Upgrade to release 4.5.6:
Bugs corrected:
- Alert level decided by dict ordering: a failing+slow URL is
downgraded to WARNING, an unscanned URL reports CRITICAL
- GPU plugin duplicates card name and omits N/A for unavailable
metrics in multi-GPU
- GPU plugin duplicates the utilisation value and paints it with
the memory colour in multi-GPU
- IP plugin displays wrong interface: outer loop in get_ip_address()
never breaks
- VideoCore (v3d) memory shows ~93% on Raspberry Pi 5 with
gpu_mem=4M - misleading denominator from drm-total-memory
- CSV export: --stdout-csv data rows desync from header when
network interfaces change count at runtime
- Glances Network plugin with mismatched schema not logging in
TimescaleDB export
Security patches:
- as_dict_secure() Value-Level Bypass Leaks Credentials in URL
Values via /api/4/config - CVE-2026-68520
- --disable-config-exec does not cover on-alert action commands
- CVE-2026-68519
- Command injection bypass of action-template sanitizer via
cross-field shell-operator reconstruction - CVE-2026-68518
- Incomplete fix of CVE-2026-32608: action-template sanitizer is
bypassed by nested stat values - CVE-2026-62982
- REST API CORS Credentials Guard Uses Exact-Match Instead of
Membership Test - CVE-2026-68517
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 4.2.3:
- Fix ty unresolved-attribute warnings and add mypy back
- Update ruff to version 0.16.5
- Bump github/codeql-action
- Update readme
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Both S and UPSTREAM_CHECK_PYPI_PACKAGE are set to the default values, so
remove them.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The need for PYPI_PACKAGE_HASH was removed in 2016[1].
[1] meta-oe 7edad4def4 ("pypi: update the base pypi url to use the
package info without requiring the hash")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Remove assignments to PYPI_PACKAGE where the value is the default value,
that is the recipe name with any python3- prefix removed.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Remove redundant UPSTREAM_CHECK_PYPI_PACKAGE assignments of PYPI_PACKAGE,
which is the default value.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Don't set PYPI_SRC_URI explicitly, instead of PYPI_PACKAGE so the correct
SRC_URI is generated.
Also remove the unused variable SRCNAME.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2.2.1:
- Fixed safety issues up to 2026-08-23.
- Development: Tolerate premature deletion of local release/start
branches.
- Docs: Migrated from our own support for generating summary tables
in the documentation to using autodocsumm to fix an import error
with Sphinx 9.
- Development: Added a GitHub Actions workflow named 'backport'
that creates a backport PR to the latest stable branch stable_M.N
when a PR labeled with the 'backport' label is merged.
- Development: Upgraded GitHub Actions plugins to versions that use
node.js 24.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 3.5.1:
- Raised upper bound of setuptools to v84 (#794)
- Cache performance access optimization for our CharInfo struct
(prebuilt only).
- No longer decoding large content when the noise detector output
give a high entropy. Only impacted large content input >1M bytes.
Deploy sample data files to fix tests.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 21.7.8:
- A missing source needed by both install modes now disables the
builtin creator through meta.error. The check compared RefWhen
values against RefMust members, so creation went on to fail with
a FileNotFoundError or a dangling symlink
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Both python3-pillow and python3-pypng are optional, make them
PACKAGECONFIG entries and enable both so that the default stays the
same. Drop python3-six which was removed in 4d80a78 ("Remove six").
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 3.12.0:
- Serialization implementation substantially rewritten.
- Publish PyPI wheels for Python 3.15. For Python 3.15 and later,
manylinux_2_39 (2024) is targeted instead of manylinux_2_17 (2012).
- No longer publish PyPI wheels for ppc64le and s390x.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
test_report_header defines an inline conftest.py using the
pytest_report_header(startdir) hook signature; newer pytest pluggy
hook-signature validation rejects "startdir" (renamed to start_path
long ago), so the nested pytest subprocess it spawns exits with
PluginValidationError/INTERNAL_ERROR, and the outer assert
result.ret == 0 fails. Version-skew in pytest-sugars own test suite,
not a runtime bug.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
test_marker_function/_and_fixture/_class/_module use the "testdir"
fixture, provided by pytest builtin pytester plugin. That plugin is
not autoloaded; upstream pyproject.toml sets addopts = "-p pytester"
but that file is not shipped into the ptest tree, so the fixture is
unavailable and these 4 tests error out (fixture testdir not found).
Pass -p pytester directly in run-ptest.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
time_machine's C-level time/timezone patching relies on libc's
tzset()//usr/share/zoneinfo, which requires the system tzdata package -
distinct from python3-tzdata (Python's importlib zoneinfo data), which
the recipe already had. Add tzdata to RDEPENDS:${PN}-ptest.
Deselect test_destination_datetime_tzinfo_non_zoneinfo: it builds an
aware datetime from dateutil's tz.gettz("America/Chicago") and expects
the CST (-6h) offset at the 1970 epoch. OE builds /usr/share/zoneinfo
in "slim" format (zic -b slim); dateutil's tzfile parser mishandles
the pre-first-transition instant of a slim tzfile and returns a 0
(UTC) offset there, so the epoch maps to 0 instead of 21600. Python's
own zoneinfo reads the same file correctly, so this is a
dateutil/slim-tzdata limitation, not a time_machine bug.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Skip test_send_binary_data_to_server_bigger_than_default_on_websockets,
test_multiprocess_health_check and test_multiprocess_sighup, and drop
use_colors from the test config, all of which don't hold up in the
ptest QEMU environment.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Ross Burton
Leon Anavi
Wang Mingyu
Alex Kiernan
Ankur Tyagi
Khem Raj