From patchwork Thu Oct 29 17:18:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 102403 Received: from mta-65-228.siemens.flowmailer.net (mta-65-228.siemens.flowmailer.net [185.136.65.228]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.17343.1793294335694781071 for ; Thu, 29 Oct 2026 10:18:56 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=J7hFGq5j; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.228, mailfrom: fm-256628-2026102917185401ff5632920002077b-9tvqpa@rts-flowmailer.siemens.com) Received: by mta-65-228.siemens.flowmailer.net with ESMTPSA id 2026102917185401ff5632920002077b for ; Thu, 29 Oct 2026 18:18:54 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=2/G2pXJtuAsUaMacjNKG6G+mrL4hpFLy3Glkd4ggbR0=; b=J7hFGq5jj4ykS8MZkLr6+gEI1Tl1G6JZITYNNxwR/ULKW7cZd4YMw3Lg/FBtCTDfgBtv2K HSOGUWV2l/GJ7VyShdszJM0SI5w+m7HG7fzKq6EMTBciVn1tqE8gvsHG6RgPRew4+ka23Swv Uu4heQih9Hzy57QXeGMoNuKTAdAwRKiRRT0W65zb/G0W0Uy1d+q+f11mzZzWxqvIl3Zl49an fRQUUmR4OxpbP+6UltFVehNvm0GaLpLoAhrvLmC5EvunHsROJl4078oeL7hrhrzouZI4K0f1 cDsfOmRo5GMqEMhHzz0gewWC49XYiH/my+7rseYirn1VtPa+DYXwJNVw==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [wrynose][PATCH 2/4] python3: upgrade 3.14.9 -> 3.14.10 Date: Thu, 29 Oct 2026 18:18:11 +0100 Message-ID: <20261029171813.2842605-2-peter.marko@siemens.com> In-Reply-To: <20261029171813.2842605-1-peter.marko@siemens.com> References: <20261029171813.2842605-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 17:19:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248966 From: Peter Marko This is an expedited security release to address the compromised eMudhra intermediate CA keys. These keys are now blocked by the ssl module as a last resort against their use. Normal uses of pip, including to upgrade pip itself, are now safe from attacks based on those compromised keys, even if pip hasn't been updated yet. Release information: [1] Security content in this release * CVE-2026-115557 gh-160040: Distrust compromised eMudhra intermediate CA keys * CVE-2026-114583 gh-160097: Reject links replacing the destination in tarfile.tar_filter * gh-160300: Reject cookies with a negative version in http.cookiejar [1] https://www.python.org/downloads/release/python-31410/ Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (From OE-Core rev: 4041f4a2e031f76e5a90207e855c735fd14259b1) Dropped parts updating patches for openssl-4 or ptests. Signed-off-by: Peter Marko --- .../0001-Avoid-shebang-overflow-on-python-config.py.patch | 2 +- ...1-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch | 2 +- .../0001-Update-test_sysconfig-for-posix_user-purelib.patch | 2 +- meta/recipes-devtools/python/python3/makerace.patch | 2 +- .../python/{python3_3.14.9.bb => python3_3.14.10.bb} | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) rename meta/recipes-devtools/python/{python3_3.14.9.bb => python3_3.14.10.bb} (99%) diff --git a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch index 7cacaf0ff3..79fee9803f 100644 --- a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch +++ b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch @@ -19,7 +19,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index e946018..345ed29 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2839,6 +2839,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh +@@ -2844,6 +2844,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh @ # Substitution happens here, as the completely-expanded BINDIR @ # is not available in configure sed -e "s,@EXENAME@,$(EXENAME)," < $(srcdir)/Misc/python-config.in >python-config.py diff --git a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch index 4e41b04a3b..d3f46c372a 100644 --- a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch +++ b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch @@ -18,7 +18,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index 526d500..a7e536d 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -863,8 +863,7 @@ profile-run-stamp: +@@ -864,8 +864,7 @@ profile-run-stamp: # enabled. $(MAKE) profile-gen-stamp # Next, run the profile task to generate the profile information. diff --git a/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch b/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch index 5509b7475a..0864f23926 100644 --- a/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch +++ b/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch @@ -25,7 +25,7 @@ diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py index 1fe4b68..383142a 100644 --- a/Lib/test/test_sysconfig.py +++ b/Lib/test/test_sysconfig.py -@@ -434,7 +434,7 @@ class TestSysConfig(unittest.TestCase, VirtualEnvironmentMixin): +@@ -435,7 +435,7 @@ class TestSysConfig(unittest.TestCase, VirtualEnvironmentMixin): expected = os.path.normpath(global_path.replace(base, user, 1)) # bpo-44860: platlib of posix_user doesn't use sys.platlibdir, # whereas posix_prefix does. diff --git a/meta/recipes-devtools/python/python3/makerace.patch b/meta/recipes-devtools/python/python3/makerace.patch index b589dfb346..7167d5b4e8 100644 --- a/meta/recipes-devtools/python/python3/makerace.patch +++ b/meta/recipes-devtools/python/python3/makerace.patch @@ -20,7 +20,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index a7e536d..e946018 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2745,7 +2745,7 @@ COMPILEALL_OPTS=-j0 +@@ -2750,7 +2750,7 @@ COMPILEALL_OPTS=-j0 TEST_MODULES=@TEST_MODULES@ .PHONY: libinstall diff --git a/meta/recipes-devtools/python/python3_3.14.9.bb b/meta/recipes-devtools/python/python3_3.14.10.bb similarity index 99% rename from meta/recipes-devtools/python/python3_3.14.9.bb rename to meta/recipes-devtools/python/python3_3.14.10.bb index 2a5279480b..73d6e89854 100644 --- a/meta/recipes-devtools/python/python3_3.14.9.bb +++ b/meta/recipes-devtools/python/python3_3.14.10.bb @@ -40,7 +40,7 @@ SRC_URI:append:class-native = " \ file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \ " -SRC_URI[sha256sum] = "e02d9ac21cebda6e46435369744a92c65cc7cd8669697694122cf97ffacd1e53" +SRC_URI[sha256sum] = "de414a57119abef52784d8993e341d53aed635fc2b05c2607d9f98a2c5b72032" # exclude pre-releases for both python 2.x and 3.x UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P\d+(\.\d+)+).tar"