diff mbox series

[3/3] python3-gitpython: upgrade 3.1.43 -> 3.1.58

Message ID 20260809231901.366919-6-tim.orling@konsulko.com
State Under Review
Headers show
Series [1/3] python3-git: fix CVE_PRODUCT | expand

Commit Message

Tim Orling Aug. 9, 2026, 11:19 p.m. UTC 
From: Tim Orling <tim.orling@konsulko.com>

Upstream tarballs changed from mixed case GitPython-3.1.43.tar.gz to
all lowercase gitpython-3.1.44.gz and the regex in pypi.bbclass was
not catching it.

Similarly, per PEP-625, the PYPI_SRC_URI since 3.1.44 needs to be
lowercase.

It appears the proper fix for fetching is to set
PYPI_PACKAGE = "gitpython".

Multiple security releases, see the change logs:
https://gitpython.readthedocs.io/en/3.1.58/changes.html
https://gitpython.readthedocs.io/en/3.1.57/changes.html
https://gitpython.readthedocs.io/en/3.1.56/changes.html
https://gitpython.readthedocs.io/en/3.1.55/changes.html
https://gitpython.readthedocs.io/en/3.1.54/changes.html
https://gitpython.readthedocs.io/en/3.1.53/changes.html
https://gitpython.readthedocs.io/en/3.1.52/changes.html
https://gitpython.readthedocs.io/en/3.1.51/changes.html

CVE: CVE-2026-42215
CVE: CVE-2026-42284
CVE: CVE-2026-44243
CVE: CVE-2026-44244

To see the details of each release:
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.57
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.56
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.55
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.53
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.52
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.50
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.46
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.45
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.44

For the full comparison changes (1292 commits, 201 files changed), see:
https://github.com/gitpython-developers/GitPython/compare/3.1.43...3.1.58

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
---
 .../python/{python3-git_3.1.43.bb => python3-git_3.1.58.bb}   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 rename meta/recipes-devtools/python/{python3-git_3.1.43.bb => python3-git_3.1.58.bb} (90%)
diff mbox series

Patch

diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.58.bb
similarity index 90%
rename from meta/recipes-devtools/python/python3-git_3.1.43.bb
rename to meta/recipes-devtools/python/python3-git_3.1.58.bb
index ccf6def292..82c8076a97 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.43.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.58.bb
@@ -8,13 +8,13 @@  SECTION = "devel/python"
 LICENSE = "BSD-3-Clause"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=5279a7ab369ba336989dcf2a107e5c8e"
 
-PYPI_PACKAGE = "GitPython"
+PYPI_PACKAGE = "gitpython"
 
 CVE_PRODUCT = "gitpython_project:gitpython"
 
 inherit pypi python_setuptools_build_meta
 
-SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"
+SRC_URI[sha256sum] = "621416df10ef3fd0e19fabf9172ddeed0fa704d353d04f194eec56a625a95b22"
 
 DEPENDS += " python3-gitdb"