On kirkstone branch, for recipe sip3_4.19.23, it seems the upstream sources have been unpublished. The only version available is version 4.19.25. This causes an error at fetch step. Maybe the recipe

Hello, I am experiencing a bug on kirkstone branch: the http-parser recipe fetches its sources from github.com/nodejs/http-parser repo : Problem: the branch is set to master but it does not exist

CVE-2019-19911 CVE-2020-10177 CVE-2020-10378 CVE-2020-10379 CVE-2020-10994 CVE-2020-11538 CVE-2020-35653 CVE-2020-35654 CVE-2020-35655 CVE-2020-5310 CVE-2020-5311 CVE-2020-5312 CVE-2020-5313

Hi Armin, I understand that we are not upgrading versions on the LTS branch, but this series of upgrades fixing the below CVEs. CVE-2019-19911 CVE-2020-10177 CVE-2020-10378 CVE-2020-10379

Add dependeces: python3-profile python3-logging Signed-off-by: Wang Mingyu <wangmy@...> --- ...someversion_22.5.1.bb => python3-awesomeversion_22.5.2.bb} | 4 +++- 1 file changed, 3

This appears to be more than a bug fix only update. This series of changes are not suited for a stable release. Thanks for thinking about this LTS release. -armin

Changelog: =========== Fix ---- Correctly read STK volumes in v3 (#805) (9b739ab) Other ----- Include py.typed in package (#815) (ba63485) Add GA token (#814) (c9a2852) Signed-off-by:

Signed-off-by: Zheng Ruoqin <zhengrq.fnst@...> --- ...tos_1.56.1.bb => python3-googleapis-common-protos_1.56.2.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename

Changelog: https://github.com/googleapis/google-api-python-client/releases/tag/v2.49.0 Signed-off-by: Zheng Ruoqin <zhengrq.fnst@...> --- ...ent_2.48.0.bb =>

Changelog: ========= Add cachetools.keys.methodkey(). Add cache_clear() function to decorators. Add src directory to sys.path for Sphinx autodoc. Modernize func wrappers. Signed-off-by: Zheng

From: Xu Huan <xuhuan.fnst@...> Changelog: Add flush method to LZ4FrameFile. Signed-off-by: Xu Huan <xuhuan.fnst@...> --- .../python/{python3-lz4_4.0.0.bb => python3-lz4_4.0.1.bb}

From: Xu Huan <xuhuan.fnst@...> Changelog: ========= Update .github/workflows/ci.yml template, #637, #640 Change note in skeleton to emphasize it can be removed/renamed,

From: Xu Huan <xuhuan.fnst@...> Changelog: ========== Better handling of message_queue connection argument #1130 More robust handling of to and room arguments of emit and send

From: Xu Huan <xuhuan.fnst@...> Signed-off-by: Xu Huan <xuhuan.fnst@...> --- .../python/{python3-h5py_3.6.0.bb => python3-h5py_3.7.0.bb} | 2 +- 1 file changed, 1 insertion(+), 1

From: Xu Huan <xuhuan.fnst@...> Signed-off-by: Xu Huan <xuhuan.fnst@...> --- .../python/{python3-mypy_0.950.bb => python3-mypy_0.960.bb} | 2 +- 1 file changed, 1 insertion(+), 1

Nacked-by: Tim Orling <ticotimo@...> NO. We do not do version upgrades in stable branches and the wheel infrastructure is only supported in 'kirkstone'+. You can create a mixin layer for the upgrade

From: Xu Huan <xuhuan.fnst@...> changelog: In show_file, use os.remove to remove temporary images. CVE-2022-24303 Restrict builtins within lambdas for ImageMath.eval.

From: Tim Orling <ticotimo@...> Recipe does not inherit pypi nor would PN resolve to the name of the wheel so we must set PIP_INSTALL_PACKAGE appropriately. The recipe also builds its wheel in

From: Leon Anavi <leon.anavi@...> Upgrade to release 9.0.0: - Restrict builtins for ImageMath.eval() - Ensure JpegImagePlugin stops at the end of a truncated file - Fixed ImagePath.Path

From: Trevor Gamblin <trevor.gamblin@...> From the release notes: - CVE-2021-23437: Avoid a potential ReDoS (regular expression denial of service) in ImageColor’s getrgb() by raising