chore: bump MaixPy with Shannon changes and RNG removal
What the developer wrote
Authored by odudex
chore: bump MaixPy with Shannon changes and RNG removal
Fixes the shannon heap overflow, removes the unused os.urandom binding,
and drops the Maix Bit build project.
What changed, and why it matters
This commit updates a bundled firmware component called MaixPy. The commit message says it fixes a 'Shannon heap overflow,' removes an unused random-number binding, and drops support for one hardware variant (Maix Bit). A heap overflow is a memory corruption bug that can sometimes be exploited to run attacker-controlled code, but the actual code change is just a one-line version bump of a submodule, so we cannot verify the fix from the diff alone.
Review the MaixPy submodule changelog and diff between the old and new commits to confirm the Shannon heap overflow fix, identify affected APIs, and verify the os.urandom removal does not break any dependent code. Consider requesting a CVE or security advisory from the project if one does not already exist.
Security signals we found
Commit message explicitly mentions fixing a heap overflow
Removal of an unused cryptographic/randomness binding (os.urandom)
Submodule bump only; no source-level patch visible in this commit
Evidence from the diff
The change is a submodule bump of firmware/MaixPy (+1 -1). The commit message claims it fixes a heap overflow in Shannon (likely the Shannon entropy/entropy collector code in MaixPy), removes the os.urandom binding, and removes the Maix Bit build target. No diff of the MaixPy changes is provided, so the exact vulnerability, affected functions, and exploit path cannot be confirmed from this repository’s commit.
Changed components
firmware/MaixPy submoduleos.urandom binding (removed)Maix Bit build target (dropped)Inspect captured patch +1 / −1
Diff not available from the source API.Why this scored 55/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.