Re: [OE-core] [kirkstone][PATCH 2/2] vim: Upgrade 9.1.2128 -> 9.1.2144

["Fabien Thomas" <fabien.thomas@smile.fr>]

On Tue Mar 17, 2026 at 7:14 AM CET, Hitendra Prajapati via lists.openembedded.org wrote:
> Upgrade from 9.1.2128 to 9.1.2144 to include the fix for
> CVE-2026-25749 [1] [2].
>
> [1] https://github.com/vim/vim/security/advisories/GHSA-5w93-4g67-mm43
> [2] https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9
>
> Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
> ---
>  meta/recipes-support/vim/vim.inc | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
> index 0ce6aa71a4..7a7bedf863 100644
> --- a/meta/recipes-support/vim/vim.inc
> +++ b/meta/recipes-support/vim/vim.inc
> @@ -18,8 +18,8 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
>             file://no-path-adjust.patch \
>             "
>  
> -PV .= ".2128"
> -SRCREV = "392b428d1239e963020b73682cd03f17ffb538b3"
> +PV .= ".2144"
> +SRCREV = "55c12373f073bacfc97d757e8f4da3daf472e4ac"
>  
>  # Do not consider .z in x.y.z, as that is updated with every commit
>  UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+\.\d+)\.0"

Hi Hitendra, 

Upgrading from 9.1.1683 to 9.1.2144 involves over 460 versions and over 1000 
commits. As previously discussed here [1], so many changes seems too risky for 
a stable/LTS branch.

So, without a exemption granted by Yocto Project TSC for Vim, 
backporting patches is the best solution for addressing CVEs. 

Regards,

[1] https://lore.kernel.org/openembedded-core/AS1PR10MB56978C6748852F61C4F7109BFD74A@AS1PR10MB5697.EURPRD10.PROD.OUTLOOK.COM/
-- 
Fabien Thomas
Smile ECS