[OE-core][blacksail 00/17] Patch review

[Yoann Congal <yoann.congal@smile.fr>]

Please review this set of changes for blacksail and have comments back by
end of day Tuesday, October 20.

Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/4944
* oe-selftest-debian failed with 16455 – AB-INT: Can't clone file://oe-core in devtool tests
  retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/5079
* oe-selftest-armhost failed with 16456 – AB-INT: "unparsed line" error in devtool /tmp/ clone of oe-core
  retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/23/builds/5110

The following changes since commit e182a0c4b91fd459c1f9dece0c7c23f7f9eaa7ab:

  recipes-support/gnutls: disable slow tests for RISCV64 (2026-10-06 22:31:54 +0200)

are available in the Git repository at:

  https://git.openembedded.org/openembedded-core-contrib stable/blacksail-review
  https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/blacksail-review

for you to fetch changes up to a4461e117c1c501b7021d20c1380e4187fcda4c1:

  barebox: inherit upstream-stable-release-point (2026-10-16 14:49:39 +0200)

----------------------------------------------------------------

Daniel Turull (1):
  lib/oe/recipeutils: honor stable_upgrade for UPSTREAM_CHECK_COMMITS
    recipes

Darsh Kelaiya (1):
  python3-click: depend on python3-shell for shlex

Frieder Schrempf (1):
  sqlite3: Fix host include path leaking in with readline/editline

Hemanth Kumar M D (1):
  gcc: Fix for CVE-2026-102010

Jaipaul Cheernam (1):
  kea: Upgrade 3.2.0 -> 3.2.1

Kris Gavvala (1):
  nasm: fix CVE-2026-6067

Lucas Stach (1):
  barebox: inherit upstream-stable-release-point

Mathieu Dubois-Briand (1):
  libpcre2: Remove testoutput3C file

Peter Marko (7):
  popt: patch CVE-2026-18743
  popt: patch CVE-2026-18739
  libpng: upgrade 1.6.58 -> 1.6.59
  expat: patch CVE-2026-102633
  expat: patch CVE-2026-77214
  glibc: stable 2.44 branch updates to 34106fee69
  go: upgrade 1.27.1 -> 1.27.2

Richard Purdie (1):
  python3-mako: upgrade 1.4.1 -> 1.4.3

Ross Burton (1):
  tcl: skip timing-sensitive clock tests

 meta/lib/oe/recipeutils.py                    |  25 ++-
 meta/recipes-bsp/barebox/barebox.bb           |   2 +-
 ...-qualifiers-to-OpenSSL-X509-pointers.patch |  49 -----
 ...se-a-runtime-safe-interpreter-string.patch |   8 +-
 .../0001-mk_cfgrpt.sh-strip-prefixes.patch    |   2 +-
 ...er_unittest_support.cc-do-not-write-.patch |   2 +-
 .../kea/files/fix-multilib-conflict.patch     |   2 +-
 .../kea/{kea_3.2.0.bb => kea_3.2.1.bb}        |   3 +-
 .../expat/expat/CVE-2026-102633.patch         |  68 +++++++
 .../expat/expat/CVE-2026-77214.patch          | 106 +++++++++++
 meta/recipes-core/expat/expat_2.8.5.bb        |   2 +
 meta/recipes-core/glibc/glibc-version.inc     |   2 +-
 meta/recipes-core/glibc/glibc_2.44.bb         |   3 +-
 meta/recipes-devtools/gcc/gcc-16.2.inc        |   1 +
 .../gcc/gcc/0026-CVE-2026-102010.patch        |  71 +++++++
 .../go/{go-1.27.1.inc => go-1.27.2.inc}       |   2 +-
 ...e_1.27.1.bb => go-binary-native_1.27.2.bb} |   6 +-
 ..._1.27.1.bb => go-cross-canadian_1.27.2.bb} |   0
 ...{go-cross_1.27.1.bb => go-cross_1.27.2.bb} |   0
 ...osssdk_1.27.1.bb => go-crosssdk_1.27.2.bb} |   0
 ...runtime_1.27.1.bb => go-runtime_1.27.2.bb} |   0
 ...ent-based-hash-generation-less-pedan.patch |   8 +-
 ...3-ld-add-soname-to-shareable-objects.patch |   6 +-
 ...d-go-make-GOROOT-precious-by-default.patch |   2 +-
 ...ut-build-specific-paths-from-linker-.patch |   4 +-
 ...est-skip-when-cpu.max-is-not-availab.patch |   6 +-
 .../go/{go_1.27.1.bb => go_1.27.2.bb}         |   0
 .../nasm/nasm/CVE-2026-6067.patch             |  36 ++++
 meta/recipes-devtools/nasm/nasm_3.02.bb       |   1 +
 .../python/python3-click_8.5.0.bb             |   1 +
 ...n3-mako_1.4.1.bb => python3-mako_1.4.3.bb} |   2 +-
 meta/recipes-devtools/tcltk/tcl/run-ptest     |   2 +
 meta/recipes-devtools/tcltk8/tcl8/run-ptest   |   2 +
 ...ts-stream-per-test-results-to-stdout.patch |   2 +-
 .../{libpng_1.6.58.bb => libpng_1.6.59.bb}    |   2 +-
 .../libpcre/libpcre2/testoutput3C             | 174 ------------------
 .../recipes-support/libpcre/libpcre2_10.49.bb |   2 -
 .../popt/popt/CVE-2026-18739.patch            |  92 +++++++++
 .../popt/popt/CVE-2026-18743.patch            |  97 ++++++++++
 meta/recipes-support/popt/popt_1.19.bb        |   4 +-
 meta/recipes-support/sqlite/sqlite3_3.53.4.bb |   4 +-
 41 files changed, 532 insertions(+), 269 deletions(-)
 delete mode 100644 meta/recipes-connectivity/kea/files/0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch
 rename meta/recipes-connectivity/kea/{kea_3.2.0.bb => kea_3.2.1.bb} (96%)
 create mode 100644 meta/recipes-core/expat/expat/CVE-2026-102633.patch
 create mode 100644 meta/recipes-core/expat/expat/CVE-2026-77214.patch
 create mode 100644 meta/recipes-devtools/gcc/gcc/0026-CVE-2026-102010.patch
 rename meta/recipes-devtools/go/{go-1.27.1.inc => go-1.27.2.inc} (91%)
 rename meta/recipes-devtools/go/{go-binary-native_1.27.1.bb => go-binary-native_1.27.2.bb} (80%)
 rename meta/recipes-devtools/go/{go-cross-canadian_1.27.1.bb => go-cross-canadian_1.27.2.bb} (100%)
 rename meta/recipes-devtools/go/{go-cross_1.27.1.bb => go-cross_1.27.2.bb} (100%)
 rename meta/recipes-devtools/go/{go-crosssdk_1.27.1.bb => go-crosssdk_1.27.2.bb} (100%)
 rename meta/recipes-devtools/go/{go-runtime_1.27.1.bb => go-runtime_1.27.2.bb} (100%)
 rename meta/recipes-devtools/go/{go_1.27.1.bb => go_1.27.2.bb} (100%)
 create mode 100644 meta/recipes-devtools/nasm/nasm/CVE-2026-6067.patch
 rename meta/recipes-devtools/python/{python3-mako_1.4.1.bb => python3-mako_1.4.3.bb} (88%)
 rename meta/recipes-multimedia/libpng/{libpng_1.6.58.bb => libpng_1.6.59.bb} (97%)
 delete mode 100644 meta/recipes-support/libpcre/libpcre2/testoutput3C
 create mode 100644 meta/recipes-support/popt/popt/CVE-2026-18739.patch
 create mode 100644 meta/recipes-support/popt/popt/CVE-2026-18743.patch