From ec302536b24570023ab5df15abc293502ff9fe69 Mon Sep 17 00:00:00 2001 From: Ricardo Dias Date: Thu, 29 Oct 2026 17:00:41 +0000 Subject: [PATCH] pgadmin: bump python3-authlib to 1.9.1 (CVE-2026-96760, CVE-2026-114615, CVE-2026-114616) Authlib 1.7+ delegates JOSE handling to joserfc, so 1.9.1 gains a runtime dependency (joserfc>=1.6.8). Package joserfc 1.7.7 from the PyPI sdist in ppg:common:deps:pgadmin and require it from authlib. The authlib %check now imports authlib.oidc.core, which pulls joserfc in, so a missing dependency fails the build instead of pgAdmin at runtime. pgAdmin REL-9_17 pins Authlib 1.7.*, upstream master pins 1.9.*; the 1.7->1.8->1.9 bumps upstream were requirements.txt-only, and pgAdmin only uses authlib.integrations.flask_client. Signed-off-by: Ricardo Dias --- .../deps/pgadmin/python3-authlib/obs/_service | 2 +- .../deps/pgadmin/python3-authlib/package.yaml | 2 +- .../python3-authlib/rpm/python3-authlib.spec | 15 +++-- .../deps/pgadmin/python3-joserfc/obs/_service | 5 ++ .../deps/pgadmin/python3-joserfc/package.yaml | 5 ++ .../python3-joserfc/rpm/python3-joserfc.spec | 57 +++++++++++++++++++ 6 files changed, 80 insertions(+), 6 deletions(-) create mode 100644 root/ppg/common/deps/pgadmin/python3-joserfc/obs/_service create mode 100644 root/ppg/common/deps/pgadmin/python3-joserfc/package.yaml create mode 100644 root/ppg/common/deps/pgadmin/python3-joserfc/rpm/python3-joserfc.spec diff --git a/root/ppg/common/deps/pgadmin/python3-authlib/obs/_service b/root/ppg/common/deps/pgadmin/python3-authlib/obs/_service index 45e2b8711..54e63a703 100644 --- a/root/ppg/common/deps/pgadmin/python3-authlib/obs/_service +++ b/root/ppg/common/deps/pgadmin/python3-authlib/obs/_service @@ -1,5 +1,5 @@ - https://files.pythonhosted.org/packages/source/A/Authlib/authlib-1.6.12.tar.gz + https://files.pythonhosted.org/packages/source/A/Authlib/authlib-1.9.1.tar.gz diff --git a/root/ppg/common/deps/pgadmin/python3-authlib/package.yaml b/root/ppg/common/deps/pgadmin/python3-authlib/package.yaml index 5c0844886..9b5f5e7f1 100644 --- a/root/ppg/common/deps/pgadmin/python3-authlib/package.yaml +++ b/root/ppg/common/deps/pgadmin/python3-authlib/package.yaml @@ -1,4 +1,4 @@ -title: Authlib 1.6.12 for Python 3.12 +title: Authlib 1.9.1 for Python 3.12 description: | The ultimate Python library in building OAuth and OpenID Connect servers and clients. RPM-only python3.12-* build from the PyPI sdist, consumed by pgAdmin 4 (percona-pgadmin4). Bump by editing obs/_service (sdist URL) and diff --git a/root/ppg/common/deps/pgadmin/python3-authlib/rpm/python3-authlib.spec b/root/ppg/common/deps/pgadmin/python3-authlib/rpm/python3-authlib.spec index 6cde7ad00..6b3574941 100644 --- a/root/ppg/common/deps/pgadmin/python3-authlib/rpm/python3-authlib.spec +++ b/root/ppg/common/deps/pgadmin/python3-authlib/rpm/python3-authlib.spec @@ -13,12 +13,12 @@ %global python3_sitelib %(%{__ospython} -Esc "import sysconfig; print(sysconfig.get_path('purelib', vars={'platbase': '/usr', 'base': '%{_prefix}'}))") Name: %{python3_pkgprefix}-authlib -Version: 1.6.12 +Version: 1.9.1 Release: 1%{?dist} Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients License: BSD-3-Clause URL: https://github.com/authlib/authlib -Source0: https://files.pythonhosted.org/packages/source/A/Authlib/authlib-1.6.12.tar.gz +Source0: https://files.pythonhosted.org/packages/source/A/Authlib/authlib-1.9.1.tar.gz BuildArch: noarch Vendor: Percona, LLC Packager: Percona Development Team @@ -30,8 +30,11 @@ BuildRequires: python%{python3_buildversion}-setuptools BuildRequires: python%{python3_buildversion}-wheel # runtime dependencies, also needed by the %check import test BuildRequires: python3.12-cryptography +BuildRequires: python3.12-joserfc Requires: python3.12-cryptography +# authlib 1.7+ delegates JOSE (JWS/JWE/JWK/JWT) to joserfc +Requires: python3.12-joserfc # authlib.integrations.flask_client imports ..requests_client unconditionally, # which needs requests (RHEL 9 package). Found by the Task 5 smoke test. Requires: python3.12-requests @@ -42,7 +45,7 @@ The ultimate Python library in building OAuth and OpenID Connect servers and cli Built for Python 3.12 from the PyPI sdist; part of the pgAdmin 4 (percona-pgadmin4) dependency stack. %prep -%autosetup -p1 -n authlib-1.6.12 +%autosetup -p1 -n authlib-1.9.1 %build %{__ospython} -m pip wheel --no-deps --no-build-isolation --no-index --wheel-dir dist . @@ -51,11 +54,15 @@ Built for Python 3.12 from the PyPI sdist; part of the pgAdmin 4 (percona-pgadmi %{__ospython} -m pip install --no-deps --no-index --root %{buildroot} --prefix %{_prefix} dist/*.whl %check -PYTHONPATH=%{buildroot}%{python3_sitelib} %{__ospython} -P -c "import authlib" +PYTHONPATH=%{buildroot}%{python3_sitelib} %{__ospython} -P -c "import authlib, authlib.oidc.core" %files %{python3_sitelib}/* %changelog +* Thu Oct 29 2026 Percona Development Team - 1.9.1-1 +- Update to Authlib 1.9.1 (CVE-2026-96760, CVE-2026-114615, CVE-2026-114616) +- Require python3.12-joserfc (new runtime dependency since 1.7) + * Thu Aug 27 2026 Percona Development Team - 1.6.12-1 - Package Authlib 1.6.12 for Python 3.12 (pgAdmin 4 dependency stack) diff --git a/root/ppg/common/deps/pgadmin/python3-joserfc/obs/_service b/root/ppg/common/deps/pgadmin/python3-joserfc/obs/_service new file mode 100644 index 000000000..1b78b5295 --- /dev/null +++ b/root/ppg/common/deps/pgadmin/python3-joserfc/obs/_service @@ -0,0 +1,5 @@ + + + https://files.pythonhosted.org/packages/source/j/joserfc/joserfc-1.7.7.tar.gz + + diff --git a/root/ppg/common/deps/pgadmin/python3-joserfc/package.yaml b/root/ppg/common/deps/pgadmin/python3-joserfc/package.yaml new file mode 100644 index 000000000..2f5000863 --- /dev/null +++ b/root/ppg/common/deps/pgadmin/python3-joserfc/package.yaml @@ -0,0 +1,5 @@ +title: joserfc 1.7.7 for Python 3.12 +description: | + The ultimate Python library for JOSE RFCs, including JWS, JWE, JWK, JWA, JWT. RPM-only python3.12-* build from the PyPI sdist, + consumed by pgAdmin 4 (percona-pgadmin4) through python3-authlib. Bump by editing obs/_service (sdist URL) and + rpm/*.spec (Version + changelog). diff --git a/root/ppg/common/deps/pgadmin/python3-joserfc/rpm/python3-joserfc.spec b/root/ppg/common/deps/pgadmin/python3-joserfc/rpm/python3-joserfc.spec new file mode 100644 index 000000000..a0743a226 --- /dev/null +++ b/root/ppg/common/deps/pgadmin/python3-joserfc/rpm/python3-joserfc.spec @@ -0,0 +1,57 @@ +%global debug_package %{nil} +%if 0%{?rhel} && 0%{?rhel} >= 8 +%global __ospython %{_bindir}/python3.12 +%global python3_pkgprefix python3.12 +%global python3_buildversion 3.12 +%global __requires_exclude ^python3\\.12dist +%else +%global __ospython %{_bindir}/python3 +%global python3_pkgprefix python3 +%global python3_buildversion 3 +%endif +%{expand: %%global py3ver %(echo `%{__ospython} -P -c "import sys; print(f'{sys.version_info[0]}.{sys.version_info[1]}')" `)} +%global python3_sitelib %(%{__ospython} -Esc "import sysconfig; print(sysconfig.get_path('purelib', vars={'platbase': '/usr', 'base': '%{_prefix}'}))") + +Name: %{python3_pkgprefix}-joserfc +Version: 1.7.7 +Release: 1%{?dist} +Summary: The ultimate Python library for JOSE RFCs, including JWS, JWE, JWK, JWA, JWT +License: BSD-3-Clause +URL: https://github.com/authlib/joserfc +Source0: https://files.pythonhosted.org/packages/source/j/joserfc/joserfc-1.7.7.tar.gz +BuildArch: noarch +Vendor: Percona, LLC +Packager: Percona Development Team + +BuildRequires: python%{python3_buildversion}-devel +BuildRequires: python%{python3_buildversion}-pip +BuildRequires: python%{python3_buildversion}-setuptools +BuildRequires: python%{python3_buildversion}-wheel +# runtime dependency, also needed by the %check import test +BuildRequires: python3.12-cryptography + +Requires: python3.12-cryptography + +%description +The ultimate Python library for JOSE RFCs, including JWS, JWE, JWK, JWA, JWT. + +Built for Python 3.12 from the PyPI sdist; part of the pgAdmin 4 (percona-pgadmin4) dependency stack. + +%prep +%autosetup -p1 -n joserfc-1.7.7 + +%build +%{__ospython} -m pip wheel --no-deps --no-build-isolation --no-index --wheel-dir dist . + +%install +%{__ospython} -m pip install --no-deps --no-index --root %{buildroot} --prefix %{_prefix} dist/*.whl + +%check +PYTHONPATH=%{buildroot}%{python3_sitelib} %{__ospython} -P -c "import joserfc.jwt" + +%files +%{python3_sitelib}/* + +%changelog +* Thu Oct 29 2026 Percona Development Team - 1.7.7-1 +- Package joserfc 1.7.7 for Python 3.12 (Authlib 1.7+ dependency, pgAdmin 4 stack)