[OE-core][patch] python3: upgrade 3.14.7 -> 3.14.8

[OE-core][patch] python3: upgrade 3.14.7 -> 3.14.8

[Vijay Anusuri]

Release information:
* https://www.python.org/downloads/release/python-3148/
* Python 3.14.8 is an expedited security release and the eighth maintenance release of 3.14, containing around 354 bugfixes, build improvements and documentation changes from 142 contributors since 3.14.7.

Handles CVE-2026-19445 CVE-2026-19553 CVE-2026-19672 CVE-2026-15310
CVE-2026-15806 CVE-2026-17084

Changelog: https://docs.python.org/3/whatsnew/changelog.html#python-3-14-8-final

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
 .../python/{python3_3.14.7.bb => python3_3.14.8.bb}             | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.8.bb} (99%)

diff --git a/meta/recipes-devtools/python/python3_3.14.7.bb b/meta/recipes-devtools/python/python3_3.14.8.bb
similarity index 99%
rename from meta/recipes-devtools/python/python3_3.14.7.bb
rename to meta/recipes-devtools/python/python3_3.14.8.bb
index f917edebd8..4663ee85cd 100644
--- a/meta/recipes-devtools/python/python3_3.14.7.bb
+++ b/meta/recipes-devtools/python/python3_3.14.8.bb
@@ -30,7 +30,7 @@ SRC_URI:append:class-native = " \
            file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \
            "
 
-SRC_URI[sha256sum] = "3b48dac8fb59f62eaa67ac83c1eb12bda1b7a08406dd286e252c11a66be27f81"
+SRC_URI[sha256sum] = "c2215904f02b175596dc49351585104f4bc20341e1c47378b26a2c274360ce73"
 
 # exclude pre-releases for both python 2.x and 3.x
 UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar"
-- 
2.43.0

Re: [OE-core][patch] python3: upgrade 3.14.7 -> 3.14.8

[Mathieu Dubois-Briand]

On Thu Oct 8, 2026 at 11:01 AM CEST, Vijay Anusuri via lists.openembedded.org wrote:
> Release information:
> * https://www.python.org/downloads/release/python-3148/
> * Python 3.14.8 is an expedited security release and the eighth maintenance release of 3.14, containing around 354 bugfixes, build improvements and documentation changes from 142 contributors since 3.14.7.
>
> Handles CVE-2026-19445 CVE-2026-19553 CVE-2026-19672 CVE-2026-15310
> CVE-2026-15806 CVE-2026-17084
>
> Changelog: https://docs.python.org/3/whatsnew/changelog.html#python-3-14-8-final
>
> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> ---

Hi Vijay,

Thanks for this upgrade, but we have failing ptests when building with
musl:

WARNING: core-image-ptest-python3-1.0-r0 do_testimage: There were failing ptests.
Traceback (most recent call last):
  File "/srv/pokybuild/yocto-worker/qemux86-64-musl-ptest/build/layers/openembedded-core/meta/lib/oeqa/core/decorator/__init__.py", line 35, in wrapped_f
    return func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^
  File "/srv/pokybuild/yocto-worker/qemux86-64-musl-ptest/build/layers/openembedded-core/meta/lib/oeqa/core/decorator/__init__.py", line 35, in wrapped_f
    return func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^
  File "/srv/pokybuild/yocto-worker/qemux86-64-musl-ptest/build/layers/openembedded-core/meta/lib/oeqa/core/decorator/__init__.py", line 35, in wrapped_f
    return func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^
  File "/srv/pokybuild/yocto-worker/qemux86-64-musl-ptest/build/layers/openembedded-core/meta/lib/oeqa/runtime/cases/ptest.py", line 27, in test_ptestrunner_expectfail
    self.do_ptestrunner()
  File "/srv/pokybuild/yocto-worker/qemux86-64-musl-ptest/build/layers/openembedded-core/meta/lib/oeqa/runtime/cases/ptest.py", line 121, in do_ptestrunner
    self.fail(failmsg)
AssertionError:
Failed ptests:
{'python3': ['test_append_limited_history', 'python3']}

https://autobuilder.yoctoproject.org/valkyrie/#/builders/109/builds/1353
https://autobuilder.yoctoproject.org/valkyrie/#/builders/110/builds/1341

This was recently discussed here:
https://lore.kernel.org/openembedded-core/DLUD1OK99YO3.1QPQV67EMZI06@bootlin.com/

Are you willing to investigate this further? We need to understand if
the test is failing because an issue in python code or because of a
dependency we are using in oe-core.

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [OE-core][patch] python3: upgrade 3.14.7 -> 3.14.8

[Ross Burton]

On 9 Oct 2026, at 10:17, Mathieu Dubois-Briand via lists.openembedded.org <mathieu.dubois-briand=bootlin.com@lists.openembedded.org> wrote:
> 
> On Thu Oct 8, 2026 at 11:01 AM CEST, Vijay Anusuri via lists.openembedded.org wrote:
>> Release information:
>> * https://www.python.org/downloads/release/python-3148/
>> * Python 3.14.8 is an expedited security release and the eighth maintenance release of 3.14, containing around 354 bugfixes, build improvements and documentation changes from 142 contributors since 3.14.7.
>> 
>> Handles CVE-2026-19445 CVE-2026-19553 CVE-2026-19672 CVE-2026-15310
>> CVE-2026-15806 CVE-2026-17084
>> 
>> Changelog: https://docs.python.org/3/whatsnew/changelog.html#python-3-14-8-final
>> 
>> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
>> ---
> 
> Hi Vijay,
> 
> Thanks for this upgrade, but we have failing ptests when building with
> musl:
> 
> WARNING: core-image-ptest-python3-1.0-r0 do_testimage: There were failing ptests.
> Traceback (most recent call last):
>  File "/srv/pokybuild/yocto-worker/qemux86-64-musl-ptest/build/layers/openembedded-core/meta/lib/oeqa/core/decorator/__init__.py", line 35, in wrapped_f
>    return func(*args, **kwargs)
>           ^^^^^^^^^^^^^^^^^^^^^
>  File "/srv/pokybuild/yocto-worker/qemux86-64-musl-ptest/build/layers/openembedded-core/meta/lib/oeqa/core/decorator/__init__.py", line 35, in wrapped_f
>    return func(*args, **kwargs)
>           ^^^^^^^^^^^^^^^^^^^^^
>  File "/srv/pokybuild/yocto-worker/qemux86-64-musl-ptest/build/layers/openembedded-core/meta/lib/oeqa/core/decorator/__init__.py", line 35, in wrapped_f
>    return func(*args, **kwargs)
>           ^^^^^^^^^^^^^^^^^^^^^
>  File "/srv/pokybuild/yocto-worker/qemux86-64-musl-ptest/build/layers/openembedded-core/meta/lib/oeqa/runtime/cases/ptest.py", line 27, in test_ptestrunner_expectfail
>    self.do_ptestrunner()
>  File "/srv/pokybuild/yocto-worker/qemux86-64-musl-ptest/build/layers/openembedded-core/meta/lib/oeqa/runtime/cases/ptest.py", line 121, in do_ptestrunner
>    self.fail(failmsg)
> AssertionError:
> Failed ptests:
> {'python3': ['test_append_limited_history', 'python3']}
> 
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/109/builds/1353
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/110/builds/1341
> 
> This was recently discussed here:
> https://lore.kernel.org/openembedded-core/DLUD1OK99YO3.1QPQV67EMZI06@bootlin.com/
> 
> Are you willing to investigate this further? We need to understand if
> the test is failing because an issue in python code or because of a
> dependency we are using in oe-core.

This is probably related to some libedit fixes that merged upstream, in an attempt to fix tests that were failing when libedit was being used:

https://github.com/python/cpython/commit/e87da800b6103fd890841688da48e41e211be7b9

Ross

Re: [OE-core][patch] python3: upgrade 3.14.7 -> 3.14.8

[Ross Burton]

On 14 Oct 2026, at 16:03, Ross Burton via lists.openembedded.org <ross.burton=arm.com@lists.openembedded.org> wrote:
>> Are you willing to investigate this further? We need to understand if
>> the test is failing because an issue in python code or because of a
>> dependency we are using in oe-core.
> 
> This is probably related to some libedit fixes that merged upstream, in an attempt to fix tests that were failing when libedit was being used:
> 
> https://github.com/python/cpython/commit/e87da800b6103fd890841688da48e41e211be7b9

I replicated and filed https://github.com/python/cpython/issues/159424 upstream.

Ross

Re: [OE-core][patch] python3: upgrade 3.14.7 -> 3.14.8

[Vijay Anusuri]

[-- Attachment #1: Type: text/plain, Size: 1062 bytes --]

Hi Ross,

Thanks for investigating this and filing the upstream issue.

I was also able to reproduce this issue with Python 3.14.8 on our musl
build.

Since the issue has been reported upstream, can we temporarily skip
test_append_limited_history until a fix is available?

Thanks & Regards,

Vijay


On Wed, Oct 14, 2026 at 10:48 PM Ross Burton <Ross.Burton@arm.com> wrote:

> On 14 Oct 2026, at 16:03, Ross Burton via lists.openembedded.org
> <ross.burton=arm.com@lists.openembedded.org> wrote:
> >> Are you willing to investigate this further? We need to understand if
> >> the test is failing because an issue in python code or because of a
> >> dependency we are using in oe-core.
> >
> > This is probably related to some libedit fixes that merged upstream, in
> an attempt to fix tests that were failing when libedit was being used:
> >
> >
> https://github.com/python/cpython/commit/e87da800b6103fd890841688da48e41e211be7b9
>
> I replicated and filed https://github.com/python/cpython/issues/159424
> upstream.
>
> Ross

[-- Attachment #2: Type: text/html, Size: 1951 bytes --]

Re: [OE-core][patch] python3: upgrade 3.14.7 -> 3.14.8

[Ross Burton]

On 15 Oct 2026, at 05:42, Vijay Anusuri <vanusuri@mvista.com> wrote:
> 
> Hi Ross, 
> Thanks for investigating this and filing the upstream issue.
> 
> I was also able to reproduce this issue with Python 3.14.8 on our musl build.
> Since the issue has been reported upstream, can we temporarily skip test_append_limited_history until a fix is available?

Only if we confirm that the test case is broken, and not the code in python.  The point of the tests is to verify that Python works: if we disable failing tests, what’s the point?

Ross

Re: [patch] python3: upgrade 3.14.7 -> 3.14.8

[Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)]

[-- Attachment #1: Type: text/plain, Size: 2804 bytes --]

Hello Vijay, Ross,

I reviewed the 3.14.8 upgrade. The downloaded source tarball’s SHA-256 matches the recipe, and the retained source patches apply without fuzz.

Following Ross’s upstream report [1], I inspected libedit’s history append path. append_history() opens the file with fopen(filename, "a"), and history_save_fp() writes the _HiStOrY_V2_ header whenever ftell() returns zero.

If the append stream initially reports offset zero on musl, this would cause another header to be appended to an existing history file. That is consistent with the reported result where the header appears as a history entry after truncation.

This suggests a history handling issue that needs investigation before deciding whether a test skip is appropriate. Could you check whether explicitly positioning the append stream at EOF before saving resolves the failure, and share the result in the upstream issue?

This analysis is based on source inspection. I have not independently reproduced the musl failure.

[1] https://github.com/python/cpython/issues/159424

Thanks,
Darsh

On Thu, Oct 8, 2026 at 02:31 PM, Vijay Anusuri wrote:

> 
> Release information:
> * https://www.python.org/downloads/release/python-3148/
> * Python 3.14.8 is an expedited security release and the eighth
> maintenance release of 3.14, containing around 354 bugfixes, build
> improvements and documentation changes from 142 contributors since 3.14.7.
> 
> 
> Handles CVE-2026-19445 CVE-2026-19553 CVE-2026-19672 CVE-2026-15310
> CVE-2026-15806 CVE-2026-17084
> 
> Changelog: https://docs.python.org/3/whatsnew/changelog.html#python-3-14-8-final
> 
> 
> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> ---
> .../python/{python3_3.14.7.bb => python3_3.14.8.bb} | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> rename meta/recipes-devtools/python/{python3_3.14.7.bb =>
> python3_3.14.8.bb} (99%)
> 
> diff --git a/meta/recipes-devtools/python/python3_3.14.7.bb
> b/meta/recipes-devtools/python/python3_3.14.8.bb
> similarity index 99%
> rename from meta/recipes-devtools/python/python3_3.14.7.bb
> rename to meta/recipes-devtools/python/python3_3.14.8.bb
> index f917edebd8..4663ee85cd 100644
> --- a/meta/recipes-devtools/python/python3_3.14.7.bb
> +++ b/meta/recipes-devtools/python/python3_3.14.8.bb
> @@ -30,7 +30,7 @@ SRC_URI:append:class-native = " \
> file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \
> "
> 
> -SRC_URI[sha256sum] =
> "3b48dac8fb59f62eaa67ac83c1eb12bda1b7a08406dd286e252c11a66be27f81"
> +SRC_URI[sha256sum] =
> "c2215904f02b175596dc49351585104f4bc20341e1c47378b26a2c274360ce73"
> 
> # exclude pre-releases for both python 2.x and 3.x
> UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar"
> --
> 2.43.0

[-- Attachment #2: Type: text/html, Size: 3338 bytes --]

Re: [OE-core] [patch] python3: upgrade 3.14.7 -> 3.14.8

[Khem Raj]

[-- Attachment #1: Type: text/plain, Size: 3672 bytes --]

On Tue, Oct 20, 2026 at 5:05 AM Darsh Kelaiya -X (dkelaiya - E INFOCHIPS
PRIVATE LIMITED at Cisco) via lists.openembedded.org <dkelaiya=
cisco.com@lists.openembedded.org> wrote:

> Hello Vijay, Ross,
>
> I reviewed the 3.14.8 upgrade. The downloaded source tarball’s SHA-256
> matches the recipe, and the retained source patches apply without fuzz.
>
> Following Ross’s upstream report [1], I inspected libedit’s history append
> path. append_history() opens the file with fopen(filename, "a"), and
> history_save_fp() writes the _HiStOrY_V2_ header whenever ftell() returns
> zero.
>
> If the append stream initially reports offset zero on musl, this would
> cause another header to be appended to an existing history file. That is
> consistent with the reported result where the header appears as a history
> entry after truncation.
>
> This suggests a history handling issue that needs investigation before
> deciding whether a test skip is appropriate. Could you check whether
> explicitly positioning the append stream at EOF before saving resolves the
> failure, and share the result in the upstream issue?
>
> This analysis is based on source inspection. I have not independently
> reproduced the musl failure.
>
> [1] https://github.com/python/cpython/issues/159424
>

I wonder why you did not look into the fix

https://github.com/python/cpython/pull/157165

which is also posted in the above
bug report. Does this fix the issue ?


>
>
> Thanks,
> Darsh
>
> On Thu, Oct 8, 2026 at 02:31 PM, Vijay Anusuri wrote:
>
> Release information:
> * https://www.python.org/downloads/release/python-3148/
> * Python 3.14.8 is an expedited security release and the eighth
> maintenance release of 3.14, containing around 354 bugfixes, build
> improvements and documentation changes from 142 contributors since 3.14.7.
>
> Handles CVE-2026-19445 CVE-2026-19553 CVE-2026-19672 CVE-2026-15310
> CVE-2026-15806 CVE-2026-17084
>
> Changelog:
> https://docs.python.org/3/whatsnew/changelog.html#python-3-14-8-final
>
> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> ---
> .../python/{python3_3.14.7.bb => python3_3.14.8.bb} | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> rename meta/recipes-devtools/python/{python3_3.14.7.bb =>
> python3_3.14.8.bb} (99%)
>
> diff --git a/meta/recipes-devtools/python/python3_3.14.7.bb
> b/meta/recipes-devtools/python/python3_3.14.8.bb
> similarity index 99%
> rename from meta/recipes-devtools/python/python3_3.14.7.bb
> rename to meta/recipes-devtools/python/python3_3.14.8.bb
> index f917edebd8..4663ee85cd 100644
> --- a/meta/recipes-devtools/python/python3_3.14.7.bb
> +++ b/meta/recipes-devtools/python/python3_3.14.8.bb
> @@ -30,7 +30,7 @@ SRC_URI:append:class-native = " \
> file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \
> "
>
> -SRC_URI[sha256sum] =
> "3b48dac8fb59f62eaa67ac83c1eb12bda1b7a08406dd286e252c11a66be27f81"
> +SRC_URI[sha256sum] =
> "c2215904f02b175596dc49351585104f4bc20341e1c47378b26a2c274360ce73"
>
> # exclude pre-releases for both python 2.x and 3.x
> UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar"
> --
> 2.43.0
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#248274):
> https://lists.openembedded.org/g/openembedded-core/message/248274
> Mute This Topic: https://lists.openembedded.org/mt/121652032/1997914
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> raj.khem@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>

[-- Attachment #2: Type: text/html, Size: 5840 bytes --]