[PATCH 0/4] upgrades: expat, libpcre2, gnupg, librepo

[PATCH 0/4] upgrades: expat, libpcre2, gnupg, librepo

[Jaipaul Cheernam]

A batch of routine version upgrades for four recipes:

  expat:    2.8.3  -> 2.8.4
  libpcre2: 10.47  -> 10.48
  gnupg:    2.5.21 -> 2.5.22
  librepo:  1.20.0 -> 1.21.0

Jaipaul Cheernam (4):
  expat: upgrade 2.8.3 -> 2.8.4
  libpcre2: upgrade 10.47 -> 10.48
  gnupg: upgrade 2.5.21 -> 2.5.22
  librepo: upgrade 1.20.0 -> 1.21.0

 .../expat/{expat_2.8.3.bb => expat_2.8.4.bb}   |  2 +-
 ...btain-PYTHON_INSTALL_DIR-by-running-p.patch |  4 ++--
 .../{librepo_1.20.0.bb => librepo_1.21.0.bb}   |  2 +-
 ...verride-init-is-not-needed-with-gcc-9.patch |  2 +-
 ...e-a-custom-value-for-the-location-of-.patch |  4 ++--
 ...-use-pkgconfig-instead-of-npth-config.patch |  2 +-
 .../recipes-support/gnupg/gnupg/relocate.patch | 18 +++++++++---------
 .../gnupg/{gnupg_2.5.21.bb => gnupg_2.5.22.bb} |  2 +-
 .../{libpcre2_10.47.bb => libpcre2_10.48.bb}   |  2 +-
 9 files changed, 19 insertions(+), 19 deletions(-)
 rename meta/recipes-core/expat/{expat_2.8.3.bb => expat_2.8.4.bb} (92%)
 rename meta/recipes-devtools/librepo/{librepo_1.20.0.bb => librepo_1.21.0.bb} (94%)
 rename meta/recipes-support/gnupg/{gnupg_2.5.21.bb => gnupg_2.5.22.bb} (97%)
 rename meta/recipes-support/libpcre/{libpcre2_10.47.bb => libpcre2_10.48.bb} (96%)

[PATCH 1/4] expat: upgrade 2.8.3 -> 2.8.4

[Jaipaul Cheernam]

Source: Changes [1]

Release 2.8.4 Mon August 31 2026
        Security fixes:
     #1321 #1331  CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from
                    "attribute isCdata lookups" that allowed denial of service
                    attacks through moderately sized crafted XML input
                    (CWE-407).
                    The vulnerability is closely related to past CVE-2026-45186
                    that was fixed with Expat 2.8.1.
                    Please note that a layer of compression around XML can
                    significantly reduce the minimum attack payload size.
                    Upstream CVSS 3.1 vector:
                    AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
                    (Note the "AV:N" for network/remote.)
           #1322  CVE-2026-76957 -- Protect custom encoding callbacks from
                    parser re-entry. The vulnerability is closely related to
                    past issues CVE-2026-50219, CVE-2026-56131 and
                    CVE-2026-56412 that were all fixed with Expat 2.8.2.
           #1326  CVE-2026-76956 -- Fix inverted getentropy() return handling
                    Allows for hash flooding denial of services in
                    configurations where getentropy is configured or detected
                    as the only high quality entropy extractor.
                    Upstream CVSS 3.1 vector:
                    AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 5.9)
                    (Note the "AV:N" for network/remote.)

        Other changes:
     #1332 #1333  CMake: Only add `/source-charset:utf-8` when `/utf-8` is not
                    present
           #1315  lib: Resolve (currently unreachable) undefined behavior from
                    overshifting a signed int to the left
     #1325 #1334  lib: Support read-only hash table lookup with keys that are
                    not zero-terminated
           #1340  lib: Use a C99 bool for `ENTITY.open`
           #1319  Fix typo in comment
           #1320  Sync file headers
     #1328 #1329  Version info bumped from 13:3:12 (libexpat*.so.1.12.3)
                    to 13:4:12 (libexpat*.so.1.12.4); see https://verbump.de/
                    for what these numbers do

        Infrastructure:
     #1317 #1335  CI: Cover compilation and execution with Fil-C
           #1337  CI: Cover compilation and execution on riscv64
           #1338  CI: Cover compilation and execution with Clang-based MinGW
           #1339  CI: Cover compilation and execution on (big-endian) s390x
           #1316  CI: Run test suite with musl, also
           #1336  CI: Bump WASI SDK from 33 to 34
           #1345  CI: Bump Clang from 22 to 23

 - Complete Changes at [1]

[1] https://github.com/libexpat/libexpat/blob/R_2_8_4/expat/Changes

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 meta/recipes-core/expat/{expat_2.8.3.bb => expat_2.8.4.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-core/expat/{expat_2.8.3.bb => expat_2.8.4.bb} (92%)

diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.4.bb
similarity index 92%
rename from meta/recipes-core/expat/expat_2.8.3.bb
rename to meta/recipes-core/expat/expat_2.8.4.bb
index 79e8c15227..050f148b07 100644
--- a/meta/recipes-core/expat/expat_2.8.3.bb
+++ b/meta/recipes-core/expat/expat_2.8.4.bb
@@ -15,7 +15,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2  \
 GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
 UPSTREAM_CHECK_REGEX = "releases/tag/R_(?P<pver>.+)"
 
-SRC_URI[sha256sum] = "b4cc2483927d5e90bf8c40b44a6b95b368b42a8a96e25883fce188b48a92b670"
+SRC_URI[sha256sum] = "963250a823c16a498582b4ad82ad0f88926be0769675d3b6956be4d769a1cd8f"
 
 EXTRA_OECMAKE:class-native += "-DEXPAT_BUILD_DOCS=OFF"
 

[PATCH 2/4] libpcre2: upgrade 10.47 -> 10.48

[Jaipaul Cheernam]

Release: https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 .../libpcre/{libpcre2_10.47.bb => libpcre2_10.48.bb}            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-support/libpcre/{libpcre2_10.47.bb => libpcre2_10.48.bb} (96%)

diff --git a/meta/recipes-support/libpcre/libpcre2_10.47.bb b/meta/recipes-support/libpcre/libpcre2_10.48.bb
similarity index 96%
rename from meta/recipes-support/libpcre/libpcre2_10.47.bb
rename to meta/recipes-support/libpcre/libpcre2_10.48.bb
index 35330845d1..d5daff03c0 100644
--- a/meta/recipes-support/libpcre/libpcre2_10.47.bb
+++ b/meta/recipes-support/libpcre/libpcre2_10.48.bb
@@ -19,7 +19,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/pcre2-${PV}/pcre2-${PV}.tar.bz2 \
 GITHUB_BASE_URI = "https://github.com/PCRE2Project/pcre2/releases"
 UPSTREAM_CHECK_REGEX = "releases/tag/pcre2-(?P<pver>\d+(\.\d+)+)$"
 
-SRC_URI[sha256sum] = "47fe8c99461250d42f89e6e8fdaeba9da057855d06eb7fc08d9ca03fd08d7bc7"
+SRC_URI[sha256sum] = "b6c68fdf6f3ac31388b50aa89ff0fc49c00c987c16e7b5146491d12003f2c8ed"
 
 CVE_PRODUCT = "pcre2"
 

[PATCH 3/4] gnupg: upgrade 2.5.21 -> 2.5.22

[Jaipaul Cheernam]

CompareLog: https://github.com/gpg/gnupg/compare/gnupg-2.5.21...gnupg-2.5.22

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 ...verride-init-is-not-needed-with-gcc-9.patch |  2 +-
 ...e-a-custom-value-for-the-location-of-.patch |  4 ++--
 ...-use-pkgconfig-instead-of-npth-config.patch |  2 +-
 .../recipes-support/gnupg/gnupg/relocate.patch | 18 +++++++++---------
 .../gnupg/{gnupg_2.5.21.bb => gnupg_2.5.22.bb} |  2 +-
 5 files changed, 14 insertions(+), 14 deletions(-)
 rename meta/recipes-support/gnupg/{gnupg_2.5.21.bb => gnupg_2.5.22.bb} (97%)

diff --git a/meta/recipes-support/gnupg/gnupg/0001-Woverride-init-is-not-needed-with-gcc-9.patch b/meta/recipes-support/gnupg/gnupg/0001-Woverride-init-is-not-needed-with-gcc-9.patch
index 7a3fa59c54..52db780959 100644
--- a/meta/recipes-support/gnupg/gnupg/0001-Woverride-init-is-not-needed-with-gcc-9.patch
+++ b/meta/recipes-support/gnupg/gnupg/0001-Woverride-init-is-not-needed-with-gcc-9.patch
@@ -1,4 +1,4 @@
-From 46db1301b1b71f47aa131b9a3de9d1cf356cf408 Mon Sep 17 00:00:00 2001
+From 8b7d344ed35bc4bcfa0d531a0885fc1bea01ffda Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Thu, 20 Dec 2018 17:37:48 -0800
 Subject: [PATCH] Woverride-init is not needed with gcc 9
diff --git a/meta/recipes-support/gnupg/gnupg/0001-configure.ac-use-a-custom-value-for-the-location-of-.patch b/meta/recipes-support/gnupg/gnupg/0001-configure.ac-use-a-custom-value-for-the-location-of-.patch
index 1c7cd7ba7b..04dd45e676 100644
--- a/meta/recipes-support/gnupg/gnupg/0001-configure.ac-use-a-custom-value-for-the-location-of-.patch
+++ b/meta/recipes-support/gnupg/gnupg/0001-configure.ac-use-a-custom-value-for-the-location-of-.patch
@@ -1,4 +1,4 @@
-From fd060f524e50c7c3f8694f71630ac151627235f1 Mon Sep 17 00:00:00 2001
+From f86e7337698debfe5152f4f4bc840bf56f868fab Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Mon, 22 Jan 2018 18:00:21 +0200
 Subject: [PATCH] configure.ac: use a custom value for the location of
@@ -13,7 +13,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/configure.ac b/configure.ac
-index 5ac4d0b..09615c5 100644
+index 9e2a42d..b48b88d 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -1909,7 +1909,7 @@ AC_DEFINE_UNQUOTED(GPGCONF_DISP_NAME, "GPGConf",
diff --git a/meta/recipes-support/gnupg/gnupg/0002-use-pkgconfig-instead-of-npth-config.patch b/meta/recipes-support/gnupg/gnupg/0002-use-pkgconfig-instead-of-npth-config.patch
index f4c9b2161a..7553bd9f3f 100644
--- a/meta/recipes-support/gnupg/gnupg/0002-use-pkgconfig-instead-of-npth-config.patch
+++ b/meta/recipes-support/gnupg/gnupg/0002-use-pkgconfig-instead-of-npth-config.patch
@@ -1,4 +1,4 @@
-From b8a99b2d9caa05f54be25635e3b1687753fe7196 Mon Sep 17 00:00:00 2001
+From 3c1d201eace11d557eb6c589842e93b8bacbe8f9 Mon Sep 17 00:00:00 2001
 From: Saul Wold <sgw@linux.intel.com>
 Date: Wed, 16 Aug 2017 11:16:30 +0800
 Subject: [PATCH] use pkgconfig instead of npth config
diff --git a/meta/recipes-support/gnupg/gnupg/relocate.patch b/meta/recipes-support/gnupg/gnupg/relocate.patch
index 02f03386ec..234afd16fe 100644
--- a/meta/recipes-support/gnupg/gnupg/relocate.patch
+++ b/meta/recipes-support/gnupg/gnupg/relocate.patch
@@ -1,4 +1,4 @@
-From c70694bd3e71cc1fec6ccb3ea0f694c3863ebd48 Mon Sep 17 00:00:00 2001
+From f49d102adf393f57e6ca7b6ec6969f60115055ef Mon Sep 17 00:00:00 2001
 From: Ross Burton <ross.burton@intel.com>
 Date: Wed, 19 Sep 2018 14:44:40 +0100
 Subject: [PATCH] Allow the environment to override where gnupg looks for its
@@ -13,10 +13,10 @@ Signed-off-by: Alexander Kanavin <alex@linutronix.de>
  1 file changed, 7 insertions(+), 7 deletions(-)
 
 diff --git a/common/homedir.c b/common/homedir.c
-index 835f0ea..0a67a33 100644
+index 7538642..92e8125 100644
 --- a/common/homedir.c
 +++ b/common/homedir.c
-@@ -1526,7 +1526,7 @@ gnupg_socketdir (void)
+@@ -1575,7 +1575,7 @@ gnupg_socketdir (void)
    if (!name)
      {
        unsigned int dummy;
@@ -25,7 +25,7 @@ index 835f0ea..0a67a33 100644
        gpgrt_annotate_leaked_object (name);
      }
  
-@@ -1555,7 +1555,7 @@ gnupg_sysconfdir (void)
+@@ -1604,7 +1604,7 @@ gnupg_sysconfdir (void)
    if (dir)
      return dir;
    else
@@ -34,7 +34,7 @@ index 835f0ea..0a67a33 100644
  #endif /*!HAVE_W32_SYSTEM*/
  }
  
-@@ -1591,7 +1591,7 @@ gnupg_bindir (void)
+@@ -1640,7 +1640,7 @@ gnupg_bindir (void)
        return name;
      }
    else
@@ -43,7 +43,7 @@ index 835f0ea..0a67a33 100644
  #endif /*!HAVE_W32_SYSTEM*/
  }
  
-@@ -1618,7 +1618,7 @@ gnupg_libexecdir (void)
+@@ -1667,7 +1667,7 @@ gnupg_libexecdir (void)
        return name;
      }
    else
@@ -52,7 +52,7 @@ index 835f0ea..0a67a33 100644
  #endif /*!HAVE_W32_SYSTEM*/
  }
  
-@@ -1648,7 +1648,7 @@ gnupg_libdir (void)
+@@ -1697,7 +1697,7 @@ gnupg_libdir (void)
        return name;
      }
    else
@@ -61,7 +61,7 @@ index 835f0ea..0a67a33 100644
  #endif /*!HAVE_W32_SYSTEM*/
  }
  
-@@ -1679,7 +1679,7 @@ gnupg_datadir (void)
+@@ -1728,7 +1728,7 @@ gnupg_datadir (void)
        return name;
      }
    else
@@ -70,7 +70,7 @@ index 835f0ea..0a67a33 100644
  #endif /*!HAVE_W32_SYSTEM*/
  }
  
-@@ -1711,7 +1711,7 @@ gnupg_localedir (void)
+@@ -1760,7 +1760,7 @@ gnupg_localedir (void)
        return name;
      }
    else
diff --git a/meta/recipes-support/gnupg/gnupg_2.5.21.bb b/meta/recipes-support/gnupg/gnupg_2.5.22.bb
similarity index 97%
rename from meta/recipes-support/gnupg/gnupg_2.5.21.bb
rename to meta/recipes-support/gnupg/gnupg_2.5.22.bb
index dc77691bbd..803fb2765a 100644
--- a/meta/recipes-support/gnupg/gnupg_2.5.21.bb
+++ b/meta/recipes-support/gnupg/gnupg_2.5.22.bb
@@ -25,7 +25,7 @@ SRC_URI:append:class-native = " file://0001-configure.ac-use-a-custom-value-for-
                                 file://relocate.patch"
 SRC_URI:append:class-nativesdk = " file://relocate.patch"
 
-SRC_URI[sha256sum] = "e3af2c8caa46a66a9329fa7c6880af260451914d819595beabc2c26597b31352"
+SRC_URI[sha256sum] = "96e27b020ad26510388e06f5f07f3f70a4ed8916ee995f1b72b7a024e6d9d87e"
 
 EXTRA_OECONF = "--disable-ldap \
 		--disable-ccid-driver \

[PATCH 4/4] librepo: upgrade 1.20.0 -> 1.21.0

[Jaipaul Cheernam]

5e5bdda use PROV for pkcs11 URIs with OpenSSL 4.x
54e8496 test: verify missing key error message consistency across backends
ea33d57 gpgme: report "Signing key not found" when signing key is missing
13e2a9b PGP: define shared error message constants for both backends
f756add Optionally build librepo as a static library as well
adf4afa test: don't expect empty file when downloading fails
84ce760 Fix metadata file descriptor leaks
ec49f22 Close zchunk seed fd in find_local_zck_header
a42277a Do not fail in lr_prepare_repodata_dir() if repodata/ dir exists
84206b2 Fix download resume within a single session
23a958f Configure packit to use caret notation for postrelease snapshots
9e5b003 Set CMAKE_SKIP_RPATH to TRUE
5d8b0ea Fix memory leaks in `lr_yum_download_repos`
e39ef74 Fix: actually store metalink and mirrorlist download targets
9eff2fc PGP: Fix creating /run/gnupg/user
731b5f9 Replace deprecated CURLOPT_PROGRESSFUNCTION
be788e8 spec: Postrelease version bump
5d52606 gpgme: Improve handling of expired GPG signatures with key rotation support
067e0ea Merge packit copr_build jobs into one
310d247 CI: Correct a link to packit documentation
03a20b2 Add build requirements installation instructions
0fc4b98 Test importing keys with prefix and suffix
a260f21 We cannot build for epel-8 due to glib2 ≥ 2.66 requirement
f22fc30 Add packit copr-builds and tests

- Refresh patches context

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 ...Do-not-try-to-obtain-PYTHON_INSTALL_DIR-by-running-p.patch | 4 ++--
 .../librepo/{librepo_1.20.0.bb => librepo_1.21.0.bb}          | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)
 rename meta/recipes-devtools/librepo/{librepo_1.20.0.bb => librepo_1.21.0.bb} (94%)

diff --git a/meta/recipes-devtools/librepo/librepo/0002-Do-not-try-to-obtain-PYTHON_INSTALL_DIR-by-running-p.patch b/meta/recipes-devtools/librepo/librepo/0002-Do-not-try-to-obtain-PYTHON_INSTALL_DIR-by-running-p.patch
index ac5373f2e7..6cfe970c2f 100644
--- a/meta/recipes-devtools/librepo/librepo/0002-Do-not-try-to-obtain-PYTHON_INSTALL_DIR-by-running-p.patch
+++ b/meta/recipes-devtools/librepo/librepo/0002-Do-not-try-to-obtain-PYTHON_INSTALL_DIR-by-running-p.patch
@@ -1,4 +1,4 @@
-From 0062f49b62ce014dc81485c6ae101d49399d22cf Mon Sep 17 00:00:00 2001
+From ba81dfc3aaeadad0e22272136740864bc95d4f6b Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Fri, 30 Dec 2016 18:05:36 +0200
 Subject: [PATCH] Do not try to obtain PYTHON_INSTALL_DIR by running python.
@@ -11,7 +11,7 @@ Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
  1 file changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/librepo/python/CMakeLists.txt b/librepo/python/CMakeLists.txt
-index 8523ca7..06e5f7b 100644
+index 91b7385..b08358b 100644
 --- a/librepo/python/CMakeLists.txt
 +++ b/librepo/python/CMakeLists.txt
 @@ -16,12 +16,12 @@ SET (librepomodule_SRCS
diff --git a/meta/recipes-devtools/librepo/librepo_1.20.0.bb b/meta/recipes-devtools/librepo/librepo_1.21.0.bb
similarity index 94%
rename from meta/recipes-devtools/librepo/librepo_1.20.0.bb
rename to meta/recipes-devtools/librepo/librepo_1.21.0.bb
index 7a2e9e6b9b..72ee9a627c 100644
--- a/meta/recipes-devtools/librepo/librepo_1.20.0.bb
+++ b/meta/recipes-devtools/librepo/librepo_1.21.0.bb
@@ -9,7 +9,7 @@ SRC_URI = "git://github.com/rpm-software-management/librepo.git;branch=master;pr
            file://0002-Do-not-try-to-obtain-PYTHON_INSTALL_DIR-by-running-p.patch \
            "
 
-SRCREV = "363cb70c6548be900832bc9b18ced3e7569da15a"
+SRCREV = "5e5bddacad52121f970c499e13a98d936dcdc7b6"
 
 DEPENDS = "curl glib-2.0 openssl attr gpgme libxml2"