Upgrade to release 3.14.2:
- fs: Fix filesystem type for temporary mounts
- misc: Fix condition for installing pocketlint on Debian/Ubuntu
- misc: Use ansible_facts instead of deprecated top-level fact variables
- Update properties for started stratis pools during populate
- Fix extra mount options for Stratis filesystems in fstab
- Directly access _type/_name in _to_string to avoid subclass property
lock
- Fix deadlock between blivet_lock and logging lock
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 26.10.1:
Highlights:
This release fixes a security issue in Black's bundled GitHub
Action. Repositories that use the action are encouraged to update
to the latest version of Black immediately. This update is received
automatically when using psf/black@stable, and is independent of
the version of Black installed by the action.
When the GitHub Action reads version specifiers from
tool.black.required-version, it now only accepts released versions
of Black, as it already did for black requirements in dependency
lists. Other values, such as URL references, are now rejected. This
issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier
is pending.
Stable style:
- Fix a long Jupyter notebook assignment magic (for example x = !ls
-la) being wrapped in parentheses, which IPython can no longer
run; such cells are now left unchanged
- Keep repeated lines outside the selected --line-ranges unchanged
- Fix --line-ranges formatting lines that follow a statement when
formatting joins or re-indents that statement
- Fix --line-ranges crashing with an internal error when an
unselected statement has a # fmt: skip comment on the last line
before a closing bracket
- Prevent moving an encoding declaration (for example # -*- coding:
latin-1 -*-) onto the first two lines of a file
- Fix adding an extra trailing blank line inside a multi-line
module docstring when its last line is near the line length limit
Preview style:
- Do not split short expressions on delimiters (such as binary
operators, comparisons, or comprehensions) inside brackets when
preceded by a standalone comment
- Fix the unstable string_processing feature removing
backslash-newline sequences from raw strings, which changed their
value
- Avoid adding unnecessary parentheses around unbreakable
right-hand side expressions in assignments (such as annotated
assignments or subscript targets)
- Parenthesize expressions with parameter comments when they exceed
the line length under --preview
- Fix wrap_long_dict_values_in_parens dropping the parentheses
around a right-hand side that contains a dictionary, leaving a
line over the length limit
- Fix the unstable string_processing feature adding a space after *
or in a PEP 695 type parameter (* Ts = ...) when it splits a
string in the parameter's default
- Avoid unnecessary line splits of trailers (such as
indexing/subscripts) when an earlier bracket split exceeds the
line length only due to a trailing comment
Configuration:
- Add --cache-dir to configure the cache directory from the command
line
- Don't cache a file as formatted after formatting or checking it
with --line-ranges, which made a later full black --check pass
and black skip the unformatted lines
- Respect a .gitignore that starts with a UTF-8 byte order mark.
The mark became part of the first pattern, so that pattern never
matched and Black formatted files that git ignores
Performance:
- Avoid quadratic runtime when splitting very long lines with many
trailing bracket pairs (such as consecutive subscripts)
Integrations:
- Fix the GitHub Action crashing on dependency-group includes when
use_pyproject is enabled
- When the GitHub Action reads version specifiers from
tool.black.required-version, it now only accepts released
versions of Black, as it already did for black requirements in
dependency lists. Other values, such as URL references, are now
rejected.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 26.10.1:
General
- Load the vendored FlatBuffers runtime only when a FlatBuffers
message is first built or parsed, instead of on every import
autobahn. The runtime imports numpy whenever numpy is installed,
so up to 26.7.1 every process importing autobahn also loaded numpy,
including WebSocket-only users such as Django Channels applications
served by Daphne. Every autobahn import now needs about 13-17 MB
less memory on CPython and 18-24 MB less on PyPy, and none loads
numpy. A new documentation page (docs/memory-footprint.rst, just
memory-footprint) shows the import memory footprint per release on
CPython and PyPy.
Wheels
- Publish native Windows ARM64 (win_arm64) wheels with NVX for
CPython 3.11-3.14, built on GitHub’s windows-11-arm runners (PyPy
publishes no Windows ARM64 interpreter); thanks to @ndabas.
cryptography currently publishes no win_arm64 wheel, so the build
compiles it against an OpenSSL from vcpkg.
- Build cryptography against an OpenSSL from vcpkg on Windows x86_64
too: cryptography 50.0.2 publishes its Windows PyPy wheels for PyPy
8 (pp80) only, and the pypy311 wheel build uses PyPy 7.3 (pp73), so
pip builds it from source there.
WebSocket
- Make all four per-message compression extensions
(permessage-deflate, -bzip2, -brotli, -snappy) enforce the
decompression budget the same way: decompression stops near the
remaining maxMessagePayloadSize budget instead of decompressing a
whole frame first, and “over budget” as well as “budget already
used up” raise PayloadExceededError. brotli now bounds its output
with Decompressor.process(output_buffer_limit=...), snappy is
decompressed one framing chunk at a time, and deflate no longer
lets one octet through once the budget is used up.
- Add autobahn.exception.PayloadCorruptError: every compression
extension now raises it for input it cannot decompress (corrupt,
truncated, or not the extension’s format), instead of the library’s
own exception (zlib.error, OSError, brotli.error, …), and snappy no
longer accepts such input silently. The protocol fails the
connection with close code 1007 (invalid frame payload data), the
same for every extension and on both Twisted and asyncio.
- Fix permessage-brotli failing on the second message of a connection
when context takeover was negotiated (the default): the compressor
and decompressor were reused after their brotli stream had
finished. Each message is now a new brotli stream, which is the
wire format brotli used for the first message already, and for no
context takeover.
- Fix an asyncio WebSocket connection being left open, but no longer
serviced, when an exception escaped the processing of received
data: the connection is now dropped, as on Twisted.
- Add a documentation page on WebSocket compression
(docs/websocket/compression.rst): for each of the four extensions,
which Python package and which compression library (and bundled
version) it uses on CPython and on PyPy, plus context takeover,
decompression limits and the handling of invalid data. The old,
unpublished page under docs/work/ did not cover permessage-brotli
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
W_EXITCODE() is a glibc extension that musl does not provide, so clang
fails with -Wimplicit-function-declaration. Define it when missing,
using the glibc definition.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
test/meson.build assumed libc provides argp whenever argp.h exists, but
on musl the header comes from argp-standalone, pulled into the sysroot
via v4l-utils, and test_decode/test_video failed to link argp_parse.
Backport the upstream fix that also checks for argp_parse and falls
back to the bundled non_argp.c.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
configure rejected riscv hosts as not ported, and the TSC read fell back
to x86 rdtsc. Patch both, reading the time CSR with rdtime.
Tested by building for qemuriscv64 (musl, clang) and running a loopback
ping-pong under qemu-riscv64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
log.c uses open() and O_* flags without including <fcntl.h>, which
glibc pulls in indirectly but musl does not, so clang fails with
-Wimplicit-function-declaration.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
kernel-arch.bbclass no longer sets ARCH (oe-core 635f85b7b8), so
ARCH=${ARCH} expanded to an empty value and tools/scripts/Makefile.arch
fell back to the build host's uname -m. libbpf was then built with
tools/arch/x86/include, breaking cross builds, e.g. on riscv64:
tools/arch/riscv/include/asm/barrier.h:13:10: fatal error: asm/fence.h: No such file or directory
Set ARCH from map_kernel_arch() as perf.bb does.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upstream LuaJIT v2.1 has no riscv64 backend, so fetch the plctlab
v2.1-riscv64 branch on riscv64, with the recipe's patches rebased onto
it, and drop the riscv64 COMPATIBLE_HOST restriction.
Tested by building for qemuriscv64 (musl, clang) and running a JIT-ed
loop under qemu-riscv64 (jit.status() is true).
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
TARGET_OS is linux-musl on musl, which matched none of the
LUA_TARGET_OS overrides, so TARGET_SYS was Unknown and LuaJIT was built
for LUAJIT_OS_OTHER, losing Linux-specific features such as the
profiler (LJ_HASPROFILE).
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Document the mailing list workflow and the conventions agents get wrong
most often: recipe-only commit summaries with the sub-layer tag carried in
the email subject as [meta-oe][PATCH x/y], the AI-Generated tag, and the
human contributor's Signed-off-by on commits and recipe patch files.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
glycin unconditionally requires libseccomp, and oe-core opts riscv32 out
of the seccomp distro feature since libseccomp is not ported to rv32.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
tcmu_lba_to_byte() returns uint64_t while size_t is 32-bit on ILP32
targets, so the type-checking min() macro fails with
-Werror,-Wcompare-distinct-pointer-types. Compare in 64 bits; the
result never exceeds length, so it still fits in size_t.
Build-tested for qemuriscv32 (musl, clang).
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
gperftools is incompatible with mips, riscv32 and riscv64, which made
tcmu-runner unbuildable there. Make tcmalloc an optional PACKAGECONFIG,
enabled by default, and disable it on those architectures.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
It was compatible on all core supported arches except rv32, which builds
now, so remove this regexp
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 4.15.1:
- Implemented a compatibility fix for supporting direct access of
anyio.* submodules from the main package even when those
submodules were not directly imported first.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.20.0:
usecase:
- [usecase] [batch] Added a warning for the case where an unnamed
CHECK constraint on a reflected table is omitted from a batch
"recreate" operation. An unnamed CHECK constraint can't be
reliably carried over in a batch recreate as it may refer to
columns that are being dropped or changed. This omission was
previously a silent operation. The presence of any
~sqlalchemy.schema.CheckConstraint in
Operations.batch_alter_table.table_args is taken to indicate that
the case has been accommodated, and no warning is emitted.
- [usecase] [autogenerate] Autogenerate now renders a warning
comment above any rendered Operations.drop_constraint() directive
for which the constraint name is None, as is the case when a
constraint that has no name in the model is dropped, most
typically within the downgrade() function of a migration that
adds an unnamed constraint. A warning is also emitted on the
console when the migration script is generated. The directive
requires a non-None name in order to be able to emit a "DROP
CONSTRAINT" command.
bug:
- [bug] [batch] Fixed bug in batch mode where adding a column with
a type that generates its own CHECK constraint, such as
~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum with
~sqlalchemy.types.Boolean.create_constraint set to True, would
emit the constraint twice when the table was recreated, once
under the name generated by the naming convention in use and once
under the name given to the type. The constraint is now emitted
once, using the same name that would be used outside of batch
mode.
- [bug] [batch] Fixed bug in batch mode where a CHECK constraint
generated by a type such as ~sqlalchemy.types.Boolean or
~sqlalchemy.types.Enum would lose the name established for it by
the naming convention in use when the table was recreated, as the
constraint was regenerated against the temporary table used for
the recreate operation. The naming convention is now resolved
against the name of the table being replaced.
As part of this change, a type that generates a CHECK constraint
but has no name of its own, used in conjunction with a naming
convention that includes the %(constraint_name)s token, now emits a
warning, as the convention has no name to interpolate; the
constraint continues to be emitted without a name. As noted at
batch_check_constraints, these datatypes should be given a name in
order to participate fully in batch mode.
- [bug] [batch] Fixed bug in batch mode where the
Operations.batch_alter_table.naming_convention parameter would
re-generate the names of constraints that already had a name when
reflected, in the case where the convention included the
%(constraint_name)s token, leading to a name that included the
convention's own prefix twice. The convention is now applied
only to those constraints that are reflected without a name,
which is the use case the parameter is documented for.
- [bug] [mysql] Fixed bug where autogenerate with
EnvironmentContext.configure.compare_server_default would report
a persistent server default change for Float, Numeric and other
decimal columns on MySQL. MySQL reports a literal server default
for such a column either in quoted form, e.g. '1', or, when the
value is fractional, as a parenthesized expression, e.g. (2.5);
neither form was accommodated for columns other than those of
Integer affinity, so that a default such as server_default="1" on
a sqlalchemy.Float column would never compare as equal to the
reflected value.
- [bug] [mysql] Fixed bug where autogenerate with
EnvironmentContext.configure.compare_server_default would report
a persistent server default change for an expression server
default such as (rand()). MySQL reports such a default with the
surrounding parenthesis included whereas MariaDB reports it
without them, so that the parenthesis are now disregarded when
comparing.
misc:
- [change] [general] Support for SQLAlchemy 1.4 is dropped as of
Alembic 1.20.0; SQLAlchemy 2.0.0 is now the minimum required
version. SQLAlchemy 1.4 has no support for Python 3.13 and above,
and the version-conditional code paths it required throughout
Alembic have been removed in favor of the SQLAlchemy 2.0 API.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2.5.1:
- A LazyObjectProxy created with an interface argument that declared
a path-like type, such as os.PathLike or pathlib.Path, did not
define the __fspath__() special method on the class it generated.
Because os.fspath() looks up __fspath__() on the type of the
object, passing such a proxy to os.fspath(), the builtin open()
or other standard library functions accepting paths raised
TypeError before the factory callable had been invoked to create
the wrapped object. The __fspath__() special method is now added
when the declared interface provides it, in the same way as is
already done for the other special methods looked up on the type,
so the first path conversion triggers creation of the wrapped
object and succeeds. With thanks to Muneeb Sheikh.
- A callback passed to wrapt.WeakFunctionProxy which was callable
but evaluated as false, such as an event emitter object which
reports its number of subscribers via __len__() and is empty when
first created, was passed the underlying weak reference object
instead of the proxy when the wrapped function expired. Where the
wrapped function was a bound method, such a callback could also
be called twice, once each when the instance and the function
expired. Only None is now treated as meaning no callback was
supplied, which mirrors the behaviour of weakref.ref() and
weakref.proxy() in the standard library, so these callbacks now
receive the proxy and are called only once, as for any other
callback. With thanks to Huanyi Xie.
- A wrapt.AdapterFactory instance passed as the adapter argument
to wrapt.decorator was ignored, and so never called, if the
instance evaluated as false, such as when the factory class
defined __bool__() or __len__(). The decorated function then
retained its original signature instead of that produced by the
factory. Whether an adapter factory was supplied is now
determined by type before the truth value of the adapter is
considered, so such factories are always called. As a consequence
of this change a factory can now also return None, or any other
false value, to indicate that no adapter should be used for a
particular function, where previously this failed with an obscure
error. With thanks to Luochenchen.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
GNU coreutils installs these in ${base_bindir}, so match it. This only
matters when usrmerge is not enabled, as otherwise ${base_bindir} and
${bindir} are the same directory and the generated links are unchanged.
Only the path of the update-alternatives symlinks changes (from ${bindir}
to ${base_bindir}); they still point to ${bindir}/coreutils.
Checked that the generated postinstall now links all six in /bin.
AI-Generated: Uses Claude Sonnet 5.5
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
posix_ipc decides at build time whether it needs librt and whether
message queues are available by compiling small probe programs in
build_support/discover_system_info.py. Its does_build_succeed() splices
the linker option into the compiler argv verbatim, so when no extra
library is wanted the compiler is called with a literal empty argument:
$CC -Wall -o foo foo.c '' -lpthread
GNU ld treats '' as an input file and fails ("cannot find : No such
file or directory"); lld ignores it. With the gcc toolchain every probe
without -lrt therefore fails, the prober wrongly decides librt is
required, and on a C library without a usable librt message queue
support is dropped - which is how posix_ipc.MessageQueue went missing
(issue #916). The result depends on the linker rather than on what the
C library provides.
The previous LDFLAGS += "-lrt" workaround only papered over this, and
is itself libc specific: it forces linking librt even where mq_* live
in libc (glibc >= 2.34, musl).
Fix the prober to split linker_options with shlex, like it already does
for CC, so an empty value adds no argument, and drop the forced -lrt so
the probes decide per C library.
Verified on qemux86-64 for glibc and musl, each with the clang and gcc
toolchains: src/system_info.h defines MESSAGE_QUEUE_SUPPORT_EXISTS,
SEM_GETVALUE_EXISTS and SEM_TIMEDWAIT_EXISTS, and the extension module
imports all mq_* from libc with no librt NEEDED entry.
Fixes: https://github.com/openembedded/meta-openembedded/issues/916
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The 3.85 README ends at line 996, so the existing license checksum
covers only a blank line. Checksum the shipped LICENSE file instead.
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
64-bit time was turned off for all of libcamera because v4l2-compat.
libcamera fixed this upstream in v0.3.0 by also
undefining _TIME_BITS for v4l2-compat (commit 705601 "v4l2:
Unset _TIME_BITS in addition to _FILE_OFFSET_BITS"), so the
workaround is no longer needed.
v4l2-compat.so still uses 32-bit APIs on purpose, so keep the
32bit-time QA skip for it.
Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Both ptests get killed by the OOM killer with the default 1G:
Out of memory: Killed process 390 (python3) total-vm:946408kB, anon-rss:909840kB
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
arrow/parser.py imports zoneinfo, falling back to backports.zoneinfo
which is not available either, so importing arrow fails on target:
ModuleNotFoundError: No module named 'zoneinfo'
Seen in python3-construct ptests.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
These CVEs are fixed in latest release however still show-up in open
CVE reports. Reason is that the DB contains entries:
{
"lessThan": "*",
"status": "affected",
"version": "1.23.3",
"versionType": "custom"
}
Which should mean that the first affected release is 1.23.3, however
without the upper limit it will match all higher releases.
The entry with >= 1.30.0 && < 1.30.6 cannot change the result as it
works by flagging CVEs where at least one version match is present.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-14 nginx-1.30.6 stable and nginx-1.31.7 mainline versions have
been released, with fixes for buffer overflow vulnerability when using
alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when
evaluating string expressions with variables (CVE-2026-93479), request
body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery
vulnerability when using TLS session ticket key rotation
(CVE-2026-97629), and use-after-free vulnerability when using
ngx_http_ssi_module with AIO (CVE-2026-97205).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Update tiobench from the legacy 0.3.3 SourceForge release to the
actively maintained upstream at github.com/mkuoppal/tiobench, pinned
to 11c965c8 (35 commits past v0.4.2). Picks up Clang build support,
random I/O test enhancements and cache handling updates.
Remove obsolete downstream patches, now fixed upstream:
avoid-glibc-clashes.patch - helper renamed to tt_aligned_alloc
0001-Specify-printf-formats.patch - format specifiers fixed
0001-Drop-inline-of-crc32-*.patch - crc32 inlining fixed
tiobench-makefile.patch - CC?= and LDFLAGS now upstream
Pass CFLAGS via EXTRA_OEMAKE. The upstream Makefile hardcodes
CFLAGS=-O2 -Wall and oe_runmake does not pass -e, so OE flags never
reached the compiler, losing -g (empty -dbg package), the hardening
flags, -ffile-prefix-map and the tune flags. DEFINES is separate, so
-DUSE_LARGEFILES is unaffected.
Install from do_install() rather than the upstream install target,
which has no DESTDIR support and installs tiosum.pl and README, both
long gone from the tree. COPYING is dropped from docdir as licenses
are handled by the license manifest.
Trim RDEPENDS to perl and perl-module-getopt-long; tiobench.pl only
uses warnings, strict and Getopt::Long, and strict is RPROVIDED by
perl. Data::Dumper and Term::ProgressBar are only reachable via the
opt-in --dump and --progress flags. Drop the redundant PV, already
set by the recipe filename.
Runtime validated on IQ-9075 EVK with tiotest and tiobench.pl across
multiple benchmark configurations, including tiobench.pl --help on an
image carrying only the trimmed RDEPENDS.
Build tested with gcc against glibc on aarch64 (armv8-2a).
Signed-off-by: Vaibhav Jindal <vaibjind@qti.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Leon Anavi
Khem Raj
Etienne Cordonnier
Darsh Kelaiya
Ankur Tyagi
prasanth
Peter Marko
shenlf
Vaibhav Jindal