]> git.ipfire.org Git - thirdparty/openembedded/openembedded-core-contrib.git/commit
python3: upgrade 3.14.2 -> 3.14.3
authorPeter Marko <peter.marko@siemens.com>
Tue, 17 Feb 2026 22:44:34 +0000 (23:44 +0100)
committerRichard Purdie <richard.purdie@linuxfoundation.org>
Thu, 19 Feb 2026 10:24:12 +0000 (10:24 +0000)
commit32e9be1675be79b9ad598604ef0ff3921766f112
tree11be9066b7e30ffa2044fe6da88f2e1a875cafc1
parentbc0075350e2a7c1d99b257877280bdad2c772fa6
python3: upgrade 3.14.2 -> 3.14.3

>From release notes [1]:

Security
* gh-144125: BytesGenerator will now refuse to serialize (write)
  headers that are unsafely folded or delimited; see
  verify_generated_headers. (Contributed by Bas Bloemsaat and Petr
  Viktorin in gh-121650).
* gh-143935: Fixed a bug in the folding of comments when flattening an
  email message using a modern email policy. Comments consisting of a
  very long sequence of non-foldable characters could trigger a forced
  line wrap that omitted the required leading space on the continuation
  line, causing the remainder of the comment to be interpreted as a new
  header field. This enabled header injection with carefully crafted
  inputs.
* gh-143925: Reject control characters in data: URL media types.
* gh-143919: Reject control characters in http.cookies.Morsel fields
  and values.
* gh-143916: Reject C0 control characters within wsgiref.headers.Headers
  fields, values, and parameters.

[1] https://docs.python.org/3/whatsnew/changelog.html#python-3-14-3-final

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
meta/recipes-devtools/python/python3_3.14.3.bb [moved from meta/recipes-devtools/python/python3_3.14.2.bb with 99% similarity]