[OE-core][scarthgap v2 00/12] Pull request (cover letter only)

[OE-core][scarthgap v2 00/12] Pull request (cover letter only)

[Yoann Congal]

Those are the patches from the last patch review:
https://lore.kernel.org/all/cover.1789163914.git.yoann.congal@smile.fr/
Changes:
* Removed "go: Fix CVE-2026-33814"
  see https://lore.kernel.org/openembedded-core/7ceb1874bae6aae6c4bb27b948a38c1015960739.camel@pbarker.dev/T/#m64e0e8296e4df92ef5bb835bcc923df9a844a1c5
* Rebased "go: Fix CVE-2026-39823"

Passed a-full on autobuilder:
The previous version of the branch built:
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/4718
> * oe-selftest-fedora fails with 16415 – AB-INT: github infrastructure issues
>   I still need to backport fixes from master to wrynose, and then,
>   scarthgap.
> * qemuarm64-ptest failed with 16267 – [scarthgap] AB-INT PTEST: python3 failure (test_wrong_cert_tls13)
>   retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/61/builds/4516
> Note: this build was not rebased on the latest build-appliance update.

For tests of this updated branch, I only built go, the CVE-2026-33814
fix is isolated from the CVE-2026-39823 fix, its removal should not
impact tests results.
But, I could start an a-full or a sub-build if deemed needed.

The following changes since commit bb166ac536daa43602ce8962cd3eb137783b8dc9:

  build-appliance-image: Update to scarthgap head revision (2026-09-11 14:32:15 +0100)

are available in the Git repository at:

  https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-next
  https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-next

for you to fetch changes up to 04f18f976b3809e195433b6b31a6121014bdc37c:

  u-boot, u-boot-tools: Fix CVE-2026-46728 (2026-09-17 16:32:11 +0200)

----------------------------------------------------------------

Daniel Turull (1):
  libarchive: mark CVE-2026-14164 as fixed-version

Darsh Kelaiya (1):
  python3-lxml: fix CVE-2026-41066

Deepak Rathore (2):
  binutils: fix CVE-2026-3441 and CVE-2026-3442
  binutils: fix CVE-2026-4647

Devansh Patel (1):
  u-boot: share CVE_PRODUCT with u-boot-tools

Gyorgy Sarvari (1):
  python3-py: set CVE_PRODUCT

Hetvi Thakar (3):
  python3-pip: Fix CVE-2026-8643
  go: Fix CVE-2026-39823
  u-boot, u-boot-tools: Fix CVE-2026-46728

Peter Marko (1):
  openssl: upgrade 3.5.7 -> 3.5.8

Vijay Anusuri (1):
  p11-kit: Fix CVE-2026-18938

Yoann Congal (1):
  linux-yocto/6.6: update CVE exclusions (6.6.151)

 .../u-boot/files/CVE-2026-46728.patch         |  379 ++
 meta/recipes-bsp/u-boot/u-boot-common.inc     |    2 +
 .../u-boot/u-boot-tools_2024.01.bb            |    2 +
 meta/recipes-bsp/u-boot/u-boot.inc            |    2 -
 meta/recipes-bsp/u-boot/u-boot_2024.01.bb     |    1 +
 .../{openssl_3.5.7.bb => openssl_3.5.8.bb}    |    2 +-
 .../binutils/binutils-2.42.inc                |    2 +
 .../CVE-2026-3441_CVE-2026-3442.patch         |   51 +
 .../binutils/binutils/CVE-2026-4647.patch     |  228 +
 meta/recipes-devtools/go/go-1.22.12.inc       |    1 +
 .../go/go/CVE-2026-39823.patch                |  100 +
 .../python/python3-lxml/CVE-2026-41066.patch  |  262 +
 .../python/python3-lxml_5.0.2.bb              |    4 +-
 .../CVE-2026-8643-regression_p1.patch         |   34 +
 .../CVE-2026-8643-regression_p2.patch         |   69 +
 .../python/python3-pip/CVE-2026-8643.patch    |   79 +
 .../python/python3-pip_24.0.bb                |    3 +
 .../python/python3-py_1.11.0.bb               |    2 +
 .../libarchive/libarchive_3.7.9.bb            |    5 +
 .../linux/cve-exclusion_6.6.inc               | 4540 ++++++++++++++++-
 .../p11-kit/files/CVE-2026-18938.patch        |   52 +
 .../recipes-support/p11-kit/p11-kit_0.25.3.bb |    1 +
 22 files changed, 5742 insertions(+), 79 deletions(-)
 create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch
 rename meta/recipes-connectivity/openssl/{openssl_3.5.7.bb => openssl_3.5.8.bb} (99%)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-3441_CVE-2026-3442.patch
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-4647.patch
 create mode 100644 meta/recipes-devtools/go/go/CVE-2026-39823.patch
 create mode 100644 meta/recipes-devtools/python/python3-lxml/CVE-2026-41066.patch
 create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2026-8643-regression_p1.patch
 create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2026-8643-regression_p2.patch
 create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2026-8643.patch
 create mode 100644 meta/recipes-support/p11-kit/files/CVE-2026-18938.patch