From 492fbe84e8fadee727e89df39fcf832c97009db9 Mon Sep 17 00:00:00 2001 From: Tim Orling Date: Thu, 20 Aug 2026 02:07:25 -0700 Subject: [PATCH] python3-babel: fix CVE_PRODUCT Recipe (PV): python3-babel (2.14.0) Before -> After: python:Babel -> pocoo:babel Newly caught CVEs: CVE-2021-42771 (locale .dat deserialization RCE) Status: patched (fixed 2.9.1) Note: The original commit targeted python3-babel_2.18.0.bb. This is adjusted for Scarthgap, where the recipe version is 2.14.0. AI-Generated: Claude Sonnet 5 (From OE-Core rev: 27c524d5c69993338612461831f7aec054eb4d00) Signed-off-by: Tim Orling Signed-off-by: Richard Purdie (cherry picked from commit 134175fa92b85e639dc4646d9a88eeaba0fae4d3) Signed-off-by: Devansh Patel Signed-off-by: Yoann Congal Signed-off-by: Richard Purdie --- meta/recipes-devtools/python/python3-babel_2.14.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/python/python3-babel_2.14.0.bb b/meta/recipes-devtools/python/python3-babel_2.14.0.bb index cd40d4222b..5185fb21f5 100644 --- a/meta/recipes-devtools/python/python3-babel_2.14.0.bb +++ b/meta/recipes-devtools/python/python3-babel_2.14.0.bb @@ -9,6 +9,8 @@ PYPI_PACKAGE = "Babel" inherit pypi setuptools3 +CVE_PRODUCT = "pocoo:babel" + CLEANBROKEN = "1" RDEPENDS:${PN} += " \