mirror of
https://git.yoctoproject.org/poky
synced 2026-09-22 09:30:14 +00:00
Hetvi Thakar
b24d56a0b3
Apply the primary upstream fix referenced in [4] with commit [1]. Then apply the two follow-up regression-fix commits [2] and [3]. The primary fix rejects entry-point names that escape the configured scripts directory. The follow-up fixes handle doubled-slash roots and reuse the existing directory-containment helper. [1] https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb [2] https://github.com/pypa/pip/commit/7ff8bdd81ec5edca2bebf78ad8506dda710d6af5 [3] https://github.com/pypa/pip/commit/fa7854f6b37113a2c4698cdde902e1fcc9bebdd5 [4] https://github.com/advisories/GHSA-wf93-45jw-7689 (From OE-Core rev: 2c276677d619bc6205872eb2b5a9948a4605d8ea) Signed-off-by: Hetvi Thakar <hthakar@cisco.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>