[Internal Review][OE-core][wrynose][PATCH 0/3] python3: upgrade to 3.14.8 and backport security fixes

[Internal Review][OE-core][wrynose][PATCH 0/3] python3: upgrade to 3.14.8 and backport security fixes

[Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Darsh Kelaiya <dkelaiya@cisco.com>

Upgrade Python 3.14.7 to 3.14.8 on Wrynose and backport fixes for
CVE-2025-15367 and CVE-2026-87910.

The 3.14.8 release addresses CVE-2026-19445, CVE-2026-19553,
CVE-2026-19672, CVE-2026-15310, CVE-2026-15806 and CVE-2026-17084.
The new test_append_limited_history ptest fails with the default
libedit backend on musl. Patch 1 skips only that test on musl while
the libedit interaction remains unresolved.

Patch 2 rejects control characters in POP3 commands to prevent command
injection. This changes behavior for clients whose passwords contain
those characters: they must replace the credentials and handle the new
ValueError as a credential error.

Patch 3 fixes tarfile extraction so a filter rejecting a link fallback
is honored. It also includes the upstream Windows test correction.

Darsh Kelaiya (2):
  python3: fix CVE-2025-15367
  python3: fix CVE-2026-87910

Vijay Anusuri (1):
  python3: upgrade 3.14.7 -> 3.14.8

 .../python/python3/CVE-2025-15367.patch       | 66 +++++++++++++
 .../python/python3/CVE-2026-87910_p1.patch    | 98 +++++++++++++++++++
 .../python/python3/CVE-2026-87910_p2.patch    | 55 +++++++++++
 .../{python3_3.14.7.bb => python3_3.14.8.bb}  |  8 +-
 4 files changed, 226 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-devtools/python/python3/CVE-2025-15367.patch
 create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-87910_p1.patch
 create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-87910_p2.patch
 rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.8.bb} (98%)

-- 
2.35.6

[OE-core][wrynose][PATCH 1/3] python3: upgrade 3.14.7 -> 3.14.8

[Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Vijay Anusuri <vanusuri@mvista.com>

Release information:
* https://www.python.org/downloads/release/python-3148/
* Python 3.14.8 is an expedited security release and the eighth
  maintenance release of 3.14, containing around 354 bugfixes,
  build improvements and documentation changes from 142 contributors
  since 3.14.7.

Handles CVE-2026-19445 CVE-2026-19553 CVE-2026-19672 CVE-2026-15310
CVE-2026-15806 CVE-2026-17084

Changelog: https://docs.python.org/3/whatsnew/changelog.html#python-3-14-8-final

Backport Changes:
- The new test_append_limited_history ptest fails on musl with the
  default libedit backend. libedit opens the history file for
  appending, then emits a header if ftell() reports offset zero.
  musl leaves the initial append stream at that offset, so a second
  _HiStOrY_V2_ header is appended and CPython's truncation keeps it
  in place of the expected history entry. Skip only that test on musl
  until the libedit interaction is fixed.

OE-Core failure report:
https://patchwork.yoctoproject.org/project/oe-core/patch/010101a0f6296539-d5cd290b-b68d-4632-a774-5263fa10249e-000000@us-west-2.amazonses.com/

Upstream issue:
https://github.com/python/cpython/issues/123018

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 .../python/{python3_3.14.7.bb => python3_3.14.8.bb}          | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
 rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.8.bb} (98%)

diff --git a/meta/recipes-devtools/python/python3_3.14.7.bb b/meta/recipes-devtools/python/python3_3.14.8.bb
similarity index 98%
rename from meta/recipes-devtools/python/python3_3.14.7.bb
rename to meta/recipes-devtools/python/python3_3.14.8.bb
index e73dc8d772..f10d6a5f4d 100644
--- a/meta/recipes-devtools/python/python3_3.14.7.bb
+++ b/meta/recipes-devtools/python/python3_3.14.8.bb
@@ -40,7 +40,7 @@ SRC_URI:append:class-native = " \
            file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \
            "
 
-SRC_URI[sha256sum] = "3b48dac8fb59f62eaa67ac83c1eb12bda1b7a08406dd286e252c11a66be27f81"
+SRC_URI[sha256sum] = "c2215904f02b175596dc49351585104f4bc20341e1c47378b26a2c274360ce73"
 
 # exclude pre-releases for both python 2.x and 3.x
 UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar"
@@ -263,6 +263,8 @@ SKIPPED_TESTS += " \
     --ignore test.test_tracemalloc.TestCAPI.test_tracemalloc_track_race \
 "
 
+# libedit treats musl's initial append-stream offset as an empty file,
+# appending a second history header (gh-123018).
 SKIPPED_TESTS:append:class-target:libc-musl = " \
     -x test__locale \
     -x test_c_locale_coercion \
@@ -272,6 +274,7 @@ SKIPPED_TESTS:append:class-target:libc-musl = " \
     -x test_threading \
     --ignore test.test_strptime.StrptimeTests.test_date_locale2 \
     --ignore test.test_ctypes.test_dlerror.TestNullDlsym.test_null_dlsym \
+    --ignore test.test_readline.TestHistoryManipulation.test_append_limited_history \
 "
 
 
-- 
2.35.6

[OE-core][wrynose][PATCH 2/3] python3: fix CVE-2025-15367

[Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Darsh Kelaiya <dkelaiya@cisco.com>

This patch applies the upstream fix shown in [1].
The advisory identifying the fix is referenced in [2].

CPython kept this change on main and deferred maintenance-branch
backports [3] because passwords containing control characters
such as tab or backspace could previously work. Wrynose takes the
compatibility change to prevent user-controlled POP3 arguments from
injecting extra commands. The new validation rejects C0 and DEL bytes
before sending a command.

Clients with affected stored credentials must replace those credentials
with ones free of control characters and handle the new ValueError with
a clear credential error. They must not silently strip password
characters or retry by bypassing the check.

[1] https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7
[2] https://nvd.nist.gov/vuln/detail/cve-2025-15367
[3] https://github.com/python/cpython/pull/143924

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 .../python/python3/CVE-2025-15367.patch       | 66 +++++++++++++++++++
 .../recipes-devtools/python/python3_3.14.8.bb |  1 +
 2 files changed, 67 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3/CVE-2025-15367.patch

diff --git a/meta/recipes-devtools/python/python3/CVE-2025-15367.patch b/meta/recipes-devtools/python/python3/CVE-2025-15367.patch
new file mode 100644
index 0000000000..21f2dfa7ed
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2025-15367.patch
@@ -0,0 +1,66 @@
+From cf799923a7a039d52432629c45ae7c603cc0b2d6 Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Tue, 20 Jan 2026 14:46:32 -0600
+Subject: [PATCH] gh-143923: Reject control characters in POP3 commands
+
+CVE: CVE-2025-15367
+Upstream-Status: Backport [https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7]
+
+(cherry picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ Lib/poplib.py                                             | 2 ++
+ Lib/test/test_poplib.py                                   | 8 ++++++++
+ .../2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst        | 1 +
+ 3 files changed, 11 insertions(+)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
+
+diff --git a/Lib/poplib.py b/Lib/poplib.py
+index 4469bff..b97274c 100644
+--- a/Lib/poplib.py
++++ b/Lib/poplib.py
+@@ -122,6 +122,8 @@ class POP3:
+     def _putcmd(self, line):
+         if self._debugging: print('*cmd*', repr(line))
+         line = bytes(line, self.encoding)
++        if re.search(b'[\x00-\x1F\x7F]', line):
++            raise ValueError('Control characters not allowed in commands')
+         self._putline(line)
+ 
+ 
+diff --git a/Lib/test/test_poplib.py b/Lib/test/test_poplib.py
+index ef2da97..18ca7cb 100644
+--- a/Lib/test/test_poplib.py
++++ b/Lib/test/test_poplib.py
+@@ -17,6 +17,7 @@ from test.support import socket_helper
+ from test.support import threading_helper
+ from test.support import asynchat
+ from test.support import asyncore
++from test.support import control_characters_c0
+ 
+ 
+ test_support.requires_working_socket(module=True)
+@@ -395,6 +396,13 @@ class TestPOP3Class(TestCase):
+         self.assertIsNone(self.client.sock)
+         self.assertIsNone(self.client.file)
+ 
++    def test_control_characters(self):
++        for c0 in control_characters_c0():
++            with self.assertRaises(ValueError):
++                self.client.user(f'user{c0}')
++            with self.assertRaises(ValueError):
++                self.client.pass_(f'{c0}pass')
++
+     @requires_ssl
+     def test_stls_capa(self):
+         capa = self.client.capa()
+diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
+new file mode 100644
+index 0000000..3cde4df
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
+@@ -0,0 +1 @@
++Reject control characters in POP3 commands.
+-- 
+2.35.6
+
diff --git a/meta/recipes-devtools/python/python3_3.14.8.bb b/meta/recipes-devtools/python/python3_3.14.8.bb
index f10d6a5f4d..6aa5514246 100644
--- a/meta/recipes-devtools/python/python3_3.14.8.bb
+++ b/meta/recipes-devtools/python/python3_3.14.8.bb
@@ -35,6 +35,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
            file://0001-Skip-flaky-test_default_timeout-tests.patch \
            file://0001-test_only_active_thread-skip-problematic-test.patch \
            file://0001-prefer-valid-entrypoints.patch \
+           file://CVE-2025-15367.patch \
            "
 SRC_URI:append:class-native = " \
            file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \
-- 
2.35.6

[OE-core][wrynose][PATCH 3/3] python3: fix CVE-2026-87910

[Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Darsh Kelaiya <dkelaiya@cisco.com>

This patch applies the upstream fix shown in [1]. The Windows test
correction is applied from [2]. The advisory identifying the fix is
referenced in [3].

[1] https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2
[2] https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b
[3] https://nvd.nist.gov/vuln/detail/cve-2026-87910

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 .../python/python3/CVE-2026-87910_p1.patch    | 98 +++++++++++++++++++
 .../python/python3/CVE-2026-87910_p2.patch    | 55 +++++++++++
 .../recipes-devtools/python/python3_3.14.8.bb |  2 +
 3 files changed, 155 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-87910_p1.patch
 create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-87910_p2.patch

diff --git a/meta/recipes-devtools/python/python3/CVE-2026-87910_p1.patch b/meta/recipes-devtools/python/python3/CVE-2026-87910_p1.patch
new file mode 100644
index 0000000000..9786e82619
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2026-87910_p1.patch
@@ -0,0 +1,98 @@
+From 19b8b2011fd1743841510e44b8e9e87f3a3f4ba0 Mon Sep 17 00:00:00 2001
+From: Petr Viktorin <encukou@gmail.com>
+Date: Fri, 11 Sep 2026 14:19:35 +0200
+Subject: [PATCH] gh-157265: tarfile: Honor None result of filter for link
+ fallbacks (GH-157266)
+
+Co-authored-by: Stan Ulbrych <stan@python.org>
+
+CVE: CVE-2026-87910
+Upstream-Status: Backport [https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2]
+
+(cherry picked from commit fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ Lib/tarfile.py                                |  4 ++-
+ Lib/test/test_tarfile.py                      | 31 +++++++++++++++++--
+ ...-09-10-13-38-11.gh-issue-157265.-vYuMp.rst |  3 ++
+ 3 files changed, 34 insertions(+), 4 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst
+
+diff --git a/Lib/tarfile.py b/Lib/tarfile.py
+index b7b4af15b1..89e1e9b218 100644
+--- a/Lib/tarfile.py
++++ b/Lib/tarfile.py
+@@ -2818,9 +2818,11 @@ class TarFile(object):
+                     "makelink_with_filter: if filter_function is not None, "
+                     + "extraction_root must also not be None")
+             try:
+-                filter_function(
++                filtered = filter_function(
+                     unfiltered.replace(name=tarinfo.name, deep=False),
+                     extraction_root)
++                if filtered is None:
++                    return
+                 filtered = filter_function(unfiltered, extraction_root)
+             except _FILTER_ERRORS as cause:
+                 raise LinkFallbackError(tarinfo, unfiltered.name) from cause
+diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
+index ab13ab34fc..c09592075b 100644
+--- a/Lib/test/test_tarfile.py
++++ b/Lib/test/test_tarfile.py
+@@ -4395,9 +4395,15 @@ class TestExtractionFilters(unittest.TestCase):
+         for filter in 'tar', 'fully_trusted':
+             with self.subTest(filter), self.check_context(arc.open(), filter):
+                 if not os_helper.can_symlink():
+-                    self.expect_file("a/t/dummy")
+-                    self.expect_file("b/")
+-                    self.expect_file("c/")
++                    if filter == 'tar':
++                        self.expect_exception(
++                            tarfile.LinkFallbackError,
++                            "link 'boom' would be extracted as a copy of "
++                            + "'c/escape', which was rejected")
++                    else:
++                        self.expect_file("a/t/dummy")
++                        self.expect_file("b/")
++                        self.expect_file("c/")
+                 else:
+                     self.expect_file("a/t/dummy")
+                     self.expect_file("b/")
+@@ -4576,6 +4582,25 @@ class TestExtractionFilters(unittest.TestCase):
+             if os_helper.can_chmod():
+                 self.assertFalse(path.stat().st_mode & stat.S_IWUSR)
+ 
++    @symlink_test
++    def test_extract_filters_target_none(self):
++        # Test that when extract() falls back to extracting (rather than
++        # linking) a hardlink target, the member is skipped if the filter
++        # returns None.
++        with ArchiveMaker() as arc:
++            arc.add('a/b/s', symlink_to='../escape')
++            arc.add('q', hardlink_to='a/b/s')
++        def filter_unsafe_members(member, path):
++            try:
++                return tarfile.data_filter(member, path)
++            except tarfile.FilterError as error:
++                return None
++        with self.check_context(arc.open(), filter_unsafe_members):
++            if os_helper.can_symlink():
++                self.expect_file('a/b/s', symlink_to='../escape')
++            else:
++                self.expect_file('a/b/')  # symlink is not extracted
++
+     def test_link_fallback_normalizes(self):
+         # Make sure hardlink fallbacks work for non-normalized paths for all
+         # filters
+diff --git a/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst b/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst
+new file mode 100644
+index 0000000000..ba27e47f73
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst
+@@ -0,0 +1,3 @@
++In :mod:`tarfile`, when extracting a link falls back to extracting a member
++of the archive, skip the member when the filter function returns None when
++called with the extracted member's name replaced with the link's.
+-- 
+2.35.6
+
diff --git a/meta/recipes-devtools/python/python3/CVE-2026-87910_p2.patch b/meta/recipes-devtools/python/python3/CVE-2026-87910_p2.patch
new file mode 100644
index 0000000000..fc97378719
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2026-87910_p2.patch
@@ -0,0 +1,55 @@
+From 8dd3fcd26e7effd2de3b3ec7709d80632b6acfc7 Mon Sep 17 00:00:00 2001
+From: Petr Viktorin <encukou@gmail.com>
+Date: Fri, 11 Sep 2026 19:54:41 +0200
+Subject: [PATCH] gh-157265: Adjust test for Windows (GH-157334)
+
+gh-157266: Adjust test for Windows
+
+On Windows (no symlinks, no hardlinks), the behaviour is
+the same as without the fix in GH-157266:
+- a/t/dummy is extracted
+- b/ is extracted
+- c/ is *not* created (the target, a/t, is not in the archive)
+- c/escape: c/ is created; escape is skipped (target,
+   c/../../link_here, is not in archive)
+- c is not recreated as a directory
+- boom is not created (target is c/escape, which falls back to
+  ..\..\link_here, which does not exist in archive)
+
+CVE: CVE-2026-87910
+Upstream-Status: Backport [https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b]
+
+(cherry picked from commit d9565e54b1fc6d63c5be9afd58114499128fa57b)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ Lib/test/test_tarfile.py | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
+index c09592075b..7e072d9090 100644
+--- a/Lib/test/test_tarfile.py
++++ b/Lib/test/test_tarfile.py
+@@ -4395,15 +4395,15 @@ class TestExtractionFilters(unittest.TestCase):
+         for filter in 'tar', 'fully_trusted':
+             with self.subTest(filter), self.check_context(arc.open(), filter):
+                 if not os_helper.can_symlink():
+-                    if filter == 'tar':
++                    if filter == 'fully_trusted' or sys.platform == "win32":
++                        self.expect_file("a/t/dummy")
++                        self.expect_file("b/")
++                        self.expect_file("c/")
++                    else:
+                         self.expect_exception(
+                             tarfile.LinkFallbackError,
+                             "link 'boom' would be extracted as a copy of "
+                             + "'c/escape', which was rejected")
+-                    else:
+-                        self.expect_file("a/t/dummy")
+-                        self.expect_file("b/")
+-                        self.expect_file("c/")
+                 else:
+                     self.expect_file("a/t/dummy")
+                     self.expect_file("b/")
+-- 
+2.35.6
+
diff --git a/meta/recipes-devtools/python/python3_3.14.8.bb b/meta/recipes-devtools/python/python3_3.14.8.bb
index 6aa5514246..2bf2806ee8 100644
--- a/meta/recipes-devtools/python/python3_3.14.8.bb
+++ b/meta/recipes-devtools/python/python3_3.14.8.bb
@@ -36,6 +36,8 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
            file://0001-test_only_active_thread-skip-problematic-test.patch \
            file://0001-prefer-valid-entrypoints.patch \
            file://CVE-2025-15367.patch \
+           file://CVE-2026-87910_p1.patch \
+           file://CVE-2026-87910_p2.patch \
            "
 SRC_URI:append:class-native = " \
            file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \
-- 
2.35.6

Re: [OE-core][wrynose][PATCH 0/3] python3: upgrade to 3.14.8 and backport security fixes

[Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)]

[-- Attachment #1: Type: text/plain, Size: 2310 bytes --]

Hi all,

The [Internal Review] prefix in the cover-letter subject was
included by mistake. This series is intended for review and
inclusion in Wrynose.

Sorry for the confusion.

Regards,
Darsh
________________________________
From: Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) <dkelaiya@cisco.com>
Sent: 16 October 2026 11:09
To: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Cc: Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) <dkelaiya@cisco.com>
Subject: [Internal Review][OE-core][wrynose][PATCH 0/3] python3: upgrade to 3.14.8 and backport security fixes

From: Darsh Kelaiya <dkelaiya@cisco.com>

Upgrade Python 3.14.7 to 3.14.8 on Wrynose and backport fixes for
CVE-2025-15367 and CVE-2026-87910.

The 3.14.8 release addresses CVE-2026-19445, CVE-2026-19553,
CVE-2026-19672, CVE-2026-15310, CVE-2026-15806 and CVE-2026-17084.
The new test_append_limited_history ptest fails with the default
libedit backend on musl. Patch 1 skips only that test on musl while
the libedit interaction remains unresolved.

Patch 2 rejects control characters in POP3 commands to prevent command
injection. This changes behavior for clients whose passwords contain
those characters: they must replace the credentials and handle the new
ValueError as a credential error.

Patch 3 fixes tarfile extraction so a filter rejecting a link fallback
is honored. It also includes the upstream Windows test correction.

Darsh Kelaiya (2):
  python3: fix CVE-2025-15367
  python3: fix CVE-2026-87910

Vijay Anusuri (1):
  python3: upgrade 3.14.7 -> 3.14.8

 .../python/python3/CVE-2025-15367.patch       | 66 +++++++++++++
 .../python/python3/CVE-2026-87910_p1.patch    | 98 +++++++++++++++++++
 .../python/python3/CVE-2026-87910_p2.patch    | 55 +++++++++++
 .../{python3_3.14.7.bb => python3_3.14.8.bb}  |  8 +-
 4 files changed, 226 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-devtools/python/python3/CVE-2025-15367.patch
 create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-87910_p1.patch
 create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-87910_p2.patch
 rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.8.bb} (98%)

--
2.35.6

[-- Attachment #2: Type: text/html, Size: 4965 bytes --]

Re: [OE-core][wrynose][PATCH 1/3] python3: upgrade 3.14.7 -> 3.14.8

[Yoann Congal]

On Fri Oct 16, 2026 at 7:39 AM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Vijay Anusuri <vanusuri@mvista.com>
>
> Release information:
> * https://www.python.org/downloads/release/python-3148/
> * Python 3.14.8 is an expedited security release and the eighth
>   maintenance release of 3.14, containing around 354 bugfixes,
>   build improvements and documentation changes from 142 contributors
>   since 3.14.7.
>
> Handles CVE-2026-19445 CVE-2026-19553 CVE-2026-19672 CVE-2026-15310
> CVE-2026-15806 CVE-2026-17084
>
> Changelog: https://docs.python.org/3/whatsnew/changelog.html#python-3-14-8-final
>
> Backport Changes:
> - The new test_append_limited_history ptest fails on musl with the
>   default libedit backend. libedit opens the history file for
>   appending, then emits a header if ftell() reports offset zero.
>   musl leaves the initial append stream at that offset, so a second
>   _HiStOrY_V2_ header is appended and CPython's truncation keeps it
>   in place of the expected history entry. Skip only that test on musl
>   until the libedit interaction is fixed.
>
> OE-Core failure report:
> https://patchwork.yoctoproject.org/project/oe-core/patch/010101a0f6296539-d5cd290b-b68d-4632-a774-5263fa10249e-000000@us-west-2.amazonses.com/
>
> Upstream issue:
> https://github.com/python/cpython/issues/123018
>
> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
> ---
>  .../python/{python3_3.14.7.bb => python3_3.14.8.bb}          | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>  rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.8.bb} (98%)

This series can only be reviewed for wrynose once python3 upgraded on
master and blacksail (both 3.14.7 right now)

I think I saw 2 attempts to upgrade on master and none yet for blacksail:
* python3: upgrade 3.14.7 -> 3.14.8 - Patchwork
  https://patchwork.yoctoproject.org/project/oe-core/patch/20261008090135.1485765-1-vanusuri@mvista.com/
* [v2,2/2] python3: upgrade 3.14.7 -> 3.15.0 - Patchwork
  https://patchwork.yoctoproject.org/project/oe-core/patch/20261012103426.3090-2-jaipaul.cheernam@est.tech/

Maybe you can help by reviewing master's patch and, then, sending
blacksail backports?

Regards,
-- 
Yoann Congal
Smile ECS