From patchwork Wed Aug 5 05:47:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 94560 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9E60CC55174 for ; Wed, 5 Aug 2026 05:47:41 +0000 (UTC) Received: from a27-45.smtp-out.us-west-2.amazonses.com (a27-45.smtp-out.us-west-2.amazonses.com [54.240.27.45]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.34046.1785908854766267934 for ; Tue, 04 Aug 2026 22:47:34 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=dxf8yBK0; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=fAqAeITF; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.45, mailfrom: 0101019fd0767c62-9467413b-e5ff-4fcf-b992-51f901d63ce3-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1785908854; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date; bh=dbaCmXrtCIyE7DR0Sdbua2tOUnSQmdegqgqciw4yeeo=; b=dxf8yBK0XxU53miFr3F10UMgHwidCQZqodlSQCprOlu6S/wHhEscC8eHdNkBkZhT PLCsopdUtftAXsTRLP4VQ4W+pI74M8CuHK3iwXObV0ZXiSOhokqMwnkA6RVuVSTq5yd rtzGQIRaAO9ZCMejoUJ/lvZ2ZwGNUdQ28UosRwNI= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1785908854; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date:Feedback-ID; bh=dbaCmXrtCIyE7DR0Sdbua2tOUnSQmdegqgqciw4yeeo=; b=fAqAeITFVCtaALTLk81Br8n9O4jgDnY7FOeDaB4bz4jJq4ybz4oQp8HdvOAPye8L 7XI7bWUVYJ33FtNjUan0MTz3PInobiPGhLKOJ1VUVF/xYrAlEZHDbxzB2/CS+I+h3cM z82NcybjJd9j0NXa1NEXcCJRNIjWxopG8L+lj8Uc= MIME-Version: 1.0 From: auh@yoctoproject.org To: Trevor Gamblin Cc: openembedded-core@lists.openembedded.org Subject: [AUH] python3-pip: upgrading to 26.2.1 SUCCEEDED Message-ID: <0101019fd0767c62-9467413b-e5ff-4fcf-b992-51f901d63ce3-000000@us-west-2.amazonses.com> Date: Wed, 5 Aug 2026 05:47:33 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.08.05-54.240.27.45 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 05 Aug 2026 05:47:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242819 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *python3-pip* to *26.2.1* has Succeeded. Next steps: - apply the patch: git am 0001-python3-pip-upgrade-26.1.2-26.2.1.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From 7313e7a584da2d115a396b25d83b5087e736fae3 Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Wed, 5 Aug 2026 05:41:16 +0000 Subject: [PATCH] python3-pip: upgrade 26.1.2 -> 26.2.1 Source: NEWS.rst 26.2.1 (2026-08-04) =================== Bug Fixes --------- - Reallow keyring installed in a (non-activated) virtual environment to be be used via the ``import`` provider method while installing build dependencies. (`#14227 `_) 26.2 (2026-07-29) ================= Deprecations and Removals ------------------------- - Newly published packages will no longer be immediately visible to pip if the index uses caching. To install a newly published package, use ``--refresh-package``. (`#13680 `_) - Drop support for detecting legacy, non-:pep:`405`, ``virtualenv`` (< 20) environments. (`#14062 `_) - Constraints files, including ``PIP_CONSTRAINT``, no longer affect isolated build environments. Use ``--build-constraint`` or the ``PIP_BUILD_CONSTRAINT`` environment variable to constrain build dependencies instead. The ``--use-feature=build-constraint`` flag is now always enabled and has no effect. (`#14094 `_) Features -------- - Declare support for Python 3.15 (`#14208 `_) - Support self-referential extras officially. pip has supported this by accident since version 21.2. (`#11296 `_) - Add ``--only-deps`` flag to instruct pip to select only the dependencies of supplied packages. It cannot be used with ``--no-deps``, ``-r``, ``--group``, or ``--requirements-from-script``. (`#11440 `_) - Cache simple responses in accordance to their ``Cache-Control`` header instead of always revalidating on every request. To refresh cached package index responses and ensure newly published packages are found, use ``--refresh-package ``. (`#13680 `_) - Add ``--no-require-hashes`` to disable automatic enablement of ``--require-hashes`` when encountering a requirement with hashes. (`#14169 `_) - Honor ``--only-final`` when sourcing requirements with ``-r pylock.toml``. (`#13950 `_) - Add support for ``pylock.toml`` ``upload-time`` field, so ``--uploaded-prior-to`` works with ``-r pylock.toml``. (`#14168 `_) - Better error messages in case of conflicts with requirements from ``-r pylock.toml``. (`#13963 `_) - Add experimental support for isolating build subprocesses by creating standard virtual environments. This will fix most (if not all) subtle isolation issues that can lead to broken builds exclusive to pip. The feature can be enabled via ``--use-feature=venv-isolation`` and will be enabled by default in a future release. Note that the feature has limited compatibility with ``--use-feature=inprocess-build-deps`` [Changelog truncated as it exceeds 3000 characters; the full changelog can be found in an attachment to the AUH email] --- .../python3-pip/no_shebang_mangling.patch | 8 +++--- ...n3-pip_26.1.2.bb => python3-pip_26.2.1.bb} | 25 +++++++++++++++++-- 2 files changed, 27 insertions(+), 6 deletions(-) rename meta/recipes-devtools/python/{python3-pip_26.1.2.bb => python3-pip_26.2.1.bb} (76%) diff --git a/meta/recipes-devtools/python/python3-pip/no_shebang_mangling.patch b/meta/recipes-devtools/python/python3-pip/no_shebang_mangling.patch index e8b2982b2a..4b61e94835 100644 --- a/meta/recipes-devtools/python/python3-pip/no_shebang_mangling.patch +++ b/meta/recipes-devtools/python/python3-pip/no_shebang_mangling.patch @@ -1,4 +1,4 @@ -From e4e1fed9f8e3ff3e04467699f36599f76caa9487 Mon Sep 17 00:00:00 2001 +From 545460879e2fbcb30b48b893a3efadb6f652e238 Mon Sep 17 00:00:00 2001 From: Richard Purdie Date: Wed, 23 Feb 2022 12:27:06 +0000 Subject: [PATCH] python3-pip: Don't change shebang @@ -13,10 +13,10 @@ Upstream-Status: Inappropriate [OE specific config] 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/pip/_vendor/distlib/scripts.py b/src/pip/_vendor/distlib/scripts.py -index 195dc3f..a0e0d61 100644 +index ac9e909..1faa5b6 100644 --- a/src/pip/_vendor/distlib/scripts.py +++ b/src/pip/_vendor/distlib/scripts.py -@@ -155,6 +155,8 @@ class ScriptMaker(object): +@@ -157,6 +157,8 @@ class ScriptMaker(object): See also: http://www.in-ulm.de/~mascheck/various/shebang/#length https://hg.mozilla.org/mozilla-central/file/tip/mach """ @@ -25,7 +25,7 @@ index 195dc3f..a0e0d61 100644 if os.name != 'posix': simple_shebang = True elif getattr(sys, "cross_compiling", False): -@@ -363,7 +365,7 @@ class ScriptMaker(object): +@@ -367,7 +369,7 @@ class ScriptMaker(object): return match = FIRST_LINE_RE.match(first_line.replace(b'\r\n', b'\n')) diff --git a/meta/recipes-devtools/python/python3-pip_26.1.2.bb b/meta/recipes-devtools/python/python3-pip_26.2.1.bb similarity index 76% rename from meta/recipes-devtools/python/python3-pip_26.1.2.bb rename to meta/recipes-devtools/python/python3-pip_26.2.1.bb index 945aad1834..d2658c941e 100644 --- a/meta/recipes-devtools/python/python3-pip_26.1.2.bb +++ b/meta/recipes-devtools/python/python3-pip_26.2.1.bb @@ -1,3 +1,24 @@ +# FIXME: the LIC_FILES_CHKSUM values have been updated by 'devtool upgrade'. +# The following is the difference between the old and the new license text. +# Please update the LICENSE value if needed, and summarize the changes in +# the commit message via 'License-Update:' tag. +# (example: 'License-Update: copyright years updated.') +# +# The changes: +# +# --- src/pip/_vendor/idna/LICENSE.md +# +++ src/pip/_vendor/idna/LICENSE.md +# @@ -1,6 +1,6 @@ +# BSD 3-Clause License +# +# -Copyright (c) 2013-2025, Kim Davies and contributors. +# +Copyright (c) 2013-2026, Kim Davies and contributors. +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# +# + SUMMARY = "The PyPA recommended tool for installing Python packages" HOMEPAGE = "https://pypi.org/project/pip" SECTION = "devel/python" @@ -7,7 +28,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=63ec52baf95163b597008bb46db68030 \ file://src/pip/_vendor/certifi/LICENSE;md5=11618cb6a975948679286b1211bd573c \ file://src/pip/_vendor/distlib/LICENSE.txt;md5=f6a11430d5cd6e2cd3832ee94f22ddfc \ file://src/pip/_vendor/distro/LICENSE;md5=d2794c0df5b907fdace235a619d80314 \ - file://src/pip/_vendor/idna/LICENSE.md;md5=18a4795c19833413a7e2f1cb3cd3b143 \ + file://src/pip/_vendor/idna/LICENSE.md;md5=9a6c29079fc90c29d80332f44d2625f2 \ file://src/pip/_vendor/msgpack/COPYING;md5=cd9523181d9d4fbf7ffca52eaa2a5751 \ file://src/pip/_vendor/packaging/LICENSE;md5=faadaedca9251a90b205c9167578ce91 \ file://src/pip/_vendor/pkg_resources/LICENSE;md5=141643e11c48898150daa83802dbc65f \ @@ -26,7 +47,7 @@ inherit pypi python_setuptools_build_meta SRC_URI += "file://no_shebang_mangling.patch" -SRC_URI[sha256sum] = "f49cd134c61cf2fd75e0ce2676db03e4054504a5a4986d00f8299ae632dc4605" +SRC_URI[sha256sum] = "f6ad667e89a1fe78046c8f13232b247200f5258d7828f3f7883d660878e0813f" CVE_PRODUCT = "pypa:pip"