diff mbox series

[5/6] python3-mako: upgrade 1.4.1 -> 1.4.3

Message ID 20260923135939.3797785-5-richard.purdie@linuxfoundation.org
State New
Headers show
Series [1/6] gnupg: upgrade 2.5.22 -> 2.5.23 | expand

Commit Message

Richard Purdie Sept. 23, 2026, 1:59 p.m. UTC 
.. changelog::
    :version: 1.4.3
    :released: Tue Sep 22 2026

    .. change::
        :tags: bug, tests
        :tickets: 441

        Fixed regression caused in 1.4.2 where tests added to the suite were
        unable to run directly on Windows, due to posix mechanics: the tests
        force ``os.path`` to ``posixpath``, whereas
        :meth:`.TemplateLookup.get_template` converts the configured directory
        using ``os.path.sep``.  These tests are now skipped on that platform,
        where the traversal check is instead exercised against ``ntpath``
        natively.

.. changelog::
    :version: 1.4.2
    :released: Tue Sep 22 2026

    .. change::
        :tags: bug, tests
        :tickets: 440

        Adjusted the test suite to accommodate for a change in Pygments 2.21.0
        where the ``HtmlFormatter`` now renders ``"`` and ``'`` characters
        literally rather than as HTML entities, which caused failures in tests
        that assert against the rendered output of
        :func:`.html_error_template`.

    .. change::
        :tags: bug, template
        :tickets: 441

        Fixed issue in :class:`.TemplateLookup` where a URI beginning with a
        drive designator (e.g. ``C:/../../secret.txt``) could bypass the directory
        traversal check on Windows, allowing reads of arbitrary files outside of
        the template directory.  The check in :class:`.Template` normalized the
        URI using ``os.path``, which on Windows is ``ntpath``; as ``ntpath`` splits
        the drive designator off and treats the remainder as rooted, the ``..``
        segments were absorbed before the check could inspect them.
        Normalization
        is now performed with ``posixpath``, which is the same module used by
        :meth:`.TemplateLookup.get_template` to resolve the URI to a file.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
 .../python/{python3-mako_1.4.1.bb => python3-mako_1.4.3.bb}     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/python/{python3-mako_1.4.1.bb => python3-mako_1.4.3.bb} (88%)
diff mbox series

Patch

diff --git a/meta/recipes-devtools/python/python3-mako_1.4.1.bb b/meta/recipes-devtools/python/python3-mako_1.4.3.bb
similarity index 88%
rename from meta/recipes-devtools/python/python3-mako_1.4.1.bb
rename to meta/recipes-devtools/python/python3-mako_1.4.3.bb
index 367a65271f5..41bccec9ebc 100644
--- a/meta/recipes-devtools/python/python3-mako_1.4.1.bb
+++ b/meta/recipes-devtools/python/python3-mako_1.4.3.bb
@@ -6,7 +6,7 @@  LIC_FILES_CHKSUM = "file://LICENSE;md5=c79ceff89df0a72f29bb0e1b6f0e36ed"
 
 inherit pypi python_setuptools_build_meta ptest-python-pytest
 
-SRC_URI[sha256sum] = "d7904710b662996425a21627710c4777c45053146942cf8a7aebf757c92b8c27"
+SRC_URI[sha256sum] = "cd6537fe88d5fec315c55c2f8529bc4ce7a9a352ad7db3eeaa6a66e2dd4ec37a"
 
 CVE_PRODUCT = "makotemplates:mako sqlalchemy:mako"