[meta-virtualization][PATCH] python3-dotenv: set CVE_PRODUCT
[email protected] Wed, 22 Jul 2026 15:17:17 +0900
| Newsgroups | org.yoctoproject.lists.meta-virtualization |
|---|---|
| Message-ID | <[email protected]> |
From: "mark.yang" <[email protected]> The pypi class default python:python_dotenv matches nothing; NVD tracks python-dotenv as saurabh-kumar:python-dotenv and the GitHub CNA uses theskumar:python-dotenv, so set both vendor:product pairs. The only existing CVE (CVE-2026-28684) is fixed in 1.2.2, the version we ship, so it resolves as not affected. Signed-off-by: mark.yang <[email protected]> --- recipes-devtools/python/python3-dotenv_1.2.2.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/recipes-devtools/python/python3-dotenv_1.2.2.bb b/recipes-devtools/python/python3-dotenv_1.2.2.bb index a112ae95..c3d5d9c6 100644 --- a/recipes-devtools/python/python3-dotenv_1.2.2.bb +++ b/recipes-devtools/python/python3-dotenv_1.2.2.bb @@ -11,3 +11,5 @@ UPSTREAM_CHECK_PYPI_PACKAGE = "${PYPI_PACKAGE}" SRC_URI[sha256sum] = "2c371a91fbd7ba082c2c1dc1f8bf89ca22564a087c2c287cd9b662adde799cf3" inherit pypi python_setuptools_build_meta + +CVE_PRODUCT = "saurabh-kumar:python-dotenv theskumar:python-dotenv"