Re: [OE-core] [wrynose][PATCH 3/7] python3: upgrade 3.14.7 -> 3.14.8

["Yoann Congal" <yoann.congal@smile.fr>]

On Tue Oct 20, 2026 at 10:26 AM CEST, Daniel Turull via lists.openembedded.org wrote:
> From: Daniel Turull <daniel.turull@ericsson.com>
>
> Security fixes in 3.14.8:
> - CVE-2026-19445: crash in ssl when sni_callback switches SSLContext
>   and the original context is no longer referenced
> - CVE-2026-15806: scope HTTPPasswordMgr credentials to the URL scheme
>   so HTTPS credentials aren't reused for a matching HTTP URL
> - asyncio/ssl: validate server_hostname when check_hostname is set,
>   for start_tls(), create_connection() and SSLContext.wrap_bio()
> - zipfile: bound decompressed data per read for bzip2/LZMA/Zstandard
>   members, matching the existing deflate limit
> - tarfile: fix extraction filters creating directories outside the
>   destination for names that leave and re-enter it
> - Bundle libexpat 2.8.5
>
> Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> ---
>  .../python/{python3_3.14.7.bb => python3_3.14.8.bb}             | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>  rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.8.bb} (99%)

That would put wrynose ahead of master.
I'll hold this one until master/blacksail are upgraded.

Regards,
-- 
Yoann Congal
Smile ECS