chore(merge): 2.4.3 into main (#1040)

Author: mr-cal

craft_parts/utils/process.py

@@ -151,6 +151,7 @@ def run(
 
         with closing(BytesIO()) as combined_io:
             while True:
+                finished = proc.poll() is not None
                 try:
                     # Time out if we don't have any event to handle
                     for key, mask in selector.select(0.1):
@@ -164,7 +165,7 @@ def run(
                 except BlockingIOError:
                     pass
 
-                if proc.poll() is not None:
+                if finished:
                     combined = combined_io.getvalue()
                     break
 

docs/common/craft-parts/craft-parts.wordlist.txt

@@ -30,6 +30,7 @@ CMakeLists
 CMakePlugin
 CMakePluginProperties
 CPAN
+CVE
 CallbackHook
 CallbackRegistrationError
 CalledProcessError
@@ -386,6 +387,7 @@ iterable
 iojs
 jdeps
 jdk
+jinja
 jlink
 jre
 js

docs/reference/changelog.rst

@@ -16,6 +16,14 @@ Bug fixes:
   only finding JAR files in the top-level directory. It now searches all
   subdirectories too.
 
+2.4.3 (2025-03-11)
+------------------
+
+Bug fixes:
+
+- Address race condition when collecting subprocess output.
+- Update jinja2 dependency to address CVE-2025-27516
+
 2.4.2 (2025-03-04)
 ------------------
 

docs/requirements.txt

@@ -346,4 +346,4 @@ websockets==14.1
     #   -r requirements.txt
     #   sphinx-autobuild
 wheel==0.45.1
-    # via -r requirements.txt
+    # via -r requirements.txt