From 7f233cd78e1d5356a975f9108fe9e1eeab624e14 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Tue, 9 Dec 2025 20:39:44 +0100 Subject: [PATCH] package/python-brotli: security bump to version 1.2.0 https://github.com/google/brotli/blob/v1.2.0/CHANGELOG.md Adds the following security hardening: python: added Decompressor::can_accept_more_data method and optional output_buffer_limit argument Decompressor::process; that allows mitigation of unexpectedly large output Which is needed to complete the security fixes in python-urllib3 2.6.0. Added dependency to host-python-pkgconfig to fix build error which would be introduced by this bump. Signed-off-by: Bernd Kuhls [Peter: mark as security bump, describe the relation with urllib3] Signed-off-by: Peter Korsgaard (cherry picked from commit fe5dcf402c0075b6ab86a92733ec75135f9dd760) Signed-off-by: Thomas Perale --- package/python-brotli/python-brotli.hash | 4 ++-- package/python-brotli/python-brotli.mk | 7 ++++--- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/package/python-brotli/python-brotli.hash b/package/python-brotli/python-brotli.hash index e8036d3bb8..ed8eea72eb 100644 --- a/package/python-brotli/python-brotli.hash +++ b/package/python-brotli/python-brotli.hash @@ -1,5 +1,5 @@ # md5, sha256 from https://pypi.org/pypi/brotli/json -md5 908d109a0309c33b626d01137eb4a060 Brotli-1.1.0.tar.gz -sha256 81de08ac11bcb85841e440c13611c00b67d3bf82698314928d0b676362546724 Brotli-1.1.0.tar.gz +md5 af164f216cba527bf6f24d09c9d3576b brotli-1.2.0.tar.gz +sha256 e310f77e41941c13340a95976fe66a8a95b01e783d430eeaf7a2f87e0a57dd0a brotli-1.2.0.tar.gz # Locally computed sha256 checksums sha256 3d180008e36922a4e8daec11c34c7af264fed5962d07924aea928c38e8663c94 LICENSE diff --git a/package/python-brotli/python-brotli.mk b/package/python-brotli/python-brotli.mk index 865c4e363f..e2343a24b2 100644 --- a/package/python-brotli/python-brotli.mk +++ b/package/python-brotli/python-brotli.mk @@ -4,12 +4,13 @@ # ################################################################################ -PYTHON_BROTLI_VERSION = 1.1.0 -PYTHON_BROTLI_SOURCE = Brotli-$(PYTHON_BROTLI_VERSION).tar.gz -PYTHON_BROTLI_SITE = https://files.pythonhosted.org/packages/2f/c2/f9e977608bdf958650638c3f1e28f85a1b075f075ebbe77db8555463787b +PYTHON_BROTLI_VERSION = 1.2.0 +PYTHON_BROTLI_SOURCE = brotli-$(PYTHON_BROTLI_VERSION).tar.gz +PYTHON_BROTLI_SITE = https://files.pythonhosted.org/packages/f7/16/c92ca344d646e71a43b8bb353f0a6490d7f6e06210f8554c8f874e454285 PYTHON_BROTLI_SETUP_TYPE = setuptools PYTHON_BROTLI_LICENSE = MIT PYTHON_BROTLI_LICENSE_FILES = LICENSE +PYTHON_BROTLI_DEPENDENCIES = host-python-pkgconfig PYTHON_BROTLI_CFLAGS = $(TARGET_CFLAGS)