Re: [Buildroot] [PATCH] package/nfs-utils: security bump version to 2.8.7

[Julien Olivain via buildroot <buildroot@buildroot.org>]

Hi Giulio,

On 16/03/2026 11:54, Giulio Benetti wrote:
> On 3/16/26 11:53, Giulio Benetti wrote:
>> Hi Julien and Petr,
>> 
>> On 3/16/26 00:07, Petr Vorel wrote:
>>> Hi Julien,
>>> 
>>>> Hi Giulio,
>>> 
>>>> On 13/03/2026 22:10, Giulio Benetti wrote:
>>>>> Release announce:
>>>>> https://lore.kernel.org/linux- 
>>>>> nfs/4d11b9d7-7b49-4a1e-8c26-29ecb2fefe2f@redhat.com/
>>> 
>>>> The commit title says it is a "security" bump. I can't find any 
>>>> reference to
>>>> security
>>>> fixes in the release note. Could you provide details?
>>> 
>>>> Or is it a copy paste error from the previous bump?
>>>> https://gitlab.com/buildroot.org/buildroot/-/ 
>>>> commit/7dfd2feb445c2cf83a2b52057fab96e72e42a071
>>> 
>>>> In the later case, no need to send a v2, I'll just remove "security" 
>>>> while
>>>> applying.
>>> 
>>> I'd also say it's just a copy paste from 2.8.6. 2.8.7 seems to me 
>>> only a bugfix
>>> release.
>> 
>> I interpret commit [1] as a security commit, but maybe I'm wrong.
>> It's not a CVE or similar but to me it sounds like a security commit,
>> this is why subject is " security bump..".
> 
> [1]: 
> https://www.kernel.org/pub/linux/utils/nfs-utils/2.8.7/2.8.7-Changelog

Applied to master, thanks.

I removed "security" in the commit title. While I agree that using
uninitialized data from the stack might be a security issue, we
generally flag updates in Buildroot as "security" when there is a
mention in the release note, a CVE assigned, or an advisory. This
"bugfix" release will go in Buildroot LTS branches anyway.

>> Best regards
>> Giulio
>> 
>>> Kind regards,
>>> Petr
>>> 
>>>>> Signed-off-by: Giulio Benetti 
>>>>> <giulio.benetti@benettiengineering.com>
>>> 
>>>> Best regards,
>>> 
>>>> Julien.

Best regards,

Julien.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot