On Wed, Sep 2, 2026 at 06:31 PM, Yoann Congal wrote:

> 
> On Wed Aug 19, 2026 at 7:08 AM CEST, Darsh Kelaiya -X (dkelaiya - E
> INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> 
>> From: Darsh Kelaiya <dkelaiya@cisco.com>
>> 
>> This patch applies the upstream fix as referenced in [4], using all the
>> backported commits shown in [1], [2], and [3].
>> 
>> [1] https://github.com/gitpython-developers/GitPython/commit/142195888e713542189533a52cdfc333f05c3af6
>> 
>> [2] https://github.com/gitpython-developers/GitPython/commit/9aed7cf8c20f69effcfcf7ebef09f312f73ab826
>> 
>> [3] https://github.com/gitpython-developers/GitPython/commit/43d92dec4683568d11495956dd556161f17c3ea8
>> 
>> [4] https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4
>> 
>> 
>> Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
>> ---
>> .../python3-git/CVE-2026-42215_p1.patch | 60 +++++++++++++++++++
>> .../python3-git/CVE-2026-42215_p2.patch | 29 +++++++++
>> .../python3-git/CVE-2026-42215_p3.patch | 45 ++++++++++++++
>> .../python/python3-git_3.1.43.bb | 3 +
>> 4 files changed, 137 insertions(+)
>> create mode 100644
>> meta/recipes-devtools/python/python3-git/CVE-2026-42215_p1.patch
>> create mode 100644
>> meta/recipes-devtools/python/python3-git/CVE-2026-42215_p2.patch
>> create mode 100644
>> meta/recipes-devtools/python/python3-git/CVE-2026-42215_p3.patch
>> 
>> diff --git
>> a/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p1.patch
>> b/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p1.patch
>> new file mode 100644
>> index 0000000000..0129250fdf
>> --- /dev/null
>> +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p1.patch
>> @@ -0,0 +1,60 @@
>> +From dd5d1c4ddcc5d44faf4e71bcfa338f09db2022d6 Mon Sep 17 00:00:00 2001
>> +From: w <w@mac.lan>
>> +Date: Mon, 20 Apr 2026 23:29:50 -0400
>> +Subject: [PATCH] Block unsafe underscored git kwargs / Fix for
>> + GHSA-rpm5-65cw-6hj4
>> +
>> +CVE: CVE-2026-42215
>> +Upstream-Status: Backport [ https://github.com/gitpython-developers/GitPython/commit/142195888e713542189533a52cdfc333f05c3af6
>> ]
>> +
>> +Backport Changes:
>> +- Omitted test/test_clone.py, test/test_git.py, and
>> + test/test_remote.py because the PyPI 3.1.43 source used by the
>> + recipe does not ship the upstream test tree.
>> +
>> +(cherry picked from commit 142195888e713542189533a52cdfc333f05c3af6)
>> +Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
>> +---
>> + git/cmd.py | 21 +++++++++++++--------
>> + 1 file changed, 13 insertions(+), 8 deletions(-)
>> +
>> [...]
>> diff --git
>> a/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p2.patch
>> b/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p2.patch
>> new file mode 100644
>> index 0000000000..4326bede07
>> --- /dev/null
>> +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p2.patch
>> @@ -0,0 +1,29 @@
>> +From e77461e6953a67f17ecd1808c352e6613a17345b Mon Sep 17 00:00:00 2001
>> +From: w <w@mac.lan>
>> +Date: Mon, 20 Apr 2026 23:43:59 -0400
>> +Subject: [PATCH] linter fix
>> +
>> +CVE: CVE-2026-42215
>> +Upstream-Status: Backport [ https://github.com/gitpython-developers/GitPython/commit/9aed7cf8c20f69effcfcf7ebef09f312f73ab826
>> ]
>> +
>> +(cherry picked from commit 9aed7cf8c20f69effcfcf7ebef09f312f73ab826)
>> +Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
>> +---
>> + git/cmd.py | 4 +---
>> + 1 file changed, 1 insertion(+), 3 deletions(-)
>> +
>> +diff --git a/git/cmd.py b/git/cmd.py
>> +index 2ecb8e66..372eac28 100644
>> +--- a/git/cmd.py
>> ++++ b/git/cmd.py
>> +@@ -729,9 +729,7 @@ class Git(metaclass=_GitMeta):
>> + for option in options:
>> + unsafe_option =
>> canonical_unsafe_options.get(cls._canonicalize_option_name(option))
>> + if unsafe_option is not None:
>> +- raise UnsafeOptionError(
>> +- f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to
>> allow it."
>> +- )
>> ++ raise UnsafeOptionError(f"{unsafe_option} is not allowed, use
>> `allow_unsafe_options=True` to allow it.")
>> +
>> + class AutoInterrupt:
>> + """Process wrapper that terminates the wrapped process on finalization.
> 
> Hello,
> 
> I don't think we need this "linter fix" _p2 patch. If that works, can you
> send a v2 without it?
> 
> Same for the scarthgap patch.
> 
> Thanks!
> --
> Yoann Congal
> Smile ECS

Hi Yoann,

Thanks for the review.

I've sent v2 patches for Wrynose [1] and Scarthgap [2] as requested.

[1] https://lists.openembedded.org/g/openembedded-core/topic/wrynose_patch_v2_2_4/121083416
[2] https://lists.openembedded.org/g/openembedded-core/topic/scarthgap_patch_v2_2_4/121083408

Regards,
Darsh Kelaiya