Repository navigation
[AUTO-CHERRYPICK] [High] python-virtualenv: security backports and dev test reconciliation - branch 3.0-dev - #19830
Open
azurelinux-ci-jwt-app[bot] wants to merge 7 commits into
Open
azurelinux-ci-jwt-app[bot] wants to merge 7 commits into
azurelinux-ci-jwt-app[bot] wants to merge 7 commits into
Conversation
…thon-virtualenv.spec
…VE-2026-113715, CVE-2026-113716, CVE-2026-113719, CVE-2026-113720, CVE-2026-113721, CVE-2026-113722, CVE-2026-113723, CVE-2026-113725, CVE-2026-113726, CVE-2026-113732, CVE-2026-113776 (#19798) (cherry picked from commit 88b378a)
azurelinux-ci-jwt-app
Bot
added
the
Auto Fast-track Cherry-pick
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
microsoft-github-policy-service
Bot
added
Packaging
3.0-dev
…thon-virtualenv.spec
Author
|
All conflicts resolved. |
Author
Auto Cherry-Pick SPEC Validation Summary
|
| Source (fasttrack) | Target (3.0-dev) | Resolved | |
|---|---|---|---|
| Version | 20.36.1 | 20.36.1 | 20.36.1 |
| Release | 9 | 8 | 9 |
| Patches | 31 | 16 | 31 |
| Conflict | Yes |
- Version-release 20.36.1-9 is not higher than Source 20.36.1-9
- Duplicate changelog entry for 20.36.1-6 (appears 2 times)
- Directive present in both Source and Target was dropped: BuildArch: noarch
12 tasks done
Preserve the published CA patch, wheel helper invocation, and private pinned pytest environment. Remove committed conflict markers, duplicate test flows and duplicate changelog entries. Resequence the dev RPM-owned-packaging fix as release 9. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5ed20da6-df62-47ec-8bba-6847e07d8f43
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5ed20da6-df62-47ec-8bba-6847e07d8f43
Preserve the published release9 security patch set and dependency ordering. Retain the tox-based package-test bootstrap now merged through #19725, resequencing its reconciliation entry above published history as release10. Net changes against current dev are only the 14 published backports and the corresponding SPEC/changelog updates. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5ed20da6-df62-47ec-8bba-6847e07d8f43
jslobodzian
changed the title
jslobodzian
approved these changes
Oct 31, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cherry-pick the final published Fast-Track security backports into
3.0-dev, preserving the CA cleanup and package-test bootstrap already merged through #19725.Original Fast-Track PR: #19798
Published source commit:
88b378a0cb0572bce86de17ba9000eafa4860450Changes
packaging==23.2pin; do not replace it with the earlier private pytest environment.20.36.1-10, above the unchanged published20.36.1-9security entry and20.36.1-8CA-cleanup history.The net change against current
3.0-devis limited to the 14 security patches and their SPEC/changelog updates. Existing CA fixes, source signatures, build/install logic, and the merged test flow are preserved.Validation
Published security-file identities, patch/application order, release/changelog reconciliation, both-architecture RPM parsing, and repository SPEC guidelines have been checked.
Unified buddy build 1242110 succeeded on AMD64 and ARM64, with package tests and install tests enabled. Both published
python-virtualenvpackage-test results passed.Validated PR head:
2821d2e3a75a76854088f8ea853aa07a8a350d77.