[PATCH 00/12] Upgrades on 3rd Nov

[PATCH 00/12] Upgrades on 3rd Nov

[Jaipaul Cheernam]

Jaipaul Cheernam (12):
  expat: upgrade 2.9.0 -> 2.10.0
  librepo: upgrade 1.21.3 -> 1.22.0
  nghttp2: upgrade 1.70.0 -> 1.71.0
  apr-util: upgrade 1.6.5 -> 1.6.6
  python3-jsonpointer: upgrade 3.5 -> 3.8
  python3-markupsafe: upgrade 3.0.3 -> 3.0.4
  python3-uv-build: upgrade 0.13.5 -> 0.13.7
  python3-pip: upgrade 26.2.2 -> 26.3
  mesa-demos: upgrade to latest revision
  hwdata: upgrade 0.411 -> 0.412
  hwdata: upgrade 0.412 -> 0.413
  gtk4: upgrade 4.24.0 -> 4.24.1

 .../expat/{expat_2.9.0.bb => expat_2.10.0.bb} |  2 +-
 ...tain-PYTHON_INSTALL_DIR-by-running-p.patch |  2 +-
 .../{librepo_1.21.3.bb => librepo_1.22.0.bb}  |  0
 ...nter_3.5.bb => python3-jsonpointer_3.8.bb} |  2 +-
 ...e_3.0.3.bb => python3-markupsafe_3.0.4.bb} |  2 +-
 .../python3-pip/no_shebang_mangling.patch     |  6 +--
 ...hon3-pip_26.2.2.bb => python3-pip_26.3.bb} |  2 +-
 .../python/python3-uv-build-crates.inc        | 42 ++++++++++---------
 ...d_0.13.5.bb => python3-uv-build_0.13.7.bb} |  2 +-
 .../gtk+/{gtk4_4.24.0.bb => gtk4_4.24.1.bb}   |  2 +-
 .../recipes-graphics/mesa/mesa-demos_9.0.0.bb |  2 +-
 .../apr/apr-util/configfix.patch              | 16 +++++--
 .../{apr-util_1.6.5.bb => apr-util_1.6.6.bb}  |  2 +-
 .../{hwdata_0.411.bb => hwdata_0.413.bb}      |  2 +-
 .../{nghttp2_1.70.0.bb => nghttp2_1.71.0.bb}  |  2 +-
 15 files changed, 48 insertions(+), 38 deletions(-)
 rename meta/recipes-core/expat/{expat_2.9.0.bb => expat_2.10.0.bb} (92%)
 rename meta/recipes-devtools/librepo/{librepo_1.21.3.bb => librepo_1.22.0.bb} (100%)
 rename meta/recipes-devtools/python/{python3-jsonpointer_3.5.bb => python3-jsonpointer_3.8.bb} (87%)
 rename meta/recipes-devtools/python/{python3-markupsafe_3.0.3.bb => python3-markupsafe_3.0.4.bb} (81%)
 rename meta/recipes-devtools/python/{python3-pip_26.2.2.bb => python3-pip_26.3.bb} (97%)
 rename meta/recipes-devtools/python/{python3-uv-build_0.13.5.bb => python3-uv-build_0.13.7.bb} (92%)
 rename meta/recipes-gnome/gtk+/{gtk4_4.24.0.bb => gtk4_4.24.1.bb} (98%)
 rename meta/recipes-support/apr/{apr-util_1.6.5.bb => apr-util_1.6.6.bb} (97%)
 rename meta/recipes-support/hwdata/{hwdata_0.411.bb => hwdata_0.413.bb} (93%)
 rename meta/recipes-support/nghttp2/{nghttp2_1.70.0.bb => nghttp2_1.71.0.bb} (84%)

[PATCH 01/12] expat: upgrade 2.9.0 -> 2.10.0

[Jaipaul Cheernam]

Changes: https://github.com/libexpat/libexpat/blob/R_2_10_0/expat/Changes

Release 2.10.0 Mon November 2 2026
        Security fixes:
           #1431  CVE-2026-113351 -- Fix denial of service with use of
                    `XML_ParserReset`
  #1433 #1436 ..
  #1438 #1439 ..
           #1442  CVE-2026-115506 -- Detect billion laughs attacks quicker
                    and more of its variations. Related payload fuzzer at:
                      https://github.com/hannob/lololol
                    Please note that a layer of compression around XML can
                    significantly reduce the minimum attack payload size.
                    In case of backporting, please note pull request #1439
                    in particular.
           #1444  CVE-2026-117610 -- Fix initial non-final empty subparser
                    parse calls. Was segfaulting previously.
           #1450  CVE-2026-118370 -- Protect `attIndex` and `nPrefixes` in
                    function `storeAtts` from signed integer overflow

        Bug fixes:
           #1452  lib: Initialize `m_parsingStatus.finalBuffer` in `parserInit`
                    to fix calling `XML_GetParsingStatus` right after
                    parser creation
     #1457 #1459  lib: Improve `XML_Parse` for `XML_CONTEXT_BYTES == 0`
                    including NULL pointer arithmetic undefined behavior
                    and uninitialized variable access
           #1458  lib: Use C99 length modifiers for `ptrdiff_t` and `size_t`
                    to fix support for CHERI-RISC-V
           #1461  lib: Check `isCalledFromInsideHandler` first in `XML_Parse`
           #1467  lib: Add missing check for a character handler reset

        Other changes:
           #1441  Autotools: Move `-lm` from LDFLAGS to LIBADD/LDADD
                    to better support compilation with `-Wl,--as-needed`
           #1412  CMake: Support repeated `find_package` calls
           #1413  lib: Address warning `XML_GE is not defined [-Werror=undef]`
           #1415  lib: Stop delaying `callStoreEntityValue` error handling
           #1415  lib: Add missing call to `poolDiscard`
           #1437  lib: Add missing `NULL` check for `m_startDoctypeDeclHandler`
           #1417  lib: Migrate `ENTITY.textLen` and `ENTITY.processed` from
                         `int` to `size_t`
           #1463  lib: Fix integer truncation in `XmlGetAttributes`/`getAtts`
           #1420  lib: Some more `XML_Bool` to `bool` migration
     #1449 #1460  lib: Document the memory reuse black magic that function
                    `storeAtts` is doing
           #1453  lib: Document failure to reject bad redefinitions of
                    predefined entities
           #1432  tests: Replace `XML_SetHashSalt` with
                    `XML_SetHashSalt16Bytes`
     #1416 #1435  Version info bumped from 14:0:13 (libexpat*.so.1.13.0)
                    to 14:1:13 (libexpat*.so.1.13.1); see https://verbump.de/
                    for what these numbers do

        Infrastructure:
           #1414  CI: Stop using about-to-be-removed image "macos-14"
     #1418 #1434  CI: Bump MinGW Clang from 23.1.2 to 23.1.4
           #1443  CI: Bump Fil-C from 0.686 to 0.687
           #1456  Drop a `lib/xcsinc.c` leftover

        Special thanks to:
            Alexander Bluhm
            Bartłomiej Dmitruk
            Berkay Eren Ürün
            Brooks Davis
            brspoon
            Funda Wang
            Hanno Böck
            Matthew Fernandez
            Minkyung Park
            Mirko Swillus
            Pu Cheng
            Scott Moore
            Shani Yosef
            Xisco Fauli
                 and
            City of Munich Open Source Sabbatical
            echo.ai
            Siemens
            Striga
            VulnCheck

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 meta/recipes-core/expat/{expat_2.9.0.bb => expat_2.10.0.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-core/expat/{expat_2.9.0.bb => expat_2.10.0.bb} (92%)

diff --git a/meta/recipes-core/expat/expat_2.9.0.bb b/meta/recipes-core/expat/expat_2.10.0.bb
similarity index 92%
rename from meta/recipes-core/expat/expat_2.9.0.bb
rename to meta/recipes-core/expat/expat_2.10.0.bb
index 9b33764839..5b252f6146 100644
--- a/meta/recipes-core/expat/expat_2.9.0.bb
+++ b/meta/recipes-core/expat/expat_2.10.0.bb
@@ -15,7 +15,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.xz  \
 GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
 UPSTREAM_CHECK_REGEX = "releases/tag/R_(?P<pver>.+)"
 
-SRC_URI[sha256sum] = "1e6371862cc31999b368c3b89b49994f0677e1bab5f1b2b85ae3741f5d803051"
+SRC_URI[sha256sum] = "c624ba2998fc65df1163a49641ff3f9ab73138b11641d92c86bee0fb01b1bc7f"
 
 EXTRA_OECMAKE:class-native += "-DEXPAT_BUILD_DOCS=OFF"
 

[PATCH 02/12] librepo: upgrade 1.21.3 -> 1.22.0

[Jaipaul Cheernam]

Release: https://github.com/rpm-software-management/librepo/releases/tag/1.22.0

What's Changed

  Add LR_PACKAGEDOWNLOAD_TRANSIENT to skip persisting checksum cache by @stewartsmith in #412
  python: Fix reference leaks of list items by @prownd in #408
  Update FSF addresses by @evan-goode in #417
  python tests: add missing shebang to run_unittests.sh.in by @fundawang in #418
  yum: Fix memory leaks in lr_yum_download_repos() and lr_yum_download_repo() by @prownd in #402
  Add support for excluding domains and locations in metalink parsing by @bc-lee in #357
  spec: Remove unsed build dependency on python3-sphinx by @ppisar in #419

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 ...2-Do-not-try-to-obtain-PYTHON_INSTALL_DIR-by-running-p.patch | 2 +-
 .../librepo/{librepo_1.21.3.bb => librepo_1.22.0.bb}            | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/librepo/{librepo_1.21.3.bb => librepo_1.22.0.bb} (100%)

diff --git a/meta/recipes-devtools/librepo/librepo/0002-Do-not-try-to-obtain-PYTHON_INSTALL_DIR-by-running-p.patch b/meta/recipes-devtools/librepo/librepo/0002-Do-not-try-to-obtain-PYTHON_INSTALL_DIR-by-running-p.patch
index c7d23732ab..2b6c1c85b4 100644
--- a/meta/recipes-devtools/librepo/librepo/0002-Do-not-try-to-obtain-PYTHON_INSTALL_DIR-by-running-p.patch
+++ b/meta/recipes-devtools/librepo/librepo/0002-Do-not-try-to-obtain-PYTHON_INSTALL_DIR-by-running-p.patch
@@ -1,4 +1,4 @@
-From a6282ddaf4a7143866ef500db3bb334b599fa300 Mon Sep 17 00:00:00 2001
+From 66610d0a0c683ecdd2f39e3936f88624452590c1 Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Fri, 30 Dec 2016 18:05:36 +0200
 Subject: [PATCH] Do not try to obtain PYTHON_INSTALL_DIR by running python.
diff --git a/meta/recipes-devtools/librepo/librepo_1.21.3.bb b/meta/recipes-devtools/librepo/librepo_1.22.0.bb
similarity index 100%
rename from meta/recipes-devtools/librepo/librepo_1.21.3.bb
rename to meta/recipes-devtools/librepo/librepo_1.22.0.bb

[PATCH 03/12] nghttp2: upgrade 1.70.0 -> 1.71.0

[Jaipaul Cheernam]

Update bash_completion
Update manual pages
Bump package and library versions
Update AUTHORS
Bump ngtcp2 and nghttp3
GHA: Remove macos-15
Remove public server text
Update window upfront
Update remote window upfront when DATA is sent
Increase recv window when DATA frame header is received
Bump deps
Fix docker build
Bump wolfssl to v5.9.4-stable
Bump aws-lc to v5.12.0
Bump boringssl
Bump libbpf to v1.8.0
Simplify map insertion
Fix priority update
Simplify map insertion
build(deps): bump github.com/quic-go/quic-go from 0.64.0 to 0.64.1
Remove LICENSE file
Add oss-scanner files
Better map hasher
build(deps): bump github.com/quic-go/quic-go from 0.64.0 to 0.64.1
nghttp2_nv_array_copy: Detect size_t overflow
Update doc
Fix signed integer overflow in nghttp2_session_get_stream_local_window_size
Deal with too large window size when consuming data
build(deps): bump github.com/quic-go/quic-go from 0.63.0 to 0.64.0
GHA: Use aws-lc instead of openssl for macos build
build(deps): bump golang.org/x/net from 0.59.0 to 0.61.0
Update doc
bpf: Avoid verifier instruction limits
nghttpx: Fix the bug that GSO on QUIC connection is disabled
Update GitHub funding configuration
build(deps): bump github.com/quic-go/quic-go from 0.62.0 to 0.63.0
build(deps): bump golang.org/x/net from 0.58.0 to 0.59.0
GHA: Reduce cmake and macos jobs
GHA: Remove cygwin build because it stopped functioning
GHA: Reduce openssl1 jobs
GHA: Use packaged OpenSSL
Bump ubuntu
Bump ubuntu to 26.04 for android Dockerfile
GHA: Bump ubuntu to 26.04
GHA: Bump clang to 21
Bump neverbleed
nghttpx: Remove server push
Bump clang-format to 21
lib: Disallow HEADERS and PUSH_PROMISE in CONNECT stream
nghttpx: Rewrite CertLookupTree based on RFC 9525 rules
nghttpx: Client TLS certificate validation based on RFC 9525
nghttpx: Refactor Router
build(deps): bump github.com/quic-go/quic-go from 0.61.0 to 0.62.0
Bump go to 1.26
Munit cxx assertions
src: Use munit C++ assertions
tests: Bump munit
GHA: Use g++-15
Gha bump ubuntu
GHA: Disable examples with aws-lc as well
GHA: Bump ubuntu to 26.04
build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0
nghttpx: Check QUIC version
Add length check for CONTINUATION
util: add <fstream> include
build(deps): bump actions/stale from 10 to 11
Revert "Take into account idle streams"
Add option to limit the maximum outbound queue size
Take into account idle streams
build(deps): bump actions/stale from 10 to 11
Bump package version

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 .../nghttp2/{nghttp2_1.70.0.bb => nghttp2_1.71.0.bb}            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-support/nghttp2/{nghttp2_1.70.0.bb => nghttp2_1.71.0.bb} (84%)

diff --git a/meta/recipes-support/nghttp2/nghttp2_1.70.0.bb b/meta/recipes-support/nghttp2/nghttp2_1.71.0.bb
similarity index 84%
rename from meta/recipes-support/nghttp2/nghttp2_1.70.0.bb
rename to meta/recipes-support/nghttp2/nghttp2_1.71.0.bb
index 1b09f91ce6..214545ab81 100644
--- a/meta/recipes-support/nghttp2/nghttp2_1.70.0.bb
+++ b/meta/recipes-support/nghttp2/nghttp2_1.71.0.bb
@@ -6,7 +6,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=764abdf30b2eadd37ce47dcbce0ea1ec"
 
 SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/nghttp2-${PV}.tar.xz"
 
-SRC_URI[sha256sum] = "e05cb1388eaca3830aded4ccf20044b6e1ac1a61411dcca11b0437c4285c8bc2"
+SRC_URI[sha256sum] = "c0f55121d88650e4b9227aec28cebaf664d2417ca60fe70be0f8d38829f52116"
 
 inherit cmake manpages python3native github-releases
 

[PATCH 04/12] apr-util: upgrade 1.6.5 -> 1.6.6

[Jaipaul Cheernam]

Changes with APR-util 1.6.6
  *) Fix crypto/apr_passwd.c compilation errors on older systems. PR 70283.

  *) Fix crashes in apr_crypto_get_block_key_types() with default cmake builds
  on
     Windows. PR 70260.

- Refresh existing patch

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 .../recipes-support/apr/apr-util/configfix.patch | 16 ++++++++++++----
 .../apr/{apr-util_1.6.5.bb => apr-util_1.6.6.bb} |  2 +-
 2 files changed, 13 insertions(+), 5 deletions(-)
 rename meta/recipes-support/apr/{apr-util_1.6.5.bb => apr-util_1.6.6.bb} (97%)

diff --git a/meta/recipes-support/apr/apr-util/configfix.patch b/meta/recipes-support/apr/apr-util/configfix.patch
index 4cc0ad79ae..5322e73d29 100644
--- a/meta/recipes-support/apr/apr-util/configfix.patch
+++ b/meta/recipes-support/apr/apr-util/configfix.patch
@@ -1,9 +1,17 @@
+From f05a53c7e957b215743359ff787eff3040f51e89 Mon Sep 17 00:00:00 2001
+From: Richard Purdie <rpurdie@linux.intel.com>
+Date: Mon, 12 Jan 2009 17:34:52 +0000
+Subject: [PATCH] apr/apr-util: Fix some other config path gremlins breaking
+
 Upstream-Status: Inappropriate [configuration]
+---
+ apu-config.in | 27 +--------------------------
+ 1 file changed, 1 insertion(+), 26 deletions(-)
 
-Index: apr-util-1.3.4/apu-config.in
-===================================================================
---- apr-util-1.3.4.orig/apu-config.in	2009-01-12 17:08:06.000000000 +0000
-+++ apr-util-1.3.4/apu-config.in	2009-01-12 17:09:00.000000000 +0000
+diff --git a/apu-config.in b/apu-config.in
+index 82109e5..12d9fca 100644
+--- a/apu-config.in
++++ b/apu-config.in
 @@ -139,14 +139,7 @@ while test $# -gt 0; do
      exit 0
      ;;
diff --git a/meta/recipes-support/apr/apr-util_1.6.5.bb b/meta/recipes-support/apr/apr-util_1.6.6.bb
similarity index 97%
rename from meta/recipes-support/apr/apr-util_1.6.5.bb
rename to meta/recipes-support/apr/apr-util_1.6.6.bb
index ba1e3359ff..ebefffcd0d 100644
--- a/meta/recipes-support/apr/apr-util_1.6.5.bb
+++ b/meta/recipes-support/apr/apr-util_1.6.6.bb
@@ -14,7 +14,7 @@ SRC_URI = "${APACHE_MIRROR}/apr/${BPN}-${PV}.tar.gz \
            file://run-ptest \
            "
 
-SRC_URI[sha256sum] = "f43a1c8c79eef497a022ec6c99dddbdf57e42001da6ccbfae259631ed5aa2805"
+SRC_URI[sha256sum] = "acd5f38440eda830e40c4fe35c2a6b8119493cfdba9c9d73d985c317beb4e4f8"
 
 EXTRA_OECONF = "--with-apr=${STAGING_BINDIR_CROSS}/apr-1-config \
 		--without-odbc \

[PATCH 05/12] python3-jsonpointer: upgrade 3.5 -> 3.8

[Jaipaul Cheernam]

CompareLog: https://github.com/stefankoegl/python-json-pointer/compare/v3.5...v3.8

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 .../{python3-jsonpointer_3.5.bb => python3-jsonpointer_3.8.bb}  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/python/{python3-jsonpointer_3.5.bb => python3-jsonpointer_3.8.bb} (87%)

diff --git a/meta/recipes-devtools/python/python3-jsonpointer_3.5.bb b/meta/recipes-devtools/python/python3-jsonpointer_3.8.bb
similarity index 87%
rename from meta/recipes-devtools/python/python3-jsonpointer_3.5.bb
rename to meta/recipes-devtools/python/python3-jsonpointer_3.8.bb
index dc39b0ea38..bc63f8a4cb 100644
--- a/meta/recipes-devtools/python/python3-jsonpointer_3.5.bb
+++ b/meta/recipes-devtools/python/python3-jsonpointer_3.8.bb
@@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=32b15c843b7a329130f4e266a281ebb3"
 
 inherit pypi ptest setuptools3
 
-SRC_URI[sha256sum] = "81f28618a019cf1b011a6cf757439737972de1ccbeca2e1f86dfb4d661800792"
+SRC_URI[sha256sum] = "a627a255641390bfb4d51d4cfbb90648078ae855b45804ef7e19ea13a4cca355"
 
 SRC_URI += " \
 	file://run-ptest \

[PATCH 06/12] python3-markupsafe: upgrade 3.0.3 -> 3.0.4

[Jaipaul Cheernam]

Version 3.0.4
-------------

Released 2026-10-02

-   Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.
-   Improve performance of ``striptags``. :issue:`521`

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 ...{python3-markupsafe_3.0.3.bb => python3-markupsafe_3.0.4.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/python/{python3-markupsafe_3.0.3.bb => python3-markupsafe_3.0.4.bb} (81%)

diff --git a/meta/recipes-devtools/python/python3-markupsafe_3.0.3.bb b/meta/recipes-devtools/python/python3-markupsafe_3.0.4.bb
similarity index 81%
rename from meta/recipes-devtools/python/python3-markupsafe_3.0.3.bb
rename to meta/recipes-devtools/python/python3-markupsafe_3.0.4.bb
index 58c03766c6..63b9fb4801 100644
--- a/meta/recipes-devtools/python/python3-markupsafe_3.0.3.bb
+++ b/meta/recipes-devtools/python/python3-markupsafe_3.0.4.bb
@@ -3,7 +3,7 @@ HOMEPAGE = "http://github.com/mitsuhiko/markupsafe"
 LICENSE = "BSD-3-Clause"
 LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=ffeffa59c90c9c4a033c7574f8f3fb75"
 
-SRC_URI[sha256sum] = "722695808f4b6457b320fdc131280796bdceb04ab50fe1795cd540799ebe1698"
+SRC_URI[sha256sum] = "2e9ad7dd851bf45fab9f75cbff4cb493fee9979e8d8c7c9c3ee119022518edd6"
 
 inherit pypi python_setuptools_build_meta ptest-python-pytest
 

[PATCH 07/12] python3-uv-build: upgrade 0.13.5 -> 0.13.7

[Jaipaul Cheernam]

Release: https://github.com/astral-sh/uv/blob/main/CHANGELOG.md#0137

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 .../python/python3-uv-build-crates.inc        | 42 ++++++++++---------
 ...d_0.13.5.bb => python3-uv-build_0.13.7.bb} |  2 +-
 2 files changed, 23 insertions(+), 21 deletions(-)
 rename meta/recipes-devtools/python/{python3-uv-build_0.13.5.bb => python3-uv-build_0.13.7.bb} (92%)

diff --git a/meta/recipes-devtools/python/python3-uv-build-crates.inc b/meta/recipes-devtools/python/python3-uv-build-crates.inc
index a5746f7693..d668493bd0 100644
--- a/meta/recipes-devtools/python/python3-uv-build-crates.inc
+++ b/meta/recipes-devtools/python/python3-uv-build-crates.inc
@@ -18,10 +18,11 @@ SRC_URI += " \
     crate://crates.io/astral-tokio-tar/0.7.0 \
     crate://crates.io/astral-version-ranges/0.2.3 \
     crate://crates.io/astral_async_zip/0.0.22 \
-    crate://crates.io/async-compression/0.4.48 \
+    crate://crates.io/async-compression/0.4.50 \
     crate://crates.io/autocfg/1.5.0 \
     crate://crates.io/backon/1.6.0 \
     crate://crates.io/base64/0.22.1 \
+    crate://crates.io/base64/0.23.1 \
     crate://crates.io/bitflags/1.3.2 \
     crate://crates.io/bitflags/2.13.2 \
     crate://crates.io/block-buffer/0.10.4 \
@@ -103,7 +104,7 @@ SRC_URI += " \
     crate://crates.io/idna_adapter/1.2.1 \
     crate://crates.io/indexmap/2.14.2 \
     crate://crates.io/indoc/2.0.7 \
-    crate://crates.io/insta/1.48.0 \
+    crate://crates.io/insta/1.49.0 \
     crate://crates.io/io-extras/0.19.0 \
     crate://crates.io/io-lifetimes/2.0.4 \
     crate://crates.io/io-lifetimes/3.0.1 \
@@ -115,7 +116,7 @@ SRC_URI += " \
     crate://crates.io/jiff-core/0.1.0 \
     crate://crates.io/jiff-static/0.2.37 \
     crate://crates.io/js-sys/0.3.91 \
-    crate://crates.io/junction/2.0.0 \
+    crate://crates.io/junction/2.1.0 \
     crate://crates.io/lazy_static/1.5.0 \
     crate://crates.io/libc/0.2.189 \
     crate://crates.io/linux-raw-sys/0.12.1 \
@@ -192,10 +193,10 @@ SRC_URI += " \
     crate://crates.io/simdutf8/0.1.5 \
     crate://crates.io/similar/2.7.0 \
     crate://crates.io/slab/0.4.12 \
-    crate://crates.io/smallvec/1.16.1 \
+    crate://crates.io/smallvec/1.16.2 \
     crate://crates.io/smawk/0.3.2 \
     crate://crates.io/socket2/0.6.3 \
-    crate://crates.io/spdx/0.13.5 \
+    crate://crates.io/spdx/0.13.6 \
     crate://crates.io/stable_deref_trait/1.2.1 \
     crate://crates.io/strip-ansi-escapes/0.2.1 \
     crate://crates.io/strsim/0.11.1 \
@@ -208,8 +209,8 @@ SRC_URI += " \
     crate://crates.io/tempfile/3.27.0 \
     crate://crates.io/terminal_size/0.4.4 \
     crate://crates.io/textwrap/0.16.4 \
-    crate://crates.io/thiserror/2.0.20 \
-    crate://crates.io/thiserror-impl/2.0.20 \
+    crate://crates.io/thiserror/2.0.21 \
+    crate://crates.io/thiserror-impl/2.0.21 \
     crate://crates.io/thread_local/1.1.9 \
     crate://crates.io/tinystr/0.8.2 \
     crate://crates.io/tinyvec/1.11.0 \
@@ -237,7 +238,7 @@ SRC_URI += " \
     crate://crates.io/url/2.5.8 \
     crate://crates.io/utf8_iter/1.0.4 \
     crate://crates.io/utf8parse/0.2.2 \
-    crate://crates.io/uuid/1.26.1 \
+    crate://crates.io/uuid/1.27.0 \
     crate://crates.io/valuable/0.1.1 \
     crate://crates.io/version_check/0.9.5 \
     crate://crates.io/vte/0.14.1 \
@@ -286,8 +287,8 @@ SRC_URI += " \
     crate://crates.io/writeable/0.6.2 \
     crate://crates.io/yoke/0.8.1 \
     crate://crates.io/yoke-derive/0.8.1 \
-    crate://crates.io/zerocopy/0.8.57 \
-    crate://crates.io/zerocopy-derive/0.8.57 \
+    crate://crates.io/zerocopy/0.8.63 \
+    crate://crates.io/zerocopy-derive/0.8.63 \
     crate://crates.io/zerofrom/0.1.6 \
     crate://crates.io/zerofrom-derive/0.1.6 \
     crate://crates.io/zerotrie/0.2.3 \
@@ -313,10 +314,11 @@ SRC_URI[astral-mail-headers-0.0.1.sha256sum] = "dc019ecca82cfc91ffa31ab4ffe705aa
 SRC_URI[astral-tokio-tar-0.7.0.sha256sum] = "6f2e989b33246fe9240d39accf4dd9a01e0b6c1f3ce9dd095e0a47fa02505523"
 SRC_URI[astral-version-ranges-0.2.3.sha256sum] = "b315acc4dc7f0d3ccdd557a01b6a89fa2d896e99a450b98e829fc8152f0b2f98"
 SRC_URI[astral_async_zip-0.0.22.sha256sum] = "0f8508d09c6bc6abd42767d1d43c7702891691484875ce94f7997da1301d95e9"
-SRC_URI[async-compression-0.4.48.sha256sum] = "fb61aea1a7def73ee7c350a184f0e70b32c182344e2e75bf70c9b621b83417fd"
+SRC_URI[async-compression-0.4.50.sha256sum] = "ee19bd99b43e3691acbad4e840420a4881cea6c0b66a208125a824f8fd53f5a1"
 SRC_URI[autocfg-1.5.0.sha256sum] = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 SRC_URI[backon-1.6.0.sha256sum] = "cffb0e931875b666fc4fcb20fee52e9bbd1ef836fd9e9e04ec21555f9f85f7ef"
 SRC_URI[base64-0.22.1.sha256sum] = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+SRC_URI[base64-0.23.1.sha256sum] = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
 SRC_URI[bitflags-1.3.2.sha256sum] = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 SRC_URI[bitflags-2.13.2.sha256sum] = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 SRC_URI[block-buffer-0.10.4.sha256sum] = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
@@ -398,7 +400,7 @@ SRC_URI[idna-1.1.0.sha256sum] = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d
 SRC_URI[idna_adapter-1.2.1.sha256sum] = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
 SRC_URI[indexmap-2.14.2.sha256sum] = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
 SRC_URI[indoc-2.0.7.sha256sum] = "79cf5c93f93228cf8efb3ba362535fb11199ac548a09ce117c9b1adc3030d706"
-SRC_URI[insta-1.48.0.sha256sum] = "86f0f8fee8c926415c58d6ae43a08523a26faccb2323f5e6b644fe7dd4ef6b82"
+SRC_URI[insta-1.49.0.sha256sum] = "b67d3d2e287e4b86c10b3f3b641033d1f89b74bdb39d05f34952e2b9a6fe21cd"
 SRC_URI[io-extras-0.19.0.sha256sum] = "20fd6de4ccfcc187e38bc21cfa543cb5a302cb86a8b114eb7f0bf0dc9f8ac00f"
 SRC_URI[io-lifetimes-2.0.4.sha256sum] = "06432fb54d3be7964ecd3649233cddf80db2832f47fec34c01f65b3d9d774983"
 SRC_URI[io-lifetimes-3.0.1.sha256sum] = "2f0fb0570afe1fed943c5c3d4102d5358592d8625fda6a0007fdbe65a92fba96"
@@ -410,7 +412,7 @@ SRC_URI[jiff-0.2.37.sha256sum] = "0ab1baf72f08796de0260609515130699b890ac25f30e6
 SRC_URI[jiff-core-0.1.0.sha256sum] = "7feca88439efe53da3754500c1851dedf3cb36c524dd5cf8225cc0794de95d09"
 SRC_URI[jiff-static-0.2.37.sha256sum] = "378268a1116ad67ae6228701118ac9f491d78fda38a40a1f1a9e1348de6f7212"
 SRC_URI[js-sys-0.3.91.sha256sum] = "b49715b7073f385ba4bc528e5747d02e66cb39c6146efb66b781f131f0fb399c"
-SRC_URI[junction-2.0.0.sha256sum] = "160f2eade097f30263b548aae5deb12ad349c909baa710fa24b92c9090b2e006"
+SRC_URI[junction-2.1.0.sha256sum] = "cde48f36530cbd91b65f050101e6c056d6eb743cea2a8f0f19beef69c6742ff8"
 SRC_URI[lazy_static-1.5.0.sha256sum] = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 SRC_URI[libc-0.2.189.sha256sum] = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 SRC_URI[linux-raw-sys-0.12.1.sha256sum] = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
@@ -487,10 +489,10 @@ SRC_URI[simd-adler32-0.3.8.sha256sum] = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1
 SRC_URI[simdutf8-0.1.5.sha256sum] = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
 SRC_URI[similar-2.7.0.sha256sum] = "bbbb5d9659141646ae647b42fe094daf6c6192d1620870b449d9557f748b2daa"
 SRC_URI[slab-0.4.12.sha256sum] = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
-SRC_URI[smallvec-1.16.1.sha256sum] = "ba467056f1b547ed52077911161fc86985becbc60e8e1857c8a144dab0def891"
+SRC_URI[smallvec-1.16.2.sha256sum] = "f9395f0f0eee849a9b707b2f06bb92a6a422090e2123bb2ef8e87a0e61892a8e"
 SRC_URI[smawk-0.3.2.sha256sum] = "b7c388c1b5e93756d0c740965c41e8822f866621d41acbdf6336a6a168f8840c"
 SRC_URI[socket2-0.6.3.sha256sum] = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
-SRC_URI[spdx-0.13.5.sha256sum] = "081670c233dfbed55690cc0cd38424e0e24ac1b2673d0b408b3f7b684738dfa9"
+SRC_URI[spdx-0.13.6.sha256sum] = "646c5a367da914e3babcb9cd8e91c37ccaac42325b8f86f036513ad103f2a716"
 SRC_URI[stable_deref_trait-1.2.1.sha256sum] = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 SRC_URI[strip-ansi-escapes-0.2.1.sha256sum] = "2a8f8038e7e7969abb3f1b7c2a811225e9296da208539e0f79c5251d6cac0025"
 SRC_URI[strsim-0.11.1.sha256sum] = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
@@ -503,8 +505,8 @@ SRC_URI[temp-env-0.3.6.sha256sum] = "96374855068f47402c3121c6eed88d29cb1de8f3ab2
 SRC_URI[tempfile-3.27.0.sha256sum] = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 SRC_URI[terminal_size-0.4.4.sha256sum] = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874"
 SRC_URI[textwrap-0.16.4.sha256sum] = "6ecfad6c3abc80a577f2b91c1e412ee57e7a060d430b553c1b0c940974ebcd49"
-SRC_URI[thiserror-2.0.20.sha256sum] = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
-SRC_URI[thiserror-impl-2.0.20.sha256sum] = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+SRC_URI[thiserror-2.0.21.sha256sum] = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
+SRC_URI[thiserror-impl-2.0.21.sha256sum] = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
 SRC_URI[thread_local-1.1.9.sha256sum] = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
 SRC_URI[tinystr-0.8.2.sha256sum] = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
 SRC_URI[tinyvec-1.11.0.sha256sum] = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
@@ -532,7 +534,7 @@ SRC_URI[unscanny-0.1.0.sha256sum] = "e9df2af067a7953e9c3831320f35c1cc0600c30d44d
 SRC_URI[url-2.5.8.sha256sum] = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
 SRC_URI[utf8_iter-1.0.4.sha256sum] = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 SRC_URI[utf8parse-0.2.2.sha256sum] = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
-SRC_URI[uuid-1.26.1.sha256sum] = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce"
+SRC_URI[uuid-1.27.0.sha256sum] = "97277d36b9c3ace13e58fa6e753f8b0bbbf302a18dd193240d70f9e29681059a"
 SRC_URI[valuable-0.1.1.sha256sum] = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 SRC_URI[version_check-0.9.5.sha256sum] = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 SRC_URI[vte-0.14.1.sha256sum] = "231fdcd7ef3037e8330d8e17e61011a2c244126acc0a982f4040ac3f9f0bc077"
@@ -581,8 +583,8 @@ SRC_URI[winx-0.36.4.sha256sum] = "3f3fd376f71958b862e7afb20cfe5a22830e1963462f3a
 SRC_URI[writeable-0.6.2.sha256sum] = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
 SRC_URI[yoke-0.8.1.sha256sum] = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
 SRC_URI[yoke-derive-0.8.1.sha256sum] = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
-SRC_URI[zerocopy-0.8.57.sha256sum] = "d35102a9f36d089ccae9e4c6802bc118be4487b80aaffc0ab4e0cf5ce92d2873"
-SRC_URI[zerocopy-derive-0.8.57.sha256sum] = "146c01f5ab44258da43cf276c74a2763db2ff3969c9c652c3f2de07041d0b2bc"
+SRC_URI[zerocopy-0.8.63.sha256sum] = "e5fe1f8f1b06191a00962174c61aa5005e0bb391a6d80d07e24d115c01a92ed8"
+SRC_URI[zerocopy-derive-0.8.63.sha256sum] = "863ad3ac83293fb4d740aedbfdc9240dd8d1a50c1099acd76ce80ce7c7230c7f"
 SRC_URI[zerofrom-0.1.6.sha256sum] = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
 SRC_URI[zerofrom-derive-0.1.6.sha256sum] = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
 SRC_URI[zerotrie-0.2.3.sha256sum] = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
diff --git a/meta/recipes-devtools/python/python3-uv-build_0.13.5.bb b/meta/recipes-devtools/python/python3-uv-build_0.13.7.bb
similarity index 92%
rename from meta/recipes-devtools/python/python3-uv-build_0.13.5.bb
rename to meta/recipes-devtools/python/python3-uv-build_0.13.7.bb
index 8b05c79a25..8974550c86 100644
--- a/meta/recipes-devtools/python/python3-uv-build_0.13.5.bb
+++ b/meta/recipes-devtools/python/python3-uv-build_0.13.7.bb
@@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://LICENSE-APACHE;md5=86d3f3a95c324c9479bd8986968f4327 \
                     file://crates/uv-pep508/License-Apache;md5=e23fadd6ceef8c618fc1c65191d846fa \
                     file://crates/uv-pep508/License-BSD;md5=ef7a6027dc4c2389b9afad7e690274c7"
 
-SRC_URI[sha256sum] = "c95a3d092cb8880b37f35013f9f7339f3867bc422abed36776255f34e22bc62c"
+SRC_URI[sha256sum] = "c561c4fa00f64efd348bdbe3a01ade41bc9af99ba57d807cc7b2abdf73571366"
 
 require ${BPN}-crates.inc
 

[PATCH 08/12] python3-pip: upgrade 26.2.2 -> 26.3

[Jaipaul Cheernam]

26.3 (2026-11-02)
=================

Improved Documentation
----------------------

- Clarify in the security policy that pip has never considered installing
  untrusted wheels safe. This is because Python's import system is dynamic, so
  pip cannot guarantee that installing a wheel will not execute third-party
  code. (`#14412 < >`_)

Deprecations and Removals
-------------------------

- Block unexpected imports during installation, warn about unsafe imports
  afterward, and improve recovery from interrupted installations. (`#13842 <
  >`_)

Features
--------

- Show build backend warnings for local source directories and log them at debug
  level for other sources. (`#14372 < >`_)
- Add support for selecting extras in pylock.toml files with ``-r
  pylock.toml[extra1,extra2]``. (`#14205 < >`_)
- Allow ``--group`` to select non-default groups from local pylock files,
  e.g. ``--group pylock.toml:docs``. (`#14390 < >`_)
- Support ``--no-binary`` with ``-r pylock.toml``. Before, pip would get the
  sdist from the index instead of the locked URL, or fail if no wheel were
  available in the lock file. (`#14187 < >`_)
- Speed up installing a wheel with console scripts by not resolving every
  ``PATH`` entry. (`#14235 < >`_)
- Clarify the warning for ``~``-prefixed leftover distribution directories.
  (`#11849 < >`_)

Bug Fixes
---------

- Report build-backend import failures as pip errors instead of displaying an
  uncaught traceback. (`#12248 < >`_)
- No longer log the "pip is looking at multiple versions of a package" message
  until pip has looked at at least two versions of that package. (`#12928 < >`_)
- Fix ``pip``'s self version check reporting an outdated version from the
  environment instead of the running pip when run as a zipapp. (`#13084 < >`_)
- Fix a fatal error when using the ``PIP_CONFIG_FILE`` environment variable with
  ``pip config set``. (`#13279 < >`_)
- Avoid misleading error messages that include extra markers such as
  ``; extra == "..."`` when installing packages. (`#13618 < >`_)
- When installing to a custom ``--prefix``, use the ``posix_prefix`` scheme
  when running from a Debian patched Python distribution to avoid a superfluous
  ``/local/`` subdirectory. (`#13634 < >`_)
- Refuse to follow an HTTP redirect to a ``file:`` URL. (`#14171 < >`_)
- Prevent wheel cache origin mismatch warnings from exposing URL credentials.
  (`#14232 < >`_)
- Report the incomplete-download error on Windows, not a ``PermissionError``.
  (`#14237 < >`_)
- Fix the global configuration location on macOS in virtual environments created
  from Homebrew Python. (`#14303 < >`_)
- Reject extra arguments to ``pip config edit`` instead of silently ignoring
  them. (`#14347 < >`_)
- Honor supplied hashes when using ``--no-require-hashes``. (`#14355 < >`_)
- Fix wheel installation with data files when the installation prefix is a
  filesystem root. (`#14358 < >`_)
- Restore support for UTF-8 configuration files when Python's UTF-8 mode is
  enabled. (`#14367 < >`_)
- Restore vendored Requests' PyOpenSSL fallback on non-Windows systems without
  importing PyOpenSSL on Windows. (`#14402 < >`_)
- Respect configured network settings while checking build constraint files.
  (`#14403 < >`_)
- Apply PyPI's direct URL dependency restriction to extras and cached wheels.
  (`#14341 < >`_)
- Fix a crash when installing or uninstalling a distribution with an invalid
  entry point. (`#8573 < >`_)
- Fail with a clearer error message on invalid configuration values. (`#8671 <
  >`_)
- Keep ``--version`` available only for pip and prevent its use in subcommands.
  (`#9456 < >`_)

Vendored Libraries
------------------

- Upgrade certifi to 2026.10.23
- Upgrade distlib to 0.4.4
- Upgrade idna to 3.20
- Upgrade msgpack to 1.2.4
- Upgrade packaging to 26.3
- Upgrade platformdirs to 4.12.4
- Upgrade pygments to 2.21.0
- Upgrade pyproject-hooks to 1.3.3
- Upgrade rich to 15.0.0
- Downgrade tomli to 2.3.2 to retain TOML 1.0 parsing on Python 3.10.
- Upgrade truststore to 0.10.5
- Upgrade urllib3 to 2.8.0

Process
-------

- Allow pip itself to be built with flit-core 4.

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 .../python/python3-pip/no_shebang_mangling.patch            | 6 +++---
 .../python/{python3-pip_26.2.2.bb => python3-pip_26.3.bb}   | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)
 rename meta/recipes-devtools/python/{python3-pip_26.2.2.bb => python3-pip_26.3.bb} (97%)

diff --git a/meta/recipes-devtools/python/python3-pip/no_shebang_mangling.patch b/meta/recipes-devtools/python/python3-pip/no_shebang_mangling.patch
index f388928230..998d8a73cf 100644
--- a/meta/recipes-devtools/python/python3-pip/no_shebang_mangling.patch
+++ b/meta/recipes-devtools/python/python3-pip/no_shebang_mangling.patch
@@ -1,4 +1,4 @@
-From ea75b7fc017f7a1a3a47e9e2bef21209f0f36a04 Mon Sep 17 00:00:00 2001
+From 717c440db8787fda9fb2abf207fe894e291ce0f0 Mon Sep 17 00:00:00 2001
 From: Richard Purdie <richard.purdie@linuxfoundation.org>
 Date: Wed, 23 Feb 2022 12:27:06 +0000
 Subject: [PATCH] python3-pip: Don't change shebang
@@ -13,7 +13,7 @@ Upstream-Status: Inappropriate [OE specific config]
  1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/src/pip/_vendor/distlib/scripts.py b/src/pip/_vendor/distlib/scripts.py
-index ac9e909..1faa5b6 100644
+index 0338012..64b00a2 100644
 --- a/src/pip/_vendor/distlib/scripts.py
 +++ b/src/pip/_vendor/distlib/scripts.py
 @@ -157,6 +157,8 @@ class ScriptMaker(object):
@@ -25,7 +25,7 @@ index ac9e909..1faa5b6 100644
          if os.name != 'posix':
              simple_shebang = True
          elif getattr(sys, "cross_compiling", False):
-@@ -367,7 +369,7 @@ class ScriptMaker(object):
+@@ -373,7 +375,7 @@ class ScriptMaker(object):
                  return
  
              match = FIRST_LINE_RE.match(first_line.replace(b'\r\n', b'\n'))
diff --git a/meta/recipes-devtools/python/python3-pip_26.2.2.bb b/meta/recipes-devtools/python/python3-pip_26.3.bb
similarity index 97%
rename from meta/recipes-devtools/python/python3-pip_26.2.2.bb
rename to meta/recipes-devtools/python/python3-pip_26.3.bb
index c83c9e4468..a6ce6a1fbc 100644
--- a/meta/recipes-devtools/python/python3-pip_26.2.2.bb
+++ b/meta/recipes-devtools/python/python3-pip_26.3.bb
@@ -26,7 +26,7 @@ inherit pypi python_flit_core
 
 SRC_URI += "file://no_shebang_mangling.patch"
 
-SRC_URI[sha256sum] = "3a8e5c800492787f33a4114ef54444546c340df428974ebba17e0fd47e11af2f"
+SRC_URI[sha256sum] = "6c36ae7da8695be67e3cd9f7d87919667ced53f57ce2ede75d89b5912ed2bc4c"
 
 CVE_PRODUCT = "pypa:pip"
 

[PATCH 09/12] mesa-demos: upgrade to latest revision

[Jaipaul Cheernam]

meson: list GLU before GL in demo dependencies

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 meta/recipes-graphics/mesa/mesa-demos_9.0.0.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-graphics/mesa/mesa-demos_9.0.0.bb b/meta/recipes-graphics/mesa/mesa-demos_9.0.0.bb
index e945538c48..6c5b83f4a1 100644
--- a/meta/recipes-graphics/mesa/mesa-demos_9.0.0.bb
+++ b/meta/recipes-graphics/mesa/mesa-demos_9.0.0.bb
@@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://src/xdemos/glxgears.c;beginline=1;endline=5;md5=2c456
 
 SRC_URI = "git://gitlab.freedesktop.org/mesa/demos.git;protocol=https;branch=main"
 
-SRCREV = "71b184c379625c91195f5d69186d4de5a1f642ac"
+SRCREV = "649baedafcb90313ade69909fdef1ee156ab5f8d"
 
 # This recipe doesn't plan to make more releases, so track upstream git commits
 PV .= "+git"

[PATCH 10/12] hwdata: upgrade 0.411 -> 0.412

[Jaipaul Cheernam]

Update pci

Release: https://github.com/vcrhonek/hwdata/releases/tag/v0.412

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 .../recipes-support/hwdata/{hwdata_0.411.bb => hwdata_0.412.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-support/hwdata/{hwdata_0.411.bb => hwdata_0.412.bb} (93%)

diff --git a/meta/recipes-support/hwdata/hwdata_0.411.bb b/meta/recipes-support/hwdata/hwdata_0.412.bb
similarity index 93%
rename from meta/recipes-support/hwdata/hwdata_0.411.bb
rename to meta/recipes-support/hwdata/hwdata_0.412.bb
index b83c11f09d..c59654e138 100644
--- a/meta/recipes-support/hwdata/hwdata_0.411.bb
+++ b/meta/recipes-support/hwdata/hwdata_0.412.bb
@@ -8,7 +8,7 @@ LICENSE = "GPL-2.0-or-later OR X11"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=1556547711e8246992b999edd9445a57"
 
 SRC_URI = "git://github.com/vcrhonek/${BPN}.git;branch=master;protocol=https;tag=v${PV}"
-SRCREV = "7fc63d411377e40aab66bfbf77dce6a439c3fe87"
+SRCREV = "816a9490ffcdad1929e0e53f79c500e1aeadd492"
 
 inherit allarch
 

[PATCH 11/12] hwdata: upgrade 0.412 -> 0.413

[Jaipaul Cheernam]

Release: https://github.com/vcrhonek/hwdata/releases/tag/v0.413

Update pci and vendor ids

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 .../recipes-support/hwdata/{hwdata_0.412.bb => hwdata_0.413.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-support/hwdata/{hwdata_0.412.bb => hwdata_0.413.bb} (93%)

diff --git a/meta/recipes-support/hwdata/hwdata_0.412.bb b/meta/recipes-support/hwdata/hwdata_0.413.bb
similarity index 93%
rename from meta/recipes-support/hwdata/hwdata_0.412.bb
rename to meta/recipes-support/hwdata/hwdata_0.413.bb
index c59654e138..cbda8816dd 100644
--- a/meta/recipes-support/hwdata/hwdata_0.412.bb
+++ b/meta/recipes-support/hwdata/hwdata_0.413.bb
@@ -8,7 +8,7 @@ LICENSE = "GPL-2.0-or-later OR X11"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=1556547711e8246992b999edd9445a57"
 
 SRC_URI = "git://github.com/vcrhonek/${BPN}.git;branch=master;protocol=https;tag=v${PV}"
-SRCREV = "816a9490ffcdad1929e0e53f79c500e1aeadd492"
+SRCREV = "1cf7032160ad57e2eaad36c4f23eede1edd8203b"
 
 inherit allarch
 

[PATCH 12/12] gtk4: upgrade 4.24.0 -> 4.24.1

[Jaipaul Cheernam]

NEWS: https://gitlab.gnome.org/GNOME/gtk/-/blob/4.24.1/NEWS

Overview of Changes in 4.24.1, 01-10-2026
=========================================

* Bugs fixed:
  - #8409 search-entry: Needs extra touch to show OSK although it has focus
    (Guido Günther)
  - #8419 text-input: Preedit gets cleared due to text-change-cause(1) (Guido
    Günther)
  - #8433 GtkSvgWidget can't parse '@media' if it is not on a new line (Matthias
    Clasen)
  - !10264 gtkmain: Split out debug code
  - !10367 gtkgstsink: release GL context on disposal (Pierre Berube)
  - !10369 Post-release version bump (Matthias Clasen)
  - !10372 Fix typo in CONTRIBUTING.md (Michael Fohqul)
  - !10385 texthandle: fix transformation issues & relative movement (Florian
    "sp1rit"​)
  - !10393 Fix typo ('witten' should be 'written') (ReinoutS)
  - !10395 searchbar: Show OSK when search-mode gets enabled (Guido Günther)
  - !10396 docs: Correct docs for allocation functions (Benjamin Otte)
  - !10398 textbuffer: Fix tag colors in accessible text attributes (Sean Rowe)
  - !10403 gtk/inscription: Refresh GtkInscription's PangoLayout when rooted
    (Christian Hergert)
  - !10409 text: Protect against invalid offset (Alessandro Astone)
  - !10414 macos: fix cursor keys (Arjan Molenaar)
  - !10421 various fixes (Benjamin Otte)
  - !10422 Norwegian Nynorsk translation. (Roy-Magne Mo)
  - !10423 gl: Create 2 fbos per frame instead of 1 per image (Benjamin Otte)
  - !10425 Update Norwegian nynorsk translation (Roy-Magne Mo)
  - !10429 textview: Make text handles visible after giving them a position
    (Carlos Garnacho)

* Translation updates:
  - Norwegian Nynorsk (Roy-Magne Mo)

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 meta/recipes-gnome/gtk+/{gtk4_4.24.0.bb => gtk4_4.24.1.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-gnome/gtk+/{gtk4_4.24.0.bb => gtk4_4.24.1.bb} (98%)

diff --git a/meta/recipes-gnome/gtk+/gtk4_4.24.0.bb b/meta/recipes-gnome/gtk+/gtk4_4.24.1.bb
similarity index 98%
rename from meta/recipes-gnome/gtk+/gtk4_4.24.0.bb
rename to meta/recipes-gnome/gtk+/gtk4_4.24.1.bb
index 08fd2c30b7..5a18c4bdf9 100644
--- a/meta/recipes-gnome/gtk+/gtk4_4.24.0.bb
+++ b/meta/recipes-gnome/gtk+/gtk4_4.24.1.bb
@@ -33,7 +33,7 @@ LIC_FILES_CHKSUM = " \
     file://tests/testgtk.c;endline=25;md5=49d06770681b8322466b52ed19d29fb2 \
 "
 
-SRC_URI[archive.sha256sum] = "28ba4ac1c04f86eac09b79a163cb163a4c2b54442d9f7eccc04679062a581044"
+SRC_URI[archive.sha256sum] = "e98abe720e16129c8c0f50761dee0a2e9ae2478055e31018f6cf977fcf6513e9"
 
 S = "${UNPACKDIR}/${GNOMEBN}-${PV}"
 

Patchtest results for [PATCH 02/12] librepo: upgrade 1.21.3 -> 1.22.0

[patchtest]

[-- Attachment #1: Type: text/plain, Size: 3150 bytes --]

Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:

---
Testing patch /home/patchtest/share/mboxes/02-12-librepo-upgrade-1.21.3---1.22.0.patch

FAIL: test commit message user tags: Mbox includes one or more GitHub-style username tags. Ensure that any "@" symbols are stripped out of usernames (test_mbox.TestMbox.test_commit_message_user_tags)

PASS: pretest src uri left files (test_metadata.TestMetadata.pretest_src_uri_left_files)
PASS: test CVE check ignore (test_metadata.TestMetadata.test_cve_check_ignore)
PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence)
PASS: test auh changelog truncation notice (test_mbox.TestMbox.test_auh_changelog_truncation_notice)
PASS: test author valid (test_mbox.TestMbox.test_author_valid)
PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence)
PASS: test lic files chksum modified not mentioned (test_metadata.TestMetadata.test_lic_files_chksum_modified_not_mentioned)
PASS: test max line length (test_metadata.TestMetadata.test_max_line_length)
PASS: test mbox format (test_mbox.TestMbox.test_mbox_format)
PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade)
PASS: test shortlog format (test_mbox.TestMbox.test_shortlog_format)
PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length)
PASS: test src uri left files (test_metadata.TestMetadata.test_src_uri_left_files)
PASS: test target mailing list (test_mbox.TestMbox.test_target_mailing_list)

SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint)
SKIP: test CVE tag format: No new source patches introduced (test_patch.TestPatch.test_cve_tag_format)
SKIP: test Signed-off-by presence: No new source patches introduced (test_patch.TestPatch.test_signed_off_by_presence)
SKIP: test Upstream-Status presence: No new source patches introduced (test_patch.TestPatch.test_upstream_status_presence_format)
SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format)
SKIP: test lic files chksum presence: No added recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_presence)
SKIP: test license presence: No added recipes, skipping test (test_metadata.TestMetadata.test_license_presence)
SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint)
SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head)
SKIP: test summary presence: No added recipes, skipping test (test_metadata.TestMetadata.test_summary_presence)

---

Please address the issues identified and
submit a new revision of the patch, or alternatively, reply to this
email with an explanation of why the patch should be accepted. If you
believe these results are due to an error in patchtest, please submit a
bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category
under 'Yocto Project Subprojects'). For more information on specific
failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank
you!

Patchtest results for [PATCH 12/12] gtk4: upgrade 4.24.0 -> 4.24.1

[patchtest]

[-- Attachment #1: Type: text/plain, Size: 3147 bytes --]

Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:

---
Testing patch /home/patchtest/share/mboxes/12-12-gtk4-upgrade-4.24.0---4.24.1.patch

FAIL: test commit message user tags: Mbox includes one or more GitHub-style username tags. Ensure that any "@" symbols are stripped out of usernames (test_mbox.TestMbox.test_commit_message_user_tags)

PASS: pretest src uri left files (test_metadata.TestMetadata.pretest_src_uri_left_files)
PASS: test CVE check ignore (test_metadata.TestMetadata.test_cve_check_ignore)
PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence)
PASS: test auh changelog truncation notice (test_mbox.TestMbox.test_auh_changelog_truncation_notice)
PASS: test author valid (test_mbox.TestMbox.test_author_valid)
PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence)
PASS: test lic files chksum modified not mentioned (test_metadata.TestMetadata.test_lic_files_chksum_modified_not_mentioned)
PASS: test max line length (test_metadata.TestMetadata.test_max_line_length)
PASS: test mbox format (test_mbox.TestMbox.test_mbox_format)
PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade)
PASS: test shortlog format (test_mbox.TestMbox.test_shortlog_format)
PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length)
PASS: test src uri left files (test_metadata.TestMetadata.test_src_uri_left_files)
PASS: test target mailing list (test_mbox.TestMbox.test_target_mailing_list)

SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint)
SKIP: test CVE tag format: No new source patches introduced (test_patch.TestPatch.test_cve_tag_format)
SKIP: test Signed-off-by presence: No new source patches introduced (test_patch.TestPatch.test_signed_off_by_presence)
SKIP: test Upstream-Status presence: No new source patches introduced (test_patch.TestPatch.test_upstream_status_presence_format)
SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format)
SKIP: test lic files chksum presence: No added recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_presence)
SKIP: test license presence: No added recipes, skipping test (test_metadata.TestMetadata.test_license_presence)
SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint)
SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head)
SKIP: test summary presence: No added recipes, skipping test (test_metadata.TestMetadata.test_summary_presence)

---

Please address the issues identified and
submit a new revision of the patch, or alternatively, reply to this
email with an explanation of why the patch should be accepted. If you
believe these results are due to an error in patchtest, please submit a
bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category
under 'Yocto Project Subprojects'). For more information on specific
failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank
you!

Re: [OE-core] [PATCH 05/12] python3-jsonpointer: upgrade 3.5 -> 3.8

[Mathieu Dubois-Briand]

On Tue Nov 3, 2026 at 10:27 AM CET, Jaipaul Cheernam wrote:
> CompareLog: https://github.com/stefankoegl/python-json-pointer/compare/v3.5...v3.8
>
> Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
> ---

Hi Jaipaul,

Thanks for the upgrades.

I can see some ptest failures here:

AssertionError:
Failed ptests:
{'python3-jsonpointer': 'START: ptest-runner\n'
                        '2026-11-03T21:12\n'
                        'ERROR: unittest.loader._FailedTest.tests\n'
                        'Traceback (most recent call last):\n'
                        '  File "/usr/lib/python3-jsonpointer/ptest/tests.py", '
                        'line 990, in load_tests\n'
                        '    '
                        "tests.addTests(doctest.DocFileSuite('doc/tutorial.rst'))\n"
                        '                   '
                        '~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^\n'
                        '  File "/usr/lib/python3.14/doctest.py", line 2636, '
                        'in DocFileSuite\n'
                        '    suite.addTest(DocFileTest(path, **kw))\n'
                        '                  ~~~~~~~~~~~^^^^^^^^^^^^\n'
                        '  File "/usr/lib/python3.14/doctest.py", line 2558, '
                        'in DocFileTest\n'
                        '    doc, path = _load_testfile(path, package, '
                        'module_relative,\n'
                        '                '
                        '~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n'
                        '                               encoding or "utf-8")\n'
                        '                               ^^^^^^^^^^^^^^^^^^^^\n'
                        '  File "/usr/lib/python3.14/doctest.py", line 255, in '
                        '_load_testfile\n'
                        '    file_contents = loader.get_data(filename)\n'
                        '  File "<frozen importlib._bootstrap_external>", line '
                        '954, in get_data\n'
                        'FileNotFoundError: [Errno 2] No such file or '
                        'directory: '
                        "'/usr/lib/python3-jsonpointer/ptest/doc/tutorial.rst'\n"
                        '============================================================================\n'
                        '\n'
                        '============================================================================\n'
                        'Testsuite summary\n'
                        '# TOTAL: 1\n'
                        '# PASS: 0\n'
                        '# SKIP: 0\n'
                        '# XFAIL: 0\n'
                        '# FAIL: 0\n'
                        '# XPASS: 0\n'
                        '# ERROR: 1\n'
                        '\n'
                        'ERROR: Exit status is 1\n'
                        'DURATION: 0\n'}

ptests which had no test results:
['python3-jsonpointer']

https://autobuilder.yoctoproject.org/valkyrie/#/builders/61/builds/4839
https://autobuilder.yoctoproject.org/valkyrie/#/builders/56/builds/2723
https://autobuilder.yoctoproject.org/valkyrie/#/builders/73/builds/4871
https://autobuilder.yoctoproject.org/valkyrie/#/builders/109/builds/1495
https://autobuilder.yoctoproject.org/valkyrie/#/builders/110/builds/1516

Can you have a look at the issues?

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

[PATCH v2] python3-jsonpointer: upgrade 3.5 -> 3.8

[Jaipaul Cheernam]

CompareLog: https://github.com/stefankoegl/python-json-pointer/compare/v3.5...v3.8

- install doc/*.rst into ptest; v3.8 tests.py now reads doc/tutorial.rst
  and doc/commandline.rst at runtime, introduced in [1]

Testsuite summary:
TOTAL: 84
PASS: 84
SKIP: 0
XFAIL: 0
FAIL: 0
XPASS: 0
ERROR: 0

[1] https://github.com/stefankoegl/python-json-pointer/commit/729bd881462f536746248188ca138fd758e910b0

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
Changes Since v1:
- install doc/*.rst into ptest

 ...{python3-jsonpointer_3.5.bb => python3-jsonpointer_3.8.bb} | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
 rename meta/recipes-devtools/python/{python3-jsonpointer_3.5.bb => python3-jsonpointer_3.8.bb} (78%)

diff --git a/meta/recipes-devtools/python/python3-jsonpointer_3.5.bb b/meta/recipes-devtools/python/python3-jsonpointer_3.8.bb
similarity index 78%
rename from meta/recipes-devtools/python/python3-jsonpointer_3.5.bb
rename to meta/recipes-devtools/python/python3-jsonpointer_3.8.bb
index dc39b0ea38..b9fdf6347e 100644
--- a/meta/recipes-devtools/python/python3-jsonpointer_3.5.bb
+++ b/meta/recipes-devtools/python/python3-jsonpointer_3.8.bb
@@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=32b15c843b7a329130f4e266a281ebb3"
 
 inherit pypi ptest setuptools3
 
-SRC_URI[sha256sum] = "81f28618a019cf1b011a6cf757439737972de1ccbeca2e1f86dfb4d661800792"
+SRC_URI[sha256sum] = "a627a255641390bfb4d51d4cfbb90648078ae855b45804ef7e19ea13a4cca355"
 
 SRC_URI += " \
 	file://run-ptest \
@@ -15,6 +15,8 @@ do_install_ptest() {
 	install -m 0644 ${S}/tests.py ${D}${PTEST_PATH}/
 	install -d ${D}${PTEST_PATH}/bin
 	install -m 0755 ${S}/bin/jsonpointer ${D}${PTEST_PATH}/bin/
+	install -d ${D}${PTEST_PATH}/doc
+	install -m 0644 ${S}/doc/*.rst ${D}${PTEST_PATH}/doc/
 }
 
 RDEPENDS:${PN} += " \