Commit Graph

80 Commits

Author SHA256 Message Date
06a5cb31be Accepting request 1220158 from devel:languages:python:Factory
- Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
  path names provided when creating a virtual environment
  (bsc#1232241, CVE-2024-9287)

OBS-URL: https://build.opensuse.org/request/show/1220158
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python312?expand=0&rev=23
2024-11-03 06:17:02 +00:00
803cb95998 Update the patch
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=79
2024-11-02 00:55:18 +00:00
cd88adc808 - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
path names provided when creating a virtual environment
  (bsc#1232241, CVE-2024-9287)

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=78
2024-10-25 13:01:30 +00:00
118ac765b0 Accepting request 1205549 from devel:languages:python:Factory
- Update to 3.12.7:
  - Tests
    - gh-124378: Updated test_ttk to pass with Tcl/Tk 8.6.15.
  - Security
    - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
      consistently use the mapped IPv4 address value for deciding
      properties. Properties which have their behavior fixed are
      is_multicast, is_reserved, is_link_local, is_global, and
      is_unspecified.
  - Library
    - gh-116850: Fix argparse for namespaces with not directly
      writable dict (e.g. classes).
    - gh-58573: Fix conflicts between abbreviated long options in
      the parent parser and subparsers in argparse.
    - gh-61181: Fix support of choices with string value in
      argparse. Substrings of the specified string no longer
      considered valid values.
    - gh-80259: Fix argparse support of positional arguments with
      nargs='?', default=argparse.SUPPRESS and specified type.
    - gh-124498: Fix typing.TypeAliasType not to be generic, when
      type_params is an empty tuple.
    - gh-124345: argparse vim supports abbreviated single-dash
      long options separated by = from its value.
    - gh-104860: Fix disallowing abbreviation of single-dash long
      options in argparse with allow_abbrev=False.
    - gh-63143: Fix parsing mutually exclusive arguments in
      argparse. Arguments with the value identical to the default
      value (e.g. booleans, small integers, empty or 1-character
      strings) are no longer considered “not present”.
    - gh-72795: Positional arguments with nargs equal to '*' or

OBS-URL: https://build.opensuse.org/request/show/1205549
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python312?expand=0&rev=22
2024-10-06 15:51:43 +00:00
2f2e126886 Fix the changelog
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=76
2024-10-03 15:01:05 +00:00
8c2f054df4 Fix the command
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=75
2024-10-01 23:45:48 +00:00
957ff77855 Fix the command
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=74
2024-10-01 23:44:23 +00:00
2aeb619628 Fix the command
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=73
2024-10-01 23:40:43 +00:00
38ff7e3150 Fix the command
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=72
2024-10-01 21:16:07 +00:00
ec208c83f9 - Update to 3.12.7:
- Tests
    - gh-124378: Updated test_ttk to pass with Tcl/Tk 8.6.15.
  - Security
    - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
      consistently use the mapped IPv4 address value for deciding
      properties. Properties which have their behavior fixed are
      is_multicast, is_reserved, is_link_local, is_global, and
      is_unspecified.
  - Library
    - gh-116850: Fix argparse for namespaces with not directly
      writable dict (e.g. classes).
    - gh-58573: Fix conflicts between abbreviated long options in
      the parent parser and subparsers in argparse.
    - gh-61181: Fix support of choices with string value in
      argparse. Substrings of the specified string no longer
      considered valid values.
    - gh-80259: Fix argparse support of positional arguments with
      nargs='?', default=argparse.SUPPRESS and specified type.
    - gh-124498: Fix typing.TypeAliasType not to be generic, when
      type_params is an empty tuple.
    - gh-124345: argparse vim supports abbreviated single-dash
      long options separated by = from its value.
    - gh-104860: Fix disallowing abbreviation of single-dash long
      options in argparse with allow_abbrev=False.
    - gh-63143: Fix parsing mutually exclusive arguments in
      argparse. Arguments with the value identical to the default
      value (e.g. booleans, small integers, empty or 1-character
      strings) are no longer considered “not present”.
    - gh-72795: Positional arguments with nargs equal to '*' or

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=71
2024-10-01 15:35:43 +00:00
e64f032e0a Accepting request 1204807 from devel:languages:python:Factory
OBS-URL: https://build.opensuse.org/request/show/1204807
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python312?expand=0&rev=21
2024-10-01 15:11:37 +00:00
a00145be7f Drop .pyc files from docdir for reproducible builds
without this change, 2 files varied between builds:
/usr/share/doc/packages/python312-core/Tools/build/__pycache__/generate_global_objects.cpython-312.pyc
/usr/share/doc/packages/python312-core/Tools/build/__pycache__/umarshal.cpython-312.pyc

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=69
2024-09-30 16:48:11 +00:00
5d2f502703 Accepting request 1200888 from devel:languages:python:Factory
- Add doc-py38-to-py36.patch making building documentation
  compatible with Python 3.6, which runs Sphinx on SLE.
- Update to 3.12.6:
  - Tests
    - gh-101525: Skip test_gdb if the binary is relocated by
      BOLT. Patch by Donghee Na.
  - Security
    - gh-123678: Upgrade libexpat to 2.6.3
    - gh-121285: Remove backtracking from tarfile header parsing
      for hdrcharset, PAX, and GNU sparse headers (bsc#1230227,
      CVE-2024-6232).
  - Library
    - gh-123270: Applied a more surgical fix for malformed
      payloads in zipfile.Path causing infinite loops (gh-122905)
      without breaking contents using legitimate characters
      (bsc#1229704, CVE-2024-8088).
    - gh-123213: xml.etree.ElementTree.Element.extend() and
      Element assignment no longer hide the internal exception if
      an erronous generator is passed. Patch by Bar Harel.
    - gh-85110: Preserve relative path in URL without netloc in
      urllib.parse.urlunsplit() and urllib.parse.urlunparse().
    - gh-123067: Fix quadratic complexity in parsing "-quoted
      cookie values with backslashes by http.cookies
      (bsc#1229596, CVE-2024-7592)
    - gh-122903: zipfile.Path.glob now correctly matches
      directories instead of silently omitting them.
    - gh-122905: zipfile.Path objects now sanitize names from the
      zipfile.
    - gh-122695: Fixed double-free when using gc.get_referents()
      with a freed asyncio.Future iterator.
    - gh-116263: logging.handlers.RotatingFileHandler no longer
      rolls over empty log files.
    - gh-118814: Fix the typing.TypeVar constructor when name is
      passed by keyword.
    - gh-122478: Remove internal frames from tracebacks
      shown in code.InteractiveInterpreter with non-default
      sys.excepthook(). Save correct tracebacks in
      sys.last_traceback and update __traceback__ attribute of
      sys.last_value and sys.last_exc.
    - gh-113785: csv now correctly parses numeric fields (when
      used with csv.QUOTE_NONNUMERIC) which start with an escape
      character.
    - gh-112182: asyncio.futures.Future.set_exception() now
      transforms StopIteration into RuntimeError instead of
      hanging or other misbehavior. Patch contributed by Jamie
      Phan.
    - gh-108172: webbrowser honors OS preferred browser on Linux
      when its desktop entry name contains the text of a known
      browser name.
    - gh-102988: email.utils.getaddresses() and
      email.utils.parseaddr() now return ('', '') 2-tuples
      in more situations where invalid email addresses are
      encountered instead of potentially inaccurate values. Add
      optional strict parameter to these two functions: use
      strict=False to get the old behavior, accept malformed
      inputs. getattr(email.utils, 'supports_strict_parsing',
      False) can be use to check if the strict paramater is
      available. Patch by Thomas Dwyer and Victor Stinner to
      improve the CVE-2023-27043 fix.
    - gh-99437: runpy.run_path() now decodes path-like objects,
      making sure __file__ and sys.argv[0] of the module being
      run are always strings.
  - IDLE
    - gh-120083: Add explicit black IDLE Hovertip foreground
      color needed for recent macOS. Fixes Sonoma showing
      unreadable white on pale yellow. Patch by John Riggles.
  - Core and Builtins
    - gh-123321: Prevent Parser/myreadline race condition from
      segfaulting on multi-threaded use. Patch by Bar Harel and
      Amit Wienner.
    - gh-122982: Extend the deprecation period for bool inversion
      (~) by two years.
    - gh-123229: Fix valgrind warning by initializing the
      f-string buffers to 0 in the tokenizer. Patch by Pablo
      Galindo
    - gh-123142: Fix too-wide source location in exception
      tracebacks coming from broken iterables in comprehensions.
    - gh-123048: Fix a bug where pattern matching code could emit
      a JUMP_FORWARD with no source location.
    - gh-123083: Fix a potential use-after-free in
      STORE_ATTR_WITH_HINT.
    - gh-122527: Fix a crash that occurred when a
      PyStructSequence was deallocated after its type’s
      dictionary was cleared by the GC. The type’s tp_basicsize
      now accounts for non-sequence fields that aren’t included
      in the Py_SIZE of the sequence.
    - gh-93691: Fix source locations of instructions generated
      for with statements.
  - Build
    - gh-123297: Propagate the value of LDFLAGS to LDCXXSHARED in
      sysconfig. Patch by Pablo Galindo
- Remove upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
  - CVE-2023-6597-TempDir-cleaning-symlink.patch
  - gh120226-fix-sendfile-test-kernel-610.patch
- Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
  failing test_sendfile_close_peer_in_the_middle_of_receiving
  tests on Linux >= 6.10 (GH-120227).

OBS-URL: https://build.opensuse.org/request/show/1200888
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python312?expand=0&rev=20
2024-09-26 16:52:41 +00:00
c75ef22ae5 - Add doc-py38-to-py36.patch making building documentation
compatible with Python 3.6, which runs Sphinx on SLE.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=67
2024-09-13 17:10:18 +00:00
10154267fc - Update to 3.12.6:
- Tests
    - gh-101525: Skip test_gdb if the binary is relocated by
      BOLT. Patch by Donghee Na.
  - Security
    - gh-123678: Upgrade libexpat to 2.6.3
    - gh-121285: Remove backtracking from tarfile header parsing
      for hdrcharset, PAX, and GNU sparse headers (bsc#1230227,
      CVE-2024-6232).
  - Library
    - gh-123270: Applied a more surgical fix for malformed
      payloads in zipfile.Path causing infinite loops (gh-122905)
      without breaking contents using legitimate characters
      (bsc#1229704, CVE-2024-8088).
    - gh-123213: xml.etree.ElementTree.Element.extend() and
      Element assignment no longer hide the internal exception if
      an erronous generator is passed. Patch by Bar Harel.
    - gh-85110: Preserve relative path in URL without netloc in
      urllib.parse.urlunsplit() and urllib.parse.urlunparse().
    - gh-123067: Fix quadratic complexity in parsing "-quoted
      cookie values with backslashes by http.cookies
      (bsc#1229596, CVE-2024-7592)
    - gh-122903: zipfile.Path.glob now correctly matches
      directories instead of silently omitting them.
    - gh-122905: zipfile.Path objects now sanitize names from the
      zipfile.
    - gh-122695: Fixed double-free when using gc.get_referents()
      with a freed asyncio.Future iterator.
    - gh-116263: logging.handlers.RotatingFileHandler no longer
      rolls over empty log files.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=66
2024-09-07 21:56:48 +00:00
456c5f3ff6 - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
failing test_sendfile_close_peer_in_the_middle_of_receiving
  tests on Linux >= 6.10 (GH-120227).

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=65
2024-09-02 10:08:57 +00:00
a7e33ce6b6 Accepting request 1197474 from devel:languages:python:Factory
- Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
  malformed payload to cause infinite loops in zipfile.Path
  (bsc#1229704, CVE-2024-8088).

OBS-URL: https://build.opensuse.org/request/show/1197474
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python312?expand=0&rev=19
2024-08-30 11:25:40 +00:00
e33fbc932e Accepting request 1192365 from devel:languages:python:Factory
- Update to 3.12.5:
  - Tests
    - gh-59022: Add tests for pkgutil.extend_path(). Patch by
      Andreas Stocker.
    - gh-99242: os.getloadavg() may throw OSError when
      running regression tests under certain conditions (e.g.
      chroot). This error is now caught and ignored, since
      reporting load average is optional.
    - gh-121084: Fix test_typing random leaks. Clear typing ABC
      caches when running tests for refleaks (-R option): call
      _abc_caches_clear() on typing abstract classes and their
      subclasses. Patch by Victor Stinner.
    - gh-121160: Add a test for
      readline.set_history_length(). Note that this test may fail
      on readline libraries.
    - gh-121200: Fix test_expanduser_pwd2() of
      test_posixpath. Call getpwnam() to get pw_dir, since it
      can be different than getpwall() pw_dir. Patch by Victor
      Stinner.
    - gh-121188: When creating the JUnit XML file, regrtest
      now escapes characters which are invalid in XML, such
      as the chr(27) control character used in ANSI escape
      sequences. Patch by Victor Stinner.
  - Security
    - gh-121957: Fixed missing audit events around interactive
      use of Python, now also properly firing for python -i, as
      well as for python -m asyncio. The event in question is
      cpython.run_stdin.
    - gh-122133: Authenticate the socket connection for the
      socket.socketpair() fallback on platforms where AF_UNIX is

OBS-URL: https://build.opensuse.org/request/show/1192365
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python312?expand=0&rev=18
2024-08-29 13:42:27 +00:00
4aab29ff15 - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
malformed payload to cause infinite loops in zipfile.Path
  (bsc#1229704, CVE-2024-8088).

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=62
2024-08-29 12:59:16 +00:00
dd7c725bd1 Fix the patch
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=61
2024-08-07 19:36:41 +00:00
31e91ac782 - Update to 3.12.5:
- Tests
    - gh-59022: Add tests for pkgutil.extend_path(). Patch by
      Andreas Stocker.
    - gh-99242: os.getloadavg() may throw OSError when
      running regression tests under certain conditions (e.g.
      chroot). This error is now caught and ignored, since
      reporting load average is optional.
    - gh-121084: Fix test_typing random leaks. Clear typing ABC
      caches when running tests for refleaks (-R option): call
      _abc_caches_clear() on typing abstract classes and their
      subclasses. Patch by Victor Stinner.
    - gh-121160: Add a test for
      readline.set_history_length(). Note that this test may fail
      on readline libraries.
    - gh-121200: Fix test_expanduser_pwd2() of
      test_posixpath. Call getpwnam() to get pw_dir, since it
      can be different than getpwall() pw_dir. Patch by Victor
      Stinner.
    - gh-121188: When creating the JUnit XML file, regrtest
      now escapes characters which are invalid in XML, such
      as the chr(27) control character used in ANSI escape
      sequences. Patch by Victor Stinner.
  - Security
    - gh-121957: Fixed missing audit events around interactive
      use of Python, now also properly firing for python -i, as
      well as for python -m asyncio. The event in question is
      cpython.run_stdin.
    - gh-122133: Authenticate the socket connection for the
      socket.socketpair() fallback on platforms where AF_UNIX is

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=60
2024-08-07 18:22:59 +00:00
822e5022b5 - Remove %suse_update_desktop_file macro as it is not useful any
more.

- Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
  adding reproducibility patches from gh#python/cpython!121872
  and gh#python/cpython!121883.

- Stop using %%defattr, it seems to be breaking proper executable
  attributes on /usr/bin/ scripts (bsc#1227378).

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=59
2024-08-07 18:04:39 +00:00
1df7c73f9c Update bluez-devel-vendor.tar.xz
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=58
2024-08-07 15:02:10 +00:00
e52f34b4c1 - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
header injection due to unquoted newlines (bsc#1228780,
  CVE-2024-6923).
- %{profileopt} variable is set according to the variable
  %{do_profiling} (bsc#1227999)
- Update bluez-devel-vendor.tar.xz

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=57
2024-08-07 15:01:40 +00:00
ff39bb892f - Remove %suse_update_desktop_file macro as it is not useful any
more.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=56
2024-07-22 21:31:13 +00:00
0790b98fac permissive than the default (bsc#1227152).
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=55
2024-07-10 05:44:28 +00:00
4b714bca06 - Stop using %%defattr, it seems to be breaking proper executable
attributes on /usr/bin/ scripts (bsc#1227378).

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=54
2024-07-04 18:31:02 +00:00
bde1a4521f Accepting request 1184846 from home:dgarcia:usr-local-cpython
- Add F00251-change-user-install-location.patch to make pip and
  modern tools install directly in /usr/local when used by the user.
  bsc#1225660

OBS-URL: https://build.opensuse.org/request/show/1184846
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=53
2024-07-04 13:16:57 +00:00
7dcd5b1426 Add CVE-2024-0397 to changelog.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=52
2024-06-26 20:34:48 +00:00
26b708641e Accepting request 1183433 from home:Andreas_Schwab:Factory
- Update import_failed.map for python 3.12

OBS-URL: https://build.opensuse.org/request/show/1183433
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=51
2024-06-26 20:11:23 +00:00
4bca3b2589 - Add docs-docutils_014-Sphinx_420.patch make building docs
compatible with Sphinx 4_2_0 and docutils 0.14.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=50
2024-06-26 20:10:05 +00:00
5465cd240f - gh-113171 (bsc#1226448, CVE-2024-4032): Fixed various false
positives and false negatives in

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=49
2024-06-25 22:06:54 +00:00
b385491107 Accepting request 1183151 from home:Andreas_Schwab:riscv:python
- Reenable test_multiprocessing_forkserver test_multiprocessing_spawn
  test_subprocess tests in qemu build

OBS-URL: https://build.opensuse.org/request/show/1183151
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=48
2024-06-25 16:08:01 +00:00
7a215a300e - Update to 3.12.4:
- Security
    - gh-118486: os.mkdir() on Windows now accepts mode of 0o700
      to restrict the new directory to the current user. This
      fixes CVE-2024-4030 affecting tempfile.mkdtemp() in
      scenarios where the base temporary directory is more
      permissive than the default.
    - gh-116741: Update bundled libexpat to 2.6.2
    - gh-117233: Detect BLAKE2, SHA3, Shake, & truncated SHA512
      support in the OpenSSL-ish libcrypto library at build
      time. This allows hashlib to be used with libraries that do
      not to support every algorithm that upstream OpenSSL does.
  - Core and Builtins
    - gh-119821: Fix execution of annotation scopes within
      classes when globals is set to a non-dict. Patch by Jelle
      Zijlstra.
    - gh-118263: Speed up os.path.normpath() with a direct C
      call.
    - gh-119311: Fix bug where names are unexpectedly mangled in
      the bases of generic classes.
    - gh-119395: Fix bug where names appearing after a generic
      class are mangled as if they are in the generic class.
    - gh-118507: Fix os.path.isfile() on Windows for pipes.
    - gh-119213: Non-builtin modules built with argument clinic
      were crashing if used in a subinterpreter before the main
      interpreter. The objects that were causing the problem by
      leaking between interpreters carelessly have been fixed.
    - gh-119011: Fixes type.__type_params__ to return an empty
      tuple instead of a descriptor.
    - gh-118997: Fix _Py_ClearImmortal() assertion: use

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=47
2024-06-07 10:51:44 +00:00
5aec8eeba8 Accepting request 1168659 from devel:languages:python:Factory
OBS-URL: https://build.opensuse.org/request/show/1168659
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python312?expand=0&rev=17
2024-04-23 16:55:03 +00:00
781fdc451d Accepting request 1168530 from home:dgarcia:branches:devel:languages:python:Factory
- Add CVE-2023-52425-libexpat-2.6.0-backport-15.6.patch to fix tests with
  patched libexpat below 2.6.0 that doesn't update the version number,
  just in 15.6.
- Drop libexpat260.patch, not needed anymore. This patch is merged
  with the CVE-2023-52425-libexpat-2.6.0-backport-15.6.patch to keep
  working on 15.6.
- Add fix-test-recursion-limit-15.6.patch, gh#python/cpython#115083.

OBS-URL: https://build.opensuse.org/request/show/1168530
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=45
2024-04-17 21:21:31 +00:00
2cda1ab826 Clean changelog
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=44
2024-04-11 20:21:37 +00:00
e62ac867bc - Update to 3.12.3:
- Security¶
    - gh-115398: Allow controlling Expat >=2.6.0 reparse deferral
      (CVE-2023-52425, bsc#1219559) by adding five new methods:
          xml.etree.ElementTree.XMLParser.flush()
          xml.etree.ElementTree.XMLPullParser.flush()
          xml.parsers.expat.xmlparser.GetReparseDeferralEnabled()
          xml.parsers.expat.xmlparser.SetReparseDeferralEnabled()
          xml.sax.expatreader.ExpatParser.flush()
    - gh-115399: Update bundled libexpat to 2.6.0 (bsc#1222075)
    - gh-115243: Fix possible crashes in
      collections.deque.index() when the deque is concurrently
      modified.
    - gh-114572: ssl.SSLContext.cert_store_stats() and
      ssl.SSLContext.get_ca_certs() now correctly lock access to
      the certificate store, when the ssl.SSLContext is shared
      across multiple threads.
  - Core and Builtins
    - gh-109120: Added handle of incorrect star expressions, e.g
      f(3, *). Patch by Grigoryev Semyon
    - gh-99108: Updated the hashlib built-in HACL* project C code
      from upstream that we use for many implementations when
      they are not present via OpenSSL in a given build. This
      also avoids the rare potential for a C symbol name one
      definition rule linking issue.
    - gh-116735: For INSTRUMENTED_CALL_FUNCTION_EX, set arg0 to
      sys.monitoring.MISSING instead of None for CALL event.
    - gh-113964: Starting new threads and process creation
      through os.fork() are now only prevented once all
      non-daemon threads exit.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=43
2024-04-10 14:51:57 +00:00
aa6257f71a Accepting request 1157646 from devel:languages:python:Factory
Automatic submission by obs-autosubmit

OBS-URL: https://build.opensuse.org/request/show/1157646
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python312?expand=0&rev=16
2024-03-14 16:42:38 +00:00
ded1f6d8f3 Accepting request 1155683 from home:pmonrealgonzalez:branches:devel:languages:python:Factory
OBS-URL: https://build.opensuse.org/request/show/1155683
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=41
2024-03-06 21:50:49 +00:00
1b3ecdbd21 Accepting request 1153616 from devel:languages:python:Factory
- (bsc#1219666, CVE-2023-6597) Add
  CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from
  gh#python/cpython!99930) fixing symlink bug in cleanup of
  tempfile.TemporaryDirectory.

OBS-URL: https://build.opensuse.org/request/show/1153616
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python312?expand=0&rev=15
2024-03-03 19:18:35 +00:00
2a55620864 - (bsc#1219666, CVE-2023-6597) Add
CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from
  gh#python/cpython!99930) fixing symlink bug in cleanup of
  tempfile.TemporaryDirectory.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=39
2024-02-29 21:00:39 +00:00
6fb45ea97f Accepting request 1148455 from devel:languages:python:Factory
- Switch to %%autopatch. Let’s try it as an experiment, and if we
  need conditional patch, we should put condition inside of it.
- Remove double definition of /usr/bin/idle%%{version} in
  %%files.

OBS-URL: https://build.opensuse.org/request/show/1148455
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python312?expand=0&rev=14
2024-02-22 19:55:26 +00:00
87dab76d59 - Switch to %%autopatch. Let’s try it as an experiment, and if we
need conditional patch, we should put condition inside of it.
- Remove double definition of /usr/bin/idle%%{version} in
  %%files.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=37
2024-02-20 22:10:13 +00:00
858e326499 Accepting request 1146839 from devel:languages:python:Factory
Forwarded request #1146789 from dgarcia

- Add upstream patch libexpat260.patch, Fix tests for XMLPullParser
    with Expat 2.6.0, gh#python/cpython#115288

OBS-URL: https://build.opensuse.org/request/show/1146839
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python312?expand=0&rev=13
2024-02-15 19:59:19 +00:00
e7723bea01 Accepting request 1146789 from home:dgarcia:branches:devel:languages:python:Factory
- Add upstream patch libexpat260.patch, Fix tests for XMLPullParser
  with Expat 2.6.0, gh#python/cpython#115288

OBS-URL: https://build.opensuse.org/request/show/1146789
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=35
2024-02-15 12:59:08 +00:00
600a900c7b Update the patch
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=34
2024-02-12 13:36:22 +00:00
3e5f9031be - (bsc#1210638, CVE-2023-27043) Add
CVE-2023-27043-email-parsing-errors.patch, which rejects
  malformed addresses in email.parseaddr() (gh#python/cpython!111116)
  Detect email address parsing errors and return empty tuple to
  indicate the parsing error (old API). Add an optional 'strict'
  parameter to getaddresses() and parseaddr() functions. Patch by
  Thomas Dwyer.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=33
2024-02-12 13:35:44 +00:00
43433c648f Accepting request 1145177 from devel:languages:python:Factory
OBS-URL: https://build.opensuse.org/request/show/1145177
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python312?expand=0&rev=12
2024-02-09 22:52:00 +00:00
120d8db339 Accepting request 1145175 from home:dgarcia:branches:devel:languages:python:Factory
- Update to 3.12.2:
  - Security
    - gh-113659: Skip .pth files with names starting with a dot or
      hidden file attribute.
  - Core and Builtins
    - gh-114887: Changed socket type validation in
      create_datagram_endpoint() to accept all non-stream sockets.
      This fixes a regression in compatibility with raw sockets.
    - gh-114388: Fix a RuntimeWarning emitted when assign an
      integer-like value that is not an instance of int to an
      attribute that corresponds to a C struct member of type T_UINT
      and T_ULONG. Fix a double RuntimeWarning emitted when assign a
      negative integer value to an attribute that corresponds to a C
      struct member of type T_UINT.
    - gh-113703: Fix a regression in the codeop module that was
      causing it to incorrectly identify incomplete f-strings. Patch
      by Pablo Galindo
    - gh-89811: Check for a valid tp_version_tag before performing
      bytecode specializations that rely on this value being usable.
    - gh-113602: Fix an error that was causing the parser to try to
      overwrite existing errors and crashing in the process. Patch by
      Pablo Galindo
    - gh-113297: Fix segfault in the compiler on with statement with
      19 context managers.
    - gh-106905: Use per AST-parser state rather than global state to
      track recursion depth within the AST parser to prevent potential
      race condition due to simultaneous parsing.
    - The issue primarily showed up in 3.11 by multithreaded users of
      ast.parse(). In 3.12 a change to when garbage collection can be
      triggered prevented the race condition from occurring.
    - gh-112943: Correctly compute end column offsets for multiline
      tokens in the tokenize module. Patch by Pablo Galindo
    - gh-112716: Fix SystemError in the import statement and in
      __reduce__() methods of builtin types when __builtins__ is not a
      dict.
    - gh-94606: Fix UnicodeEncodeError when
      email.message.get_payload() reads a message with a Unicode
      surrogate character and the message content is not well-formed
      for surrogateescape encoding. Patch by Sidney Markowitz.
  - Library
    - gh-114965: Update bundled pip to 24.0
    - gh-114959: tarfile no longer ignores errors when trying to
      extract a directory on top of a file.
    - gh-109475: Fix support of explicit option value “–” in argparse
      (e.g. --option=--).
    - gh-110190: Fix ctypes structs with array on Windows ARM64
      platform by setting MAX_STRUCT_SIZE to 32 in stgdict. Patch by
      Diego Russo
    - gh-113280: Fix a leak of open socket in rare cases when error
      occurred in ssl.SSLSocket creation.
    - gh-77749: email.policy.EmailPolicy.fold() now always encodes
      non-ASCII characters in headers if utf8 is false.
    - gh-114492: Make the result of termios.tcgetattr() reproducible
      on Alpine Linux. Previously it could leave a random garbage in
      some fields.
    - gh-113267: Revert changes in gh-106584 which made calls of
      TestResult methods startTest() and stopTest() unbalanced.
    - gh-75128: Ignore an OSError in
      asyncio.BaseEventLoop.create_server() when IPv6 is available but
      the interface cannot actually support it.
    - gh-114257: Dismiss the FileNotFound error in
      ctypes.util.find_library() and just return None on Linux.
    - gh-114328: The tty.setcbreak() and new tty.cfmakecbreak() no
      longer clears the terminal input ICRLF flag. This fixes a
      regression introduced in 3.12 that no longer matched how OSes
      define cbreak mode in their stty(1) manual pages.
    - gh-101438: Avoid reference cycle in ElementTree.iterparse. The
      iterator returned by ElementTree.iterparse may hold on to a file
      descriptor. The reference cycle prevented prompt clean-up of the
      file descriptor if the returned iterator was not exhausted.
    - gh-104522: OSError raised when run a subprocess now only has
      filename attribute set to cwd if the error was caused by a
      failed attempt to change the current directory.
    - gh-114149: Enum: correctly handle tuple subclasses in custom
      __new__.
    - gh-109534: Fix a reference leak in
      asyncio.selector_events.BaseSelectorEventLoop when SSL
      handshakes fail. Patch contributed by Jamie Phan.
    - gh-114077: Fix possible OverflowError in
      socket.socket.sendfile() when pass count larger than 2 GiB on
      32-bit platform.
    - gh-114014: Fixed a bug in fractions.Fraction where an invalid
      string using d in the decimals part creates a different error
      compared to other invalid letters/characters. Patch by Jeremiah
      Gabriel Pascual.
    - gh-113951: Fix the behavior of tag_unbind() methods of
      tkinter.Text and tkinter.Canvas classes with three arguments.
      Previously, widget.tag_unbind(tag, sequence, funcid) destroyed
      the current binding for sequence, leaving sequence unbound, and
      deleted the funcid command. Now it removes only funcid from the
      binding for sequence, keeping other commands, and deletes the
      funcid command. It leaves sequence unbound only if funcid was
      the last bound command.
    - gh-113877: Fix tkinter method winfo_pathname() on 64-bit
      Windows.
    - gh-113661: unittest runner: Don’t exit 5 if tests were skipped.
      The intention of exiting 5 was to detect issues where the test
      suite wasn’t discovered at all. If we skipped tests, it was
      correctly discovered.
    - gh-113781: Silence unraisable AttributeError when warnings are
      emitted during Python finalization.
    - gh-112932: Restore the ability for zipfile to extractall from
      zip files with a “/” directory entry in them as is commonly
      added to zips by some wiki or bug tracker data exporters.
    - gh-113594: Fix UnicodeEncodeError in email when re-fold lines
      that contain unknown-8bit encoded part followed by
      non-unknown-8bit encoded part.
    - gh-113538: In asyncio.StreamReaderProtocol.connection_made(),
      there is callback that logs an error if the task wrapping the
      “connected callback” fails. This callback would itself fail if
      the task was cancelled. Prevent this by checking whether the
      task was cancelled first. If so, close the transport but don’t
      log an error.
    - gh-85567: Fix resource warnings for unclosed files in pickle and
      pickletools command line interfaces.
    - gh-101225: Increase the backlog for
      multiprocessing.connection.Listener objects created by
      multiprocessing.manager and multiprocessing.resource_sharer to
      significantly reduce the risk of getting a connection refused
      error when creating a multiprocessing.connection.Connection to
      them.
    - gh-113543: Make sure that webbrowser.MacOSXOSAScript sends
      webbrowser.open audit event.
    - gh-113028: When a second reference to a string appears in the
      input to pickle, and the Python implementation is in use, we are
      guaranteed that a single copy gets pickled and a single object
      is shared when reloaded. Previously, in protocol 0, when a
      string contained certain characters (e.g. newline) it resulted
      in duplicate objects.
    - gh-113421: Fix multiprocessing logger for %(filename)s.
    - gh-111784: Fix segfaults in the _elementtree module. Fix first
      segfault during deallocation of _elementtree.XMLParser instances
      by keeping strong reference to pyexpat module in module state
      for capsule lifetime. Fix second segfault which happens in the
      same deallocation process by keeping strong reference to
      _elementtree module in XMLParser structure for _elementtree
      module lifetime.
    - gh-113407: Fix import of unittest.mock when CPython is built
      without docstrings.
    - gh-113320: Fix regression in Python 3.12 where Protocol classes
      that were not marked as runtime-checkable would be unnecessarily
      introspected, potentially causing exceptions to be raised if the
      protocol had problematic members. Patch by Alex Waygood.
    - gh-113358: Fix rendering tracebacks for exceptions with a broken
      __getattr__.
    - gh-113214: Fix an AttributeError during asyncio SSL protocol
      aborts in SSL-over-SSL scenarios.
    - gh-113246: Update bundled pip to 23.3.2.
    - gh-113199: Make http.client.HTTPResponse.read1 and
      http.client.HTTPResponse.readline close IO after reading all
      data when content length is known. Patch by Illia Volochii.
    - gh-113188: Fix shutil.copymode() and shutil.copystat() on
      Windows. Previously they worked differenly if dst is a symbolic
      link: they modified the permission bits of dst itself rather
      than the file it points to if follow_symlinks is true or src is
      not a symbolic link, and did not modify the permission bits if
      follow_symlinks is false and src is a symbolic link.
    - gh-61648: Detect line numbers of properties in doctests.
    - gh-112559: signal.signal() and signal.getsignal() no longer call
      repr on callable handlers. asyncio.run() and
      asyncio.Runner.run() no longer call repr on the task results.
      Patch by Yilei Yang.
    - gh-110190: Fix ctypes structs with array on PPC64LE platform by
      setting MAX_STRUCT_SIZE to 64 in stgdict. Patch by Diego Russo.
    - gh-79429: Ignore FileNotFoundError when remove a temporary
      directory in the multiprocessing finalizer.
    - gh-81194: Fix a crash in socket.if_indextoname() with specific
      value (UINT_MAX). Fix an integer overflow in
      socket.if_indextoname() on 64-bit non-Windows platforms.
    - gh-112343: Improve handling of pdb convenience variables to
      avoid replacing string contents.
    - gh-111615: Fix a regression caused by a fix to gh-93162 whereby
      you couldn’t configure a QueueHandler without specifying
      handlers.
    - gh-111049: Fix crash during garbage collection of the io.BytesIO
      buffer object.
    - gh-110345: Show the Tcl/Tk patchlevel (rather than version) in
      tkinter._test().
    - gh-109858: Protect zipfile from “quoted-overlap” zipbomb. It now
      raises BadZipFile when try to read an entry that overlaps with
      other entry or central directory.
    - gh-114440: On Windows, closing the connection writer when
      cleaning up a broken multiprocessing.Queue queue is now done for
      all queues, rather than only in concurrent.futures manager
      thread. This can prevent a deadlock when a multiprocessing
      worker process terminates without cleaning up. This completes
      the backport of patches by Victor Stinner and Serhiy Storchaka.
    - gh-38807: Fix race condition in trace. Instead of checking if a
      directory exists and creating it, directly call os.makedirs()
      with the kwarg exist_ok=True.
    - gh-75705: Set unixfrom envelope in mailbox.mbox and
      mailbox.MMDF.
    - gh-106233: Fix stacklevel in InvalidTZPathWarning during
      zoneinfo module import.
    - gh-105102: Allow ctypes.Union to be nested in ctypes.Structure
      when the system endianness is the opposite of the classes.
    - gh-104282: Fix null pointer dereference in
      lzma._decode_filter_properties() due to improper handling of BCJ
      filters with properties of zero length. Patch by Radislav
      Chugunov.
    - gh-102512: When os.fork() is called from a foreign thread (aka
      _DummyThread), the type of the thread in a child process is
      changed to _MainThread. Also changed its name and daemonic
      status, it can be now joined.
    - bpo-35928: io.TextIOWrapper now correctly handles the decoding
      buffer after read() and write().
    - bpo-26791: shutil.move() now moves a symlink into a directory
      when that directory is the target of the symlink. This provides
      the same behavior as the mv shell command. The previous behavior
      raised an exception. Patch by Jeffrey Kintscher.
    - bpo-36959: Fix some error messages for invalid ISO format string
      combinations in strptime() that referred to directives not
      contained in the format string. Patch by Gordon P. Hemsley.
    - bpo-18060: Fixed a class inheritance issue that can cause
      segfaults when deriving two or more levels of subclasses from a
      base class of Structure or Union.
  - Documentation
    - gh-110746: Improved markup for valid options/values for methods
      ttk.treeview.column and ttk.treeview.heading, and for Layouts.
    - gh-95649: Document that the asyncio module contains code taken
      from v0.16.0 of the uvloop project, as well as the required MIT
      licensing information.
  - Tests
    - gh-109980: Fix test_tarfile_vs_tar in test_shutil for macOS,
      where system tar can include more information in the archive
      than shutil.make_archive.
    - gh-105089: Fix
      test.test_zipfile.test_core.TestWithDirectory.test_create_directory_with_write
      test in AIX by doing a bitwise AND of 0xFFFF on mode , so that
      it will be in sync with zinfo.external_attr
    - bpo-40648: Test modes that file can get with chmod() on Windows.
  - Build
    - gh-112305: Fixed the check-clean-src step performed on out of
      tree builds to detect errant $(srcdir)/Python/frozen_modules/*.h
      files and recommend appropriate source tree cleanup steps to get
      a working build again.
    - gh-112867: Fix the build for the case that
      WITH_PYMALLOC_RADIX_TREE=0 set.
    - bpo-11102: The os.major(), os.makedev(), and os.minor()
      functions are now available on HP-UX v3.
    - bpo-36351: Do not set ipv6type when cross-compiling.
  - IDLE
    - gh-96905: In idlelib code, stop redefining built-ins ‘dict’ and
      ‘object’.
    - gh-72284: Improve the lists of features, editor key bindings,
      and shell key bingings in the IDLE doc.
    - gh-113903: Fix rare failure of test.test_idle, in
      test_configdialog.
    - gh-113729: Fix the “Help -> IDLE Doc” menu bug in 3.11.7 and
      3.12.1.
    - gh-113269: Fix test_editor hang on macOS Catalina.
    - gh-112898: Fix processing unsaved files when quitting IDLE on
      macOS.
    - gh-103820: Revise IDLE bindings so that events from mouse button
      4/5 on non-X11 windowing systems (i.e. Win32 and Aqua) are not
      mistaken for scrolling.
    - bpo-13586: Enter the selected text when opening the “Replace”
      dialog.
  - Tools/Demos
    - gh-109991: Update GitHub CI workflows to use OpenSSL 3.0.13 and
      multissltests to use 1.1.1w, 3.0.13, 3.1.5, and 3.2.1.
    - gh-115015: Fix a bug in Argument Clinic that generated incorrect
      code for methods with no parameters that use the METH_METHOD |
      METH_FASTCALL | METH_KEYWORDS calling convention. Only the
      positional parameter count was checked; any keyword argument
      passed would be silently accepted.
- Refresh patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - python-3.3.0b1-fix_date_time_compiler.patch
  - python-3.3.0b1-localpath.patch
  - python-3.3.0b1-test-posix_fadvise.patch
  - skip-test_pyobject_freed_is_freed.patch
  - subprocess-raise-timeout.patch

OBS-URL: https://build.opensuse.org/request/show/1145175
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=31
2024-02-08 12:49:08 +00:00