Re: [patch] python3: upgrade 3.14.7 -> 3.14.8

["Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" <dkelaiya@cisco.com>]

[-- Attachment #1: Type: text/plain, Size: 2804 bytes --]

Hello Vijay, Ross,

I reviewed the 3.14.8 upgrade. The downloaded source tarball’s SHA-256 matches the recipe, and the retained source patches apply without fuzz.

Following Ross’s upstream report [1], I inspected libedit’s history append path. append_history() opens the file with fopen(filename, "a"), and history_save_fp() writes the _HiStOrY_V2_ header whenever ftell() returns zero.

If the append stream initially reports offset zero on musl, this would cause another header to be appended to an existing history file. That is consistent with the reported result where the header appears as a history entry after truncation.

This suggests a history handling issue that needs investigation before deciding whether a test skip is appropriate. Could you check whether explicitly positioning the append stream at EOF before saving resolves the failure, and share the result in the upstream issue?

This analysis is based on source inspection. I have not independently reproduced the musl failure.

[1] https://github.com/python/cpython/issues/159424

Thanks,
Darsh

On Thu, Oct 8, 2026 at 02:31 PM, Vijay Anusuri wrote:

> 
> Release information:
> * https://www.python.org/downloads/release/python-3148/
> * Python 3.14.8 is an expedited security release and the eighth
> maintenance release of 3.14, containing around 354 bugfixes, build
> improvements and documentation changes from 142 contributors since 3.14.7.
> 
> 
> Handles CVE-2026-19445 CVE-2026-19553 CVE-2026-19672 CVE-2026-15310
> CVE-2026-15806 CVE-2026-17084
> 
> Changelog: https://docs.python.org/3/whatsnew/changelog.html#python-3-14-8-final
> 
> 
> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> ---
> .../python/{python3_3.14.7.bb => python3_3.14.8.bb} | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> rename meta/recipes-devtools/python/{python3_3.14.7.bb =>
> python3_3.14.8.bb} (99%)
> 
> diff --git a/meta/recipes-devtools/python/python3_3.14.7.bb
> b/meta/recipes-devtools/python/python3_3.14.8.bb
> similarity index 99%
> rename from meta/recipes-devtools/python/python3_3.14.7.bb
> rename to meta/recipes-devtools/python/python3_3.14.8.bb
> index f917edebd8..4663ee85cd 100644
> --- a/meta/recipes-devtools/python/python3_3.14.7.bb
> +++ b/meta/recipes-devtools/python/python3_3.14.8.bb
> @@ -30,7 +30,7 @@ SRC_URI:append:class-native = " \
> file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \
> "
> 
> -SRC_URI[sha256sum] =
> "3b48dac8fb59f62eaa67ac83c1eb12bda1b7a08406dd286e252c11a66be27f81"
> +SRC_URI[sha256sum] =
> "c2215904f02b175596dc49351585104f4bc20341e1c47378b26a2c274360ce73"
> 
> # exclude pre-releases for both python 2.x and 3.x
> UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar"
> --
> 2.43.0

[-- Attachment #2: Type: text/html, Size: 3338 bytes --]