[oe][meta-python][scarthgap][PATCH 2/2] python3-filelock: fix CVE-2026-22701

From: Darsh Kelaiya <[email protected]>

This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-22701

Signed-off-by: Darsh Kelaiya <[email protected]>
---
 .../python3-filelock/CVE-2026-22701.patch     | 44 +++++++++++++++++++
 .../python/python3-filelock_3.13.4.bb         |  1 +
 2 files changed, 45 insertions(+)
 create mode 100644 meta-python/recipes-devtools/python/python3-filelock/CVE-2026-22701.patch

diff --git a/meta-python/recipes-devtools/python/python3-filelock/CVE-2026-22701.patch b/meta-python/recipes-devtools/python/python3-filelock/CVE-2026-22701.patch
new file mode 100644
index 0000000000..0431a2160e
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-filelock/CVE-2026-22701.patch
@@ -0,0 +1,44 @@
+From c07f9db7726babc801ea3bd6f7c0f09d92a48bc7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= <[email protected]>
+Date: Fri, 9 Jan 2026 09:53:50 -0800
+Subject: [PATCH] Fix TOCTOU symlink vulnerability in SoftFileLock (#465)
+
+CVE: CVE-2026-22701
+Upstream-Status: Backport [https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5]
+
+Backport Changes:
+- Omitted docs/index.rst because the filelock 3.13.4 source archive
+  does not contain the upstream documentation tree. The omission does
+  not affect the SoftFileLock security fix.
+
+Co-authored-by: Claude <[email protected]>
+(cherry picked from commit 41b42dd2c72aecf7da83dbda5903b8087dddc4d5)
+Signed-off-by: Darsh Kelaiya <[email protected]>
+---
+ src/filelock/_soft.py | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/filelock/_soft.py b/src/filelock/_soft.py
+index 28c67f7..93709c5 100644
+--- a/src/filelock/_soft.py
++++ b/src/filelock/_soft.py
+@@ -16,13 +16,15 @@ class SoftFileLock(BaseFileLock):
+     def _acquire(self) -> None:
+         raise_on_not_writable_file(self.lock_file)
+         ensure_directory_exists(self.lock_file)
+-        # first check for exists and read-only mode as the open will mask this case as EEXIST
+         flags = (
+             os.O_WRONLY  # open for writing only
+             | os.O_CREAT
+             | os.O_EXCL  # together with above raise EEXIST if the file specified by filename exists
+             | os.O_TRUNC  # truncate the file to zero byte
+         )
++        o_nofollow = getattr(os, "O_NOFOLLOW", None)
++        if o_nofollow is not None:
++            flags |= o_nofollow
+         try:
+             file_handler = os.open(self.lock_file, flags, self._context.mode)
+         except OSError as exception:  # re-raise unless expected exception
+-- 
+2.44.4
+
diff --git a/meta-python/recipes-devtools/python/python3-filelock_3.13.4.bb b/meta-python/recipes-devtools/python/python3-filelock_3.13.4.bb
index 9fa5f95ff1..1ea3d796aa 100644
--- a/meta-python/recipes-devtools/python/python3-filelock_3.13.4.bb
+++ b/meta-python/recipes-devtools/python/python3-filelock_3.13.4.bb
@@ -9,6 +9,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=911690f51af322440237a253d695d19f"
 SRC_URI[sha256sum] = "d13f466618bfde72bd2c18255e269f72542c6e70e7bac83a0232d6b1cc5c8cf4"
 
 SRC_URI += "file://CVE-2025-68146.patch \
+            file://CVE-2026-22701.patch \
            "
 
 BBCLASSEXTEND = "native nativesdk"
-- 
2.44.4