Commit Graph
41148 Commits
Author SHA1 Message Date
Leon Anavi e231f03b8f python3-wrapt: Upgrade 2.5.1 -> 2.5.2
Upgrade to release 2.5.2:

- The special methods added to the class generated for an
  wrapt.AutoObjectProxy, and adjusted when __wrapped__ was
  reassigned, were determined by inspecting the wrapped object
  itself, rather than the type of the wrapped object. As special
  methods are only ever looked up on the type of an object, this
  gave the wrong result in several cases. When the wrapped object
  was a class, the special methods it defined for its instances
  were added to the proxy class, so a proxy for a class defining
  __set_name__() raised TypeError when assigned to an attribute in
  a class body, a proxy for a class defining __get__() was bound as
  a descriptor on attribute access, and a proxy for a class
  defining __await__() or __iter__() was reported as awaitable or
  iterable by inspect.isawaitable() and collections.abc checks,
  even though the class itself was not. Special methods provided by
  the metaclass of a wrapped class, such as __iter__(), were not
  added to the proxy class. When the wrapped object was an
  instance, instance attributes shadowing the dunder names were
  treated as special methods of the wrapped object, and special
  methods which a __dir__() method of the wrapped object did not
  report were missed. The special methods are now always determined
  from the type of the wrapped object, so a proxy behaves the same
  as the object it wraps. This also covers a wrapt.LazyObjectProxy
  whose factory returns an object, as resolving the wrapped object
  reassigns __wrapped__. With thanks to ybai08 for pull request
  #361 which identified the issue.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:34 -08:00
Leon Anavi 010f86076f python3-twisted: Upgrade 26.4.0 -> 26.10.0
Upgrade to release 26.10.0:

Security fixes:

- CVE-2026-83813 (GHSA-jj36-9pvh-vj5r)
- CVE-2023-44487 (GHSA-vpp8-g58w-m8mp)
- CVE-2026-115778 (GHSA-cwm5-jh59-mwxr)
- CVE-2026-115775 (GHSA-3476-c5c2-fr73)
- CVE-2026-115877 (GHSA-q7qq-6mhp-9rc4)
- CVE-2026-115774 (GHSA-2qrf-pqgx-qh9v)
- CVE-2026-115776 (GHSA-53xc-49m8-p798)

Features:

- It is now possible to set the SO_REUSEPORT and SO_REUSEADDR TCP
  socket flags from user code.
- Python 3.14 is now supported.
- twisted.internet.defer.Deferred.__iter__, used when awaiting a
  Deferred, is now about 2-3% faster.

Bugfixes:

- twisted.internet.tcp.Port.startListening() now closes the socket
  when raising CannotListenError.
- Initiating a TCP connection with an address literals and a port
  outside of the 1-65535 range in twisted.internet.tcp.BaseClient
  and twisted.internet.iocpreactor.tcp.Client now triggers an
  errback instead of an unhandled error. This change might also fix
  other unhandled errors occurred while connecting using address
  literals.
- twisted.logger.LoggingFile.fileno now raises
  io.UnsupportedOperation instead of returning -1. This fixes an
  interoperability issue with multiprocessing.
- twistd now exits with a non-zero status when given an unknown
  subcommand.
- twisted.internet.testing.MemoryReactor.removeAll() now returns
  what was removed to comply with IReactorFDSet.removeAll()

- twisted.internet.asyncioreactor.AsyncioSelectorReactor.callLater
  now has the same signature as
  twisted.internet.interfaces.IReactorTime.callLater.
  twisted.internet.asyncioreactor.AsyncioSelectorReactor.callFromThread
  now has the same signature as
  twisted.internet.interfaces.IReactorFromThreads.callFromThread.

- twisted.protocols.ftp.FTPClient now uses ip address of the
  original ftp server to open passive data connections by default,
  instead of trusting PASV responses.

Improved Documentation:

- The "Writing Servers" and "UDP Networking" documentation pages
  have been updated to remove obsolete references to persisting the
  reactor (a feature gone from Twisted for several decades now),
  and to better explain the factory and protocol setup and teardown
  lifecycle.
- Twisted's policy documentation now includes a prominently
  featured, clear explanation of our AI policy: to wit, including
  the outputs of generative AI systems is forbidden.

Deprecations and Removals:

- twisted.internet.tcp.Connection no longer supports returning a
  non-None value from a protocol's dataReceived method, deprecated
  since Twisted 11.0.0.
- twisted.internet.error.PotentialZombieWarning, deprecated since
  Twisted 10.0, has been removed.
- Implementations of twisted.internet.interfaces.IProcessProtocol
  are now required to provide a processExited method. Omitting this
  method was deprecated in Twisted 8.2.
- twisted.internet.ssl.protocolNegotiationMechanisms and
  twisted.internet.ssl.ProtocolNegotiationSupport are deprecated
  because all supported TLS backends provide ALPN. Callers can
  configure ALPN without checking for support.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:33 -08:00
Leon Anavi ea007add6c python3-trio: Upgrade 0.34.0 -> 0.35.0
Upgrade to release 0.35.0:

- Mark that Trio supports 3.15.
- Ensure that Trio consistently encodes all hostnames using IDNA
  2008.
- Avoid erroring when running in a CPython built for an Android API
  version less than 24.
- Ensure trio.lowlevel.notify_closing works even on events that
  have been deleted, e.g. because they were registered as one shot
  events.
- trio.Process no longer emits an EncodingWarning on Linux when
  Python runs with -X warn_default_encoding
  (or PYTHONWARNDEFAULTENCODING=1).
- The typing for async-file-objects is now consistent about what it
  exposes based on what is exposed by the underlying object.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:33 -08:00
Leon Anavi f3f36654a0 python3-socketio: Upgrade 5.17.0 -> 5.18.0
Upgrade to release 5.18.0:

- Reject events over HTTP before the connection completes

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:33 -08:00
Leon Anavi fc02b4475a python3-python-multipart: Upgrade 0.0.32 -> 0.0.33
Upgrade to release 0.0.33:

This release lets you cap URL-encoded form fields as they stream in, and
fixes several upload and decoding edge cases. It also drops Python 3.10
and adds Python 3.15.

- Limit URL-encoded fields while streaming. The new opt-in
  MAX_FIELDS and MAX_FIELD_SIZE options for FormParser raise
  FormParserError before oversized data is buffered. Both default
  to no limit, and multipart forms are unaffected.
- Nameless uploads no longer crash when spilled to disk.
  Uploads without a filename used to raise AttributeError when
  UPLOAD_KEEP_EXTENSIONS or UPLOAD_KEEP_FILENAME was set.
- UPLOAD_DIR accepts str with UPLOAD_KEEP_FILENAME. A str
  upload directory used to fail on the first write to disk.
- Decoded data is complete before callbacks run (#336, #355).
  Content-Transfer-Encoding decoders are finalized at the end of
  each part, and quoted-printable escapes split across writes
  decode correctly.
- parse_options_header lowercases content types with parameters
 . Multipart/Form-Data; boundary=abc now returns
  multipart/form-data, the same as headers without parameters.
- Faster opening boundary matching. Complete boundaries are
  matched in one step.
- Faster parser state lookups. Parser states are
  module-level enum members, so their repr is now multipart.END
  instead of <MultipartState.END: 12>.
- Faster querystring callback dispatch.
- Python 3.10 is no longer supported. Python 3.11 is now the
  minimum.
- Python 3.15 is supported.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:33 -08:00
Leon Anavi 135ffe8da0 python3-pytest-codspeed: Upgrade 5.0.3 -> 5.0.4
Upgrade to release 5.0.4:

- Support pytest 9.2: pytest --codspeed no longer crashes at
  session start when pytest-benchmark is installed
- build: pin -std=c11 for instrument-hooks core.c
- docs(readme): bump action version to v5
- feat: warn when running on an unsupported Python version
- ci: migrate to github default arm runners
- ci: use 26.04 image instead of latest
- ci: test against stable python 3.15 and 3.15t
- docs: add Python 3.15 to README version badge

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:33 -08:00
Leon Anavi 9c5f02348d python3-pytest-asyncio: Upgrade 1.4.1 -> 1.4.1.post1
Upgrade to release 1.4.1.post1:

Changed:

- Removed the upper version bound on the pytest dependency.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:33 -08:00
Leon Anavi 1f86ceb4c8 python3-oauthlib: Upgrade 4.0.0 -> 4.0.1
Upgrade to release 4.0.1:

- CVE-2026-49272 / GHSA-3jp2-3mrg-2vxc: The device code flow token
  endpoint did not validate the device_code parameter. A request
  with a known client_id and a bogus device_code could obtain a
  bearer token. DeviceCodeGrant.validate_token_request now calls
  DeviceCodeGrant.validate_device_code(), which rejects missing or
  unknown device codes (invalid_request / invalid_grant) and
  delegates the code's authorization status to the new
  RequestValidator.validate_device_code() hook, per RFC 8628
  Section 3.5.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:32 -08:00
Leon Anavi 01ba445a0e python3-nodeenv: Upgrade 1.11.1 -> 1.12.0
Upgrade to release 1.12.0:

- feat(nodeenv): print shell completion scripts with shtab
- fix(nodeenv): point npm_config_prefix at the env in activate.bat
  and Activate.ps1
- fix(nodeenv): install npm from the registry tarball on Windows
- fix(nodeenv): read quoted config values and mirror credentials
- fix: stop putting ^/dev/null on PATH in activate.fish
- fix(nodeenv): retry broken node downloads and stop hanging on
  stalls
- fix: do not require python2 to build node from source
- fix(nodeenv): do not put the venv bin on PATH twice with -p
- fix(nodeenv): skip node.js pre-releases for latest and ranges
- fix: preserve fish activation environment
- fix(nodeenv): read a config value raw when interpolation fails
- fix(nodeenv): ignore source trees during prebuilt installs
- fix(nodeenv): escape glob characters in prebuilt paths
- fix(nodeenv): raise on bad config references again
- Make tox configuration more flexible
- chore(tests): port the Makefile test targets to pytest
- Align Python support metadata and runtime with Python 3.10+
- perf(nodeenv): unpack the node.js zip archive in parallel
- docs(site): new landing page for ekalinin.github.io/nodeenv
- docs(site): show GitHub stars and PyPI downloads badges
- docs: update isolated installation instructions
- docs(contributing): add contributing guide and templates

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:32 -08:00
Leon Anavi ae61861875 python3-jsonpatch: Upgrade 1.38 -> 1.39
Upgrade to release 1.39:

- Test that the code examples in the docs run and match their
  output
- Raise JsonPatchConflict when removing from immutable containers
- docs: explain copy and in-place behavior when a patch fails

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:32 -08:00
Leon Anavi fb7795bbc5 python3-ipython: Upgrade 9.17.1 -> 9.18.1
Upgrade to release 9.18.1:

- The main change in this release is that themes are now JSON data:
  you can install a theme by putting a file in your IPython
  directory, or from a package, without writing any code.
- The release also fixes a number of completion regressions, fixes
  WebP handling in ~IPython.display.Image, stops get_tail from
  wiping the history database when ipykernel asks for n=None, and
  adds ~IPython.core.formatters.DisplayFormatter.register_formatter.
- theme_table can no longer be mutated, and the individual theme
  objects are no longer importable from IPython.utils.PyColorize.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:32 -08:00
Leon Anavi 0e0c8dbe07 python3-huey: Upgrade 3.5.3 -> 3.5.4
Upgrade to release 3.5.4:

- Fix possible hang if worker holding the stop flag was killed
  while holding it.
- Lots of refactoring/cleanup.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:32 -08:00
Leon Anavi 25b9cdfcd4 python3-grpcio-reflection: Upgrade 1.85.0 -> 1.85.1
Upgrade to release 1.85.1:

- Fixes Denial of service in Health Watch RPC
- Fixes Memory leak in AsyncIO client-streaming calls with
  interceptors

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:32 -08:00
Leon Anavi 4b9a01eaaa python3-grpcio-channelz: Upgrade 1.85.0 -> 1.85.1
Upgrade to release 1.85.1:

- Fixes Denial of service in Health Watch RPC
- Fixes Memory leak in AsyncIO client-streaming calls with
  interceptors

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:31 -08:00
Leon Anavi c9b9aa121d python3-flask-socketio: Upgrade 5.7.0 -> 5.7.1
Upgrade to release 5.7.1:

- Update version of python-socketio dependency
- Add Python 3.15 and PyPy 3.12 to CI

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:31 -08:00
Leon Anavi 276523852d python3-fastjsonschema: Upgrade 2.22.2 -> 2.22.3
Upgrade to release 2.22.3:

- Fixed property names with { or } being evaluated as format string
  in error messages
- Fixed numeric keywords (minimum, maximum, multipleOf,
  exclusiveMinimum, exclusiveMaximum) being applied to booleans
- Fixed propertyNames: false crashing on non-object values
- Fixed the date-time format accepting months, days and hours out
  of range (such as 2020-19-39T29:00:00Z) and rejecting a leap
  second (23:59:60Z)
- Fixed the date and date-time formats accepting days that do not
  exist in their month, such as 2021-02-29 and 2021-04-31
- Fixed the time format accepting hours, minutes, seconds and
  offsets out of range (such as 29:99:99)
- Fixed minimum and maximum being exclusive in draft 06 and later
  when exclusiveMinimum or exclusiveMaximum is set to a number
  other than zero
- Fixed bools in uniqueItems
- Added type annotations for public API and py.typed marker
  (PEP 561)
- Added message to JsonSchemaValuesException joining messages of
  all collected errors

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:31 -08:00
Leon Anavi b0c03dffde python3-cmd2: Upgrade 4.3.1 -> 4.4.0
Upgrade to release 4.4.0:

- Fix history ranges starting past the end
- Fix History.truncate() leaving session start index stale
- Flush window title updates without waiting for a prompt
- Fix two races behind the flaky pipeline job-control test
- Add security policy naming the Security Maintainer
- Preserve history session boundaries across list mutations
- Track history session membership by entry instead of index
- Preserve live history while persisting a bounded copy
- Address review feedback on persisted history copy

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:31 -08:00
Leon Anavi ff180c6359 python3-cbor2: Upgrade 6.1.5 -> 6.2.0.post1
Upgrade to release 6.2.0.post1:

- Build Pyodide (pyemscripten) wheels for Python 3.14

From 6.2.0:

- Added the strict_hashable_types parameter to CBORDecoder, load()
  and loads() which, when enabled, restricts map keys and set
  elements to text strings and byte strings in order to prevent
  denial-of-service attacks via hash collisions
  (GHSA-p6xp-9h6j-r278)
- Documented decoding concatenated CBOR objects with EOF checks
  between objects
- Fixed CBOREncoder.encode_to_bytes() sharing the string reference
  namespace of the enclosing encode operation when called from a
  default hook
- Fixed the encoder writing the repr() of a bytes regular
  expression pattern (tag 35) instead of the pattern itself, so the
  regular expression decoded back as the text pattern b'...' and no
  longer matched the same input
- Fixed shared references (tag 29) allowing the decoder to
  construct object graphs nested deeper than max_depth, which could
  crash the interpreter with a segmentation fault when such an
  object was hashed (as a map key or set member)
  (GHSA-55vx-2phh-7grr)
- Fixed mission conversion of date values (tags 100 and 1004) to
  JSON as ISO formatted strings
- Fixed a PanicException on Python 3.10 when decoding a string-form
  datetime (tag 0) whose fractional seconds part contains a
  multi-byte Unicode numeric character, as the microsecond padding
  treated those as digits and then truncated the part on a byte
  index inside one of them
- Fixed the decoder accepting a set (tag 258) whose payload is not
  an array, folding a text string, byte string or map into a set of
  its characters, bytes or keys instead of rejecting it
- Fixed the decoder accepting a non-integer exponent or mantissa in
  a decimal fraction (tag 4) or a bigfloat (tag 5)

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:31 -08:00
Leon Anavi 5426691227 python3-cachetools: Upgrade 7.2.7 -> 7.2.8
Upgrade to release 7.2.8:

- Fix type stubs for TTLCache and TLRUCache with default timer.
- Minor documentation and unit test improvements.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:31 -08:00
Leon Anavi f2963e81ee python3-anyio: Upgrade 4.15.1 -> 4.16.0
Upgrade to release 4.16.0:

- Added BlockingPortal.call_async() for asynchronously calling into
  an event loop with optional abandonment on cancellation
- Added SOCK_SEQPACKET support to connect_unix() and
  create_unix_listener()
- Changed UDP sockets on the asyncio backend to make send() wait
  until the datagram has been passed to the operating system
- Fixed documentation implying that use_uvloop=True falls back to
  the standard event loop when uvloop (winloop on Windows) is not
  installed, and showed how to skip the corresponding pytest
  backend variant when the dependency is missing
- Fixed get_current_task() on the asyncio backend raising an opaque
  TypeError: cannot create weak reference to 'NoneType' object
  instead of a clear error when called from a callback scheduled
  via loop.call_soon_threadsafe() (e.g. from within
  from_thread.run_sync()), where asyncio.current_task() is
  legitimately None
- Fixed CancelScope on the asyncio backend swallowing a native
  Task.cancel() that was delivered in the same event loop iteration
  as the scope's own cancellation (such as a move_on_after()
  deadline expiring), which left the host task with a pending
  cancellation request that never raised CancelledError (\#1214)
- Fixed UDP socket closing hanging if a datagram send was still in
  flight
- Fixed concurrent aclose_forcefully() calls on asyncio socket
  streams returning before the underlying socket was closed
- Fixed aclose() on sockets not checkpointing, and thus failing to
  raise a cancellation exception when called inside a cancelled
  scope (affected UNIX socket streams and UNIX datagram sockets on
  asyncio, and all sockets on Trio)
- Fixed aclose() on asyncio TCP socket listeners not checkpointing,
  and leaking the listening socket if cancelled while another task
  was waiting in accept()
- Fixed accept() on asyncio UNIX socket listeners hanging forever,
  and leaving the listening socket registered with the event loop,
  when the listener was closed by another task
- Fixed send() on asyncio TCP and UDP sockets returning normally,
  despite the data being discarded, when the socket was closed by
  another task (or, for TCP, the connection was lost) while send()
  was waiting for the operating system to accept the data
- Fixed SocketStream.send() on the asyncio backend handing its data
  to a paused transport after a previous send() was cancelled
- Fixed sleep() treating a negative delay (including -inf)
  inconsistently across backends (asyncio returned immediately;
  Trio raised ValueError) by raising ValueError on all backends
- Fixed create_tcp_listener() occasionally failing with a message
  like Could not create 2 listeners with a consistent port when an
  ephemeral port is requested and IPv6 is enabled and the
  dual-stack path is not available or a specific local host name
  was given
- Fixed AsyncFile not shielding against cancellation while closing
- Fixed TemporaryDirectory.cleanup() reacting to cancellation
  prematurely when the host task was already cancelled, causing the
  actual cleanup operation to be skipped
- Fixed a NaN deadline being accepted on asyncio while Trio raised
  ValueError, which silently disabled the timeout
  (fail_after(math.nan) returned instead of raising TimeoutError);
  CancelScope now rejects it on both backends
- Fixed FileReadStream and FileWriteStream leaving files open when
  cancelled during context manager exit, including unflushed writes
- Fixed Condition.notify() and Condition.notify_all() failing when
  the underlying lock was acquired directly rather than through the
  condition
- Fixed importing AnyIO with loaders that do not provide __file__,
  such as PyOxidizer, raising TypeError instead of falling back to
  eager imports
- Fixed text receive streams silently discarding incomplete
  characters at end-of-file instead of applying the configured
  decoding error handler
- Fixed Semaphore(fast_acquire=True) losing its fast-acquire
  behavior when instantiated outside a running event loop
- Fixed BlockingPortalProvider permanently failing with an
  AttributeError on every subsequent use if the first attempt to
  start its blocking portal failed
- Fixed create_udp_socket() silently ignoring the local_port
  argument when local_host was omitted, making the socket bind to a
  random ephemeral port instead of the requested one
- Fixed worker threads on the asyncio backend never returning to
  the idle pool (and thus never being reused or pruned) when a
  to_thread.run_sync() call was cancelled after it had been queued
  for the worker but before the worker thread had picked it up
- Fixed pytest plugin running Hypothesis async tests only on the
  first parametrized backend instead of each backend
- Fixed TypeError when subclassing an existing TypedAttributeSet
  subclass, and this subclass contains type annotations
- Fixed Lock.locked() (and Condition.locked()) raising
  NoEventLoopError when the lock was created outside a running
  event loop
- Fixed connect_tcp() leaking a connected socket when an enclosing
  cancel scope was cancelled before the connection attempt task
  group exited
- Fixed create_connected_udp_socket() silently ignoring local_port
  when local_host was not given: the local address was left unset,
  so the OS picked an ephemeral port instead of the requested one
- Fixed BlockingPortalProvider not passing the exception raised in
  its with block on to the start_blocking_portal() context manager
  it wraps
- Fixed anyio.itertools.islice() not consuming the first start
  items when stop <= start
- Fixed BufferedByteReceiveStream.receive_exactly() and
  receive_until() returning buffered data after explicit closure
  instead of raising ClosedResourceError
- Fixed a TLS stream sending records the peer could no longer
  decrypt after a cancelled send() lost an already-encrypted
  record; the stream now raises BrokenResourceError on further use
  instead
- Fixed close() on memory object streams not waking up tasks
  blocked in send() or receive() on the same stream
- Fixed anyio.itertools.product() acquiring and consuming unused
  input iterables when repeat=0
- Fixed SpooledTemporaryFile rolling over to disk on writes when
  max_size is zero (the default)
- Fixed Trio UDP sockets remaining open when initialization failed
  or was cancelled
- Fixed SpooledTemporaryFile.rollover() moving the current file
  position to the end of the file
- Fixed cancellation during temporary directory creation leaving
  the directory behind while its context manager is retained
- Fixed cancellation during SpooledTemporaryFile.rollover() losing
  buffered contents
- Fixed TextSendStream.send() re-emitting the byte order mark on
  every item with BOM-emitting encodings (utf-16, utf-32,
  utf-8-sig), which made the peer decode a stray \ufeff in front of
  every message after the first
- Fixed buffered byte streams returning empty bytes when a wrapped
  object stream received empty messages instead of waiting for data
  or raising EndOfStream
- Fixed BlockingPortal crashing with InvalidStateError when a
  future it returned was cancelled just as the callable was
  completing
- Fixed UNIXSocketStream.send_fds() silently truncating messages on
  short socket writes
- Fixed cancelled TCP receives on the asyncio backend leaving
  transport reads enabled, allowing incoming data to accumulate
  while the application was not receiving.
- Fixed CapacityLimiter.acquire_on_behalf_of() on asyncio releasing
  the wrong borrower when the acquiring task was cancelled during
  the cancel-shielded checkpoint that runs after a non-blocking
  acquisition

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:30 -08:00
Chen Qi c3377db45b iperf3: fix do_configure failure for native variant
For native recipes, the prefix variable is not '/usr', resulting
in iperf3-native searching for wrong location for ssl.h.

Fix to use the correct location to find ssl.h.

With this fix, iperf3, iperf3-native, nativesdk-iperf3 all succeed
to build.

Signed-off-by: Chen Qi <chenqi_hycx@cetc.com.cn>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:30 -08:00
Khem Raj 0faea72623 python3-tomlkit: Remove recipe, it is in oe-core now
python3-tomlkit was added to oe-core (46d3b26a63 "python3-tomlkit: add
new recipe (from meta-oe)") and is at 0.15.2 there, so the meta-python
0.15.1 copy is not used. Drop it, and drop it from the meta-python ptest
list as oe-core's ptest-packagelists.inc already lists it.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Cc: Ross Burton <ross.burton@arm.com>
2026-11-03 07:10:30 -08:00
Khem Raj bd06f006bb libfaketime: Remove recipe, it is in oe-core now
libfaketime was imported into oe-core (f3a4faaf4c "libfaketime: Import
recipe from meta-oe") and has had fixes there since: a 32-bit build fix,
the clang 23 fix, -O1 for the clobbered-variable error and the man page
install. Both copies are 0.9.13 at the same layer priority, so bitbake
picks one by parse order and currently ends up with the outdated meta-oe
copy.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Cc: Ross Burton <ross.burton@arm.com>
2026-11-03 07:10:30 -08:00
Kris Gavvala 53cf975e9b python3-pillow: patch CVE-2026-112393
This patch applies the upstream fix and related tests in commit [1]
to address the issue in [2].

[1] https://github.com/python-pillow/Pillow/commit/78c08bd4d9c08037f77465a61d90633f669013f4
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wf

Signed-off-by: Kris Gavvala <kris.gavvala@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-02 19:16:17 -08:00
Ayoub Zaki e9c8cabbe1 leancrypto: add Linux kernel module recipe
Add leancrypto-module to build and package leancrypto.ko
independently of the userspace library.

Move common source and license metadata into leancrypto.inc and include the
submitted upstream patch to generate headers using the target kernel
architecture instead of the build host.

Signed-off-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-02 19:16:17 -08:00
Leon Anavi 6568ff3954 python3-asciitree: Upgrade 0.3.3 -> 1.0.0
Upgrade to release 1.0.0:

- Configurable layout spaces through BoxStyle.gfx["SPACE"], with an
  ordinary-space fallback for existing palettes.
- Declared the existing public API stable, without breaking changes
  from 0.4.0.

Fixes:

WARNING: python3-asciitree-1.0.0-r0 do_check_backend: QA Issue:
inherits setuptools3 but has pyproject.toml specifying backend
setuptools.build_meta, use the correct class [pep517-backend]

License-Update: Update copyright years to 2015-2026

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-02 06:49:25 -08:00
Jason Schonberg 33f74f5dc5 cockpit: upgrade 366 -> 366.1
This is a security release.

Fixes for CVE-2026-91147, CVE-2026-91149, CVE-2026-76235, CVE-2026-91148

Changelog: https://github.com/cockpit-project/cockpit/releases/tag/366.1

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-01 23:06:13 -08:00
Khem Raj 5be4480300 lcov: Fix parallel build race in sphinx docs
"make install" depends on a doc target which runs "make -C docs man html".
With -j both goals start their own sphinx-build sharing _build/doctrees,
which sphinx does not write atomically, so one can read a doctree the
other is rewriting. do_install then fails at random:

  AttributeError: 'dict' object has no attribute 'append'
  make: *** [Makefile:138: doc] Error 2

Add .NOTPARALLEL to docs/Makefile so that the goals run one after the
other. Running "make -j64 man html" on an oversubscribed host failed 71
out of 576 times without this change and never with it.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
AI-Generated: Uses Claude Code
2026-11-01 22:53:06 -08:00
Khem Raj fda02577cc lcov: Disable the XS extension
lcov 2.6 makes "make install" depend on a new xs_lib target which runs
"perl Makefile.PL" with the host perl. That loads lcovutil.pm, so
do_install fails on hosts without Capture::Tiny:

  Can't locate Capture/Tiny.pm in @INC
  make: *** [Makefile:169: xs_lib] Error 2

The extension can't be cross-built this way, since it would use the host
perl configuration. It is an optional speedup and lcovutil.pm falls back
to pure Perl without it, so set LCOV_NO_XS=1.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-01 18:24:25 -08:00
Khem Raj ffe4bd60f6 lcov: Upgrade to 2.6
Changes from v2.5 release:

- new html2lcov tool
  * Capture source diff and 'baseline' coverage from lcov HTML report - suitable
    as input to generate differential coverage report versus 'now'. See the html2lcov documentation for details.

- new jacoco2lcov tool
  * Translate JaCoCo java coverage data to lcov format - e.g., for multi-language
    coverage reporting or to take advantage of lcov features. See the jacoco2lcov documentation for details.

- new XS back end (on plaforms which support it).
  * C++ implementation of some key types and operations - to improve execution
    time and memory footprint compared to pure Perl.

- various bug fixes and test coverage improvements.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-01 17:15:42 -08:00
Khem Raj 70893a1464 bearssl: Upgrade to tip of trunk
Brings following changes

3c04036 Fix: make static ECDH selectable with the br_ssl_client_set_single_ec() helper function.
3d9be2f Added dependencies to better support parallel or shuffled compilation.
3479195 Fixed chunked decoding in case of errors (if decoding failed at some point, subsequent chunks should be ignored, trying to reenter the decoder after a failure is a recipe for Bad Thing). Impacted functions were not used over malicious on-the-wire data for "normal" SSL/TLS usage.
8f795e5 Fixed Makefile dependencies.
7bea48e Fixed bug in handling incoming records with invalid length (impacted CBC encryption with 3DES or with the aes_small or aes_big AES implementations; only 3DES was selectable by default).

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-01 17:01:36 -08:00
Khem Raj c334303418 influxdb: Do not package upstream CI files
.circleci and scripts/ci are upstream's tooling for its AWS Ubuntu test
runners. They hardcode /home/ubuntu, which trips the buildpaths QA check
on build hosts whose HOME has the same path:

  File .../influxdb/.circleci/config.yml in package influxdb-dev contains
  a reference to the build host HOME directory.

Remove them before do_install instead of setting OEQA_BUILDPATHS_SKIP,
as they are of no use in influxdb-dev and a skip would also hide real
leaks. run_perftest.sh goes with them, so drop the sed fixing its shebang.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-01 17:01:25 -08:00
Khem Raj 7f106dffb2 accountsservice: Require the systemd distro feature
libaccountsservice uses sd-login for its session tracking and links
against libsystemd or libelogind unconditionally. There is no elogind
recipe to satisfy the alternative, so on sysvinit distros configure fails:

  meson.build:206:2: ERROR: Assert failed: systemd required but not found

Declare the requirement so that the recipe is skipped there.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-01 16:27:04 -08:00
Khem Raj 6f74c160b1 power-profiles-daemon: Fix configure without systemd
The systemdsystemunitdir option defaults to auto, which makes meson look
up systemd.pc. That only worked because systemd ends up in the sysroot
through other dependencies, and it fails on sysvinit distros:

  meson.build:36:18: ERROR: Dependency "systemd" not found

Pass the unit directory explicitly. The unit is installed unconditionally
and systemd.bbclass removes it again on distros without systemd.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-01 16:27:04 -08:00
Khem Raj 5f86b08e9d malcontent: Require the systemd distro feature
malcontent and malcontent-ui depend on accountsservice, which needs
systemd now, so they can not be built on sysvinit distros. Declare it so
the skip message names the actual requirement.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-01 16:27:04 -08:00
Khem Raj cfecdc92b3 fwupd-efi: Use the cross linker instead of the host ld.bfd
fwupd-efi finds the linker with find_program(cc.get_linker_id()),
which looks for a program named ld.bfd. meson.cross only sets ld, so
meson falls back to PATH and picks up ld.bfd from HOSTTOOLS. That breaks
cross builds on an x86-64 host:

  hosttools/ld.bfd: cannot represent machine `aarch64'

and on x86-64 targets it silently links with the host linker.

Set ld.bfd in an additional cross file

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-01 16:27:04 -08:00
Khem Raj 6f950c5c50 smolkit: Only provide polkit when selected
Universe builds every recipe, so the unconditional PROVIDES puts this
recipe and polkit in the same build, and bitbake -c fetch universe
reports that multiple .bb files provide polkit.

Claim the name only when PREFERRED_PROVIDER_polkit selects smolkit. With
the overlap gone, smolkit is no longer dropped from the world targets.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-01 16:27:04 -08:00
Khem Raj 981fbbed9c uutils-coreutils: Only provide coreutils when selected
Universe builds every recipe and ignores EXCLUDE_FROM_WORLD, so the
unconditional PROVIDES puts this recipe and GNU coreutils in the same
build, and bitbake -c fetch universe reports that multiple .bb files
provide coreutils, coreutils-native and nativesdk-coreutils.

Claim the name only when this recipe is the preferred provider, checked
separately for the target, native and nativesdk variants so they can
still be selected independently.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-01 16:27:04 -08:00
Martin Siegumfeldt d2c8362c71 spitools: upgrade 1.1.1 -> 1.2.0
Signed-off-by: Martin Siegumfeldt <mns@gomspace.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-01 16:27:03 -08:00
Jason Schonberg c426592c24 webmin: upgrade 2.660 -> 2.670
Changelog: https://github.com/webmin/webmin/releases/tag/2.670

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-01 16:27:03 -08:00
Etienne Cordonnier 443ecddc7e android-tools: drop GPL-2.0-only from LICENSE
The GPL-2.0 entry dates back to the first recipe (AOSP android-5.1.1_r37,
2016) and was carried over unchanged to the Debian android-platform-tools
based 35.0.2 recipe.

In the android-5.1.1_r37 repos the recipe fetched, the only GPLv2 mentions
are headers which are dual licensed "Apache 2.0 OR GPLv2"
(system/core include/cutils/ashmem.h, include/utils/ashmem.h,
include/log/logger.h), kernel headers in libion which are not built, and
documentation templates. Apache-2.0 can be chosen for all of them.

The 35.0.2 sources come from Debian's android-platform-tools, whose
debian/copyright lists no GPL license: the files are Apache-2.0, BSD,
Expat, Khronos, PSF and public-domain, and a scan of the unpacked tarball
finds no GPL licensed source files.

Remove GPL-2.0-only from LICENSE and LIC_FILES_CHKSUM so that the recipe is
not wrongly treated as GPL by license based tooling (e.g. copyleft source
archiving).

Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-01 16:27:03 -08:00
Khem Raj f3da02099d python3-fastapi: Upgrade 0.141.1 -> 0.162.0
Release notes: https://github.com/fastapi/fastapi/releases

* opentelemetry-api is now a runtime dependency
* Add opentelemetry-sdk and git to ptest dependencies, used by the new
  telemetry and translation script tests
* Ignore telemetry tests that need logfire, the opentelemetry OTLP
  exporter and the opentelemetry fastapi instrumentation, which are not
  packaged in meta-python
* Fixes the ptest hang in
  test_frontend_dependency_restores_existing_dependency_stacks with
  starlette 1.10, fixed upstream in 0.142.0

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 20:59:21 -07:00
Khem Raj 4faf8dd010 python3-opentelemetry-sdk: Add missing runtime dependencies
opentelemetry-sdk requires opentelemetry-api, opentelemetry-semantic-conventions
and typing-extensions, without them importing opentelemetry.sdk fails with:

ModuleNotFoundError: No module named 'opentelemetry.semconv'

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 20:59:21 -07:00
Khem Raj 8d36a79a6e python3-opentelemetry-semantic-conventions: Add missing runtime dependencies
opentelemetry-semantic-conventions requires opentelemetry-api and
typing-extensions.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 20:59:20 -07:00
Khem Raj 61e1cb4a0f python3-opentelemetry-api: Add missing runtime dependency
opentelemetry-api requires typing-extensions.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 20:59:20 -07:00
Khem Raj 4f1d8f85f0 python3-platformdirs: Fix ptest failures on musl
test_runtime_dir_unreachable_xdg_runtime_dir_warns hardcodes the glibc
strerror(ELOOP) text "Too many levels of symbolic links", whereas musl
reports "Symbolic link loop". Backport the upstream fix which uses
os.strerror() instead.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 20:59:20 -07:00
Khem Raj 2b8a5e012d python3-pyroute2: Add missing python3-resource runtime dependency
pyroute2/ndb/task_manager.py imports the resource module and it is
pulled in when importing pyroute2, so every ptest module failed to
import with:

ModuleNotFoundError: No module named 'resource'

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 20:59:20 -07:00
Khem Raj df1403411f tuna: Fix build with PEP 517 frontends
setup.py imports tuna.version from the source tree. The setuptools
build_meta backend does not put the source directory on sys.path, so
do_compile fails:

  File "<string>", line 9, in <module>
  ModuleNotFoundError: No module named 'tuna'
  ERROR Backend subprocess exited when trying to invoke get_requires_for_build_wheel

It only worked so far because python3targetconfig added an empty entry,
i.e. the current directory, to PYTHONPATH. The same happens with a plain
"python3 -m build" outside of OE.

pyproject.toml already gets the version from tuna.version via
[tool.setuptools.dynamic], so drop the import from setup.py.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:08:46 -07:00
Khem Raj 54697429ce python3-wxgtk4: Use python_setuptools_build_meta
pyproject.toml specifies setuptools.build_meta as the build backend.
Inheriting setuptools3 with INSANE_SKIP for pep517-backend was a
workaround for the top level build.py shadowing pyproject-build's own
"build" module, which is fixed in oe-core's python3targetconfig class
("python3targetconfig: Do not add the current directory to PYTHONPATH").

pyproject.toml pins sip == 6.12.0, which is only used to regenerate the
wrapper sources that the sdist already ships, so skip the build
dependency check.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:08:46 -07:00
Leon Anavi 3d159389a6 python3-webencodings: Upgrade 0.5.1 -> 0.6.1
Upgrade to release 0.6.1:

- Update CI dependencies
- Drop support of Python 3.10, support Python 3.15
- Replace deprecated license classifier
- Use HTTP server for Doconfly

Fixes:

WARNING: python3-webencodings-0.6.1-r0 do_check_backend: QA Issue:
inherits setuptools3 but has pyproject.toml specifying backend
flit_core.buildapi, use the correct class [pep517-backend]

License-Update: Use LICENSE file

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:27 -07:00