[OE-core][scarthgap 00/35] Patch review

[Yoann Congal <yoann.congal@smile.fr>]

Please review this set of changes for scarthgap and have comments back by
end of day Wednesday, September 9.

Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/4676
* qemuppc (AB disk space issue) retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/31/builds/1662
* pkgman-non-rpm (AB disk space issue) retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/67/builds/4598
* oe-selftest-debian: AB disk space issue in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/4777
  but "Bitbake Selftest" passed.
  Retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/4779
  but, here, "Bitbake Selftest" failed on github infra issue (see #16415 – AB-INT: github infrastructure issues)
* oe-selftest-fedora failed with 16206 – [scarthgap] AB-INT: runtime_test.SystemTap.test_crosstap_* failures
  retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/48/builds/4594

(TL;DR: No new bug seen in test with this series.)

The following changes since commit 048f2f8e8864ae5861afe95ea52efc0354bfc18c:

  build-appliance-image: Update to scarthgap head revision (2026-09-04 10:39:17 +0100)

are available in the Git repository at:

  https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
  https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut

for you to fetch changes up to 5b4292b3fc1586709dcdc27d7cfa3d880e6f338a:

  gnutls: Backport fix for CVE-2026-33846 (2026-09-06 01:25:16 +0200)

----------------------------------------------------------------

Anil Dongare (1):
  apt: mark CVE-2011-3374 as not-applicable-config

Bruce Ashfield (3):
  linux-yocto/6.6: update to v6.6.150
  linux-yocto/6.6: update to v6.6.151
  linux-yocto/6.6: fix tiny build

Darsh Kelaiya (3):
  python3-git: fix CVE-2026-42284
  python3-git: fix CVE-2026-44243
  python3-git: fix CVE-2026-44244

Eilís 'pidge' Ní Fhlannagáin (1):
  ovmf: fix tpm PACKAGECONFIG to use TPM2_ENABLE

Hetvi Thakar (3):
  python3-idna: Fix CVE-2026-45409
  python3-mako: Fix CVE-2026-41205
  libssh2: Fix CVE-2026-58051

Jaipaul Cheernam (2):
  util-linux: Fix CVE-2026-3184
  expat: set CVE_STATUS for CVE-2026-72522

Jakub Szczudlo (Nokia) (2):
  gnutls: fix CVE-2026-42010
  gnutls: fix for CVE-2026-42011

Peter Marko (3):
  libevent: set status for CVE-2026-63380
  alsa-lib: patch CVE-2026-56109
  busybox: patch CVE-2024-58251

Pratik Farkase (1):
  libevent: merge inherit statements

Roland Kovacs (1):
  gnutls: Backport fix for CVE-2026-33846

Ross Burton (2):
  libevent: use libtool to install test binaries
  libevent: upgrade 2.1.12 -> 2.1.13

Tim Orling (9):
  python3-babel: fix CVE_PRODUCT
  python3-click: fix CVE_PRODUCT
  python3-dbusmock: fix CVE_PRODUCT
  python3-attrs: fix CVE_PRODUCT
  python3-numpy: fix CVE_PRODUCT
  python3-pycryptodome: fix CVE_PRODUCT
  python3-wheel: fix CVE_PRODUCT
  python3-pycryptodomex: fix CVE_PRODUCT
  python3-git: fix CVE_PRODUCT

Vijay Anusuri (4):
  p11-kit: Fix CVE-2026-13757
  libxfont2: Fix CVE-2026-56001
  libxfont2: Fix CVE-2026-56002
  libxfont2: Fix CVE-2026-56003

 .../busybox/busybox/CVE-2024-58251.patch      |  51 ++++
 meta/recipes-core/busybox/busybox_1.36.1.bb   |   1 +
 meta/recipes-core/expat/expat_2.6.4.bb        |   3 +
 meta/recipes-core/ovmf/ovmf_git.bb            |   2 +-
 meta/recipes-core/util-linux/util-linux.inc   |   1 +
 .../util-linux/util-linux/CVE-2026-3184.patch |  61 ++++
 meta/recipes-devtools/apt/apt_2.6.1.bb        |   3 +
 .../python/python3-attrs_23.2.0.bb            |   2 +
 .../python/python3-babel_2.14.0.bb            |   2 +
 .../python/python3-click_8.1.7.bb             |   2 +
 .../python/python3-dbusmock_0.31.1.bb         |   2 +
 .../python/python3-git/CVE-2026-42284.patch   |  37 +++
 .../python3-git/CVE-2026-44243_p1.patch       | 136 +++++++++
 .../python3-git/CVE-2026-44243_p2.patch       |  86 ++++++
 .../python3-git/CVE-2026-44244_p1.patch       | 104 +++++++
 .../python3-git/CVE-2026-44244_p2.patch       |  30 ++
 .../python/python3-git_3.1.42.bb              |   8 +
 .../python3-idna/CVE-2026-45409_p1.patch      |  75 +++++
 .../python3-idna/CVE-2026-45409_p2.patch      |  48 ++++
 .../python3-idna/CVE-2026-45409_p3.patch      |  72 +++++
 .../python/python3-idna_3.7.bb                |   5 +
 .../python/python3-mako/CVE-2026-41205.patch  | 110 ++++++++
 .../python/python3-mako_1.3.2.bb              |   2 +
 .../python/python3-numpy_1.26.4.bb            |   2 +
 .../python/python3-pycryptodome_3.20.0.bb     |   1 +
 .../python/python3-pycryptodomex_3.20.0.bb    |   2 +
 .../python/python3-wheel_0.42.0.bb            |   2 +
 .../xorg-lib/libxfont2/CVE-2026-56001.patch   |  75 +++++
 .../xorg-lib/libxfont2/CVE-2026-56002.patch   | 138 +++++++++
 .../xorg-lib/libxfont2/CVE-2026-56003.patch   | 114 ++++++++
 .../xorg-lib/libxfont2_2.0.6.bb               |   5 +
 .../linux/linux-yocto-rt_6.6.bb               |   6 +-
 .../linux/linux-yocto-tiny_6.6.bb             |   6 +-
 meta/recipes-kernel/linux/linux-yocto_6.6.bb  |  28 +-
 .../alsa/alsa-lib/CVE-2026-56109.patch        |  33 +++
 .../alsa/alsa-lib_1.2.11.bb                   |   1 +
 .../gnutls/gnutls/CVE-2026-33846.patch        |  66 +++++
 .../gnutls/gnutls/CVE-2026-42010.patch        |  41 +++
 .../gnutls/gnutls/CVE-2026-42011_p1.patch     |  43 +++
 .../gnutls/gnutls/CVE-2026-42011_p2.patch     | 141 ++++++++++
 meta/recipes-support/gnutls/gnutls_3.8.4.bb   |   4 +
 ....c-patch-out-tests-that-require-a-wo.patch |   8 +-
 ...ncrease-default-timeval-tolerance-50.patch |  10 +-
 ...-monotonic_prc_fallback-as-retriable.patch |  11 +-
 ...ts-are-marked-failed-only-when-all-a.patch |   9 +-
 .../libevent/Makefile-missing-test-dir.patch  |  14 +-
 ...{libevent_2.1.12.bb => libevent_2.1.13.bb} |  16 +-
 .../libssh2/libssh2/CVE-2026-58051.patch      |  34 +++
 .../recipes-support/libssh2/libssh2_1.11.1.bb |   1 +
 .../p11-kit/files/CVE-2026-13757.patch        | 265 ++++++++++++++++++
 .../recipes-support/p11-kit/p11-kit_0.25.3.bb |   1 +
 51 files changed, 1863 insertions(+), 57 deletions(-)
 create mode 100644 meta/recipes-core/busybox/busybox/CVE-2024-58251.patch
 create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-3184.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-42284.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-44243_p1.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-44243_p2.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-44244_p1.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-44244_p2.patch
 create mode 100644 meta/recipes-devtools/python/python3-idna/CVE-2026-45409_p1.patch
 create mode 100644 meta/recipes-devtools/python/python3-idna/CVE-2026-45409_p2.patch
 create mode 100644 meta/recipes-devtools/python/python3-idna/CVE-2026-45409_p3.patch
 create mode 100644 meta/recipes-devtools/python/python3-mako/CVE-2026-41205.patch
 create mode 100644 meta/recipes-graphics/xorg-lib/libxfont2/CVE-2026-56001.patch
 create mode 100644 meta/recipes-graphics/xorg-lib/libxfont2/CVE-2026-56002.patch
 create mode 100644 meta/recipes-graphics/xorg-lib/libxfont2/CVE-2026-56003.patch
 create mode 100644 meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-56109.patch
 create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-33846.patch
 create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42010.patch
 create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p1.patch
 create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p2.patch
 rename meta/recipes-support/libevent/{libevent_2.1.12.bb => libevent_2.1.13.bb} (84%)
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-58051.patch
 create mode 100644 meta/recipes-support/p11-kit/files/CVE-2026-13757.patch