From patchwork Wed Sep 16 05:44:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 98391 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4175C982C4 for ; Wed, 16 Sep 2026 05:44:58 +0000 (UTC) Received: from a27-33.smtp-out.us-west-2.amazonses.com (a27-33.smtp-out.us-west-2.amazonses.com [54.240.27.33]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.8416.1789537495123832101 for ; Tue, 15 Sep 2026 22:44:55 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=J+aobAPN; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=bBhPwgQZ; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.33, mailfrom: 010101a0a8bf2485-7fcc913b-46eb-4433-90e8-9347981ba858-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1789537494; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date; bh=9G8ZKPTunUidrHtoOyN+l6BOj62D5UMk6r43RDwH/Vk=; b=J+aobAPNGAFs5yC++/Ago8LTS+91UpOUdgJbAliV2SbOfdRWU/wiMDGE+mdymDCc +1mOyDUdVXZBM1XrRfG3E6KMwIEhK+OEtTsRPReh/gs8osHqEc2+N20kK0+rBFJjPEk WtyY5sNPngXHtznCnpO4mIf5uuOxvRic0reU+xSE= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1789537494; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date:Feedback-ID; bh=9G8ZKPTunUidrHtoOyN+l6BOj62D5UMk6r43RDwH/Vk=; b=bBhPwgQZYytsgkhPhq8dwyMzia+rxylqg9I66hHIlh0fOho5GSqTmnKSQW2EzvSk BrZSzHmp1fvSqvkIj5TZznxs9YYaxQtj0gno963aBKQcX1SNIEhtTiJ3KaBwo6S/r7i GtOM2+mJlqScJxvIpjR3GEf46NDfDgtYzGjvqtyU= MIME-Version: 1.0 From: auh@yoctoproject.org To: Tim Orling Cc: openembedded-core@lists.openembedded.org Subject: [AUH] python3-urllib3: upgrading to 2.8.0 SUCCEEDED Message-ID: <010101a0a8bf2485-7fcc913b-46eb-4433-90e8-9347981ba858-000000@us-west-2.amazonses.com> Date: Wed, 16 Sep 2026 05:44:54 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.09.16-54.240.27.33 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 16 Sep 2026 05:44:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245919 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *python3-urllib3* to *2.8.0* has Succeeded. Next steps: - apply the patch: git am 0001-python3-urllib3-upgrade-2.7.0-2.8.0.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From 4048ca87d1bb1dbd0e37e15ff770cda24c87322c Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Wed, 16 Sep 2026 05:39:03 +0000 Subject: [PATCH] python3-urllib3: upgrade 2.7.0 -> 2.8.0 Source: CHANGES.rst 2.8.0 (2026-09-15) ================== Security -------- Fixed the following security issues: - The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, `GHSA-8988-9cw3-xx77 `__) - ``HTTPResponse.stream()`` and ``read_chunked()`` could buffer a chunk-size line of unbounded length in memory. (High severity, `GHSA-vxq7-64xx-v4gw `__) - Chunked Deflate streaming could enter an infinite loop. (Medium severity, `GHSA-gh4c-6fx4-qh6g `__) .. caution:: urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes. Configure proxy CA certificates and client certificates in ``proxy_ssl_context``, and proxy identity checks with ``proxy_assert_hostname`` or ``proxy_assert_fingerprint``. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections. Deprecations & Removals ----------------------- - Deprecated using an empty collection as the ``Retry`` option ``allowed_methods`` to retry any verb. (`#5044 `__) Features -------- - Added ``Url.auth_decoded`` and ``Url.auth_decoded_joined`` convenience properties to the result of ``parse_url()``. (`#4945 `__) - Added ``basic_auth_encoding`` and ``proxy_basic_auth_encoding`` parameters to ``urllib3.util.make_headers()``. (`#5092 `__) Bugfixes -------- - Fixed response header handling to replace obsolete folded header lines (`obs-fold`) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as ``Set-Cookie``. (`#1362 `__) - Fixed usage of ``proxy_ssl_context`` with ``ProxyManager`` when ``use_forwarding_for_https=True``. Passing ``ssl_context`` instead of ``proxy_ssl_context`` for HTTPS proxies in this configuration now emits a ``FutureWarning`` and will raise an error in v3.0. (`#2577 `__) - Changed behavior of the default ``ConnectionPool.pool`` initialization. ``LifoQueue`` is now resolved from the ``queue`` module after the ``ConnectionPool`` is instantiated instead of using the default cached ``QueueCls`` class property. This is done because sometimes the ``queue.LifoQueue`` is monkey-patched late in the program, such as by gevent. (`#3289 `__) - Raised ``UnrewindableBodyError`` instead of ``ValueError`` when retrying a request whose body had ``tell()`` but not ``seek( [Changelog truncated as it exceeds 3000 characters; the full changelog can be found in an attachment to the AUH email] --- .../{python3-urllib3_2.7.0.bb => python3-urllib3_2.8.0.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-devtools/python/{python3-urllib3_2.7.0.bb => python3-urllib3_2.8.0.bb} (91%) diff --git a/meta/recipes-devtools/python/python3-urllib3_2.7.0.bb b/meta/recipes-devtools/python/python3-urllib3_2.8.0.bb similarity index 91% rename from meta/recipes-devtools/python/python3-urllib3_2.7.0.bb rename to meta/recipes-devtools/python/python3-urllib3_2.8.0.bb index 9e73a49bca..4aafe2d63d 100644 --- a/meta/recipes-devtools/python/python3-urllib3_2.7.0.bb +++ b/meta/recipes-devtools/python/python3-urllib3_2.8.0.bb @@ -3,7 +3,7 @@ HOMEPAGE = "https://github.com/urllib3/urllib3" LICENSE = "MIT" LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=52d273a3054ced561275d4d15260ecda" -SRC_URI[sha256sum] = "231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c" +SRC_URI[sha256sum] = "63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63" inherit pypi python_hatchling