mbox series

[layerindex-web,0/4] Dependency upgrades, and a fix for site notices

Message ID 20261113232808.96792-1-tim.orling@konsulko.com
Headers show
Series Dependency upgrades, and a fix for site notices | expand

Message

Tim Orling Nov. 13, 2026, 11:28 p.m. UTC 
1: Fixes four advisories against soupsieve 2.9.2 (CVE-2026-126190,
   -126191, -126192, -126193). Soupsieve 4 needs Python 3.11.5 or
   later, which the move to Ubuntu noble provides.
2: Upgrades the other dependencies with newer patch or minor releases.
   Celery 5.7 also needs click-repl 0.4.1 and the new tzlocal.
3: Writing a test for the only use of Beautiful Soup turned up two
   bugs in site notices: they showed a literal b'...', and a notice
   with an attribute on an allowed tag, such as <p class="x">, failed
   to render.
4: Adds tests that run the Celery tasks without a broker, to cover the
   Celery upgrade.

The full test suite passes in the Docker image against MariaDB (83
passed, 1 skipped), and the series is running on a test instance
loaded with a copy of the layers.openembedded.org database.

Tim Orling (4):
  requirements.txt: upgrade soupsieve to 4.1
  requirements.txt: upgrade patch and minor releases
  layerindex/utils.py: fix sanitise_html() for Python 3 and current bs4
  tests: add tests for the Celery tasks

 layerindex/utils.py |  6 +++---
 requirements.txt    | 29 +++++++++++++++--------------
 tests/test_tasks.py | 39 +++++++++++++++++++++++++++++++++++++++
 tests/test_utils.py | 13 +++++++++++++
 4 files changed, 70 insertions(+), 17 deletions(-)
 create mode 100644 tests/test_tasks.py


base-commit: 08e58cdece30019a6f9e5d14af16ebe20afa6177