GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.13] gh-131261: generate_sbom.py: Exclude the refresh script from SBOM (GH-131359) by encukou · Pull Request #144625 · python/cpython

Conversation

@encukou

@encukou encukou commented Feb 9, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member
  • generate_sbom.py: Exclude the refresh script from SBOM (gh-131261: expat/refresh.sh: Expand list of manual steps #131359)
  • Modules/expat/refresh.sh: Expand the list of manual steps

(cherry picked from commit 51d3099)

  • Issue: Please upgrade bundled Expat to 2.7.0 (e.g. for the fix to CVE-2024-8176) #131261

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@encukou
[3.13] pythongh-131261: expat/refresh.sh: Expand list of manual steps (…
988ea75 
…pythonGH-131359)

(cherry picked from commit 51d3099)
@encukou
encukou requested a review from sethmlarson as a code owner February 9, 2026 13:27
@bedevere-app bedevere-app Bot added the awaiting core review label Feb 9, 2026
This was referenced Feb 9, 2026
Please upgrade bundled Expat to 2.7.0 (e.g. for the fix to CVE-2024-8176) #131261
Closed
gh-131261: expat/refresh.sh: Expand list of manual steps #131359
Merged
@bedevere-app bedevere-app Bot added the skip news label Feb 9, 2026
@encukou encukou changed the title [3.13] gh-131261: expat/refresh.sh: Expand list of manual steps (GH-131359) [3.13] gh-131261: generate_sbom.py: Exclude the refresh script from SBOM (GH-131359) Feb 9, 2026
@encukou
Remove reference to a 3.14+ file
9da16d3
@encukou

encukou commented Feb 9, 2026

Copy link
Copy Markdown
Member Author

This causes a conflict when backporting the expat update. In #144500, I currently bundle this fix with the expat update, but it seems cleaner to have it as a separate commit.

@sethmlarson, does that sound good?
sethmlarson and StanFromIreland reacted with thumbs up emoji
All reactions
  • 👍 2 reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
sethmlarson
sethmlarson approved these changes Feb 9, 2026
View reviewed changes

@sethmlarson sethmlarson left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thank you!

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
StanFromIreland
StanFromIreland reviewed Feb 9, 2026
View reviewed changes
Comment thread Modules/expat/refresh.sh
- Verify all is okay:
git diff
git status
- Regenerate the sbom file

@StanFromIreland StanFromIreland Feb 9, 2026

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now that I look at it, this is missing a step, you have to update the version in the sbom file IIRC.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
sethmlarson reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

@encukou encukou Feb 10, 2026

Copy link
Copy Markdown
Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you send a PR for main?
I don't think it even needs to be backported since you only do that on main.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@encukou
encukou merged commit bad4bc4 into python:3.13 Feb 10, 2026
53 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting core review label Feb 10, 2026
@encukou
encukou deleted the backport-51d3099-3.13 branch February 10, 2026 09:49
@encukou encukou added needs backport to 3.10 needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Feb 10, 2026
@miss-islington-app

miss-islington-app Bot commented Feb 10, 2026

Copy link
Copy Markdown

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Feb 10, 2026

Copy link
Copy Markdown

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Feb 10, 2026

Copy link
Copy Markdown

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Feb 10, 2026

Copy link
Copy Markdown

Sorry, @encukou, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bad4bc4603fea4541b9e3db45b4050104e461c0a 3.10
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app miss-islington-app Bot assigned encukou Feb 10, 2026
@miss-islington-app

miss-islington-app Bot commented Feb 10, 2026

Copy link
Copy Markdown

Sorry, @encukou, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bad4bc4603fea4541b9e3db45b4050104e461c0a 3.11
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 10, 2026
@encukou @miss-islington
[3.13] pythongh-131261: generate_sbom.py: Exclude the refresh script …
7b7483b 
…from SBOM (pythonGH-131359) (pythonGH-144625)

- generate_sbom.py: Exclude the refresh script from SBOM
- Modules/expat/refresh.sh: Expand the list of manual steps
(cherry picked from commit bad4bc4)

Co-authored-by: Petr Viktorin <[email protected]>
(cherry picked from commit 51d3099)
@bedevere-app

bedevere-app Bot commented Feb 10, 2026

Copy link
Copy Markdown

GH-144660 is a backport of this pull request to the 3.12 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Feb 10, 2026
@encukou encukou mentioned this pull request Feb 10, 2026
[3.13] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) #144500
Merged
@StanFromIreland StanFromIreland removed needs backport to 3.10 needs backport to 3.11 only security fixes labels Feb 11, 2026
@StanFromIreland

StanFromIreland commented Feb 11, 2026

Copy link
Copy Markdown
Member

3.10/3.11 don't have the SBOM file.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@StanFromIreland StanFromIreland StanFromIreland left review comments
@sethmlarson sethmlarson sethmlarson approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@encukou encukou

Labels

skip news

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@encukou @StanFromIreland @sethmlarson
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.