Update patchelf requirement from >=0.17 to >=0.19.1.0 in /glean-core/python

[dependabot]

Updates the requirements on patchelf to permit the latest version.

Changelog

Sourced from patchelf's changelog.

Release History

0.19.1 (July 6, 2026)

A small bug fix release for --build-resolution-cache.

Bug fixes

• --build-resolution-cache: run-path entries that only resolve at run time are now recorded as search hints in run-path order instead of being dropped or baked in as bogus exact entries, so cached resolution keeps the semantics of a plain run-path walk (#658, #659). This covers empty and relative components, absolute directories absent at patch time (such as /run/opengl-driver/lib on NixOS), trailing empty components, and entries that exist but are not searchable directories when patching.

0.19.0 (June 26, 2026)

This is the first feature release since 0.18.0 (April 2023) and collects three years of fixes and hardening.

New features

• Add --build-resolution-cache to write a per-DSO library resolution note (#647).
• Add --no-clobber-old-sections switch to keep the original section contents in place.

Bug fixes

• Fix support for files larger than 4GB.
• Fix alignment problem when rewriting sections.
• Allocate the program and section header tables at the end of the file.
• Set the interpreter only when necessary.
• Fix [#639](https://github.com/NixOS/patchelf/issues/639): update DT_INIT/DT_FINI dynamic tags when their sections move, and stop rewriting them to the .init/.fini sh_addr.
• Fix DT_MIPS_RLD_MAP_REL on cross-endian patches and after --remove-rpath, --remove-needed and friends.
• Allow removing an RPATH on MIPS (#645).
• Fix the page size on Alpha, Itanium and SPARC.
• roundUp: reject a zero alignment instead of dividing by it.
• Preserve pointer provenance during string table offset arithmetic, fixing a SIGSEGV on capability-based architectures such as CHERI RISC-V (#641).
• Restrict system operations on OpenBSD.
• Optimize prefix stripping in replaceNeeded (#650).
• Fix compilation with GCC 7.

Hardening

A round of fuzzing-driven robustness fixes so malformed inputs are rejected with errors instead of crashing (#648):

... (truncated)

Commits

• 7688b17 Merge pull request #661 from NixOS/release-0.19.1
• b956517 Release 0.19.1
• ebf1e84 Merge pull request #659 from domenkozar/resolution-cache-more-search-hints
• 7f1c254 Lift needsSearchHint to a free function
• f59a2c9 Trim resolution-cache search-hint comments
• 4402b28 Merge pull request #654 from NixOS/dependabot/github_actions/actions/upload-a...
• 27b232e Merge pull request #656 from NixOS/dependabot/github_actions/actions/checkout-7
• 3287c46 Merge pull request #657 from NixOS/dependabot/github_actions/docker/setup-qem...
• 6117bca Merge pull request #660 from NixOS/dependabot/github_actions/Mic92/hestia-2
• 09194a3 build(deps): bump Mic92/hestia from 1 to 2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)