From: Yoann Congal <yoann.congal@smile.fr>
To: openembedded-core@lists.openembedded.org
Cc: Paul Barker <paul@pbarker.dev>
Subject: [OE-core][scarthgap v2 00/12] Pull request (cover letter only)
Date: Thu, 17 Sep 2026 17:15:47 +0200 [thread overview]
Message-ID: <cover.1789657495.git.yoann.congal@smile.fr> (raw)
Those are the patches from the last patch review:
https://lore.kernel.org/all/cover.1789163914.git.yoann.congal@smile.fr/
Changes:
* Removed "go: Fix CVE-2026-33814"
see https://lore.kernel.org/openembedded-core/7ceb1874bae6aae6c4bb27b948a38c1015960739.camel@pbarker.dev/T/#m64e0e8296e4df92ef5bb835bcc923df9a844a1c5
* Rebased "go: Fix CVE-2026-39823"
Passed a-full on autobuilder:
The previous version of the branch built:
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/4718
> * oe-selftest-fedora fails with 16415 – AB-INT: github infrastructure issues
> I still need to backport fixes from master to wrynose, and then,
> scarthgap.
> * qemuarm64-ptest failed with 16267 – [scarthgap] AB-INT PTEST: python3 failure (test_wrong_cert_tls13)
> retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/61/builds/4516
> Note: this build was not rebased on the latest build-appliance update.
For tests of this updated branch, I only built go, the CVE-2026-33814
fix is isolated from the CVE-2026-39823 fix, its removal should not
impact tests results.
But, I could start an a-full or a sub-build if deemed needed.
The following changes since commit bb166ac536daa43602ce8962cd3eb137783b8dc9:
build-appliance-image: Update to scarthgap head revision (2026-09-11 14:32:15 +0100)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-next
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-next
for you to fetch changes up to 04f18f976b3809e195433b6b31a6121014bdc37c:
u-boot, u-boot-tools: Fix CVE-2026-46728 (2026-09-17 16:32:11 +0200)
----------------------------------------------------------------
Daniel Turull (1):
libarchive: mark CVE-2026-14164 as fixed-version
Darsh Kelaiya (1):
python3-lxml: fix CVE-2026-41066
Deepak Rathore (2):
binutils: fix CVE-2026-3441 and CVE-2026-3442
binutils: fix CVE-2026-4647
Devansh Patel (1):
u-boot: share CVE_PRODUCT with u-boot-tools
Gyorgy Sarvari (1):
python3-py: set CVE_PRODUCT
Hetvi Thakar (3):
python3-pip: Fix CVE-2026-8643
go: Fix CVE-2026-39823
u-boot, u-boot-tools: Fix CVE-2026-46728
Peter Marko (1):
openssl: upgrade 3.5.7 -> 3.5.8
Vijay Anusuri (1):
p11-kit: Fix CVE-2026-18938
Yoann Congal (1):
linux-yocto/6.6: update CVE exclusions (6.6.151)
.../u-boot/files/CVE-2026-46728.patch | 379 ++
meta/recipes-bsp/u-boot/u-boot-common.inc | 2 +
.../u-boot/u-boot-tools_2024.01.bb | 2 +
meta/recipes-bsp/u-boot/u-boot.inc | 2 -
meta/recipes-bsp/u-boot/u-boot_2024.01.bb | 1 +
.../{openssl_3.5.7.bb => openssl_3.5.8.bb} | 2 +-
.../binutils/binutils-2.42.inc | 2 +
.../CVE-2026-3441_CVE-2026-3442.patch | 51 +
.../binutils/binutils/CVE-2026-4647.patch | 228 +
meta/recipes-devtools/go/go-1.22.12.inc | 1 +
.../go/go/CVE-2026-39823.patch | 100 +
.../python/python3-lxml/CVE-2026-41066.patch | 262 +
.../python/python3-lxml_5.0.2.bb | 4 +-
.../CVE-2026-8643-regression_p1.patch | 34 +
.../CVE-2026-8643-regression_p2.patch | 69 +
.../python/python3-pip/CVE-2026-8643.patch | 79 +
.../python/python3-pip_24.0.bb | 3 +
.../python/python3-py_1.11.0.bb | 2 +
.../libarchive/libarchive_3.7.9.bb | 5 +
.../linux/cve-exclusion_6.6.inc | 4540 ++++++++++++++++-
.../p11-kit/files/CVE-2026-18938.patch | 52 +
.../recipes-support/p11-kit/p11-kit_0.25.3.bb | 1 +
22 files changed, 5742 insertions(+), 79 deletions(-)
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch
rename meta/recipes-connectivity/openssl/{openssl_3.5.7.bb => openssl_3.5.8.bb} (99%)
create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-3441_CVE-2026-3442.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-4647.patch
create mode 100644 meta/recipes-devtools/go/go/CVE-2026-39823.patch
create mode 100644 meta/recipes-devtools/python/python3-lxml/CVE-2026-41066.patch
create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2026-8643-regression_p1.patch
create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2026-8643-regression_p2.patch
create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2026-8643.patch
create mode 100644 meta/recipes-support/p11-kit/files/CVE-2026-18938.patch
reply other threads:[~2026-09-17 15:16 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1789657495.git.yoann.congal@smile.fr \
--to=yoann.congal@smile.fr \
--cc=openembedded-core@lists.openembedded.org \
--cc=paul@pbarker.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.