Re: [Buildroot] [PATCH] package/nfs-utils: security bump version to 2.8.7

Julien Olivain via buildroot
2026-03-16T21:28:48Z

Hi Giulio,

On 16/03/2026 11:54, Giulio Benetti wrote:
> On 3/16/26 11:53, Giulio Benetti wrote:
>> Hi Julien and Petr,
>>
>> On 3/16/26 00:07, Petr Vorel wrote:
>>> Hi Julien,
>>>
>>>> Hi Giulio,
>>>
>>>> On 13/03/2026 22:10, Giulio Benetti wrote:
>>>>> Release announce:
>>>>> https://lore.kernel.org/linux-
>>>>> nfs/4d11b9d7-7b49-4a1e-8c26-29ecb2fefe2f@redhat.com/
>>>
>>>> The commit title says it is a "security" bump. I can't find any
>>>> reference to
>>>> security
>>>> fixes in the release note. Could you provide details?
>>>
>>>> Or is it a copy paste error from the previous bump?
>>>> https://gitlab.com/buildroot.org/buildroot/-/
>>>> commit/7dfd2feb445c2cf83a2b52057fab96e72e42a071
>>>
>>>> In the later case, no need to send a v2, I'll just remove "security"
>>>> while
>>>> applying.
>>>
>>> I'd also say it's just a copy paste from 2.8.6. 2.8.7 seems to me
>>> only a bugfix
>>> release.
>>
>> I interpret commit [1] as a security commit, but maybe I'm wrong.
>> It's not a CVE or similar but to me it sounds like a security commit,
>> this is why subject is " security bump..".
>
> [1]:
> https://www.kernel.org/pub/linux/utils/nfs-utils/2.8.7/2.8.7-Changelog

Applied to master, thanks.

I removed "security" in the commit title. While I agree that using
uninitialized data from the stack might be a security issue, we
generally flag updates in Buildroot as "security" when there is a
mention in the release note, a CVE assigned, or an advisory. This
"bugfix" release will go in Buildroot LTS branches anyway.

>> Best regards
>> Giulio
>>
>>> Kind regards,
>>> Petr
>>>
>>>>> Signed-off-by: Giulio Benetti
>>>>> <giulio.benetti@benettiengineering.com>
>>>
>>>> Best regards,
>>>
>>>> Julien.

Best regards,

Julien.