Build with mbedtls-3.6.5 instead of bundled 3.6.2 to fix CVE-2025-59438

- Version 1.26.0
  * Added machine.I2CTarget for creating I2C target devices on multiple ports.
  * New MCU support: STM32N6xx (800 MHz, ML accel) & ESP32-C2 (WiFi + BLE).
  * Major float accuracy boost (~28% → ~98%), constant folding in compiler.
  * Optimized native/Viper emitters; reduced heap use for slices.
  * Time functions standardized (1970–2099); new boards across ESP32, SAMD, STM32, Zephyr.
  * ESP32: ESP-IDF 5.4.2, flash auto-detect, PCNT class, LAN8670 PHY.
  * RP2: compressed errors, better lightsleep, hard IRQ timers.
  * Zephyr v4.0.0: PWM, SoftI2C/SPI, BLE runtime services, boot.py/main.py support.
  * mpremote adds fs tree, improved df, portable config paths.
  * Updated lwIP, LittleFS, libhydrogen, stm32lib; expanded hardware/CI tests.
- Removed micropython-gcc15-string-initialization.patch as included upstream

OBS-URL: https://build.opensuse.org/request/show/1299777
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/micropython?expand=0&rev=22

fix_re_sub_test_on_python3.13.patch

@@ -1,46 +0,0 @@
-From e73cf71a246ee456aac0f4d16167e0856846db6b Mon Sep 17 00:00:00 2001
-From: Alessandro Gatti <a.gatti@frob.it>
-Date: Sat, 4 Jan 2025 15:00:28 +0100
-Subject: [PATCH] tests/extmod/re_sub.py: Fix test execution on Python 3.13.
-
-This commit fixes a test failure for `extmod/re_sub.py` where the code,
-whilst being correct, would not make the test pass due to a newer
-Python version than expected.
-
-On Python 3.13, running `tests/extmod/re_sub.py` would yield a
-deprecation warning about `re.sub` not providing the match count as a
-keyword parameter.  This warning would be embedded in the expected test
-result and thus the test would always fail.
-
-Co-authored-by: stijn <stijn@ignitron.net>
-Signed-off-by: Alessandro Gatti <a.gatti@frob.it>
----
- tests/extmod/re_sub.py | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/tests/extmod/re_sub.py b/tests/extmod/re_sub.py
-index 2c7c6c10f1a49..ecaa66d83d8a7 100644
---- a/tests/extmod/re_sub.py
-+++ b/tests/extmod/re_sub.py
-@@ -10,6 +10,8 @@
-     print("SKIP")
-     raise SystemExit
- 
-+import sys
-+
- 
- def multiply(m):
-     return str(int(m.group(0)) * 2)
-@@ -47,7 +49,11 @@ def A():
- print(re.sub("a", "b", "c"))
- 
- # with maximum substitution count specified
--print(re.sub("a", "b", "1a2a3a", 2))
-+if sys.implementation.name != "micropython":
-+    # On CPython 3.13 and later the substitution count must be a keyword argument.
-+    print(re.sub("a", "b", "1a2a3a", count=2))
-+else:
-+    print(re.sub("a", "b", "1a2a3a", 2))
- 
- # invalid group
- try:

micropython-gcc15-string-initialization.patch

@@ -1,231 +0,0 @@
-From 531d4839d44a90447c232d51d1bee0cae45add9a Mon Sep 17 00:00:00 2001
-From: Angus Gratton <angus@redyak.com.au>
-Date: Fri, 9 May 2025 13:34:37 +1000
-Subject: [PATCH 1/3] extmod/moductypes: Refactor string literal as array
- initializer.
-
-Avoids the new Wunterminated-string-literal when compiled with gcc 15.1.
-
-Also split out the duplicate string to a top-level array (probably the
-duplicate string literal was interned, so unlikely to have any impact.)
-
-This work was funded through GitHub Sponsors.
-
-Signed-off-by: Angus Gratton <angus@redyak.com.au>
----
- extmod/moductypes.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/extmod/moductypes.c b/extmod/moductypes.c
-index bf45797658fa0..54abce79e06fe 100644
---- a/extmod/moductypes.c
-+++ b/extmod/moductypes.c
-@@ -277,15 +277,18 @@ static mp_obj_t uctypes_struct_sizeof(size_t n_args, const mp_obj_t *args) {
- }
- static MP_DEFINE_CONST_FUN_OBJ_VAR_BETWEEN(uctypes_struct_sizeof_obj, 1, 2, uctypes_struct_sizeof);
- 
-+static const char type2char[16] = {
-+    'B', 'b', 'H', 'h', 'I', 'i', 'Q', 'q',
-+    '-', '-', '-', '-', '-', '-', 'f', 'd'
-+};
-+
- static inline mp_obj_t get_unaligned(uint val_type, byte *p, int big_endian) {
-     char struct_type = big_endian ? '>' : '<';
--    static const char type2char[16] = "BbHhIiQq------fd";
-     return mp_binary_get_val(struct_type, type2char[val_type], p, &p);
- }
- 
- static inline void set_unaligned(uint val_type, byte *p, int big_endian, mp_obj_t val) {
-     char struct_type = big_endian ? '>' : '<';
--    static const char type2char[16] = "BbHhIiQq------fd";
-     mp_binary_set_val(struct_type, type2char[val_type], val, p, &p);
- }
- 
-
-From 0398873d8c8096d2054db130efd1fcecba2a426d Mon Sep 17 00:00:00 2001
-From: Angus Gratton <angus@redyak.com.au>
-Date: Fri, 9 May 2025 13:36:05 +1000
-Subject: [PATCH 2/3] py/emitinlinethumb: Refactor string literal as array
- initializer.
-
-Avoids the new Wunterminated-string-literal when compiled with gcc 15.1.
-
-This work was funded through GitHub Sponsors.
-
-Signed-off-by: Angus Gratton <angus@redyak.com.au>
----
- py/emitinlinethumb.c | 108 +++++++++++++++++++++----------------------
- 1 file changed, 54 insertions(+), 54 deletions(-)
-
-diff --git a/py/emitinlinethumb.c b/py/emitinlinethumb.c
-index 7818bb4f46da8..d6596337ae5a6 100644
---- a/py/emitinlinethumb.c
-+++ b/py/emitinlinethumb.c
-@@ -150,27 +150,27 @@ typedef struct _reg_name_t { byte reg;
-                              byte name[3];
- } reg_name_t;
- static const reg_name_t reg_name_table[] = {
--    {0, "r0\0"},
--    {1, "r1\0"},
--    {2, "r2\0"},
--    {3, "r3\0"},
--    {4, "r4\0"},
--    {5, "r5\0"},
--    {6, "r6\0"},
--    {7, "r7\0"},
--    {8, "r8\0"},
--    {9, "r9\0"},
--    {10, "r10"},
--    {11, "r11"},
--    {12, "r12"},
--    {13, "r13"},
--    {14, "r14"},
--    {15, "r15"},
--    {10, "sl\0"},
--    {11, "fp\0"},
--    {13, "sp\0"},
--    {14, "lr\0"},
--    {15, "pc\0"},
-+    {0, {'r', '0' }},
-+    {1, {'r', '1' }},
-+    {2, {'r', '2' }},
-+    {3, {'r', '3' }},
-+    {4, {'r', '4' }},
-+    {5, {'r', '5' }},
-+    {6, {'r', '6' }},
-+    {7, {'r', '7' }},
-+    {8, {'r', '8' }},
-+    {9, {'r', '9' }},
-+    {10, {'r', '1', '0' }},
-+    {11, {'r', '1', '1' }},
-+    {12, {'r', '1', '2' }},
-+    {13, {'r', '1', '3' }},
-+    {14, {'r', '1', '4' }},
-+    {15, {'r', '1', '5' }},
-+    {10, {'s', 'l' }},
-+    {11, {'f', 'p' }},
-+    {13, {'s', 'p' }},
-+    {14, {'l', 'r' }},
-+    {15, {'p', 'c' }},
- };
- 
- #define MAX_SPECIAL_REGISTER_NAME_LENGTH 7
-@@ -368,20 +368,20 @@ typedef struct _cc_name_t { byte cc;
-                             byte name[2];
- } cc_name_t;
- static const cc_name_t cc_name_table[] = {
--    { ASM_THUMB_CC_EQ, "eq" },
--    { ASM_THUMB_CC_NE, "ne" },
--    { ASM_THUMB_CC_CS, "cs" },
--    { ASM_THUMB_CC_CC, "cc" },
--    { ASM_THUMB_CC_MI, "mi" },
--    { ASM_THUMB_CC_PL, "pl" },
--    { ASM_THUMB_CC_VS, "vs" },
--    { ASM_THUMB_CC_VC, "vc" },
--    { ASM_THUMB_CC_HI, "hi" },
--    { ASM_THUMB_CC_LS, "ls" },
--    { ASM_THUMB_CC_GE, "ge" },
--    { ASM_THUMB_CC_LT, "lt" },
--    { ASM_THUMB_CC_GT, "gt" },
--    { ASM_THUMB_CC_LE, "le" },
-+    { ASM_THUMB_CC_EQ, { 'e', 'q' }},
-+    { ASM_THUMB_CC_NE, { 'n', 'e' }},
-+    { ASM_THUMB_CC_CS, { 'c', 's' }},
-+    { ASM_THUMB_CC_CC, { 'c', 'c' }},
-+    { ASM_THUMB_CC_MI, { 'm', 'i' }},
-+    { ASM_THUMB_CC_PL, { 'p', 'l' }},
-+    { ASM_THUMB_CC_VS, { 'v', 's' }},
-+    { ASM_THUMB_CC_VC, { 'v', 'c' }},
-+    { ASM_THUMB_CC_HI, { 'h', 'i' }},
-+    { ASM_THUMB_CC_LS, { 'l', 's' }},
-+    { ASM_THUMB_CC_GE, { 'g', 'e' }},
-+    { ASM_THUMB_CC_LT, { 'l', 't' }},
-+    { ASM_THUMB_CC_GT, { 'g', 't' }},
-+    { ASM_THUMB_CC_LE, { 'l', 'e' }},
- };
- 
- typedef struct _format_4_op_t { byte op;
-@@ -389,21 +389,21 @@ typedef struct _format_4_op_t { byte op;
- } format_4_op_t;
- #define X(x) (((x) >> 4) & 0xff) // only need 1 byte to distinguish these ops
- static const format_4_op_t format_4_op_table[] = {
--    { X(ASM_THUMB_FORMAT_4_EOR), "eor" },
--    { X(ASM_THUMB_FORMAT_4_LSL), "lsl" },
--    { X(ASM_THUMB_FORMAT_4_LSR), "lsr" },
--    { X(ASM_THUMB_FORMAT_4_ASR), "asr" },
--    { X(ASM_THUMB_FORMAT_4_ADC), "adc" },
--    { X(ASM_THUMB_FORMAT_4_SBC), "sbc" },
--    { X(ASM_THUMB_FORMAT_4_ROR), "ror" },
--    { X(ASM_THUMB_FORMAT_4_TST), "tst" },
--    { X(ASM_THUMB_FORMAT_4_NEG), "neg" },
--    { X(ASM_THUMB_FORMAT_4_CMP), "cmp" },
--    { X(ASM_THUMB_FORMAT_4_CMN), "cmn" },
--    { X(ASM_THUMB_FORMAT_4_ORR), "orr" },
--    { X(ASM_THUMB_FORMAT_4_MUL), "mul" },
--    { X(ASM_THUMB_FORMAT_4_BIC), "bic" },
--    { X(ASM_THUMB_FORMAT_4_MVN), "mvn" },
-+    { X(ASM_THUMB_FORMAT_4_EOR), {'e', 'o', 'r' }},
-+    { X(ASM_THUMB_FORMAT_4_LSL), {'l', 's', 'l' }},
-+    { X(ASM_THUMB_FORMAT_4_LSR), {'l', 's', 'r' }},
-+    { X(ASM_THUMB_FORMAT_4_ASR), {'a', 's', 'r' }},
-+    { X(ASM_THUMB_FORMAT_4_ADC), {'a', 'd', 'c' }},
-+    { X(ASM_THUMB_FORMAT_4_SBC), {'s', 'b', 'c' }},
-+    { X(ASM_THUMB_FORMAT_4_ROR), {'r', 'o', 'r' }},
-+    { X(ASM_THUMB_FORMAT_4_TST), {'t', 's', 't' }},
-+    { X(ASM_THUMB_FORMAT_4_NEG), {'n', 'e', 'g' }},
-+    { X(ASM_THUMB_FORMAT_4_CMP), {'c', 'm', 'p' }},
-+    { X(ASM_THUMB_FORMAT_4_CMN), {'c', 'm', 'n' }},
-+    { X(ASM_THUMB_FORMAT_4_ORR), {'o', 'r', 'r' }},
-+    { X(ASM_THUMB_FORMAT_4_MUL), {'m', 'u', 'l' }},
-+    { X(ASM_THUMB_FORMAT_4_BIC), {'b', 'i', 'c' }},
-+    { X(ASM_THUMB_FORMAT_4_MVN), {'m', 'v', 'n' }},
- };
- #undef X
- 
-@@ -428,10 +428,10 @@ typedef struct _format_vfp_op_t {
-     char name[3];
- } format_vfp_op_t;
- static const format_vfp_op_t format_vfp_op_table[] = {
--    { 0x30, "add" },
--    { 0x34, "sub" },
--    { 0x20, "mul" },
--    { 0x80, "div" },
-+    { 0x30, {'a', 'd', 'd' }},
-+    { 0x34, {'s', 'u', 'b' }},
-+    { 0x20, {'m', 'u', 'l' }},
-+    { 0x80, {'d', 'i', 'v' }},
- };
- 
- // shorthand alias for whether we allow ARMv7-M instructions
-
-From bfd5a0350a0d53f52695d373dae6ee367971b145 Mon Sep 17 00:00:00 2001
-From: Angus Gratton <angus@redyak.com.au>
-Date: Fri, 9 May 2025 14:34:09 +1000
-Subject: [PATCH 3/3] lib/littlefs: Fix string initializer in lfs1.c.
-
-Avoids the new Wunterminated-string-literal when compiled with gcc 15.1.
-
-It would be preferable to just disable this warning, but Clang
--Wunknown-warning-option kicks in even when disabling warnings so this
-becomes fiddly to apply.
-
-This work was funded through GitHub Sponsors.
-
-Signed-off-by: Angus Gratton <angus@redyak.com.au>
----
- lib/littlefs/lfs1.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/littlefs/lfs1.c b/lib/littlefs/lfs1.c
-index 6a3fd670012cc..ec18dc470258c 100644
---- a/lib/littlefs/lfs1.c
-+++ b/lib/littlefs/lfs1.c
-@@ -2141,7 +2141,7 @@ int lfs1_format(lfs1_t *lfs1, const struct lfs1_config *cfg) {
-             .d.elen = sizeof(superblock.d) - sizeof(superblock.d.magic) - 4,
-             .d.nlen = sizeof(superblock.d.magic),
-             .d.version = LFS1_DISK_VERSION,
--            .d.magic = {"littlefs"},
-+            .d.magic = {'l', 'i', 't', 't', 'l', 'e', 'f', 's'},
-             .d.block_size  = lfs1->cfg->block_size,
-             .d.block_count = lfs1->cfg->block_count,
-             .d.root = {lfs1->root[0], lfs1->root[1]},

micropython.changes

@@ -1,3 +1,24 @@
+-------------------------------------------------------------------
+Wed Oct 22 12:19:48 UTC 2025 - Dominik Heidler <dheidler@suse.de>
+
+- Build with mbedtls-3.6.5 instead of bundled 3.6.2 to fix CVE-2025-59438
+
+-------------------------------------------------------------------
+Fri Aug 15 08:13:39 UTC 2025 - Dominik Heidler <dheidler@suse.de>
+
+- Version 1.26.0
+  * Added machine.I2CTarget for creating I2C target devices on multiple ports.
+  * New MCU support: STM32N6xx (800 MHz, ML accel) & ESP32-C2 (WiFi + BLE).
+  * Major float accuracy boost (~28% → ~98%), constant folding in compiler.
+  * Optimized native/Viper emitters; reduced heap use for slices.
+  * Time functions standardized (1970–2099); new boards across ESP32, SAMD, STM32, Zephyr.
+  * ESP32: ESP-IDF 5.4.2, flash auto-detect, PCNT class, LAN8670 PHY.
+  * RP2: compressed errors, better lightsleep, hard IRQ timers.
+  * Zephyr v4.0.0: PWM, SoftI2C/SPI, BLE runtime services, boot.py/main.py support.
+  * mpremote adds fs tree, improved df, portable config paths.
+  * Updated lwIP, LittleFS, libhydrogen, stm32lib; expanded hardware/CI tests.
+- Removed micropython-gcc15-string-initialization.patch as included upstream
+
 -------------------------------------------------------------------
 Thu Jul 10 20:22:14 UTC 2025 - Atri Bhattacharya <badshah400@gmail.com>
 

micropython.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package micropython
 #
-# Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2025 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -20,15 +20,14 @@
 %{?sle15_python_module_pythons}
 
 Name:           micropython
-Version:        1.25.0
+Version:        1.26.0
 Release:        0
 Summary:        Implementation of Python 3 with very low memory footprint
 License:        MIT
 URL:            https://micropython.org/
 Source0:        %{name}-%{version}.tar.xz
 Source1:        prepare.sh
-# PATCH-FIX-UPSTREAM
-Patch0:         https://patch-diff.githubusercontent.com/raw/micropython/micropython/pull/17269.patch#/micropython-gcc15-string-initialization.patch
+Source2:        https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-3.6.5/mbedtls-3.6.5.tar.bz2#/mbedtls-3.6.5.tar.bz2
 BuildRequires:  openssl
 BuildRequires:  pkgconfig
 BuildRequires:  python3
@@ -67,12 +66,15 @@ MicroPython tools like the mpy-cross compiler for compiling.py files to .mpy fil
 Also mpy-tool for inspecting .mpy files.
 
 %prep
-%autosetup -p1
+%autosetup -p1 -a2
 
 sed -i -e "s:/usr/lib/micropython:%{_prefix}/lib/micropython:g" "ports/unix/main.c"
 
 %define make_flags V=1 MICROPY_PY_BTREE=0 MICROPY_PY_USSL=0
 
+rm -rf lib/mbedtls
+mv mbedtls-3.6.5 lib/mbedtls
+
 %build
 # micropython
 export CFLAGS="%optflags -Wno-dangling-pointer"