From patchwork Wed Sep 23 06:27:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 98940 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6712EC98308 for ; Wed, 23 Sep 2026 06:27:59 +0000 (UTC) Received: from a27-33.smtp-out.us-west-2.amazonses.com (a27-33.smtp-out.us-west-2.amazonses.com [54.240.27.33]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.1228.1790144870247368461 for ; Tue, 22 Sep 2026 23:27:50 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=AQWGl07Z; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=wYmqgLmQ; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.33, mailfrom: 010101a0ccf2f470-476c8261-1960-4a04-ada5-35160e4199b8-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1790144869; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date; bh=rcRN7Ul2H5PyDWmmoX9XbZQg5FFOxpFTacSiTBxF674=; b=AQWGl07Z92cPpBd20hVMD/M1zUuvnPWPtDH9CHWD8zpf24laPp0U3yHiQRQcJYkF ByoVnG7E4daHXQt4ejsgROYeHnbvApxeo7sMuLs37m9nj6iiTcc63igCZi4Nn6mxgWB 21e2FewaY7ZSR53xISoPJvx6pPwef+LfJLbD1Yj4= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1790144869; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date:Feedback-ID; bh=rcRN7Ul2H5PyDWmmoX9XbZQg5FFOxpFTacSiTBxF674=; b=wYmqgLmQzCpL1CVkkYWc6YorOCaeqbGVKadv+D1NOnCXJ7/5pFeNFMt+P5oY1bTi lf4+UqpsPUsLQnE4OLEqs3rr3eBa7kjT6ZLOSdWknoLPtAIzGedu1R/F2Q06veShmQZ YZQQTZj5cKvV/KfurRnAjkADUGQ7dngoOwu2jeWs= MIME-Version: 1.0 From: auh@yoctoproject.org To: Trevor Gamblin Cc: openembedded-core@lists.openembedded.org Subject: [AUH] python3-mako: upgrading to 1.4.3 SUCCEEDED Message-ID: <010101a0ccf2f470-476c8261-1960-4a04-ada5-35160e4199b8-000000@us-west-2.amazonses.com> Date: Wed, 23 Sep 2026 06:27:49 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.09.23-54.240.27.33 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 23 Sep 2026 06:27:59 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246447 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *python3-mako* to *1.4.3* has Succeeded. Next steps: - apply the patch: git am 0001-python3-mako-upgrade-1.4.1-1.4.3.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From dc4416fb2e3b89fd294421a5b46d0c3fe24f9c3b Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Wed, 23 Sep 2026 06:10:25 +0000 Subject: [PATCH] python3-mako: upgrade 1.4.1 -> 1.4.3 .. changelog:: :version: 1.4.3 :released: Tue Sep 22 2026 .. change:: :tags: bug, tests :tickets: 441 Fixed regression caused in 1.4.2 where tests added to the suite were unable to run directly on Windows, due to posix mechanics: the tests force ``os.path`` to ``posixpath``, whereas :meth:`.TemplateLookup.get_template` converts the configured directory using ``os.path.sep``. These tests are now skipped on that platform, where the traversal check is instead exercised against ``ntpath`` natively. .. changelog:: :version: 1.4.2 :released: Tue Sep 22 2026 .. change:: :tags: bug, tests :tickets: 440 Adjusted the test suite to accommodate for a change in Pygments 2.21.0 where the ``HtmlFormatter`` now renders ``"`` and ``'`` characters literally rather than as HTML entities, which caused failures in tests that assert against the rendered output of :func:`.html_error_template`. .. change:: :tags: bug, template :tickets: 441 Fixed issue in :class:`.TemplateLookup` where a URI beginning with a drive designator (e.g. ``C:/../../secret.txt``) could bypass the directory traversal check on Windows, allowing reads of arbitrary files outside of the template directory. The check in :class:`.Template` normalized the URI using ``os.path``, which on Windows is ``ntpath``; as ``ntpath`` splits the drive designator off and treats the remainder as rooted, the ``..`` segments were absorbed before the check could inspect them. Normalization is now performed with ``posixpath``, which is the same module used by :meth:`.TemplateLookup.get_template` to resolve the URI to a file. --- .../python/{python3-mako_1.4.1.bb => python3-mako_1.4.3.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-devtools/python/{python3-mako_1.4.1.bb => python3-mako_1.4.3.bb} (88%) diff --git a/meta/recipes-devtools/python/python3-mako_1.4.1.bb b/meta/recipes-devtools/python/python3-mako_1.4.3.bb similarity index 88% rename from meta/recipes-devtools/python/python3-mako_1.4.1.bb rename to meta/recipes-devtools/python/python3-mako_1.4.3.bb index 367a65271f..41bccec9eb 100644 --- a/meta/recipes-devtools/python/python3-mako_1.4.1.bb +++ b/meta/recipes-devtools/python/python3-mako_1.4.3.bb @@ -6,7 +6,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=c79ceff89df0a72f29bb0e1b6f0e36ed" inherit pypi python_setuptools_build_meta ptest-python-pytest -SRC_URI[sha256sum] = "d7904710b662996425a21627710c4777c45053146942cf8a7aebf757c92b8c27" +SRC_URI[sha256sum] = "cd6537fe88d5fec315c55c2f8529bc4ce7a9a352ad7db3eeaa6a66e2dd4ec37a" CVE_PRODUCT = "makotemplates:mako sqlalchemy:mako"