diff mbox series

[meta-python,13/22] python3-oauthlib: Upgrade 4.0.0 -> 4.0.1

Message ID 20261103102350.1952237-13-leon.anavi@konsulko.com
State Under Review
Headers show
Series [meta-python,01/22] python3-anyio: Upgrade 4.15.1 -> 4.16.0 | expand

Commit Message

Leon Anavi Nov. 3, 2026, 10:23 a.m. UTC 
Upgrade to release 4.0.1:

- CVE-2026-49272 / GHSA-3jp2-3mrg-2vxc: The device code flow token
  endpoint did not validate the device_code parameter. A request
  with a known client_id and a bogus device_code could obtain a
  bearer token. DeviceCodeGrant.validate_token_request now calls
  DeviceCodeGrant.validate_device_code(), which rejects missing or
  unknown device codes (invalid_request / invalid_grant) and
  delegates the code's authorization status to the new
  RequestValidator.validate_device_code() hook, per RFC 8628
  Section 3.5.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
---
 .../{python3-oauthlib_4.0.0.bb => python3-oauthlib_4.0.1.bb}    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta-python/recipes-devtools/python/{python3-oauthlib_4.0.0.bb => python3-oauthlib_4.0.1.bb} (92%)
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-oauthlib_4.0.0.bb b/meta-python/recipes-devtools/python/python3-oauthlib_4.0.1.bb
similarity index 92%
rename from meta-python/recipes-devtools/python/python3-oauthlib_4.0.0.bb
rename to meta-python/recipes-devtools/python/python3-oauthlib_4.0.1.bb
index 8c6252595b..b3a7281aa6 100644
--- a/meta-python/recipes-devtools/python/python3-oauthlib_4.0.0.bb
+++ b/meta-python/recipes-devtools/python/python3-oauthlib_4.0.1.bb
@@ -4,7 +4,7 @@  HOMEPAGE = "https://github.com/idan/oauthlib"
 LICENSE = "BSD-3-Clause"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=2699a9fb0d71d5eafd75d8d7c302f7df"
 
-SRC_URI[sha256sum] = "efb274799819440f95b4ab3b818869f1ce9ae26c5beacba0201d1a1b76b54f86"
+SRC_URI[sha256sum] = "3d73febdb6faa00f277c81fb04be7b7586fb96fc3b7f0b9c772dada69a25ede7"
 
 CVE_PRODUCT = "oauthlib"