SG-42118 - SG-42922 - SG-42923 - Update third party libraries to address CVEs - CI update

resources/python/bin/3.10/explicit_requirements.txt

@@ -8,6 +8,6 @@
 # By accessing, using, copying or modifying this work you indicate your
 # agreement to the Shotgun Pipeline Toolkit Source Code License. All rights
 # not expressly granted therein are reserved by Shotgun Software Inc.
-cffi==1.15.1
-cryptography==44.0.1
-zope.interface==5.5.2
+cffi==2.0.0
+cryptography==46.0.7
+zope.interface==8.3

resources/python/bin/3.10/linux/cffi-2.0.0.dist-info/METADATA

@@ -0,0 +1,68 @@
+Metadata-Version: 2.4
+Name: cffi
+Version: 2.0.0
+Summary: Foreign Function Interface for Python calling C code.
+Author: Armin Rigo, Maciej Fijalkowski
+Maintainer: Matt Davis, Matt Clay, Matti Picus
+License-Expression: MIT
+Project-URL: Documentation, https://cffi.readthedocs.io/
+Project-URL: Changelog, https://cffi.readthedocs.io/en/latest/whatsnew.html
+Project-URL: Downloads, https://github.com/python-cffi/cffi/releases
+Project-URL: Contact, https://groups.google.com/forum/#!forum/python-cffi
+Project-URL: Source Code, https://github.com/python-cffi/cffi
+Project-URL: Issue Tracker, https://github.com/python-cffi/cffi/issues
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: Free Threading :: 2 - Beta
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: AUTHORS
+Requires-Dist: pycparser; implementation_name != "PyPy"
+Dynamic: license-file
+
+[![GitHub Actions Status](https://github.com/python-cffi/cffi/actions/workflows/ci.yaml/badge.svg?branch=main)](https://github.com/python-cffi/cffi/actions/workflows/ci.yaml?query=branch%3Amain++)
+[![PyPI version](https://img.shields.io/pypi/v/cffi.svg)](https://pypi.org/project/cffi)
+[![Read the Docs](https://img.shields.io/badge/docs-latest-blue.svg)][Documentation]
+
+
+CFFI
+====
+
+Foreign Function Interface for Python calling C code.
+
+Please see the [Documentation] or uncompiled in the `doc/` subdirectory.
+
+Download
+--------
+
+[Download page](https://github.com/python-cffi/cffi/releases)
+
+Source Code
+-----------
+
+Source code is publicly available on
+[GitHub](https://github.com/python-cffi/cffi).
+
+Contact
+-------
+
+[Mailing list](https://groups.google.com/forum/#!forum/python-cffi)
+
+Testing/development tips
+------------------------
+
+After `git clone` or `wget && tar`, we will get a directory called `cffi` or `cffi-x.x.x`. we call it `repo-directory`. To run tests under CPython, run the following in the `repo-directory`:
+
+    pip install pytest
+    pip install -e .  # editable install of CFFI for local development
+    pytest src/c/ testing/
+
+[Documentation]: http://cffi.readthedocs.org/

resources/python/bin/3.10/linux/cffi-2.0.0.dist-info/RECORD

@@ -0,0 +1,50 @@
+_cffi_backend.cpython-310-x86_64-linux-gnu.so,sha256=dwyj8cOietCtbyfR3bujHUjHGSeatvkaM0kobPAUWYM,339896
+cffi-2.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
+cffi-2.0.0.dist-info/METADATA,sha256=uYzn40F68Im8EtXHNBLZs7FoPM-OxzyYbDWsjJvhujk,2559
+cffi-2.0.0.dist-info/RECORD,,
+cffi-2.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+cffi-2.0.0.dist-info/WHEEL,sha256=DTnKjM5OInJxWADod3iQyWxWcdG-eRwxzGww236swpY,151
+cffi-2.0.0.dist-info/entry_points.txt,sha256=y6jTxnyeuLnL-XJcDv8uML3n6wyYiGRg8MTp_QGJ9Ho,75
+cffi-2.0.0.dist-info/licenses/AUTHORS,sha256=KmemC7-zN1nWfWRf8TG45ta8TK_CMtdR_Kw-2k0xTMg,208
+cffi-2.0.0.dist-info/licenses/LICENSE,sha256=W6JN3FcGf5JJrdZEw6_EGl1tw34jQz73Wdld83Cwr2M,1123
+cffi-2.0.0.dist-info/top_level.txt,sha256=rE7WR3rZfNKxWI9-jn6hsHCAl7MDkB-FmuQbxWjFehQ,19
+cffi/__init__.py,sha256=-ksBQ7MfDzVvbBlV_ftYBWAmEqfA86ljIzMxzaZeAlI,511
+cffi/__pycache__/__init__.cpython-310.pyc,,
+cffi/__pycache__/_imp_emulation.cpython-310.pyc,,
+cffi/__pycache__/_shimmed_dist_utils.cpython-310.pyc,,
+cffi/__pycache__/api.cpython-310.pyc,,
+cffi/__pycache__/backend_ctypes.cpython-310.pyc,,
+cffi/__pycache__/cffi_opcode.cpython-310.pyc,,
+cffi/__pycache__/commontypes.cpython-310.pyc,,
+cffi/__pycache__/cparser.cpython-310.pyc,,
+cffi/__pycache__/error.cpython-310.pyc,,
+cffi/__pycache__/ffiplatform.cpython-310.pyc,,
+cffi/__pycache__/lock.cpython-310.pyc,,
+cffi/__pycache__/model.cpython-310.pyc,,
+cffi/__pycache__/pkgconfig.cpython-310.pyc,,
+cffi/__pycache__/recompiler.cpython-310.pyc,,
+cffi/__pycache__/setuptools_ext.cpython-310.pyc,,
+cffi/__pycache__/vengine_cpy.cpython-310.pyc,,
+cffi/__pycache__/vengine_gen.cpython-310.pyc,,
+cffi/__pycache__/verifier.cpython-310.pyc,,
+cffi/_cffi_errors.h,sha256=zQXt7uR_m8gUW-fI2hJg0KoSkJFwXv8RGUkEDZ177dQ,3908
+cffi/_cffi_include.h,sha256=Exhmgm9qzHWzWivjfTe0D7Xp4rPUkVxdNuwGhMTMzbw,15055
+cffi/_embedding.h,sha256=Ai33FHblE7XSpHOCp8kPcWwN5_9BV14OvN0JVa6ITpw,18786
+cffi/_imp_emulation.py,sha256=RxREG8zAbI2RPGBww90u_5fi8sWdahpdipOoPzkp7C0,2960
+cffi/_shimmed_dist_utils.py,sha256=Bjj2wm8yZbvFvWEx5AEfmqaqZyZFhYfoyLLQHkXZuao,2230
+cffi/api.py,sha256=alBv6hZQkjpmZplBphdaRn2lPO9-CORs_M7ixabvZWI,42169
+cffi/backend_ctypes.py,sha256=h5ZIzLc6BFVXnGyc9xPqZWUS7qGy7yFSDqXe68Sa8z4,42454
+cffi/cffi_opcode.py,sha256=JDV5l0R0_OadBX_uE7xPPTYtMdmpp8I9UYd6av7aiDU,5731
+cffi/commontypes.py,sha256=7N6zPtCFlvxXMWhHV08psUjdYIK2XgsN3yo5dgua_v4,2805
+cffi/cparser.py,sha256=QUTfmlL-aO-MYR8bFGlvAUHc36OQr7XYLe0WLkGFjRo,44790
+cffi/error.py,sha256=v6xTiS4U0kvDcy4h_BDRo5v39ZQuj-IMRYLv5ETddZs,877
+cffi/ffiplatform.py,sha256=avxFjdikYGJoEtmJO7ewVmwG_VEVl6EZ_WaNhZYCqv4,3584
+cffi/lock.py,sha256=l9TTdwMIMpi6jDkJGnQgE9cvTIR7CAntIJr8EGHt3pY,747
+cffi/model.py,sha256=W30UFQZE73jL5Mx5N81YT77us2W2iJjTm0XYfnwz1cg,21797
+cffi/parse_c_type.h,sha256=OdwQfwM9ktq6vlCB43exFQmxDBtj2MBNdK8LYl15tjw,5976
+cffi/pkgconfig.py,sha256=LP1w7vmWvmKwyqLaU1Z243FOWGNQMrgMUZrvgFuOlco,4374
+cffi/recompiler.py,sha256=78J6lMEEOygXNmjN9-fOFFO3j7eW-iFxSrxfvQb54bY,65509
+cffi/setuptools_ext.py,sha256=0rCwBJ1W7FHWtiMKfNXsSST88V8UXrui5oeXFlDNLG8,9411
+cffi/vengine_cpy.py,sha256=oyQKD23kpE0aChUKA8Jg0e723foPiYzLYEdb-J0MiNs,43881
+cffi/vengine_gen.py,sha256=DUlEIrDiVin1Pnhn1sfoamnS5NLqfJcOdhRoeSNeJRg,26939
+cffi/verifier.py,sha256=oX8jpaohg2Qm3aHcznidAdvrVm5N4sQYG0a3Eo5mIl4,11182

resources/python/bin/3.10/linux/cffi-1.15.1.dist-info/WHEEL → resources/python/bin/3.10/linux/cffi-2.0.0.dist-info/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: bdist_wheel (0.37.1)
+Generator: setuptools (80.9.0)
 Root-Is-Purelib: false
 Tag: cp310-cp310-manylinux_2_17_x86_64
 Tag: cp310-cp310-manylinux2014_x86_64

resources/python/bin/3.10/linux/cffi-2.0.0.dist-info/licenses/AUTHORS

@@ -0,0 +1,8 @@
+This package has been mostly done by Armin Rigo with help from
+Maciej Fijałkowski. The idea is heavily based (although not directly
+copied) from LuaJIT ffi by Mike Pall.
+
+
+Other contributors:
+
+  Google Inc.

resources/python/bin/3.10/linux/cffi-1.15.1.dist-info/LICENSE → resources/python/bin/3.10/linux/cffi-2.0.0.dist-info/licenses/LICENSE

@@ -3,18 +3,15 @@ Except when otherwise stated (look for LICENSE files in directories or
 information at the beginning of each file) all software and
 documentation is licensed as follows: 
 
-    The MIT License
+    MIT No Attribution
 
     Permission is hereby granted, free of charge, to any person 
     obtaining a copy of this software and associated documentation 
     files (the "Software"), to deal in the Software without 
     restriction, including without limitation the rights to use, 
     copy, modify, merge, publish, distribute, sublicense, and/or 
     sell copies of the Software, and to permit persons to whom the 
-    Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included 
-    in all copies or substantial portions of the Software.
+    Software is furnished to do so.
 
     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 
     OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 

resources/python/bin/3.10/linux/cffi/__init__.py

@@ -5,8 +5,8 @@
 from .error import CDefError, FFIError, VerificationError, VerificationMissing
 from .error import PkgConfigError
 
-__version__ = "1.15.1"
-__version_info__ = (1, 15, 1)
+__version__ = "2.0.0"
+__version_info__ = (2, 0, 0)
 
 # The verifier module file names are based on the CRC32 of a string that
 # contains the following version number.  It may be older than __version__

resources/python/bin/3.10/linux/cffi/_cffi_include.h

@@ -101,11 +101,15 @@ extern "C" {
     typedef unsigned char _Bool;
 #  endif
 # endif
+# define _cffi_float_complex_t   _Fcomplex    /* include <complex.h> for it */
+# define _cffi_double_complex_t  _Dcomplex    /* include <complex.h> for it */
 #else
 # include <stdint.h>
 # if (defined (__SVR4) && defined (__sun)) || defined(_AIX) || defined(__hpux)
 #  include <alloca.h>
 # endif
+# define _cffi_float_complex_t   float _Complex
+# define _cffi_double_complex_t  double _Complex
 #endif
 
 #ifdef __GNUC__

resources/python/bin/3.10/linux/cffi/_embedding.h

@@ -225,7 +225,7 @@ static int _cffi_initialize_python(void)
 
         if (f != NULL && f != Py_None) {
             PyFile_WriteString("\nFrom: " _CFFI_MODULE_NAME
-                               "\ncompiled with cffi version: 1.15.1"
+                               "\ncompiled with cffi version: 2.0.0"
                                "\n_cffi_backend module: ", f);
             modules = PyImport_GetModuleDict();
             mod = PyDict_GetItemString(modules, "_cffi_backend");
@@ -283,6 +283,15 @@ static int _cffi_carefully_make_gil(void)
        Python < 3.8 because someone might use a mixture of cffi
        embedded modules, some of which were compiled before this file
        changed.
+
+       In Python >= 3.12, this stopped working because that particular
+       tp_version_tag gets modified during interpreter startup.  It's
+       arguably a bad idea before 3.12 too, but again we can't change
+       that because someone might use a mixture of cffi embedded
+       modules, and no-one reported a bug so far.  In Python >= 3.12
+       we go instead for PyCapsuleType.tp_as_buffer, which is supposed
+       to always be NULL.  We write to it temporarily a pointer to
+       a struct full of NULLs, which is semantically the same.
     */
 
 #ifdef WITH_THREAD
@@ -307,19 +316,32 @@ static int _cffi_carefully_make_gil(void)
         }
     }
 # else
+#  if PY_VERSION_HEX < 0x030C0000
     int volatile *lock = (int volatile *)&PyCapsule_Type.tp_version_tag;
-    int old_value, locked_value;
+    int old_value, locked_value = -42;
     assert(!(PyCapsule_Type.tp_flags & Py_TPFLAGS_HAVE_VERSION_TAG));
+#  else
+    static struct ebp_s { PyBufferProcs buf; int mark; } empty_buffer_procs;
+    empty_buffer_procs.mark = -42;
+    PyBufferProcs *volatile *lock = (PyBufferProcs *volatile *)
+        &PyCapsule_Type.tp_as_buffer;
+    PyBufferProcs *old_value, *locked_value = &empty_buffer_procs.buf;
+#  endif
 
     while (1) {    /* spin loop */
         old_value = *lock;
-        locked_value = -42;
         if (old_value == 0) {
             if (cffi_compare_and_swap(lock, old_value, locked_value))
                 break;
         }
         else {
+#  if PY_VERSION_HEX < 0x030C0000
             assert(old_value == locked_value);
+#  else
+            /* The pointer should point to a possibly different
+               empty_buffer_procs from another C extension module */
+            assert(((struct ebp_s *)old_value)->mark == -42);
+#  endif
             /* should ideally do a spin loop instruction here, but
                hard to do it portably and doesn't really matter I
                think: PyEval_InitThreads() should be very fast, and