h:1159:7: error: expected primary-expression before 'unsigned'
1159 | unsigned: __builtin_addc, \
| ^~~~~~~~
third_party/boringssl-with-bazel/src/ssl/../crypto/internal.h:1166:10: note: in expansion of macro 'CRYPTO_GENERIC_ADDC'
1166 | return CRYPTO_GENERIC_ADDC(x, y, carry, out_carry);
| ^~~~~~~~~~~~~~~~~~~
third_party/boringssl-with-bazel/src/ssl/../crypto/internal.h:1160:7: error: expected primary-expression before 'unsigned'
1160 | unsigned long: __builtin_addcl, \
| ^~~~~~~~
third_party/boringssl-with-bazel/src/ssl/../crypto/internal.h:1166:10: note: in expansion of macro 'CRYPTO_GENERIC_ADDC'
1166 | return CRYPTO_GENERIC_ADDC(x, y, carry, out_carry);
| ^~~~~~~~~~~~~~~~~~~
third_party/boringssl-with-bazel/src/ssl/../crypto/internal.h:1161:7: error: expected primary-expression before 'unsigned'
1161 | unsigned long long: __builtin_addcll))((x), (y), (carry), (out_carry))
| ^~~~~~~~
third_party/boringssl-with-bazel/src/ssl/../crypto/internal.h:1166:10: note: in expansion of macro 'CRYPTO_GENERIC_ADDC'
1166 | return CRYPTO_GENERIC_ADDC(x, y, carry, out_carry);
| ^~~~~~~~~~~~~~~~~~~
third_party/boringssl-with-bazel/src/ssl/../crypto/internal.h:1158:4: error: '_Generic' was not declared in this scope
1158 | (_Generic((x), \
| ^~~~~~~~
third_party/boringssl-with-bazel/src/ssl/../crypto/internal.h:1166:10: note: in expansion of macro 'CRYPTO_GENERIC_ADDC'
1166 | return CRYPTO_GENERIC_ADDC(x, y, carry, out_carry);
| ^~~~~~~~~~~~~~~~~~~
(cherry picked from commit 5778e32eae)
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Changelog:
==========
- Fixed typo 'marking' instead of 'marketing' in case-insensitive mailbox name list.
- When DNS-based deliverability checks fail, in some cases exceptions are now
thrown with raise ... from for better nested exception tracking.
- Fixed tests to work when no local resolver can be configured.
- This project is now licensed under the Unlicense (instead of CC0).
- Minor improvements to tests.
- Minor improvements to code style.
License-Update: Relicense under the Unlicense (instead of CC0)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0dd1264a94)
Signed-off-by: Richard Leitner <dev@g0hl1n.net>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Our python3-protobuf is installed in standard site-packages location,
there's no need for an extra .pth file. So this .pth is useless.
What's worse, this .pth file is problematic for python 3.12 ptest. It will
cause the following test case to hang forever:
test.test__xxsubinterpreters.CreateTests.test_in_thread
I've filed an issue[1] for cpython. Until the problem is resolved there,
we should avoid packaging this .pth file.
In fact, Debian also removes this file in the rules file, though their reason
for removal is likely that the file is useless.
rules: find $(CURDIR)/debian/python3-protobuf -name 'protobuf-*-nspkg.pth' -delete
Some more information below, just for better tracking:
1. That .pth file is way too complicated according to .pth design[2].
2. The subinterpreter is not offically part of python, at least for 3.12. The PEP[3][4]
has not been accepted. The test__xxsubinterpreter is a preparation for it.
[1] https://github.com/python/cpython/issues/122220
[2] https://docs.python.org/3/library/site.html
[3] https://peps.python.org/pep-0554/
[4] https://peps.python.org/pep-0554/
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
The flow module was removed in Twisted 9.0.0 a long time
and currently does not install anything. Let's remove it
to cleanup the recipe.
This commit also removes python3-twisted-news package because
the source files were removed in Twisted 21.2.0. All other
files which no longer exist in the source are also removed from FILES.
Signed-off-by: Guðni Már Gilbert <gudnimar@noxmedical.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Fixes an issue where split packages were no populated since all the files
were picked up by FILES:${PN}
Signed-off-by: Guðni Már Gilbert <gudnimar@noxmedical.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
It looks like python3-six was dropped as a dependency between
version 3.17.0 and 3.18.0. Looking at the PyPi downloads indicates
this coincides with when Python 2 support was dropped.
I couldn't find any release notes so this patch is based on looking
at the source code downloaded from PyPi.
Signed-off-by: Guðni Már Gilbert <gudnimar@noxmedical.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
- build backend is hatchling.build
- python3-six is not a runtime dependency, it's not imported anywhere in the source
- add python3-asyncio to RDEPENDS
Signed-off-by: Guðni Már Gilbert <gudnimar@noxmedical.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
python3-six is no longer a dependency and Python 2 support has already been dropped.
Change python3-twisted to python3-twisted-core such that only required modules
are installed.
Signed-off-by: Guðni Már Gilbert <gudnimar@noxmedical.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
Correct way to convert bytes to string if orjson exists.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
Add preliminary support for Python 3.13 as of 3.13a6.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
===========
-Add feedback survey banner to docs
-Fix eth_createAccessList docs to reflect the correct behavior.
-Add request formatter for maxFeePerBlobGas when sending blob transactions. Add
formatters for blobGasPrice and blobGasUsed for eth_getTransactionReceipt.
-Add formatters to ensure that the result of a eth_createAccessList response
can be plugged directly into an accessList in a transaction.
-Add Cancun support to EthereumTesterProvider; update Cancun-related fields in
some internal types.
-Use pre-commit for linting the v6 branch
-Add an upperpin at eth-typing<4.2.0 due to removal of EthPM types in that lib
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
-patch: moves country_code module to country module
moves base58 and base64 into encoding
adds encoding tests and docs
supported extended latin in username
-feat: adds indian aadhar and pan validator
adds finance validator
adds consider_tld parameter to domain, hostname and url modules
lays foundation for URI validation
adds private parameter to ip_address, hostname & url
adds base58 and base64 validators
adds basic cron validator
-fix: regex ignore-case uses only a-z
domain validation is now more consistent across rfcs
-maint: adds quick start docs
updated dev dependencies, doc links; bump version
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
-Allow to upsert monitors
-Add Django signals_denylist to filter signals that are attached to by signals_spans
-increment for metrics
-Add value, unit to before_emit_metric
-Remove experimental metric summary options
-New normalization rules for metric keys, names, units, tags
-Change data_category from statsd to metric_bucket
-Accessing __mro__ might throw a ValueError
-Suppress prompt spawned by subprocess when using pythonw
-Handle None in GraphQL query
-Do not send "quiet" Sanic exceptions to Sentry
-Implement metric_bucket rate limits
-Fix type hints for monitor decorator
-Remove deprecated typing imports in crons
-Make monitor_config a TypedDict
-Add devenv-requirements.txt and update env setup instructions
-Bump types-protobuf from 4.24.0.20240311 to 4.24.0.20240408
-Disable Codecov check run annotations
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
License-Update: Copyright year updated to 2024.
Changelog:
===========
-Support unrar-free >= 0.2.0.
-Add RarFile.is_solid to check if archive uses solid compression.
-Support old multi-volume archives better where ENDARC does not contain NEXTVOL.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
============
-Add lock to async requests, correct logging and length calc.
-test_simulator: use unused_tcp_port fixture
-streamline imports in Factory.py
-Secure testing is done with pymodbus in PR.
-Fix link to github in README
-Wildcard exception catch from pyserial.
-Problem with stale CI.
-Add connection exception to list of exceptions catpured in retries
-Move on_reconnect to client level
-Bump github stale.
-update package_test_tool (add 4 test scenarios)
-Bump dependencies.
-Cancel send if no connection.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
===========
-Revert the package cache introduced in 2.13. Don't cache the decompressed
contents of wheels unless being told so.
-Fix inconsistent logging when pdm use a different python interpreter
-Fix PDM unable to find Python interpreters when PDM_IGNORE_ACTIVE_VENV is set
-Check verify_ssl when trusting each source.
-Fix name check for project itself in pdm outdated
-Fix a regression that proxy env vars are not respected.
-Fix an issue that venv provider can't be found when providers are explicitly
configured.
-Fix a bug that [tool.pdm.options] are ignored if -c/--config CONFIG is given.
-Make --without respect groups in dev-dependencies
-Per-source configuration for ca-certs and client-cert.
-Remove all caches by removing individual cache types one by one.
-Use the default HTTP client when downloading the pythons, to use the
certificates settings.
-Fix a race condition where pth files take effect when multiple packages are
installed in parallel.
-Refuse to run recursive composite scripts.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
============
-Add .symlink_to and .hardlink_to.
-Add .cwd method and deprecated .getcwd.
-Create 'absolute' method and deprecate 'abspath'.
-In readlink, prefer the display path to the substitute path.
-Restore functionality in .isdir and .isfile.
-Added .is_dir and .is_file for parity with pathlib. Deprecates .isdir and .isfile.
-Inlined some types.
-Fix iterdir - it also accepts match.
-Add type annotation for iterdir.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
