From patchwork Tue Nov 3 06:26:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 102712 Received: from a27-29.smtp-out.us-west-2.amazonses.com (a27-29.smtp-out.us-west-2.amazonses.com [54.240.27.29]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5402.1793687202710816515 for ; Mon, 02 Nov 2026 22:26:42 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=oyUXzEzr; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=QFngmFwD; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.29, mailfrom: 010101a1a016a818-76921a76-ae43-48ee-90b7-05de64a0d53b-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1793687202; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date; bh=Lomml4YfDWeCia7/9bulDyG9UFWL3KZ0knmE1Syykys=; b=oyUXzEzrc2n1SJBh/clh0901gtFjy/Z+G+HPEFhQ5PElhCVEb2HtkGe21Ylkia7v MryQ/G8WVr0mrXA5UyCD0Rk8kDtjzVAUqda2iJKy919EHbC4zqtU2SCjC0RtfR3yCW/ KsXHCK3ir4i1+ix3m+OlXKMccLRsLARpX8D72DgA= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1793687202; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date:Feedback-ID; bh=Lomml4YfDWeCia7/9bulDyG9UFWL3KZ0knmE1Syykys=; b=QFngmFwDTwNqfm47l0BMuUPknwSQXGjIj4LxLiDEhIBXozUVWTYtsRhNWBFN+W2I diqz31mqUln9vFOHUr5Utrr6GP22gbRe/giXczMpGnMvaMzkthQi/XQ8RsZczKp60XB MtW/zU2jjTBNTHOMpxQej3eDQZ3uOxAjeN0oAgaE= MIME-Version: 1.0 From: auh@yoctoproject.org To: Trevor Gamblin Cc: openembedded-core@lists.openembedded.org Subject: [AUH] python3-pip: upgrading to 26.3 SUCCEEDED Message-ID: <010101a1a016a818-76921a76-ae43-48ee-90b7-05de64a0d53b-000000@us-west-2.amazonses.com> Date: Tue, 3 Nov 2026 06:26:41 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.11.03-54.240.27.29 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 03 Nov 2026 06:26:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249236 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *python3-pip* to *26.3* has Succeeded. Next steps: - apply the patch: git am 0001-python3-pip-upgrade-26.2.2-26.3.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From f26f61fcb4346bdc4ab9ac369d298ad745812e71 Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Tue, 3 Nov 2026 05:46:57 +0000 Subject: [PATCH] python3-pip: upgrade 26.2.2 -> 26.3 26.3 (2026-11-02) ================= Improved Documentation ---------------------- - Clarify in the security policy that pip has never considered installing untrusted wheels safe. This is because Python's import system is dynamic, so pip cannot guarantee that installing a wheel will not execute third-party code. (`#14412 < >`_) Deprecations and Removals ------------------------- - Block unexpected imports during installation, warn about unsafe imports afterward, and improve recovery from interrupted installations. (`#13842 < >`_) Features -------- - Show build backend warnings for local source directories and log them at debug level for other sources. (`#14372 < >`_) - Add support for selecting extras in pylock.toml files with ``-r pylock.toml[extra1,extra2]``. (`#14205 < >`_) - Allow ``--group`` to select non-default groups from local pylock files, e.g. ``--group pylock.toml:docs``. (`#14390 < >`_) - Support ``--no-binary`` with ``-r pylock.toml``. Before, pip would get the sdist from the index instead of the locked URL, or fail if no wheel were available in the lock file. (`#14187 < >`_) - Speed up installing a wheel with console scripts by not resolving every ``PATH`` entry. (`#14235 < >`_) - Clarify the warning for ``~``-prefixed leftover distribution directories. (`#11849 < >`_) Bug Fixes --------- - Report build-backend import failures as pip errors instead of displaying an uncaught traceback. (`#12248 < >`_) - No longer log the "pip is looking at multiple versions of a package" message until pip has looked at at least two versions of that package. (`#12928 < >`_) - Fix ``pip``'s self version check reporting an outdated version from the environment instead of the running pip when run as a zipapp. (`#13084 < >`_) - Fix a fatal error when using the ``PIP_CONFIG_FILE`` environment variable with ``pip config set``. (`#13279 < >`_) - Avoid misleading error messages that include extra markers such as ``; extra == "..."`` when installing packages. (`#13618 < >`_) - When installing to a custom ``--prefix``, use the ``posix_prefix`` scheme when running from a Debian patched Python distribution to avoid a superfluous ``/local/`` subdirectory. (`#13634 < >`_) - Refuse to follow an HTTP redirect to a ``file:`` URL. (`#14171 < >`_) - Prevent wheel cache origin mismatch warnings from exposing URL credentials. (`#14232 < >`_) - Report the incomplete-download error on Windows, not a ``PermissionError``. (`#14237 < >`_) - Fix the global configuration location on macOS in virtual environments created from Homebrew Python. (`#14303 < >`_) - Reject extra arguments to ``pip config edit`` instead of silently ignoring them. (`#14347 < >`_) - Honor supplied hashes when using ``--no-require-hashes``. (`#14355 < >`_) - Fix wheel installation with data files when the installation prefix is a filesystem root. (`#14358 < >`_) - Restore support for UTF-8 configuration files when Python's UTF-8 mode is enabled. (`#14367 < >`_) - Restore vendored Requests' PyOpenSSL fallback on non-Windows systems without importing PyOpenSSL on Windows. (`#14402 < >`_) - Respect configured network settings while checking build constraint files. (`#14403 < >`_) - Apply PyPI's direct URL dependency restriction to extras and cached wheels. (`#14341 < >`_) - Fix a crash when installing or uninstalling a distribution with an invalid entry point. (`#8573 < >`_) - Fail with a clearer error message on invalid configuration values. (`#8671 < >`_) - Keep ``--version`` available only for pip and prevent its use in subcommands. (`#9456 < >`_) Vendored Libraries ------------------ - Upgrade certifi to 2026.10.23 - Upgrade distlib to 0.4.4 - Upgrade idna to 3.20 - Upgrade msgpack to 1.2.4 - Upgrade packaging to 26.3 - Upgrade platformdirs to 4.12.4 - Upgrade pygments to 2.21.0 - Upgrade pyproject-hooks to 1.3.3 - Upgrade rich to 15.0.0 - Downgrade tomli to 2.3.2 to retain TOML 1.0 parsing on Python 3.10. - Upgrade truststore to 0.10.5 - Upgrade urllib3 to 2.8.0 Process ------- - Allow pip itself to be built with flit-core 4. --- .../python/python3-pip/no_shebang_mangling.patch | 6 +++--- .../python/{python3-pip_26.2.2.bb => python3-pip_26.3.bb} | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) rename meta/recipes-devtools/python/{python3-pip_26.2.2.bb => python3-pip_26.3.bb} (97%) diff --git a/meta/recipes-devtools/python/python3-pip/no_shebang_mangling.patch b/meta/recipes-devtools/python/python3-pip/no_shebang_mangling.patch index f388928230..998d8a73cf 100644 --- a/meta/recipes-devtools/python/python3-pip/no_shebang_mangling.patch +++ b/meta/recipes-devtools/python/python3-pip/no_shebang_mangling.patch @@ -1,4 +1,4 @@ -From ea75b7fc017f7a1a3a47e9e2bef21209f0f36a04 Mon Sep 17 00:00:00 2001 +From 717c440db8787fda9fb2abf207fe894e291ce0f0 Mon Sep 17 00:00:00 2001 From: Richard Purdie Date: Wed, 23 Feb 2022 12:27:06 +0000 Subject: [PATCH] python3-pip: Don't change shebang @@ -13,7 +13,7 @@ Upstream-Status: Inappropriate [OE specific config] 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/pip/_vendor/distlib/scripts.py b/src/pip/_vendor/distlib/scripts.py -index ac9e909..1faa5b6 100644 +index 0338012..64b00a2 100644 --- a/src/pip/_vendor/distlib/scripts.py +++ b/src/pip/_vendor/distlib/scripts.py @@ -157,6 +157,8 @@ class ScriptMaker(object): @@ -25,7 +25,7 @@ index ac9e909..1faa5b6 100644 if os.name != 'posix': simple_shebang = True elif getattr(sys, "cross_compiling", False): -@@ -367,7 +369,7 @@ class ScriptMaker(object): +@@ -373,7 +375,7 @@ class ScriptMaker(object): return match = FIRST_LINE_RE.match(first_line.replace(b'\r\n', b'\n')) diff --git a/meta/recipes-devtools/python/python3-pip_26.2.2.bb b/meta/recipes-devtools/python/python3-pip_26.3.bb similarity index 97% rename from meta/recipes-devtools/python/python3-pip_26.2.2.bb rename to meta/recipes-devtools/python/python3-pip_26.3.bb index c83c9e4468..a6ce6a1fbc 100644 --- a/meta/recipes-devtools/python/python3-pip_26.2.2.bb +++ b/meta/recipes-devtools/python/python3-pip_26.3.bb @@ -26,7 +26,7 @@ inherit pypi python_flit_core SRC_URI += "file://no_shebang_mangling.patch" -SRC_URI[sha256sum] = "3a8e5c800492787f33a4114ef54444546c340df428974ebba17e0fd47e11af2f" +SRC_URI[sha256sum] = "6c36ae7da8695be67e3cd9f7d87919667ced53f57ce2ede75d89b5912ed2bc4c" CVE_PRODUCT = "pypa:pip"