From 12e69785c0c1d1bcb200c5d119f54790c75dbbbd Mon Sep 17 00:00:00 2001 From: "mark.yang" Date: Wed, 29 Jul 2026 01:56:17 -0700 Subject: [PATCH] python3-xmltodict: set CVE_PRODUCT The CVE databases track xmltodict as xmltodict:xmltodict, so the default python:xmltodict vendor prefix never matches and its CVEs are not evaluated at all. Use the exact vendor:product pair. Note: Original commit was for python3-xmltodict_1.0.4.bb. This is adjusted for scarthgap where recipe version is python3-xmltodict_0.13.0.bb. (From OE-Core rev: 918d1fd448ff96431197031e5adb1be658156bc2) Signed-off-by: mark.yang Signed-off-by: Richard Purdie (cherry picked from commit 2229426b729adf85780c23d38c85fc3cf090f6ba) Signed-off-by: Himanshu Jadon Signed-off-by: Fabien Thomas Signed-off-by: Paul Barker --- meta/recipes-devtools/python/python3-xmltodict_0.13.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/python/python3-xmltodict_0.13.0.bb b/meta/recipes-devtools/python/python3-xmltodict_0.13.0.bb index 9a308a29d2..33bf49b1fc 100644 --- a/meta/recipes-devtools/python/python3-xmltodict_0.13.0.bb +++ b/meta/recipes-devtools/python/python3-xmltodict_0.13.0.bb @@ -7,6 +7,8 @@ SRC_URI[sha256sum] = "341595a488e3e01a85a9d8911d8912fd922ede5fecc4dce437eb4b6c8d PYPI_PACKAGE = "xmltodict" +CVE_PRODUCT = "xmltodict:xmltodict" + BBCLASSEXTEND = "native nativesdk" inherit pypi setuptools3 ptest