From patchwork Sun Aug 9 23:21:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Tim Orling X-Patchwork-Id: 94826 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 41CF6C5AD4E for ; Sun, 9 Aug 2026 23:21:39 +0000 (UTC) Received: from mail-pg1-f173.google.com (mail-pg1-f173.google.com [209.85.215.173]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.18669.1786317695208890459 for ; Sun, 09 Aug 2026 16:21:35 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@konsulko.com header.s=google header.b=HygRy9ja; spf=pass (domain: konsulko.com, ip: 209.85.215.173, mailfrom: tim.orling@konsulko.com) Received: by mail-pg1-f173.google.com with SMTP id 41be03b00d2f7-c966b9ee9cbso651885a12.1 for ; Sun, 09 Aug 2026 16:21:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=konsulko.com; s=google; t=1786317694; x=1786922494; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=5Q5DlK6frOV9bnDfixy8MLr3BpGP9CVxGkHed+2BUmw=; b=HygRy9jakTKfyNFGnaFKyQzP2XIba99yaq3OBTqodvIyYW95xH/4x6+Z+gi9FlanRO AQ2ogK7enTiitT5q58ylPkI09iD5JmplaeLFsh8sdXXnR7fPCwes91OquLsIs2ODFO3s utT3dRMAQzg+mkZ9d1wvK24ZZL13vtRZXWKXM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786317694; x=1786922494; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=5Q5DlK6frOV9bnDfixy8MLr3BpGP9CVxGkHed+2BUmw=; b=Z1zR5VQ7+n4K3eGdE57SFhybj2h9e/Bl0frUrAOaJ8byPVrDoYk4xgaVqg1mEsyrRV mG+O430MQNEEwKupVvn0Vf67h0FXnBrio9AeqrKwP4SnRSM4kxZSyJ8P4fo5Xb9SWgQ5 DQUagxVKs/pgJNDVECcqm2rda7fOt3qY4S1ZgwrbEr65IC69mARTamnfTKp4inzgs4/J 03g4ynSB2fus0/1AA+ElREyJQ/Svuc2Az+dVVS0D0shsbViN0509vCwGMFonXqd5beqM F5g7l4HMOK0Iczcly587f6/HjMnm8Ej0Y7FkUennEzEzbEpKqTXK8YVCqvHYZ674v19y S3Kw== X-Gm-Message-State: AOJu0YwqT+uk4c1HRS7far2qy7JKvIMrwjWwaybUjYEtzPhOr+JJGvDF jGDyZWIw4gPkHgQ9G0lLMKgvq5CMOhKgH7zBtClDLcW1CJmg/jE2rEmTKQNyrYwFFWSNqkj903n DVEgl X-Gm-Gg: AR+sD13beJ3ltVfWBdWTLLpazmXzyQwfI6LeIuFuclRGICRhHEWkm6NnYt5Sv1TnuYU eOOSDATtMI+7fUsMxf+NuRSa711bMEGSEzSKAN7F5ruCiQa6GkHuXL2L7nH+ofk6VnZkHl7F/Pn SBpqr3wnOQ4fVcIob3vVid5N4EY35278z4xtKnmyglMY36a0Mn6JIMb5EUwrw5C/QUYF92Jcna3 gEkqiX/o4KHpPu+gzE8+AE2aqf+HC81im6ksukQTeE50X9nK+CxBhMmuHYvIiUuWpEVVFh9XLhf K2zLJKZeMm4wqHZbHdRNFcVgJcSzB2F9uCH4aMXPGMgzdmzZdeh1Zpm86O/Ql/YhO6K9kl/jN43 GG+Buvct7ilZiZo9JOSXLS2zvFeH/pwlC2Ep6q6z6bvtKcNkmpmED4+PrSuLRELA0/Ae7GWsV+r r5+NriWqrTS8nfSmvXJtcFJfaZOxmGzpsePxm0nL/eLfSQF7N2AEb3fLU7jLnkzFxFAmlYKXH16 kFQcQ== X-Received: by 2002:a05:6a20:7285:b0:3c3:7a0a:18a6 with SMTP id adf61e73a8af0-3cb85eea69cmr36517263637.18.1786317694529; Sun, 09 Aug 2026 16:21:34 -0700 (PDT) Received: from thetis.home.local ([2606:c800:6024:2000:6f86:9ad6:671d:ec76]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cbe8f1af992sm2950850a12.14.2026.08.09.16.21.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 16:21:33 -0700 (PDT) From: tim.orling@konsulko.com To: openembedded-core@lists.openembedded.org Cc: Tim Orling Subject: [PATCH 1/5] python3-wheel: fix CVE_PRODUCT Date: Sun, 9 Aug 2026 16:21:05 -0700 Message-ID: <20260809232107.367378-3-tim.orling@konsulko.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 09 Aug 2026 23:21:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243083 From: Tim Orling The proper CVE_PRODUCT is "wheel_project:wheel". BEFORE: python:wheel -> 0 CVEs AFTER: wheel_project:wheel -> 2 CVEs * Already patched at 0.47.0. - CVE-2022-40898 — DoS in wheel CLI via malicious input. Affects <0.38.1. - CVE-2026-24049 — malicious wheel file can modify permissions of arbitrary files. Affects 0.40.0–<0.46.2. AI-Generated: Claude Sonnet 5 Signed-off-by: Tim Orling --- meta/recipes-devtools/python/python3-wheel_0.47.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/python/python3-wheel_0.47.0.bb b/meta/recipes-devtools/python/python3-wheel_0.47.0.bb index 88b54c2ee2..4320442729 100644 --- a/meta/recipes-devtools/python/python3-wheel_0.47.0.bb +++ b/meta/recipes-devtools/python/python3-wheel_0.47.0.bb @@ -8,6 +8,8 @@ SRC_URI[sha256sum] = "cc72bd1009ba0cf63922e28f94d9d83b920aa2bb28f798a31d0691b02f inherit python_flit_core pypi ptest-python-pytest +CVE_PRODUCT = "wheel_project:wheel" + RDEPENDS:${PN} += "python3-packaging" # One test is skipped but requires the "full" python3-flit, not just python3-flit-core From patchwork Sun Aug 9 23:21:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tim Orling X-Patchwork-Id: 94827 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2104DC5AD5A for ; Sun, 9 Aug 2026 23:21:49 +0000 (UTC) Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.19002.1786317704266823591 for ; Sun, 09 Aug 2026 16:21:44 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@konsulko.com header.s=google header.b=Da/TXSJC; spf=pass (domain: konsulko.com, ip: 209.85.214.175, mailfrom: tim.orling@konsulko.com) Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2cf52d15d88so9496155ad.2 for ; Sun, 09 Aug 2026 16:21:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=konsulko.com; s=google; t=1786317703; x=1786922503; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=AaLAnVySXc22ebeSnbxAQ75VCekKn6ERJ85Y68KIcFg=; b=Da/TXSJC7qm798Dlx0ICq8za/ygFJCNUqiMx6/7aKmJxXwxXbU+0iihGRD2Cu7s1p8 z/XV7fqVNP1oN5d4gu0/f0nvCUpzGNvXGJSFSyUz7BEon+ztAsOa3F8uBn/r39raVM1w i45C7CQwm2siPkyvQZgEphy17U/bJL7ZPQbx8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786317703; x=1786922503; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=AaLAnVySXc22ebeSnbxAQ75VCekKn6ERJ85Y68KIcFg=; b=GfbtUa7GF8gUSktqhvtUuB/5pdsrOUppjQ9tu5J8fVqnG4Sx84qvdphNMFpEkQt+N1 GqsdsAaESKJEEz++B9xjI8snRPbCRCNz3b0fh+WxqYoUi3D/yg8qsEQqx2MXkICpE8uq pRi1Jv5cQkruxe3rAl0bWu1qCK7JD0N/zfzL0hqrXVeULg0PlBUsA+l9Gf/gvqUCDA5U XbEnJer+m1js74QCvIdlbBFnry5dSc6TEpKkqrEZoHHoAwwH0qGqYOmvkM5ZaVto/l82 +rLgqtThq2c3edIQQL1oyKpMImWL7Jt2xh/xPoAx1cADwtcDfr6gn1eAre8C7lAWp7rL iCrA== X-Gm-Message-State: AOJu0YzSeSSFCrMJqlBvfgNAfNn2qtIQAEOjERE/pSzJcoezv7fmp+CF 5Udw2F41c/Q+TiDPfRXK3SBhRVwP2Yc3xH/dmME7bDU+cdu65wUpKgq5DJEWGjsnfOSE5xLvO43 5AvDv X-Gm-Gg: AR+sD11vdxn5N/6otpLern6mrfYBWB5jLD2Ev6hAhdqsnCcudJG5Myv/ojArwiyvvWG DPY4uWaffBWv8DWaURGBY4UzFypLjhjQ6YxFeewTnm/4xrFl4DyVv9X7WUi24eM9GJdZ7Cgoxhm kzyhs1ajDdBL8E8QUp53l22OTLk8eW8eqYMT6y380m9ZVLzO+bdiVEROjFOCvsXZJarVfprLwUm 4KKP1BxzD2KG8OlTwDluCUWYW4B8Zh90yEbPQflviic/jRcmd3Xw9tqZ6GqcYDLXlS9/Oz4FwQ/ cX5MmCIefalpzGQgNzaaZq/h9y/3voHXuhWzDdkd/T3OXEfl6xbSCWqjqkBLQ2j8tqJV/mjU0db QJYznUvdHN3vQBfQbyLti1BRalZ3VB/VNOgTBlX9WlhRhR5G6FaA5JQ3bdCSRY5TY/WYB0G0n3i Bmtl5EEriObXfOfkZIT59tJrehIXDDXT9gpqqKFQiSJ9D0DtiiscD+U9Il5evayaIR0drVUNJsf /l6zA== X-Received: by 2002:a05:6a20:a11a:b0:3cb:8eb2:acbd with SMTP id adf61e73a8af0-3cbce9294abmr15408075637.25.1786317703558; Sun, 09 Aug 2026 16:21:43 -0700 (PDT) Received: from thetis.home.local ([2606:c800:6024:2000:6f86:9ad6:671d:ec76]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cbe8f1af992sm2950850a12.14.2026.08.09.16.21.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 16:21:43 -0700 (PDT) From: tim.orling@konsulko.com To: openembedded-core@lists.openembedded.org Cc: Tim Orling Subject: [PATCH 2/5] python3-attrs: fix CVE_PRODUCT Date: Sun, 9 Aug 2026 16:21:07 -0700 Message-ID: <20260809232107.367378-5-tim.orling@konsulko.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260809232107.367378-3-tim.orling@konsulko.com> References: <20260809232107.367378-3-tim.orling@konsulko.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 09 Aug 2026 23:21:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243084 From: Tim Orling No new CVEs are caught, but attrs_project:attrs matches the CPE upstream. AI-Generated: Claude Sonnet 5 Signed-off-by: Tim Orling --- meta/recipes-devtools/python/python3-attrs_26.1.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/python/python3-attrs_26.1.0.bb b/meta/recipes-devtools/python/python3-attrs_26.1.0.bb index 03621e41a6..1c28809728 100644 --- a/meta/recipes-devtools/python/python3-attrs_26.1.0.bb +++ b/meta/recipes-devtools/python/python3-attrs_26.1.0.bb @@ -7,6 +7,8 @@ SRC_URI[sha256sum] = "d03ceb89cb322a8fd706d4fb91940737b6642aa36998fe130a9bc96c98 inherit pypi ptest-python-pytest python_hatchling +CVE_PRODUCT = "attrs_project:attrs" + DEPENDS += " \ python3-hatch-vcs-native \ python3-hatch-fancy-pypi-readme-native \ From patchwork Sun Aug 9 23:21:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tim Orling X-Patchwork-Id: 94828 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E7C0C5AD5A for ; Sun, 9 Aug 2026 23:22:19 +0000 (UTC) Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.19010.1786317730701303505 for ; Sun, 09 Aug 2026 16:22:10 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@konsulko.com header.s=google header.b=dxj/P5cF; spf=pass (domain: konsulko.com, ip: 209.85.215.175, mailfrom: tim.orling@konsulko.com) Received: by mail-pg1-f175.google.com with SMTP id 41be03b00d2f7-cb5a6aa8760so617643a12.1 for ; Sun, 09 Aug 2026 16:22:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=konsulko.com; s=google; t=1786317730; x=1786922530; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=CdB6fbDpc76w3WyzN9BGzqmi401GqtQR4BL67ko8JEM=; b=dxj/P5cFAbyZvWDAZ+1S72xhWqgbLTl3oL91dYP2JUYc4NHl5B/kxb8SDcxV3E0wGC Vhw/Q0G7LuC9X1XpJrZ91NV6mLPiIKjlmDdfgcT7Zp9LAsdQlQxYWWzIFCSHmhNe+vlA 1kLZZ7v6+4wySXH8C7L9M4yye0pNBEPEtMJjU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786317730; x=1786922530; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=CdB6fbDpc76w3WyzN9BGzqmi401GqtQR4BL67ko8JEM=; b=nI5sF4TKu/qJcm5E7a+WOJnwBnE1zn5brl6OSiHxLt9G1s2v7Sw9bQQQycZOlzH7cZ +J4s+IXLyaTzfKSyluloDYKSSKUFvscxwxvLGPJEloA3lcX20pSbFhJr0FlAlPfMUIdj +Kub3NqPJ/9Yilg4NgDClQ/vUE0eL/oSMacUlx3Cb+QhhgdZz8ZDiJz5pVXRc7M5DXFK QDdz6mVehHm5OMFKzfQ8HoCORCrIKTHMI4GIBMYD+9H3wUMmLY5puf2rQWgnbps7I+P0 +9SjBe7/fLpzs+1X96s0yfohKXLPGXS0z5eFOg2rnZjIGaE3aIK8IRZr9Dln5k+mDHbx k5Hw== X-Gm-Message-State: AOJu0YxkHAUeXecW89Ba/AWZCfdrZR2CFDr7323EtB36epQj/bJyoChd L99EubAdcM9XxAH3pLwO0n407+WYhvZT+Lx1IaJIsZYoZqEz9macriaJihHFr8YX+oi6DKX5sH2 ujkZP X-Gm-Gg: AR+sD13qkULzOHLoUI1tVFH+HAhXgkpoFioILPRG1PqopiwwThBrP/WeoK98qZFXlui NT3kbx4la0kL+28xaR7m4IgFq+uYaPHPf1rw476nadTgfalq9rfTvjm/bO7GIwBAShtrYiQxytQ po9q5CRLfLFo/eah7HRYSBDw+oekdwO3AYPTKKKWDD9v5EdY9efckRM4ZLBnbpwxEjCOLGmePjN GPCBkZPS8bcINieeDkQgFuxAQZsUM/gDvhsrD7yvlE8PbA0LRQFSbB3Ipeb4DHXAp0/4HX+hbyO 0qwaKn+lnlyxukkddXQAwDBHDqCccgXRG9Joil99oY1HK47E8DClijWmSLSioTy+6HE+nTYKNdt 8wprNxprGdMKQ/mnO4qb88ovMKq/ZtAso9SgsxdGnQLn6DChekoSijP/8uW+osoE49y2r+Bylpb k6qwiIz83kKDeu9hYsPHemrPemWjOA2ZEIw5PPT/ZDsLlyFQShYh4j8iV31sVRlcj3vPUr1lseP A6XLw== X-Received: by 2002:a05:6a20:9c15:b0:3b3:2703:110 with SMTP id adf61e73a8af0-3cbada680bfmr31121748637.4.1786317729854; Sun, 09 Aug 2026 16:22:09 -0700 (PDT) Received: from thetis.home.local ([2606:c800:6024:2000:6f86:9ad6:671d:ec76]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cbe8f1af992sm2950850a12.14.2026.08.09.16.22.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 16:22:09 -0700 (PDT) From: tim.orling@konsulko.com To: openembedded-core@lists.openembedded.org Cc: Tim Orling Subject: [PATCH 3/5] python3-babel: fix CVE_PRODUCT Date: Sun, 9 Aug 2026 16:21:09 -0700 Message-ID: <20260809232107.367378-7-tim.orling@konsulko.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260809232107.367378-3-tim.orling@konsulko.com> References: <20260809232107.367378-3-tim.orling@konsulko.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 09 Aug 2026 23:22:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243085 From: Tim Orling Recipe (PV): python3-babel (2.18.0) Before -> After: python:babel -> pocoo:babel Newly caught CVEs: CVE-2021-42771 (locale .dat deserialization RCE) Status: patched (fixed 2.9.1) AI-Generated: Claude Sonnet 5 Signed-off-by: Tim Orling --- meta/recipes-devtools/python/python3-babel_2.18.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/python/python3-babel_2.18.0.bb b/meta/recipes-devtools/python/python3-babel_2.18.0.bb index b0abb2c62e..26847372bf 100644 --- a/meta/recipes-devtools/python/python3-babel_2.18.0.bb +++ b/meta/recipes-devtools/python/python3-babel_2.18.0.bb @@ -7,6 +7,8 @@ SRC_URI[sha256sum] = "b80b99a14bd085fcacfa15c9165f651fbb3406e66cc603abf11c575093 inherit pypi setuptools3 +CVE_PRODUCT = "pocoo:babel" + S = "${UNPACKDIR}/babel-${PV}" CLEANBROKEN = "1" From patchwork Sun Aug 9 23:26:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tim Orling X-Patchwork-Id: 94829 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4E3E7C5AD4E for ; Sun, 9 Aug 2026 23:27:29 +0000 (UTC) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.19088.1786318039254052868 for ; Sun, 09 Aug 2026 16:27:19 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@konsulko.com header.s=google header.b=XD9ESWQ0; spf=pass (domain: konsulko.com, ip: 209.85.214.170, mailfrom: tim.orling@konsulko.com) Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2caced6038eso11943675ad.0 for ; Sun, 09 Aug 2026 16:27:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=konsulko.com; s=google; t=1786318039; x=1786922839; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=qGWeE5BGhcQN+FDqvH3SQReU9gVCeRm4r0mYOu8Q0mM=; b=XD9ESWQ0rnb0uWb+asXx7Rjr0wFDB9H9DnNolw/oUrS5PXdxJdyPMJuVovyO1Dokut euv0Xuw7yJ3e3El7DXuLM8arz/iNosoIoPycloc5JAJgci13MMiAGOcO0ucAdXsb8Rxq ZOUHGpijlK3pQ3Dnga7RS1C1TMwM6if+s5PbE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786318039; x=1786922839; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=qGWeE5BGhcQN+FDqvH3SQReU9gVCeRm4r0mYOu8Q0mM=; b=P3WZmbY4K0s1U5u/hCr/vkmZkYKbnNzSZBj13fhS8zuowcfTSfe+pCfMiGCKBsxl9U J6ARTc7QDQ4dQdiygSTbM9H3QCdf/R2f4GKXBw+pa9W34Y1BQF4D1T7kuTxIAZANXn6n mEL69o3/6RPcZ+VAuLSN0GSkDFAoD2adkZ/Mte841ClXiNp+U6AGUmGibHqUI7Muop/J 1QaGOlSDsFlBFjFTwMCUcCeB+vTe8vCNaVj/Nrc+2FYQ7V2qYEwJo0ju1C4s1BXFBhBb DkQMZf4Pf4tqdDzRTBhkXOu1O69S3uOvI0F8XP+N5Bl2XeAW29fwo+UwTRKvJcpiBC4E /9+g== X-Gm-Message-State: AOJu0YyokrKsDCu+abjQ8YHv6bb9fV4B2Tgc2xDGDuXJBIyUskZye+fa 7uAsurzZBa+TlqcdkEfON9wevMxqmgUACMckhgOZFIdi3mvm4JhEZ3GUZWALk/pysY1wwYHJ7mG R/yBM X-Gm-Gg: AR+sD12oPoad7zbVAN+RiRVfyUkMK/CO6wgEf+Q0wsptoYjzJPzLTT9c8twQQBwgPPn BGLc6zJWmO23Nbxws6hFt4lO3kEZI56QG1fbLwFHtwLQFnieozshW8kcgW/ZSoWlw01ZwzaHMha x7CYsaNw4g8XzfzBVvyaeMXRgJfLlmEZSjowN5uCL7MMl3GeSUif4U9K+ddt1pM7xgz6PbzMJua T5x1uTZEVNL1YcVouWSB3l0Yscdq+6cT2fcYsJc3rqxpel5nNj3GM5oAal+7izt2epv94bqfnH3 h3QfpuTNiNO/LT6YlBAlqh0qB3KWjHQ3VhGY5JgAVoiSvH0ndLT3Vx0QR52AX/3o4mBP/WZQR5m hDyPrJRMi0J2eVLHo40oC+Yglm47qNK+aTU8kmJdHsJxCyYeVGqzbJUuj9Urmy3XTJGvcL48SIt ZdFZw0gjfidsz+p8oHAOScHJLTK/85o/aPgdSYxgBpgIj6V6RnYOxt7IhPANxkGExvTdIdRQRrY fC++A== X-Received: by 2002:a17:902:f612:b0:2d2:a982:a388 with SMTP id d9443c01a7336-2d2b2eb169fmr184024025ad.15.1786318038565; Sun, 09 Aug 2026 16:27:18 -0700 (PDT) Received: from thetis.home.local ([2606:c800:6024:2000:6f86:9ad6:671d:ec76]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d14ccae6f8sm26373605ad.1.2026.08.09.16.27.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 16:27:17 -0700 (PDT) From: tim.orling@konsulko.com To: openembedded-core@lists.openembedded.org Cc: Tim Orling Subject: [PATCH 4/5] python3-click: fix CVE_PRODUCT Date: Sun, 9 Aug 2026 16:26:49 -0700 Message-ID: <20260809232649.368812-5-tim.orling@konsulko.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 09 Aug 2026 23:27:29 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243086 From: Tim Orling Fix " vs ' in DESCRIPTION Recipe (PV): python3-click (8.4.2) Before -> After python:click -> palletsprojects:click Newly caught: CVE-2026-7246 (command injection in click.edit()) Status: patched (fixed 8.3.3) AI-Generated: Claude Sonnet 5 Signed-off-by: Tim Orling --- meta/recipes-devtools/python/python3-click_8.4.2.bb | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/meta/recipes-devtools/python/python3-click_8.4.2.bb b/meta/recipes-devtools/python/python3-click_8.4.2.bb index b13bdc9285..0578a0421e 100644 --- a/meta/recipes-devtools/python/python3-click_8.4.2.bb +++ b/meta/recipes-devtools/python/python3-click_8.4.2.bb @@ -1,8 +1,8 @@ SUMMARY = "A simple wrapper around optparse for powerful command line utilities." DESCRIPTION = "\ Click is a Python package for creating beautiful command line interfaces \ -in a composable way with as little code as necessary. It's the "Command \ -Line Interface Creation Kit". It's highly configurable but comes with \ +in a composable way with as little code as necessary. It is the 'Command \ +Line Interface Creation Kit'. It is highly configurable but comes with \ sensible defaults out of the box." HOMEPAGE = "http://click.pocoo.org/" LICENSE = "BSD-3-Clause" @@ -13,6 +13,8 @@ SRC_URI[sha256sum] = "9a6cea6e60b17ebe0a44c5cc636d94f09bd66142c1cd7d8b4cd731c491 inherit pypi python_flit_core ptest-python-pytest +CVE_PRODUCT = "palletsprojects:click" + RDEPENDS:${PN}-ptest += " \ python3-pytest \ python3-terminal \ From patchwork Sun Aug 9 23:26:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tim Orling X-Patchwork-Id: 94830 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2744BC5AD4E for ; Sun, 9 Aug 2026 23:27:39 +0000 (UTC) Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.19091.1786318054273799691 for ; Sun, 09 Aug 2026 16:27:34 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@konsulko.com header.s=google header.b=hjypsiS7; spf=pass (domain: konsulko.com, ip: 209.85.214.179, mailfrom: tim.orling@konsulko.com) Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2ceab75934dso14302505ad.2 for ; Sun, 09 Aug 2026 16:27:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=konsulko.com; s=google; t=1786318054; x=1786922854; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=VY4usRICaxhXCeQhmdvYOfZpDLIP6WMeSO8y2fav6mo=; b=hjypsiS72LYBVFb3d5u3vtFkZOlJHUR+gchdmZpCtLVBkTvsJv53fXZxOLlBltctjy i7pSbOgzcR/Wk36I+SziVdlsoPHRRzCF1jpwXSGYxTGG7sNS/KmqyzNFScFPZ1nUmxLz kC3NFi8PvIuj6piI85SupNLva9HTqNxPkSeK8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786318054; x=1786922854; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=VY4usRICaxhXCeQhmdvYOfZpDLIP6WMeSO8y2fav6mo=; b=rZo2rd7m/N1gcF825sOCu+SMpVVLWe+u7c1DOHH3T/WEPZFT6Kb8BsCdtMhS2num9J oh1n09j09J4Wbadp1GiX/1Clj6K+7jkw5UqnkAQmae2zISQjddIdCiSPVYD3XuVCEy/p jn0Drv9HSv+NNLcXs0rZwXjz0fy+kE3IbRcShEbFAxAFnAOaaKUQ+qaQp91DKIgW0ZK0 tXdCnE39a5cpgj2fIG2d4PIY9KZ9Ld/QEYw4KrO+4bvOc1ArSlrvuoksan1bg/wJf6yE WjcjDwlKH9XbN+m9r2+/WiLOs8hbQbfFCEgpFtzMrE0qMosJXtK5aruazqhGRXW+BZ/a N8zQ== X-Gm-Message-State: AOJu0YzYsLf0p/2HKSP6t6Z8SdgMI6DiUh7m+cu2no2hXQtP01mr1IzE jNzdLjMkDv8kSvW1C6ASRn8Nr1sfODauBc9kBiDdE39L+k5V7ZKOBkUTuU6XqMadCwZMl1Qx2jJ QKPq8 X-Gm-Gg: AR+sD13K2MHQZ76SKE1l1l3K48hRIFDQlNHCN+WebGCDvcab01fJGW4AvGSE422p1Kh sN0iUmqZN9J0uL2dmJzlJOJAG9+fz33s6v8LB0XKNWzCkQBrN2xunni+VOM4PaGJlnU6H4g5D38 8ItQfvISzSfLzzw59P2ev4F/snaQNiK0BfVbgAIAsen+LkwkUkeGKvXhbq5eKZJqd4fiKsnKUTs WM5oeICTqYCUbpiTNY85GLlgD0h3fEe3vUZOmCklq+AnC38cJoftVWeb+BAt0x3ytEoLfG7XOIL /mzlPwPaotPLzFCyahVg77gjsx8c1h0mZP20RACY14OQ27Heh0+0l9fO8H+ZKip0QOmLbBje/qk Goib3oIvNN2x/vpuRt3590fgOMuF8efr7cBtxJCk5HzSthvt0v6iYIt6Md9108enFdj9rcZvpKd 0ID0RhvHTFE+BiDTnNYHiSOJnGrcA2sUbsMasaWC9DhZl0yf4/1rWW/SQC43pFAWP/bV7ESzQmI PDdww== X-Received: by 2002:a17:903:3848:b0:2c9:c991:3bf0 with SMTP id d9443c01a7336-2d0ca70da11mr471415205ad.8.1786318051397; Sun, 09 Aug 2026 16:27:31 -0700 (PDT) Received: from thetis.home.local ([2606:c800:6024:2000:6f86:9ad6:671d:ec76]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d14ccae6f8sm26373605ad.1.2026.08.09.16.27.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 16:27:30 -0700 (PDT) From: tim.orling@konsulko.com To: openembedded-core@lists.openembedded.org Cc: Tim Orling Subject: [PATCH 5/5] python3-dbusmock: fix CVE_PRODUCT Date: Sun, 9 Aug 2026 16:26:51 -0700 Message-ID: <20260809232649.368812-7-tim.orling@konsulko.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260809232649.368812-5-tim.orling@konsulko.com> References: <20260809232649.368812-5-tim.orling@konsulko.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 09 Aug 2026 23:27:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243087 From: Tim Orling Recipe (PV): python3-dbusmock (0.38.1) Before -> After: python:python_dbusmock -> python-dbusmock_project:python-dbusmock Newly caught CVEs: CVE-2015-1326 (.pyc code exec via AddTemplate) Status: patched (fixed 0.15.1) AI-Generated: Claude Sonnet 5 Signed-off-by: Tim Orling --- meta/recipes-devtools/python/python3-dbusmock_0.38.1.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/python/python3-dbusmock_0.38.1.bb b/meta/recipes-devtools/python/python3-dbusmock_0.38.1.bb index cbd74b4059..ecec075f6f 100644 --- a/meta/recipes-devtools/python/python3-dbusmock_0.38.1.bb +++ b/meta/recipes-devtools/python/python3-dbusmock_0.38.1.bb @@ -11,6 +11,8 @@ PYPI_PACKAGE = "python_dbusmock" inherit pypi python_setuptools_build_meta DEPENDS += "python3-setuptools-scm-native" +CVE_PRODUCT = "python-dbusmock_project:python-dbusmock" + RDEPENDS:${PN} += "\ python3-dbus \ python3-unittest \