Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *python3-mako* to *1.4.3* has Succeeded.
Next steps:
- apply the patch: git am 0001-python3-mako-upgrade-1.4.1-1.4.3.patch
- check the changes to upstream patches and summarize them in the commit
message,
- compile an image that contains the package
- perform some basic sanity tests
- amend the patch and sign it off: git commit -s --reset-author --amend
- send it to the appropriate mailing list
Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.
Please review the attached files for further information and build/update
failures.
Any problem please file a bug at
https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler
Regards,
The Upgrade Helper
-- >8 --
>From dc4416fb2e3b89fd294421a5b46d0c3fe24f9c3b Mon Sep 17 00:00:00 2001
From: Upgrade Helper <[email protected]>
Date: Wed, 23 Sep 2026 06:10:25 +0000
Subject: [PATCH] python3-mako: upgrade 1.4.1 -> 1.4.3
.. changelog::
:version: 1.4.3
:released: Tue Sep 22 2026
.. change::
:tags: bug, tests
:tickets: 441
Fixed regression caused in 1.4.2 where tests added to the suite were
unable to run directly on Windows, due to posix mechanics: the tests
force
``os.path`` to ``posixpath``, whereas
:meth:`.TemplateLookup.get_template` converts the configured directory
using ``os.path.sep``. These tests are now skipped on that platform,
where the traversal check is instead exercised against ``ntpath``
natively.
.. changelog::
:version: 1.4.2
:released: Tue Sep 22 2026
.. change::
:tags: bug, tests
:tickets: 440
Adjusted the test suite to accommodate for a change in Pygments 2.21.0
where the ``HtmlFormatter`` now renders ``"`` and ``'`` characters
literally rather than as HTML entities, which caused failures in tests
that assert against the rendered output of
:func:`.html_error_template`.
.. change::
:tags: bug, template
:tickets: 441
Fixed issue in :class:`.TemplateLookup` where a URI beginning with a
drive
designator (e.g. ``C:/../../secret.txt``) could bypass the directory
traversal check on Windows, allowing reads of arbitrary files outside of
the template directory. The check in :class:`.Template` normalized the
URI
using ``os.path``, which on Windows is ``ntpath``; as ``ntpath`` splits
the
drive designator off and treats the remainder as rooted, the ``..``
segments were absorbed before the check could inspect them.
Normalization
is now performed with ``posixpath``, which is the same module used by
:meth:`.TemplateLookup.get_template` to resolve the URI to a file.
---
.../python/{python3-mako_1.4.1.bb => python3-mako_1.4.3.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-devtools/python/{python3-mako_1.4.1.bb =>
python3-mako_1.4.3.bb} (88%)
diff --git a/meta/recipes-devtools/python/python3-mako_1.4.1.bb
b/meta/recipes-devtools/python/python3-mako_1.4.3.bb
similarity index 88%
rename from meta/recipes-devtools/python/python3-mako_1.4.1.bb
rename to meta/recipes-devtools/python/python3-mako_1.4.3.bb
index 367a65271f..41bccec9eb 100644
--- a/meta/recipes-devtools/python/python3-mako_1.4.1.bb
+++ b/meta/recipes-devtools/python/python3-mako_1.4.3.bb
@@ -6,7 +6,7 @@ LIC_FILES_CHKSUM =
"file://LICENSE;md5=c79ceff89df0a72f29bb0e1b6f0e36ed"
inherit pypi python_setuptools_build_meta ptest-python-pytest
-SRC_URI[sha256sum] =
"d7904710b662996425a21627710c4777c45053146942cf8a7aebf757c92b8c27"
+SRC_URI[sha256sum] =
"cd6537fe88d5fec315c55c2f8529bc4ce7a9a352ad7db3eeaa6a66e2dd4ec37a"
CVE_PRODUCT = "makotemplates:mako sqlalchemy:mako"
--
2.47.1
packages/x86-64-v3-poky-linux/python3-mako: PKGV changed from 1.4.1 [default] to 1.4.3 [default] packages/x86-64-v3-poky-linux/python3-mako: SRC_URI changed from "https://files.pythonhosted.org/packages/source/m/mako/mako-1.4.1.tar.gz"; to "https://files.pythonhosted.org/packages/source/m/mako/mako-1.4.3.tar.gz"; packages/x86-64-v3-poky-linux/python3-mako: PV changed from "1.4.1" to "1.4.3" packages/x86-64-v3-poky-linux/python3-mako/python3-mako-dbg: PKGV changed from 1.4.1 [default] to 1.4.3 [default] packages/x86-64-v3-poky-linux/python3-mako/python3-mako-dbg: PV changed from "1.4.1" to "1.4.3" packages/x86-64-v3-poky-linux/python3-mako/python3-mako-dev: PKGV changed from 1.4.1 [default] to 1.4.3 [default] packages/x86-64-v3-poky-linux/python3-mako/python3-mako-dev: PV changed from "1.4.1" to "1.4.3" packages/x86-64-v3-poky-linux/python3-mako/python3-mako-doc: PKGV changed from 1.4.1 [default] to 1.4.3 [default] packages/x86-64-v3-poky-linux/python3-mako/python3-mako-doc: PV changed from "1.4.1" to "1.4.3" packages/x86-64-v3-poky-linux/python3-mako/python3-mako-locale: PKGV changed from 1.4.1 [default] to 1.4.3 [default] packages/x86-64-v3-poky-linux/python3-mako/python3-mako-locale: PV changed from "1.4.1" to "1.4.3" packages/x86-64-v3-poky-linux/python3-mako/python3-mako-ptest: PKGV changed from 1.4.1 [default] to 1.4.3 [default] packages/x86-64-v3-poky-linux/python3-mako/python3-mako-ptest: PKGSIZE changed from 365339 to 367652 (+1%) packages/x86-64-v3-poky-linux/python3-mako/python3-mako-ptest: PV changed from "1.4.1" to "1.4.3" packages/x86-64-v3-poky-linux/python3-mako/python3-mako-src: PKGV changed from 1.4.1 [default] to 1.4.3 [default] packages/x86-64-v3-poky-linux/python3-mako/python3-mako-src: PV changed from "1.4.1" to "1.4.3" packages/x86-64-v3-poky-linux/python3-mako/python3-mako-staticdev: PKGV changed from 1.4.1 [default] to 1.4.3 [default] packages/x86-64-v3-poky-linux/python3-mako/python3-mako-staticdev: PV changed from "1.4.1" to "1.4.3" packages/x86-64-v3-poky-linux/python3-mako/python3-mako: FILELIST: directory renamed /usr/lib/python3.14/site-packages/mako-1.4.1.dist-info -> /usr/lib/python3.14/site-packages/mako-1.4.3.dist-info, directory renamed /usr/lib/python3.14/site-packages/mako-1.4.1.dist-info/licenses -> /usr/lib/python3.14/site-packages/mako-1.4.3.dist-info/licenses packages/x86-64-v3-poky-linux/python3-mako/python3-mako: PKGV changed from 1.4.1 [default] to 1.4.3 [default] packages/x86-64-v3-poky-linux/python3-mako/python3-mako: PKGSIZE changed from 652895 to 653267 (+0%) packages/x86-64-v3-poky-linux/python3-mako/python3-mako: PV changed from "1.4.1" to "1.4.3" Changes to packages/x86-64-v3-poky-linux/python3-mako (sysroot): /usr/lib/python3.14/site-packages/mako-1.4.1.dist-info moved to /usr/lib/python3.14/site-packages/mako-1.4.3.dist-info
.. changelog::
:version: 1.4.3
:released: Tue Sep 22 2026
.. change::
:tags: bug, tests
:tickets: 441
Fixed regression caused in 1.4.2 where tests added to the suite were
unable to run directly on Windows, due to posix mechanics: the tests
force
``os.path`` to ``posixpath``, whereas
:meth:`.TemplateLookup.get_template` converts the configured directory
using ``os.path.sep``. These tests are now skipped on that platform,
where the traversal check is instead exercised against ``ntpath``
natively.
.. changelog::
:version: 1.4.2
:released: Tue Sep 22 2026
.. change::
:tags: bug, tests
:tickets: 440
Adjusted the test suite to accommodate for a change in Pygments 2.21.0
where the ``HtmlFormatter`` now renders ``"`` and ``'`` characters
literally rather than as HTML entities, which caused failures in tests
that assert against the rendered output of
:func:`.html_error_template`.
.. change::
:tags: bug, template
:tickets: 441
Fixed issue in :class:`.TemplateLookup` where a URI beginning with a
drive
designator (e.g. ``C:/../../secret.txt``) could bypass the directory
traversal check on Windows, allowing reads of arbitrary files outside of
the template directory. The check in :class:`.Template` normalized the
URI
using ``os.path``, which on Windows is ``ntpath``; as ``ntpath`` splits
the
drive designator off and treats the remainder as rooted, the ``..``
segments were absorbed before the check could inspect them.
Normalization
is now performed with ``posixpath``, which is the same module used by
:meth:`.TemplateLookup.get_template` to resolve the URI to a file.
packages/x86-64-v3-poky-linux/python3-mako/python3-mako: FILELIST: directory renamed /usr/lib/python3.14/site-packages/mako-1.4.1.dist-info -> /usr/lib/python3.14/site-packages/mako-1.4.3.dist-info, directory renamed /usr/lib/python3.14/site-packages/mako-1.4.1.dist-info/licenses -> /usr/lib/python3.14/site-packages/mako-1.4.3.dist-info/licenses Changes to packages/x86-64-v3-poky-linux/python3-mako (sysroot): /usr/lib/python3.14/site-packages/mako-1.4.1.dist-info moved to /usr/lib/python3.14/site-packages/mako-1.4.3.dist-info
0001-python3-mako-upgrade-1.4.1-1.4.3.patch
Description: Binary data
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#246447): https://lists.openembedded.org/g/openembedded-core/message/246447 Mute This Topic: https://lists.openembedded.org/mt/121388741/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
