[PATCH 00/24] 2026-09-29 upgrades

[PATCH 00/24] 2026-09-29 upgrades

[Mathieu Dubois-Briand]

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
Mathieu Dubois-Briand (24):
      python3-pytz: upgrade 2026.3.post1 -> 2026.4
      python3-vcs-versioning: upgrade 2.4.0 -> 2.5.0
      python3-setuptools-scm: upgrade 10.2.3 -> 10.3.4
      python3-wcwidth: upgrade 0.8.3 -> 0.9.1
      gnupg: upgrade 2.5.22 -> 2.5.24
      repo: upgrade 2.67 -> 2.68.1
      python3-pbr: upgrade 7.1.0 -> 7.1.2
      ccache: upgrade 4.14 -> 4.14.1
      python3-hypothesis: upgrade 6.168.1 -> 6.168.2
      git: upgrade 2.55.0 -> 2.56.0
      spirv-headers: upgrade 1.4.357.0 -> 1.4.363.0
      vulkan-headers: upgrade 1.4.357.0 -> 1.4.363.0
      glslang: upgrade 1.4.357.0 -> 1.4.363.0
      spirv-tools: upgrade 1.4.357.0 -> 1.4.363.0
      vulkan-loader: 1.4.357.0 -> 1.4.363.0
      vulkan-tools: upgrade 1.4.357.0 -> 1.4.363.0
      vulkan-utility-libraries: upgrade 1.4.357.0 -> 1.4.363.0
      vulkan-validation-layers: upgrade 1.4.357.0 -> 1.4.363.0
      vulkan-volk: upgrade 1.4.357.0 -> 1.4.363.0
      python3-uv-build: upgrade 0.12.19 -> 0.12.20
      diffoscope: upgrade 331 -> 332
      libpcre2: upgrade 10.48 -> 10.49
      igt-gpu-tools: upgrade 2.5 -> 2.6
      appstream: upgrade 1.2.0 -> 1.2.1

 .../ccache/{ccache_4.14.bb => ccache_4.14.1.bb}    |  2 +-
 meta/recipes-devtools/git/git/fixsort.patch        |  4 +-
 .../git/{git_2.55.0.bb => git_2.56.0.bb}           |  2 +-
 ...is_6.168.1.bb => python3-hypothesis_6.168.3.bb} |  2 +-
 .../{python3-pbr_7.1.0.bb => python3-pbr_7.1.2.bb} |  2 +-
 ...pytz_2026.3.post1.bb => python3-pytz_2026.4.bb} |  2 +-
 ..._10.2.3.bb => python3-setuptools-scm_10.3.4.bb} |  2 +-
 .../python/python3-uv-build-crates.inc             | 20 +++++-----
 ...uild_0.12.19.bb => python3-uv-build_0.12.20.bb} |  2 +-
 ...ng_2.4.1.bb => python3-vcs-versioning_2.5.0.bb} |  2 +-
 ...3-wcwidth_0.8.4.bb => python3-wcwidth_0.9.1.bb} |  8 +++-
 .../repo/{repo_2.68.bb => repo_2.68.1.bb}          |  2 +-
 .../glslang/0001-generate-glslang-pkg-config.patch |  2 +-
 .../{glslang_1.4.357.0.bb => glslang_1.4.363.0.bb} |  2 +-
 ...uild-do-not-hardcode-the-build-directory-.patch | 46 ----------------------
 .../{igt-gpu-tools_2.5.bb => igt-gpu-tools_2.6.bb} |  3 +-
 ...ers_1.4.357.0.bb => spirv-headers_1.4.363.0.bb} |  2 +-
 ...tools_1.4.357.0.bb => spirv-tools_1.4.363.0.bb} |  5 +--
 ...rs_1.4.357.0.bb => vulkan-headers_1.4.363.0.bb} |  2 +-
 ...der_1.4.357.0.bb => vulkan-loader_1.4.363.0.bb} |  4 +-
 ...ools_1.4.357.0.bb => vulkan-tools_1.4.363.0.bb} |  2 +-
 ....0.bb => vulkan-utility-libraries_1.4.363.0.bb} |  2 +-
 ....0.bb => vulkan-validation-layers_1.4.363.0.bb} |  4 +-
 ...-volk_1.4.357.0.bb => vulkan-volk_1.4.363.0.bb} |  2 +-
 .../appstream/0001-remove-hardcoded-path.patch     | 32 ---------------
 .../appstream/0002-Do-not-build-qt-tests.patch     |  4 +-
 ..._PREFIX_DIR-in-qt-cmake-AppStreamQtConfig.patch |  4 +-
 .../{appstream_1.2.0.bb => appstream_1.2.1.bb}     | 12 +++---
 .../{diffoscope_331.bb => diffoscope_332.bb}       |  2 +-
 ...1-Woverride-init-is-not-needed-with-gcc-9.patch |  2 +-
 ...c-use-a-custom-value-for-the-location-of-.patch |  4 +-
 ...0002-use-pkgconfig-instead-of-npth-config.patch |  2 +-
 meta/recipes-support/gnupg/gnupg/relocate.patch    |  2 +-
 .../gnupg/{gnupg_2.5.23.bb => gnupg_2.5.24.bb}     |  2 +-
 .../{libpcre2_10.48.bb => libpcre2_10.49.bb}       |  2 +-
 35 files changed, 58 insertions(+), 136 deletions(-)
---
base-commit: b2c42ac2a70fbbee2df1fbda2199643d5e5bb66d
change-id: 20260930-mathieu-upgrades-2026-02-29-6d077838f244

Best regards,
-- 
Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>

[PATCH 01/24] python3-pytz: upgrade 2026.3.post1 -> 2026.4

[Mathieu Dubois-Briand]

Full changelog:
https://github.com/stub42/pytz/compare/release_2026.3.post1...release_2026.4

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 .../python/{python3-pytz_2026.3.post1.bb => python3-pytz_2026.4.bb}     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-devtools/python/python3-pytz_2026.3.post1.bb b/meta/recipes-devtools/python/python3-pytz_2026.4.bb
similarity index 86%
rename from meta/recipes-devtools/python/python3-pytz_2026.3.post1.bb
rename to meta/recipes-devtools/python/python3-pytz_2026.4.bb
index 72a74db35776..4a2eda07a606 100644
--- a/meta/recipes-devtools/python/python3-pytz_2026.3.post1.bb
+++ b/meta/recipes-devtools/python/python3-pytz_2026.4.bb
@@ -7,7 +7,7 @@ inherit pypi setuptools3 ptest-python-pytest
 
 PTEST_PYTEST_DIR = "pytz/tests"
 
-SRC_URI[sha256sum] = "2211d3fcf9a797d3405cac96ac7f61d80e6a644f72a3309607282fe8a2010c5d"
+SRC_URI[sha256sum] = "464303645bafafd72418898368b2429458f709cf1eb6a15372fbcc396b64da63"
 
 RDEPENDS:${PN}:class-target += "\
     python3-datetime \

-- 
2.47.3

[PATCH 02/24] python3-vcs-versioning: upgrade 2.4.0 -> 2.5.0

[Mathieu Dubois-Briand]

- Add `discover_file_workdir()`, which finds the checkout a project sits in for
  the purpose of listing files. `discover_workdir()` answers which checkout
  defines the version, scoped by `root` and `search_parent_directories`; which
  files a project ships is a separate question, and a project in a subdirectory
  of a checkout still ships that checkout's files. ([#1543]( ))

- Accept the `tool` keyword in `_version_missing()` again. setuptools-scm 10.1.0
  through 10.2.3 pass it and allow any `vcs-versioning<3`; since 2.4.1 removed
  it,
  a build without a detectable version failed with
  `TypeError: _version_missing() got an unexpected keyword argument 'tool'`
  instead of the `LookupError` that says how to set a version. The keyword is
  ignored; the tool is taken from the configuration's environment. ([#1550]( ))

- The error raised when a `.jj/` directory is found but `jj` is not installed
  now names the environment variables that actually disable jj discovery
  (`SETUPTOOLS_SCM_DISABLE_JJ=1` / `VCS_VERSIONING_DISABLE_JJ=1`) instead of an
  unprefixed `DISABLE_JJ=1`, which was never read. ([#1537]( ))
- The "unable to detect version" error now names the environment variables the
  running integration actually reads. It previously suggested
  `SETUPTOOLS_SCM_PRETEND_VERSION_FOR_${NORMALIZED_DIST_NAME}` unconditionally,
  which is not read by `vcs-versioning` on its own (or by any other integrator),
  and it named setuptools-scm as the failing tool regardless of which one ran.

  When the distribution name is known the suggested variable is spelled out in
  full. When it is not, the generic variables are suggested instead, with a note
  that the per-distribution `..._FOR_<DIST>` form needs a dist name to match --
  the previous message offered a `${NORMALIZED_DIST_NAME}` template that could
  never be filled in. ([#1539]( ))
- Warn when file discovery is suppressed while a VCS marker sits in the
  project directory. `scm_search_known_failed()` means an integrator already
  looked and found no checkout, so a `.git`, `.hg` or `.jj` right there
  contradicts it and the artifact is about to lose every tracked file. That
  combination was the signature of the pretend-version regression and stayed
  invisible for three releases. Parent directories are not searched, since an
  unpacked sdist inside an unrelated checkout is the case the suppression
  exists for, and roots listed in `IGNORE_VCS_ROOTS` are skipped. ([#1540]( ))

- Environment variable names are now built in one place (`env_var_name` /
  `EnvReader.candidate_names`), shared by the lookup in `EnvReader.read` and by
  every error message that suggests a variable, so a message cannot name a
  variable the lookup would not honour.

The "repository found in a parent directory" error no longer offers a
  `get_version(relative_to=...)` call to integrators that do not ship one; the
  remaining options are renumbered instead. ([#1539]( ))

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 ...{python3-vcs-versioning_2.4.1.bb => python3-vcs-versioning_2.5.0.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-devtools/python/python3-vcs-versioning_2.4.1.bb b/meta/recipes-devtools/python/python3-vcs-versioning_2.5.0.bb
similarity index 91%
rename from meta/recipes-devtools/python/python3-vcs-versioning_2.4.1.bb
rename to meta/recipes-devtools/python/python3-vcs-versioning_2.5.0.bb
index 36bb2856a0ba..16e009c16dbd 100644
--- a/meta/recipes-devtools/python/python3-vcs-versioning_2.4.1.bb
+++ b/meta/recipes-devtools/python/python3-vcs-versioning_2.5.0.bb
@@ -5,7 +5,7 @@ library that can be used independently of setuptools."
 LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=c9b06ad2ebd7e2e82d34b3caf353e7d5"
 
-SRC_URI[sha256sum] = "d4575de3115ec9434393c87c80ffb0eb98a16056bfe2b11ce0f3a97aff67fe0a"
+SRC_URI[sha256sum] = "956a796e31f80fe714d219d6d1df15a6bf247d10f6d851bf4b98279d0a42da55"
 
 SRC_URI += "\
     file://run-ptest \

-- 
2.47.3

[PATCH 03/24] python3-setuptools-scm: upgrade 10.2.3 -> 10.3.4

[Mathieu Dubois-Briand]

10.3.4 (2026-09-23)
- Fixed
  - Ship the tracked files of projects whose pyproject.toml sits in a
    subdirectory of the checkout. root defaults to the project
    directory, so version inference correctly finds no SCM there and
    answers from SETUPTOOLS_SCM_PRETEND_VERSION or fallback_version --
    but that says nothing about which files git tracks, and the sdist
    and wheel came out with none of them. This was the 10.3.0 regression
    fixed in 10.3.3, surviving in the subdirectory layout.
  - File discovery now follows the checkout the project sits in,
    independently of the root that scopes versioning, and records
    scm_file_list.json in the egg-info as a root-level project already
    did.
  - Require vcs-versioning>=2.5.0. The subdirectory file-discovery fix
    imports discover_file_workdir, which no earlier release has, while
    the declared floor still named 2.4.0 -- an install against a
    published vcs-versioning raised ImportError during the build.

10.3.3 (2026-09-16)
- Fixed
  - Keep file discovery working when the version is pretended.
    SETUPTOOLS_SCM_PRETEND_VERSION and its scoped _FOR_<DIST> form made
    version inference return before discovering a workdir, and the
    egg_info mixin read the absent workdir as "searched, found no
    checkout" -- the signal it acts on by suppressing the
    setuptools.file_finders chain. Every SCM-tracked file that
    setuptools' own package discovery does not find was then dropped
    from the sdist and the wheel, silently, since the build succeeded
    and the version was correct.
  - A pretended version still skips discovery, because most builds only
    want a version and probing for a checkout nobody asks about costs
    subprocesses for nothing. What no longer happens is passing that off
    as an answer: "nobody looked yet" is now distinct from "looked and
    found nothing", and the workdir is discovered on demand the first
    time a consumer needs a file list.
  - scm_file_list.json is now written to the egg-info for pretended
    builds as well. It describes which files the checkout tracks, which
    a pretended version says nothing about. scm_version.json stays
    absent there, because a pretended version must not be recorded as
    what the SCM said.

10.3.2 (2026-09-14)
- Fixed
  - Stop the command mixins from reordering a project's own build_py,
    egg_info or bdist_wheel MRO. ScmVersionFileMixin and friends
    inherited from the corresponding setuptools command, so wrapping a
    project class built on a disjoint hierarchy --
    distutils.command.build_py, or the standalone wheel package's
    bdist_wheel -- placed setuptools' command ahead of the project's
    class. setuptools.build_py.run() does not delegate any further, so
    the project's run() was silently skipped, surfacing as error:
    package directory '...' does not exist. The mixins now carry no
    runtime base class and linearise to (wrapped, mixin,
    *project_command.__mro__).
  - Leave a project's cmdclass alone when setuptools-scm is installed
    but not actually inferring a version. build_py, egg_info and
    bdist_wheel are now registered only once version inference has
    stored data on the distribution -- the precondition for any of the
    mixins doing something. Previously every project with a
    pyproject.toml had its commands wrapped, including projects with no
    [tool.setuptools_scm] section at all.
  - Note for projects that used to configure setuptools-scm and no
    longer do: a scm_version.json left behind in a stale *.egg-info
    directory is no longer stripped from built wheels, because the
    bdist_wheel mixin that strips it is no longer registered either.
    Remove the stale *.egg-info directory.

10.3.1 (2026-09-14)
- Fixed
  - Require vcs-versioning>=2.4.0. setuptools-scm 10.3.0 declared
    >=2.3.2 but imports
    vcs_versioning._file_finders.scm_search_known_failed, which
    vcs-versioning only gained in 2.4.0, so installing it alongside an
    older vcs-versioning failed with ImportError. CI now installs
    setuptools-scm against the oldest vcs-versioning its metadata
    permits, so the lower bound can no longer go stale unnoticed.

10.3.0 (2026-09-12)
- Deprecated
  - Emit a DeprecationWarning when the setuptools.file_finders entry
    point is invoked for a project that does not configure
    setuptools-scm. The entry point will be removed in a future major
    release.
- Fixed
  - Run the setuptools.file_finders hook inside a setuptools-scm
    override context. It previously resolved settings under the
    VCS_VERSIONING prefix only, so documented variables such as
    SETUPTOOLS_SCM_SUBPROCESS_TIMEOUT and SETUPTOOLS_SCM_HG_COMMAND were
    ignored when finding files.
  - When version inference has already run and found no SCM checkout,
    the egg_info mixin now tells the file finders so, rather than
    letting walk_revctrl() re-probe every backend for a repository known
    to be absent.

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 ...ython3-setuptools-scm_10.2.3.bb => python3-setuptools-scm_10.3.4.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-devtools/python/python3-setuptools-scm_10.2.3.bb b/meta/recipes-devtools/python/python3-setuptools-scm_10.3.4.bb
similarity index 89%
rename from meta/recipes-devtools/python/python3-setuptools-scm_10.2.3.bb
rename to meta/recipes-devtools/python/python3-setuptools-scm_10.3.4.bb
index 0af4bd24f5e2..db9a565439c5 100644
--- a/meta/recipes-devtools/python/python3-setuptools-scm_10.2.3.bb
+++ b/meta/recipes-devtools/python/python3-setuptools-scm_10.3.4.bb
@@ -6,7 +6,7 @@ argument or in a SCM managed file."
 LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=838c366f69b72c5df05c96dff79b35f2"
 
-SRC_URI[sha256sum] = "f179ed3e2a63cf5823e5ee9aa9ca08386219400443a0553224d72dde3f206b44"
+SRC_URI[sha256sum] = "a69f28bfc245608781205e912faae437c2b2165773afa4e7b979d77447a69dd2"
 
 PYPI_PACKAGE = "setuptools_scm"
 

-- 
2.47.3

[PATCH 04/24] python3-wcwidth: upgrade 0.8.3 -> 0.9.1

[Mathieu Dubois-Briand]

Changelog:

0.9.1 2026-09-23
- Bugfix width() in Python and libwcwidth mis-measured CSI sequences
  over 64 bytes, a 0.9.0 release regression!
- Performance improvement of ~15% for many Python API functions when
  using default arguments like ambiguous_width and term_program.

0.9.0 2026-09-23
- New Optional CPython extension using libwcwidth, improving performance
  10-58x.
- Drop Support for Python 3.8.

0.8.5 2026-09-23
- Bugfix CJK hyphen break positions for wrap().

0.8.4 2026-09-17
- Bugfix clip() hangs with OSC 8 hyperlinks in some conditions.
- Bugfix width of ITU T.416 colon-format SGR color parameters.
- Bugfix width of OSC 66 text sizing sequences without a text field.
- Bugfix width(), ljust(), rjust(), center(), clip() and
  strip_sequences() treated ESC ( LF as text instead of a character set
  designation (rare).
- Bugfix clip() painter's algorithm and "tab expansion" should be
  spaces.
- Changed iter_graphemes() clustering rule GB9c for Unicode 18.0.
- Changed ambiguous_width arguments are now clamped to allowed range (1,
  2).
- Changed wrap() now raises ValueError for a width of zero or less,
  matching stdlib textwrap. Previously wrap('女', 0) returned ['女'].
- Changed clip() arguments start=0 and end=-1 become optional.
- Updated tables for Unicode version 18.0.
- Updated ucs-detect data files used in some automatic tests are no
  longer distributed.

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 .../python/{python3-wcwidth_0.8.4.bb => python3-wcwidth_0.9.1.bb} | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/meta/recipes-devtools/python/python3-wcwidth_0.8.4.bb b/meta/recipes-devtools/python/python3-wcwidth_0.9.1.bb
similarity index 55%
rename from meta/recipes-devtools/python/python3-wcwidth_0.8.4.bb
rename to meta/recipes-devtools/python/python3-wcwidth_0.9.1.bb
index 8ac99afc3ec0..e7156a79eefb 100644
--- a/meta/recipes-devtools/python/python3-wcwidth_0.8.4.bb
+++ b/meta/recipes-devtools/python/python3-wcwidth_0.9.1.bb
@@ -4,12 +4,16 @@ HOMEPAGE = "https://github.com/jquast/wcwidth"
 LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=b15979c39a2543892fca8cd86b4b52cb"
 
-SRC_URI[sha256sum] = "2dae09efa25253ae2874188e86d6861af3b1652aef4118cdf3f0bda288a957fb"
+SRC_URI[sha256sum] = "5823209b0d43af322ce698c689380d7c15ca31fa8e6e3be8459f27031bef0af5"
 
 inherit pypi python_hatchling ptest-python-pytest
 
 do_install_ptest:append() {
-      cp ${S}/pyproject.toml ${D}${PTEST_PATH}/
+      cp ${S}/pyproject.toml ${S}/setup.py ${D}${PTEST_PATH}/
+      cp -r ${S}/libwcwidth ${D}${PTEST_PATH}/libwcwidth
+
+      # Remove pre-release tests, require authentication with github
+      rm ${D}${PTEST_PATH}/tests/test_check_release.py
 }
 
 BBCLASSEXTEND = "native nativesdk"

-- 
2.47.3

[PATCH 05/24] gnupg: upgrade 2.5.22 -> 2.5.24

[Mathieu Dubois-Briand]

Noteworthy changes in version 2.5.24 (2026-09-23)
- Bug fixes:
 - scd: Fix for regression in 2.5.23 related to the new Nitrokey
   detection.

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 .../gnupg/gnupg/0001-Woverride-init-is-not-needed-with-gcc-9.patch    | 2 +-
 .../0001-configure.ac-use-a-custom-value-for-the-location-of-.patch   | 4 ++--
 .../gnupg/gnupg/0002-use-pkgconfig-instead-of-npth-config.patch       | 2 +-
 meta/recipes-support/gnupg/gnupg/relocate.patch                       | 2 +-
 meta/recipes-support/gnupg/{gnupg_2.5.23.bb => gnupg_2.5.24.bb}       | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/meta/recipes-support/gnupg/gnupg/0001-Woverride-init-is-not-needed-with-gcc-9.patch b/meta/recipes-support/gnupg/gnupg/0001-Woverride-init-is-not-needed-with-gcc-9.patch
index 707bba9faf94..4d6e364a65c9 100644
--- a/meta/recipes-support/gnupg/gnupg/0001-Woverride-init-is-not-needed-with-gcc-9.patch
+++ b/meta/recipes-support/gnupg/gnupg/0001-Woverride-init-is-not-needed-with-gcc-9.patch
@@ -1,4 +1,4 @@
-From 1c8f78f659e094aa924e1a84326a086701e803c9 Mon Sep 17 00:00:00 2001
+From abe388c8f38df7cd2f0641f17c6f872dd847c330 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Thu, 20 Dec 2018 17:37:48 -0800
 Subject: [PATCH] Woverride-init is not needed with gcc 9
diff --git a/meta/recipes-support/gnupg/gnupg/0001-configure.ac-use-a-custom-value-for-the-location-of-.patch b/meta/recipes-support/gnupg/gnupg/0001-configure.ac-use-a-custom-value-for-the-location-of-.patch
index 94120195a781..95f62ff26d0f 100644
--- a/meta/recipes-support/gnupg/gnupg/0001-configure.ac-use-a-custom-value-for-the-location-of-.patch
+++ b/meta/recipes-support/gnupg/gnupg/0001-configure.ac-use-a-custom-value-for-the-location-of-.patch
@@ -1,4 +1,4 @@
-From ff6e519a6034d331a82d8018772db940191a3887 Mon Sep 17 00:00:00 2001
+From f8d096e62c06085e93a339bc2d7421a65c437e6f Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Mon, 22 Jan 2018 18:00:21 +0200
 Subject: [PATCH] configure.ac: use a custom value for the location of
@@ -13,7 +13,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/configure.ac b/configure.ac
-index 59e2bce..4eff4a8 100644
+index 51ffbc6..39924db 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -1910,7 +1910,7 @@ AC_DEFINE_UNQUOTED(GPGCONF_DISP_NAME, "GPGConf",
diff --git a/meta/recipes-support/gnupg/gnupg/0002-use-pkgconfig-instead-of-npth-config.patch b/meta/recipes-support/gnupg/gnupg/0002-use-pkgconfig-instead-of-npth-config.patch
index c30677e80de3..6b2cfc250397 100644
--- a/meta/recipes-support/gnupg/gnupg/0002-use-pkgconfig-instead-of-npth-config.patch
+++ b/meta/recipes-support/gnupg/gnupg/0002-use-pkgconfig-instead-of-npth-config.patch
@@ -1,4 +1,4 @@
-From a0a9afc96bcf352324109496a3c5419133002afe Mon Sep 17 00:00:00 2001
+From 7d42cbba53eddce53d1763d7ffe70e728d7b0445 Mon Sep 17 00:00:00 2001
 From: Saul Wold <sgw@linux.intel.com>
 Date: Wed, 16 Aug 2017 11:16:30 +0800
 Subject: [PATCH] use pkgconfig instead of npth config
diff --git a/meta/recipes-support/gnupg/gnupg/relocate.patch b/meta/recipes-support/gnupg/gnupg/relocate.patch
index 2775967303dd..0bffeb0a69e4 100644
--- a/meta/recipes-support/gnupg/gnupg/relocate.patch
+++ b/meta/recipes-support/gnupg/gnupg/relocate.patch
@@ -1,4 +1,4 @@
-From 4d15672a7dadaa0d21ef9339a065af20a49b5348 Mon Sep 17 00:00:00 2001
+From 4c4068e6f8a180737d1b28c6914387bc0a485df3 Mon Sep 17 00:00:00 2001
 From: Ross Burton <ross.burton@intel.com>
 Date: Wed, 19 Sep 2018 14:44:40 +0100
 Subject: [PATCH] Allow the environment to override where gnupg looks for its
diff --git a/meta/recipes-support/gnupg/gnupg_2.5.23.bb b/meta/recipes-support/gnupg/gnupg_2.5.24.bb
similarity index 97%
rename from meta/recipes-support/gnupg/gnupg_2.5.23.bb
rename to meta/recipes-support/gnupg/gnupg_2.5.24.bb
index 139e1c9ef2e6..3e562250d70a 100644
--- a/meta/recipes-support/gnupg/gnupg_2.5.23.bb
+++ b/meta/recipes-support/gnupg/gnupg_2.5.24.bb
@@ -25,7 +25,7 @@ SRC_URI:append:class-native = " file://0001-configure.ac-use-a-custom-value-for-
                                 file://relocate.patch"
 SRC_URI:append:class-nativesdk = " file://relocate.patch"
 
-SRC_URI[sha256sum] = "97ebba329ed0aa1ed24395b6a485a3626680f4c19232c62a0c0f0433c726e2bd"
+SRC_URI[sha256sum] = "bf149d01a2b9fcc0e4589b8ae8697d3d5c557ea48ed95a3fa55dd3b1187e6039"
 
 EXTRA_OECONF = "--disable-ldap \
 		--disable-ccid-driver \

-- 
2.47.3

[PATCH 06/24] repo: upgrade 2.67 -> 2.68.1

[Mathieu Dubois-Briand]

Changelog:
- project: don't plan a stateless prune without a worktree
- sync: skip the bloat check for projects without a worktree
- project: don't rerun git status after a failed snapshot
- Fix fail in test_repo_trace if trace is disabled

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 meta/recipes-devtools/repo/{repo_2.68.bb => repo_2.68.1.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-devtools/repo/repo_2.68.bb b/meta/recipes-devtools/repo/repo_2.68.1.bb
similarity index 94%
rename from meta/recipes-devtools/repo/repo_2.68.bb
rename to meta/recipes-devtools/repo/repo_2.68.1.bb
index ee448583ab9c..053f1cabcfad 100644
--- a/meta/recipes-devtools/repo/repo_2.68.bb
+++ b/meta/recipes-devtools/repo/repo_2.68.1.bb
@@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
 
 SRC_URI = "git://gerrit.googlesource.com/git-repo.git;protocol=https;branch=main;tag=v${PV} \
            "
-SRCREV = "8c7e0a683e88cf23f2c4765b26cfa1c917b660f4"
+SRCREV = "e1e215a14ea5373419acb8753b6865de19d1f122"
 
 MIRRORS += "git://gerrit.googlesource.com/git-repo.git git://github.com/GerritCodeReview/git-repo.git"
 

-- 
2.47.3

[PATCH 07/24] python3-pbr: upgrade 7.1.0 -> 7.1.2

[Mathieu Dubois-Briand]

Changelog:
7.1.2
- Set setuptools min in requirements.txt

7.1.1
- Fix hook ordering race that drops subpackages from wheels

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 .../python/{python3-pbr_7.1.0.bb => python3-pbr_7.1.2.bb}               | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-devtools/python/python3-pbr_7.1.0.bb b/meta/recipes-devtools/python/python3-pbr_7.1.2.bb
similarity index 83%
rename from meta/recipes-devtools/python/python3-pbr_7.1.0.bb
rename to meta/recipes-devtools/python/python3-pbr_7.1.2.bb
index 7fc227e6bbdb..9aeb50268df4 100644
--- a/meta/recipes-devtools/python/python3-pbr_7.1.0.bb
+++ b/meta/recipes-devtools/python/python3-pbr_7.1.2.bb
@@ -13,4 +13,4 @@ RDEPENDS:${PN} += "python3-setuptools"
 
 BBCLASSEXTEND = "native nativesdk"
 
-SRC_URI[sha256sum] = "66ece3a2f5c4f05e5f37569213e755193f6e00b8aa361bfb190533ea8ee8b10c"
+SRC_URI[sha256sum] = "4639b87cc91d0d58471b7bda1f28b7d0849ba43d7935c4c482f3c74fef719804"

-- 
2.47.3

[PATCH 08/24] ccache: upgrade 4.14 -> 4.14.1

[Mathieu Dubois-Briand]

=== New deliverables

- Added musl static binary release for Linux s390x. +

=== Bug fixes

- Restored storage helper lock compatibility with ccache versions
  earlier than 4.14.
- Fixed lookup of GCC 9+ profile data for object files in subdirectories
  and added support for GCC's `-fprofile-partial-training` option.
- Fixed the output location of files produced by GCC's
  `-fdump-ipa-clones` option.
- Fixed hashing of C++20 module files found via Clang's
  `-fprebuilt-module-path` option, preventing false cache hits when a
  module changes.
- Made ccache reject clang-cl's `/clang:` option and MSVC's `/FA` and
  `/Fa` options instead of potentially caching compilations incorrectly.
- Fixed cleanup of temporary response files on Windows.

=== Build improvements

- Avoided passing a superfluous `-include` option when building with MSVC. +

=== Test improvements

- Made the `remote_file` and `remote_only` test suites work on Windows. +
- Improved MSVC test failure diagnostics. +
- Improved skip messages for test suites known to fail on Windows. +

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 meta/recipes-devtools/ccache/{ccache_4.14.bb => ccache_4.14.1.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-devtools/ccache/ccache_4.14.bb b/meta/recipes-devtools/ccache/ccache_4.14.1.bb
similarity index 93%
rename from meta/recipes-devtools/ccache/ccache_4.14.bb
rename to meta/recipes-devtools/ccache/ccache_4.14.1.bb
index 6d922d85147f..4dd8da212cef 100644
--- a/meta/recipes-devtools/ccache/ccache_4.14.bb
+++ b/meta/recipes-devtools/ccache/ccache_4.14.1.bb
@@ -16,7 +16,7 @@ DEPENDS = "zstd fmt xxhash"
 
 SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${BP}.tar.gz"
 
-SRC_URI[sha256sum] = "fca63f36a83fb2f4b3cc4c01b2c7a1cd6e3629e7f7bd1e01a2eb8810f947c5ab"
+SRC_URI[sha256sum] = "dfd2b9e446b2cf68e83e21b25317d8f868de6f1b246c7e99e04d07f4e1b0b97e"
 
 inherit cmake github-releases
 

-- 
2.47.3

[PATCH 09/24] python3-hypothesis: upgrade 6.168.1 -> 6.168.2

[Mathieu Dubois-Briand]

Changelog:
6.168.3 - 2026-09-28
- This patch fixes quadratic-time behaviour when summarising the
  statistics of a test run, which Hypothesis does for every test when
  running under pytest. This avoids an apparent hang after the last test
  case with a high number of test cases (>100k).

6.168.2 - 2026-09-27
- This patch makes writes to the cache of constants collected from local
  source files atomic. Previously, a concurrent process sharing the same
  .hypothesis directory, such as another pytest-xdist worker, could read
  a partially written cache file, which silently changed the data
  generated for a given @seed.

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 .../{python3-hypothesis_6.168.1.bb => python3-hypothesis_6.168.3.bb}    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-devtools/python/python3-hypothesis_6.168.1.bb b/meta/recipes-devtools/python/python3-hypothesis_6.168.3.bb
similarity index 91%
rename from meta/recipes-devtools/python/python3-hypothesis_6.168.1.bb
rename to meta/recipes-devtools/python/python3-hypothesis_6.168.3.bb
index 7386f26afa4a..980161d42cb4 100644
--- a/meta/recipes-devtools/python/python3-hypothesis_6.168.1.bb
+++ b/meta/recipes-devtools/python/python3-hypothesis_6.168.3.bb
@@ -16,7 +16,7 @@ SRC_URI += " \
     file://test_rle.py \
     "
 
-SRC_URI[sha256sum] = "fd8acb5c67f260dfbdcc1b2dc95ff48b2b3f90708ae595c76f591bbf3f6f8eeb"
+SRC_URI[sha256sum] = "a43388f9067678fef6e13bdff325b6cfa6961a590498bb37f7ff31589c83bc75"
 
 RDEPENDS:${PN} += " \
     python3-attrs \

-- 
2.47.3

[PATCH 10/24] git: upgrade 2.55.0 -> 2.56.0

[Mathieu Dubois-Briand]

Lots of UI and performance improvements, as well as bug fixes.

Full changelog can be found here:
https://gitlab.com/git-scm/git/-/blob/HEAD/Documentation/RelNotes/2.56.0.adoc

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 meta/recipes-devtools/git/git/fixsort.patch                | 4 ++--
 meta/recipes-devtools/git/{git_2.55.0.bb => git_2.56.0.bb} | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/meta/recipes-devtools/git/git/fixsort.patch b/meta/recipes-devtools/git/git/fixsort.patch
index 86b41fd8192e..6dda82dbdec3 100644
--- a/meta/recipes-devtools/git/git/fixsort.patch
+++ b/meta/recipes-devtools/git/git/fixsort.patch
@@ -1,4 +1,4 @@
-From e3bdf5adc50b12d8625e70415c81402e0e938b68 Mon Sep 17 00:00:00 2001
+From dbc552db68ca945a24d3cd15f39c6f9982cc317c Mon Sep 17 00:00:00 2001
 From: Richard Purdie <richard.purdie@linuxfoundation.org>
 Date: Wed, 17 Feb 2021 17:57:13 +0000
 Subject: [PATCH] generate-configlist.sh: Fix determinism issue
@@ -23,7 +23,7 @@ Upstream-Status: Submitted [https://public-inbox.org/git/f029a942dd3d50d85e60bd3
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/tools/generate-configlist.sh b/tools/generate-configlist.sh
-index e28054f..96ddd51 100755
+index d1d2ba4..c259b77 100755
 --- a/tools/generate-configlist.sh
 +++ b/tools/generate-configlist.sh
 @@ -24,7 +24,7 @@ EOF
diff --git a/meta/recipes-devtools/git/git_2.55.0.bb b/meta/recipes-devtools/git/git_2.56.0.bb
similarity index 98%
rename from meta/recipes-devtools/git/git_2.55.0.bb
rename to meta/recipes-devtools/git/git_2.56.0.bb
index 4535f949251e..6fc2d5d78e41 100644
--- a/meta/recipes-devtools/git/git_2.55.0.bb
+++ b/meta/recipes-devtools/git/git_2.56.0.bb
@@ -175,7 +175,7 @@ EXTRA_OECONF += "ac_cv_snprintf_returns_bogus=no \
                  "
 EXTRA_OEMAKE += "NO_GETTEXT=1"
 
-SRC_URI[tarball.sha256sum] = "0842dc384a23ac33ba3e570c4f3a8ded85963ee4713b1cd21153c3db41813d1e"
+SRC_URI[tarball.sha256sum] = "826817fd3671b8565586d6d49f688298de8354ab11db829c02720e5c74b9b39f"
 
 CVE_STATUS[CVE-2024-32002] = "fixed-version: fixed since v2.46.0"
 CVE_STATUS[CVE-2024-50349] = "fixed-version: fixed since v2.49.0"

-- 
2.47.3

[PATCH 11/24] spirv-headers: upgrade 1.4.357.0 -> 1.4.363.0

[Mathieu Dubois-Briand]

Changelog:
- SPV_QCOM_subgroup_size
- SPV_QCOM_bfloat16_muladd
- document header tagging conventions
- Correct name and comment
- Add SPV_EXT_cooperative_matrix_maintenance1
- switch to the canonical CC-BY-4.0 license text
- Add Java output

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 .../spir/{spirv-headers_1.4.357.0.bb => spirv-headers_1.4.363.0.bb}     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-graphics/spir/spirv-headers_1.4.357.0.bb b/meta/recipes-graphics/spir/spirv-headers_1.4.363.0.bb
similarity index 93%
rename from meta/recipes-graphics/spir/spirv-headers_1.4.357.0.bb
rename to meta/recipes-graphics/spir/spirv-headers_1.4.363.0.bb
index 244c6854fa1b..4ad077c6883a 100644
--- a/meta/recipes-graphics/spir/spirv-headers_1.4.357.0.bb
+++ b/meta/recipes-graphics/spir/spirv-headers_1.4.363.0.bb
@@ -4,7 +4,7 @@ HOMEPAGE = "https://www.khronos.org/registry/spir-v"
 LICENSE = "CC-BY-4.0 AND MIT"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=a0dcaa512cc2dee95fe0fd791ee83a18"
 
-SRCREV = "29981f65241605e08b0ede4cfeb999fe3b723c6a"
+SRCREV = "496543121ce6419f23d6fa5d7194ba66c36212d2"
 SRC_URI = "git://github.com/KhronosGroup/SPIRV-Headers;protocol=https;branch=main;tag=vulkan-sdk-${PV}"
 PE = "1"
 # These recipes need to be updated in lockstep with each other:

-- 
2.47.3

[PATCH 12/24] vulkan-headers: upgrade 1.4.357.0 -> 1.4.363.0

[Mathieu Dubois-Briand]

Changelog:
- Update for Vulkan-Docs 1.4.363
- Update for Vulkan-Docs 1.4.362
- Update for Vulkan-Docs 1.4.361
- Update Vulkan named module in test
- Update for Vulkan-Docs 1.4.360
- Update for Vulkan-Docs 1.4.359
- Update for Vulkan-Docs 1.4.358
- Mention CONTRIBUTING.md to be part of the repo itself
- Clarify home repository of `registry/*.xml` files

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 .../vulkan/{vulkan-headers_1.4.357.0.bb => vulkan-headers_1.4.363.0.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-graphics/vulkan/vulkan-headers_1.4.357.0.bb b/meta/recipes-graphics/vulkan/vulkan-headers_1.4.363.0.bb
similarity index 95%
rename from meta/recipes-graphics/vulkan/vulkan-headers_1.4.357.0.bb
rename to meta/recipes-graphics/vulkan/vulkan-headers_1.4.363.0.bb
index 4a91e39dcdbb..b187d75d5ff0 100644
--- a/meta/recipes-graphics/vulkan/vulkan-headers_1.4.357.0.bb
+++ b/meta/recipes-graphics/vulkan/vulkan-headers_1.4.363.0.bb
@@ -11,7 +11,7 @@ LICENSE = "Apache-2.0 AND MIT AND (Apache-2.0 OR MIT)"
 LIC_FILES_CHKSUM = "file://LICENSE.md;md5=adc9da32fdd898219b3db5529f2185c0"
 SRC_URI = "git://github.com/KhronosGroup/Vulkan-Headers.git;branch=main;protocol=https;tag=vulkan-sdk-${PV}"
 
-SRCREV = "e3b1eec08173d6b825cd3ac88c885a63b621504a"
+SRCREV = "6802bb4733b63ed5efd3adb308a6c885ef180ea1"
 
 inherit cmake
 

-- 
2.47.3

[PATCH 13/24] glslang: upgrade 1.4.357.0 -> 1.4.363.0

[Mathieu Dubois-Briand]

All changes history:
https://github.com/KhronosGroup/glslang/compare/vulkan-sdk-1.4.357.0...vulkan-sdk-1.4.363.0

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 .../glslang/glslang/0001-generate-glslang-pkg-config.patch              | 2 +-
 .../glslang/{glslang_1.4.357.0.bb => glslang_1.4.363.0.bb}              | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta/recipes-graphics/glslang/glslang/0001-generate-glslang-pkg-config.patch b/meta/recipes-graphics/glslang/glslang/0001-generate-glslang-pkg-config.patch
index b6a4c5a29b88..b000dabff9d7 100644
--- a/meta/recipes-graphics/glslang/glslang/0001-generate-glslang-pkg-config.patch
+++ b/meta/recipes-graphics/glslang/glslang/0001-generate-glslang-pkg-config.patch
@@ -1,4 +1,4 @@
-From f7aad1905705097782ebfea3c74c75856158a2ba Mon Sep 17 00:00:00 2001
+From 347ba2f438483f66d14fa0e8ef7baf828ed6be92 Mon Sep 17 00:00:00 2001
 From: Jose Quaresma <quaresma.jose@gmail.com>
 Date: Sun, 7 Feb 2021 01:30:39 +0000
 Subject: [PATCH] generate glslang pkg-config
diff --git a/meta/recipes-graphics/glslang/glslang_1.4.357.0.bb b/meta/recipes-graphics/glslang/glslang_1.4.363.0.bb
similarity index 96%
rename from meta/recipes-graphics/glslang/glslang_1.4.357.0.bb
rename to meta/recipes-graphics/glslang/glslang_1.4.363.0.bb
index 0f43d83f4ea9..1a92e89564ea 100644
--- a/meta/recipes-graphics/glslang/glslang_1.4.357.0.bb
+++ b/meta/recipes-graphics/glslang/glslang_1.4.363.0.bb
@@ -8,7 +8,7 @@ HOMEPAGE = "https://www.khronos.org/opengles/sdk/tools/Reference-Compiler"
 LICENSE = "Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND MIT AND GPL-3.0-or-later WITH Bison-exception-2.2"
 LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=50ff9d0fcde2d5b953ebe431c48e34e3"
 
-SRCREV = "168d452a4f460d24b588fed08477a81c44ee27a1"
+SRCREV = "e1b562a8bed273a02f30b59b66a5d499793cede5"
 SRC_URI = "git://github.com/KhronosGroup/glslang.git;protocol=https;branch=main;tag=vulkan-sdk-${PV} \
            file://0001-generate-glslang-pkg-config.patch \
            "

-- 
2.47.3

[PATCH 14/24] spirv-tools: upgrade 1.4.357.0 -> 1.4.363.0

[Mathieu Dubois-Briand]

v2026.4 2026-09-09
  - Optimizer
    - Add pass to convert typed pointers to untyped pointers (`--convert-to-
      untyped`)
    - Support optimizing shaders using SPV_KHR_opacity_micromap across dead-code
      elimination and local passes
    - Add folding rule to dissolve OpCopyLogical of OpCompositeConstruct in
      simplification pass
    - Harden optimizer passes against ID overflow (#6851, #6852, #6857, #6858,
      #6863)
    - Filter duplicate decorations during module serialization to binary
    - Correctness fixes for vector constant folding size and OpSelect folding
      pre-SPIR-V 1.4 (#6798, #6827)
    - Stability fixes for IRContext analysis handling, debug info stripping, and
      eliminate dead functions (#6765, #6797, #6799)
  - Validator
    - Support and validate SPV_EXT_cooperative_matrix_maintenance1
    - Support and validate SPV_QCOM_image_processing3 and OpImageGatherQCOM
    - Add validation for NonSemantic.DebugPrintf extended instruction set
    - Validate OpAbortKHR explicit layout message type and require scalar
      packing (#6854, #6859)
    - Tighten relaxed block layout alignments and add explicit alignment VUIDs
      (#6819, #6853)
    - Validate Offset decoration on Input/Output storage classes and add VUID
      12509 (#6835, #6855)
    - Allow OpExtInstWithForwardRefsKHR in generic non-semantic instruction sets
    - Restrict Workgroup execution scope to OpGroupNonUniformRotateKHR for non-
      uniform group operations
    - Validate OpControlBarrierArriveEXT execution and memory scopes
    - Allow Generic pointer casts to and from CodeSectionINTEL storage class
    - Allow BFloat16 and FP8 result types in OpExtInst
    - Validate OpSourceContinued order following OpSource
    - Correctness fixes for >64-bit integer constant evaluation and
      AliasScopeINTELMask/NoAliasINTELMask operand counting (#6816, #6791,
      #6865)
    - Validate ArrayStride on OpConstantDataKHR result types
    - Add validation for UTFEncodedKHR decoration on array types
    - Validate that OpAbortKHR Message Type is a concrete type
  - Linker
    - Detect duplicate exported definitions without imports to prevent ODR
      violations
  - Assembler/Disassembler
    - Initialize parsed operand floating-point encoding to ensure deterministic
      disassembly of literal floats

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 .../spir/{spirv-tools_1.4.357.0.bb => spirv-tools_1.4.363.0.bb}      | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/meta/recipes-graphics/spir/spirv-tools_1.4.357.0.bb b/meta/recipes-graphics/spir/spirv-tools_1.4.363.0.bb
similarity index 93%
rename from meta/recipes-graphics/spir/spirv-tools_1.4.357.0.bb
rename to meta/recipes-graphics/spir/spirv-tools_1.4.363.0.bb
index d9f6d2926788..a5b08684f0d4 100644
--- a/meta/recipes-graphics/spir/spirv-tools_1.4.357.0.bb
+++ b/meta/recipes-graphics/spir/spirv-tools_1.4.363.0.bb
@@ -7,9 +7,8 @@ SECTION = "graphics"
 LICENSE  = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
 
-SRCREV = "9a49b0883b9b635689a85b5647dbfcb223268151"
-SRC_URI = "git://github.com/KhronosGroup/SPIRV-Tools.git;branch=vulkan-sdk-1.4.357;protocol=https;tag=vulkan-sdk-${PV} \
-"
+SRCREV = "ef96ed763b43b59b33b31b362f09a02b729fa1c9"
+SRC_URI = "git://github.com/KhronosGroup/SPIRV-Tools.git;branch=main;protocol=https;tag=vulkan-sdk-${PV}"
 PE = "1"
 # These recipes need to be updated in lockstep with each other:
 # glslang, vulkan-headers, vulkan-loader, vulkan-tools, spirv-headers, spirv-tools

-- 
2.47.3

[PATCH 15/24] vulkan-loader: 1.4.357.0 -> 1.4.363.0

[Mathieu Dubois-Briand]

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 .../vulkan/{vulkan-loader_1.4.357.0.bb => vulkan-loader_1.4.363.0.bb} | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta/recipes-graphics/vulkan/vulkan-loader_1.4.357.0.bb b/meta/recipes-graphics/vulkan/vulkan-loader_1.4.363.0.bb
similarity index 91%
rename from meta/recipes-graphics/vulkan/vulkan-loader_1.4.357.0.bb
rename to meta/recipes-graphics/vulkan/vulkan-loader_1.4.363.0.bb
index 1c21bea5e9a4..7d976a256b72 100644
--- a/meta/recipes-graphics/vulkan/vulkan-loader_1.4.357.0.bb
+++ b/meta/recipes-graphics/vulkan/vulkan-loader_1.4.363.0.bb
@@ -9,8 +9,8 @@ SECTION = "libs"
 
 LICENSE = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=7dbefed23242760aa3475ee42801c5ac"
-SRC_URI = "git://github.com/KhronosGroup/Vulkan-Loader.git;branch=main;protocol=https;tag=vulkan-sdk-${PV}"
-SRCREV = "5f157b62e333c63260d05d81bf66faa216ab0fb8"
+SRC_URI = "git://github.com/KhronosGroup/Vulkan-Loader.git;nobranch=1;protocol=https;tag=vulkan-sdk-${PV}"
+SRCREV = "fa218055ff4948b159f31d43f800c808a13d51df"
 
 REQUIRED_DISTRO_FEATURES = "vulkan"
 

-- 
2.47.3

[PATCH 16/24] vulkan-tools: upgrade 1.4.357.0 -> 1.4.363.0

[Mathieu Dubois-Briand]

Changelog:
- Update known_good.json
- Add VK_EXT_display_surface_counter instance extension
- build: Update to header v1.4.363
- vulkaninfo: add missing <ctime> include
- build: Update to header v1.4.362
- build: Update to header v1.4.361
- vulkaninfo: Include extended flags in video format props output
- build: Update to header v1.4.360
- build: Update to header v1.4.359
- build: Avoid AppleClang using the wrong headers
- vulkaninfo: Fix 32-bit image usage flags upper bound
- build: Update to header v1.4.358
- vulkaninfo: VK_KHR_extended_flags interaction with video
- vulkaninfo: Enable more instance extensions

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 .../vulkan/{vulkan-tools_1.4.357.0.bb => vulkan-tools_1.4.363.0.bb}     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-graphics/vulkan/vulkan-tools_1.4.357.0.bb b/meta/recipes-graphics/vulkan/vulkan-tools_1.4.363.0.bb
similarity index 96%
rename from meta/recipes-graphics/vulkan/vulkan-tools_1.4.357.0.bb
rename to meta/recipes-graphics/vulkan/vulkan-tools_1.4.363.0.bb
index cafd3e7a0a2e..b987c1af7f52 100644
--- a/meta/recipes-graphics/vulkan/vulkan-tools_1.4.357.0.bb
+++ b/meta/recipes-graphics/vulkan/vulkan-tools_1.4.363.0.bb
@@ -7,7 +7,7 @@ SECTION = "libs"
 LICENSE = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57"
 SRC_URI = "git://github.com/KhronosGroup/Vulkan-Tools.git;branch=main;protocol=https;tag=vulkan-sdk-${PV}"
-SRCREV = "286299bb6b732e4b22771cfb9d7d421542d40501"
+SRCREV = "6fe2055cf2fa921d52a4c6a31528cfc279a6977f"
 
 inherit cmake features_check pkgconfig
 ANY_OF_DISTRO_FEATURES = "x11 wayland"

-- 
2.47.3

[PATCH 17/24] vulkan-utility-libraries: upgrade 1.4.357.0 -> 1.4.363.0

[Mathieu Dubois-Briand]

Changelog:
- build: Update to header v1.4.363
- safe: Handle Sampler in VkDescriptorMappingSourceDataEXT
- build: Update to header v1.4.362
- build: Update to header v1.4.361
- build: Update to header v1.4.360
- build: Check if Vulkan-Headers is an ALIAS target
- build: Update to header v1.4.359
- build: Avoid AppleClang using the wrong headers
- cmake: support shared utility libraries
- build: Update to header v1.4.358

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 ...ity-libraries_1.4.357.0.bb => vulkan-utility-libraries_1.4.363.0.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-graphics/vulkan/vulkan-utility-libraries_1.4.357.0.bb b/meta/recipes-graphics/vulkan/vulkan-utility-libraries_1.4.363.0.bb
similarity index 95%
rename from meta/recipes-graphics/vulkan/vulkan-utility-libraries_1.4.357.0.bb
rename to meta/recipes-graphics/vulkan/vulkan-utility-libraries_1.4.363.0.bb
index c750428d0940..45ffa83af1d9 100644
--- a/meta/recipes-graphics/vulkan/vulkan-utility-libraries_1.4.357.0.bb
+++ b/meta/recipes-graphics/vulkan/vulkan-utility-libraries_1.4.363.0.bb
@@ -10,7 +10,7 @@ LICENSE = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://LICENSE.md;md5=4ca2d6799091aaa98a8520f1b793939b"
 
 SRC_URI = "git://github.com/KhronosGroup/Vulkan-Utility-Libraries.git;branch=main;protocol=https;tag=vulkan-sdk-${PV}"
-SRCREV = "e9585c3e3d41ab608ee3b098ce4721d357308fc8"
+SRCREV = "57f01541b3959f2528f769043396e882851a7e75"
 
 REQUIRED_DISTRO_FEATURES = "vulkan"
 

-- 
2.47.3

[PATCH 18/24] vulkan-validation-layers: upgrade 1.4.357.0 -> 1.4.363.0

[Mathieu Dubois-Briand]

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 ...tion-layers_1.4.357.0.bb => vulkan-validation-layers_1.4.363.0.bb} | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta/recipes-graphics/vulkan/vulkan-validation-layers_1.4.357.0.bb b/meta/recipes-graphics/vulkan/vulkan-validation-layers_1.4.363.0.bb
similarity index 94%
rename from meta/recipes-graphics/vulkan/vulkan-validation-layers_1.4.357.0.bb
rename to meta/recipes-graphics/vulkan/vulkan-validation-layers_1.4.363.0.bb
index 5a35e9797b9c..10f74b49ec31 100644
--- a/meta/recipes-graphics/vulkan/vulkan-validation-layers_1.4.357.0.bb
+++ b/meta/recipes-graphics/vulkan/vulkan-validation-layers_1.4.363.0.bb
@@ -8,8 +8,8 @@ SECTION = "libs"
 LICENSE = "Apache-2.0 AND BSL-1.0 AND MIT AND BSD-2-Clause AND (Apache-2.0 WITH LLVM-exception)"
 LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=15158583155fe4efc33ea65c1370a177"
 
-SRC_URI = "git://github.com/KhronosGroup/Vulkan-ValidationLayers.git;branch=vulkan-sdk-1.4.357;protocol=https;tag=vulkan-sdk-${PV}"
-SRCREV = "f4874eee15c78d7bdb2b7e60659d539f14741500"
+SRC_URI = "git://github.com/KhronosGroup/Vulkan-ValidationLayers.git;branch=vulkan-sdk-1.4.363;protocol=https;tag=vulkan-sdk-${PV}"
+SRCREV = "15c64e73db67e27ff0215708fbe48684a35c6827"
 
 REQUIRED_DISTRO_FEATURES = "vulkan"
 

-- 
2.47.3

[PATCH 19/24] vulkan-volk: upgrade 1.4.357.0 -> 1.4.363.0

[Mathieu Dubois-Briand]

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 .../vulkan/{vulkan-volk_1.4.357.0.bb => vulkan-volk_1.4.363.0.bb}       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-graphics/vulkan/vulkan-volk_1.4.357.0.bb b/meta/recipes-graphics/vulkan/vulkan-volk_1.4.363.0.bb
similarity index 95%
rename from meta/recipes-graphics/vulkan/vulkan-volk_1.4.357.0.bb
rename to meta/recipes-graphics/vulkan/vulkan-volk_1.4.363.0.bb
index 4e8504ed6605..b336428595a6 100644
--- a/meta/recipes-graphics/vulkan/vulkan-volk_1.4.357.0.bb
+++ b/meta/recipes-graphics/vulkan/vulkan-volk_1.4.363.0.bb
@@ -10,7 +10,7 @@ LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://LICENSE.md;md5=cfcbdd69e15396e371f639c69acf40bf"
 
 SRC_URI = "git://github.com/zeux/volk.git;branch=master;protocol=https;tag=vulkan-sdk-${PV}"
-SRCREV = "776893306c5d3b22b6185b5d4a258b81d94572bf"
+SRCREV = "54fc0d7a72887cbfc5b030d26897b2b40ac53fb8"
 
 REQUIRED_DISTRO_FEATURES = "vulkan"
 

-- 
2.47.3

[PATCH 20/24] python3-uv-build: upgrade 0.12.19 -> 0.12.20

[Mathieu Dubois-Briand]

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 .../python/python3-uv-build-crates.inc               | 20 ++++++++++----------
 ...-build_0.12.19.bb => python3-uv-build_0.12.20.bb} |  2 +-
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/meta/recipes-devtools/python/python3-uv-build-crates.inc b/meta/recipes-devtools/python/python3-uv-build-crates.inc
index 3ba46dd5de9a..a21746312ebf 100644
--- a/meta/recipes-devtools/python/python3-uv-build-crates.inc
+++ b/meta/recipes-devtools/python/python3-uv-build-crates.inc
@@ -70,7 +70,7 @@ SRC_URI += " \
     crate://crates.io/fastrand/2.5.0 \
     crate://crates.io/find-msvc-tools/0.1.9 \
     crate://crates.io/fixedbitset/0.5.7 \
-    crate://crates.io/flate2/1.1.9 \
+    crate://crates.io/flate2/1.1.10 \
     crate://crates.io/foldhash/0.1.5 \
     crate://crates.io/foldhash/0.2.0 \
     crate://crates.io/form_urlencoded/1.2.2 \
@@ -103,7 +103,7 @@ SRC_URI += " \
     crate://crates.io/icu_provider/2.1.1 \
     crate://crates.io/idna/1.1.0 \
     crate://crates.io/idna_adapter/1.2.1 \
-    crate://crates.io/indexmap/2.14.0 \
+    crate://crates.io/indexmap/2.14.1 \
     crate://crates.io/indoc/2.0.7 \
     crate://crates.io/insta/1.48.0 \
     crate://crates.io/io-extras/0.19.0 \
@@ -131,14 +131,14 @@ SRC_URI += " \
     crate://crates.io/matchers/0.2.0 \
     crate://crates.io/maybe-owned/0.3.4 \
     crate://crates.io/memchr/2.8.3 \
-    crate://crates.io/miniz_oxide/0.8.9 \
+    crate://crates.io/miniz_oxide/0.9.1 \
     crate://crates.io/mio/1.2.0 \
     crate://crates.io/munge/0.4.7 \
     crate://crates.io/munge_macro/0.4.7 \
     crate://crates.io/nu-ansi-term/0.50.3 \
     crate://crates.io/once_cell/1.21.4 \
     crate://crates.io/once_cell_polyfill/1.70.2 \
-    crate://crates.io/owo-colors/4.3.0 \
+    crate://crates.io/owo-colors/4.4.0 \
     crate://crates.io/parking/2.2.1 \
     crate://crates.io/parking_lot/0.12.5 \
     crate://crates.io/parking_lot_core/0.9.12 \
@@ -210,7 +210,7 @@ SRC_URI += " \
     crate://crates.io/strip-ansi-escapes/0.2.1 \
     crate://crates.io/strsim/0.11.1 \
     crate://crates.io/syn/2.0.118 \
-    crate://crates.io/syn/3.0.3 \
+    crate://crates.io/syn/3.0.4 \
     crate://crates.io/synstructure/0.13.2 \
     crate://crates.io/tar-codec/0.0.14 \
     crate://crates.io/tar-framing/0.0.14 \
@@ -379,7 +379,7 @@ SRC_URI[errno-0.3.14.sha256sum] = "39cab71617ae0d63f51a36d69f866391735b51691dbda
 SRC_URI[fastrand-2.5.0.sha256sum] = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
 SRC_URI[find-msvc-tools-0.1.9.sha256sum] = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 SRC_URI[fixedbitset-0.5.7.sha256sum] = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
-SRC_URI[flate2-1.1.9.sha256sum] = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+SRC_URI[flate2-1.1.10.sha256sum] = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
 SRC_URI[foldhash-0.1.5.sha256sum] = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 SRC_URI[foldhash-0.2.0.sha256sum] = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 SRC_URI[form_urlencoded-1.2.2.sha256sum] = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
@@ -412,7 +412,7 @@ SRC_URI[icu_properties_data-2.1.2.sha256sum] = "616c294cf8d725c6afcd8f55abc17c56
 SRC_URI[icu_provider-2.1.1.sha256sum] = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
 SRC_URI[idna-1.1.0.sha256sum] = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
 SRC_URI[idna_adapter-1.2.1.sha256sum] = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
-SRC_URI[indexmap-2.14.0.sha256sum] = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+SRC_URI[indexmap-2.14.1.sha256sum] = "07aa2048142242915a31d35844fb311e0e53fcca590c3a0a40dcf1b841fa09eb"
 SRC_URI[indoc-2.0.7.sha256sum] = "79cf5c93f93228cf8efb3ba362535fb11199ac548a09ce117c9b1adc3030d706"
 SRC_URI[insta-1.48.0.sha256sum] = "86f0f8fee8c926415c58d6ae43a08523a26faccb2323f5e6b644fe7dd4ef6b82"
 SRC_URI[io-extras-0.19.0.sha256sum] = "20fd6de4ccfcc187e38bc21cfa543cb5a302cb86a8b114eb7f0bf0dc9f8ac00f"
@@ -440,14 +440,14 @@ SRC_URI[mailparse-0.16.1.sha256sum] = "60819a97ddcb831a5614eb3b0174f3620e793e97e
 SRC_URI[matchers-0.2.0.sha256sum] = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
 SRC_URI[maybe-owned-0.3.4.sha256sum] = "4facc753ae494aeb6e3c22f839b158aebd4f9270f55cd3c79906c45476c47ab4"
 SRC_URI[memchr-2.8.3.sha256sum] = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
-SRC_URI[miniz_oxide-0.8.9.sha256sum] = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+SRC_URI[miniz_oxide-0.9.1.sha256sum] = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
 SRC_URI[mio-1.2.0.sha256sum] = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
 SRC_URI[munge-0.4.7.sha256sum] = "5e17401f259eba956ca16491461b6e8f72913a0a114e39736ce404410f915a0c"
 SRC_URI[munge_macro-0.4.7.sha256sum] = "4568f25ccbd45ab5d5603dc34318c1ec56b117531781260002151b8530a9f931"
 SRC_URI[nu-ansi-term-0.50.3.sha256sum] = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 SRC_URI[once_cell-1.21.4.sha256sum] = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 SRC_URI[once_cell_polyfill-1.70.2.sha256sum] = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
-SRC_URI[owo-colors-4.3.0.sha256sum] = "d211803b9b6b570f68772237e415a029d5a50c65d382910b879fb19d3271f94d"
+SRC_URI[owo-colors-4.4.0.sha256sum] = "13c45bb4a6ae1280ec0803b1ef9d3455eb50f01efbbe1447ab020f1d54fba9d8"
 SRC_URI[parking-2.2.1.sha256sum] = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
 SRC_URI[parking_lot-0.12.5.sha256sum] = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
 SRC_URI[parking_lot_core-0.9.12.sha256sum] = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
@@ -519,7 +519,7 @@ SRC_URI[stable_deref_trait-1.2.1.sha256sum] = "6ce2be8dc25455e1f91df71bfa12ad37d
 SRC_URI[strip-ansi-escapes-0.2.1.sha256sum] = "2a8f8038e7e7969abb3f1b7c2a811225e9296da208539e0f79c5251d6cac0025"
 SRC_URI[strsim-0.11.1.sha256sum] = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 SRC_URI[syn-2.0.118.sha256sum] = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
-SRC_URI[syn-3.0.3.sha256sum] = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+SRC_URI[syn-3.0.4.sha256sum] = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
 SRC_URI[synstructure-0.13.2.sha256sum] = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 SRC_URI[tar-codec-0.0.14.sha256sum] = "7ea42eb144d30fcbf32c26dfea8959175bb8335bfb7b18d20c6ed32edecf0551"
 SRC_URI[tar-framing-0.0.14.sha256sum] = "783223a7a6590be4227cb821e7ce80372575511f67c824921aba0752d8ad5573"
diff --git a/meta/recipes-devtools/python/python3-uv-build_0.12.19.bb b/meta/recipes-devtools/python/python3-uv-build_0.12.20.bb
similarity index 92%
rename from meta/recipes-devtools/python/python3-uv-build_0.12.19.bb
rename to meta/recipes-devtools/python/python3-uv-build_0.12.20.bb
index 9004a762480d..0a590d16564d 100644
--- a/meta/recipes-devtools/python/python3-uv-build_0.12.19.bb
+++ b/meta/recipes-devtools/python/python3-uv-build_0.12.20.bb
@@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://LICENSE-APACHE;md5=86d3f3a95c324c9479bd8986968f4327 \
                     file://crates/uv-pep508/License-Apache;md5=e23fadd6ceef8c618fc1c65191d846fa \
                     file://crates/uv-pep508/License-BSD;md5=ef7a6027dc4c2389b9afad7e690274c7"
 
-SRC_URI[sha256sum] = "6b605574da32cefd4264727f7e391e77fe289686192a7eb772e69b3e705da577"
+SRC_URI[sha256sum] = "1d6906511beb61469ca638e1cd97472c9e887c4d03495eba91bab14fd68920c7"
 
 require ${BPN}-crates.inc
 

-- 
2.47.3

[PATCH 21/24] diffoscope: upgrade 331 -> 332

[Mathieu Dubois-Briand]

Changelog:
- Do not Build-Depend on GNU Guix. Thanks to Vagrant and Holger for the
  reports.
- Update more tests to support new versions of Radare.

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 .../recipes-support/diffoscope/{diffoscope_331.bb => diffoscope_332.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-support/diffoscope/diffoscope_331.bb b/meta/recipes-support/diffoscope/diffoscope_332.bb
similarity index 93%
rename from meta/recipes-support/diffoscope/diffoscope_331.bb
rename to meta/recipes-support/diffoscope/diffoscope_332.bb
index 3c64e1231816..a43b20b4608c 100644
--- a/meta/recipes-support/diffoscope/diffoscope_331.bb
+++ b/meta/recipes-support/diffoscope/diffoscope_332.bb
@@ -10,7 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"
 
 inherit pypi setuptools3
 
-SRC_URI[sha256sum] = "298a62c374f5d60dd3d3af38cdea21cbad7148c84dbfe9cc5a91fdb1b5af4e37"
+SRC_URI[sha256sum] = "da858807ce2535f1bb5c3942020b01c7aef14f870257c964b70cd4e1f2333206"
 
 RDEPENDS:${PN} += "\
         binutils \

-- 
2.47.3

[PATCH 22/24] libpcre2: upgrade 10.48 -> 10.49

[Mathieu Dubois-Briand]

Version 10.49 28-September-2026
-------------------------------

This is a security-only release, to address GHSA-r9hj-j2rw-4q3m.

Compared to 10.48, this release has only a minimal code change to prevent an
out-of-bounds write with arbitrary data. An attacker-controlled regex pattern
is required, and applications are only affected if using the
pcre2_jit_stack_create() and pcre2_jit_stack_assign() APIs to provide a growable
JIT stack, and then matching against a pattern with unusually high JIT stack
usage, such as a large number of capturing groups.

The implications of an out-of-bounds write could include arbitrary code
execution.

The issue is not a regression and affects releases 10.48 and earlier.

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 meta/recipes-support/libpcre/{libpcre2_10.48.bb => libpcre2_10.49.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-support/libpcre/libpcre2_10.48.bb b/meta/recipes-support/libpcre/libpcre2_10.49.bb
similarity index 96%
rename from meta/recipes-support/libpcre/libpcre2_10.48.bb
rename to meta/recipes-support/libpcre/libpcre2_10.49.bb
index 56791171c238..5fa7c3db3b4c 100644
--- a/meta/recipes-support/libpcre/libpcre2_10.48.bb
+++ b/meta/recipes-support/libpcre/libpcre2_10.49.bb
@@ -20,7 +20,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/pcre2-${PV}/pcre2-${PV}.tar.bz2 \
 GITHUB_BASE_URI = "https://github.com/PCRE2Project/pcre2/releases"
 UPSTREAM_CHECK_REGEX = "releases/tag/pcre2-(?P<pver>\d+(\.\d+)+)$"
 
-SRC_URI[sha256sum] = "b6c68fdf6f3ac31388b50aa89ff0fc49c00c987c16e7b5146491d12003f2c8ed"
+SRC_URI[sha256sum] = "53c156e1ba416a20da8e65395daa132da0d80e76910424caca3fcdae7831d384"
 
 CVE_PRODUCT = "pcre2"
 

-- 
2.47.3

[PATCH 23/24] igt-gpu-tools: upgrade 2.5 -> 2.6

[Mathieu Dubois-Briand]

Drop obsolete reproducibility fix, issue was fixed upstream:
https://gitlab.freedesktop.org/drm/igt-gpu-tools/-/commit/573a2c9824ce7893a32b8ce6022d21d7b5434842

General changes:
- Removed xe_eudebug from meson.

Devops changes:
- Bumped Debian version to bookworm and Fedora to latest 44

Runner changes:
- New igt_runner option --save-results-after-each-test.

Library changes:
- Continued refactor of display library code.
- New platform filtering helpers for skipping tests without modifying
  test source code.
- Improved setting up the render and compute pipelines for Intel GPUs.

Test changes:
- Improved display testing during suspend.
- Added subtest for BACKGROUND_COLOR crtc property.
- New test for HDMI TMDS audio bandwidth constraints on Intel GPUs.
- Added subtest for Content Match Refresh Rate across both fixed and
  video timing display modes.
- New Xe page offline tests on Intel CRI GPUs.
- Added test coverage for FIXED_MATRIX colorops for CSC.
- Added GT reset submit stress subtest.
- New tests for SRIOV GGTT accesses by PF and VFs on Xe..
- Added FIXED_MATRIX colorop subtests.
- Added UHBR-to-HBR fallback subtest for UHBR-capable DP
  connectors.(Sowmiya S)
- Improved KMS tests on MediaTek.
- Added user fence no signal subtest for Intel Xe driver.
- Improved userptr stress test for amdgpu.
- Improved Xe OA testing.
- Improved FBC handling in display tests.
- Improved amdgpu reset tests.
- Added subtest to validate YUV420 with DC3CO.
- Ported dmabuf tests to KUnit.
- Added display feature discovery subtests for HDR, VRR and DSC.
- Added Panthor sparse VM_BIND tests.
- Extended BO tests to cover GEM_INFO and cache flags on MSM.
- New tests for PERFCNTR_CONFIG ioctl on MSM GPUs.
- New tests for PowerVR Imagination GPUs.

Tools changes:
- Fixed gputop on Panthor.
- Renamed AMD tool to igt_hdmi_compliance and improved it to work on
  Intel GPUs
- Improvements in amd_hdmi_compliance.
- Decreased number of dynamically linked libraries in many tools.

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 ...uild-do-not-hardcode-the-build-directory-.patch | 46 ----------------------
 .../{igt-gpu-tools_2.5.bb => igt-gpu-tools_2.6.bb} |  3 +-
 2 files changed, 1 insertion(+), 48 deletions(-)

diff --git a/meta/recipes-graphics/igt-gpu-tools/igt-gpu-tools/0001-lib-meson.build-do-not-hardcode-the-build-directory-.patch b/meta/recipes-graphics/igt-gpu-tools/igt-gpu-tools/0001-lib-meson.build-do-not-hardcode-the-build-directory-.patch
deleted file mode 100644
index 3cf62632903c..000000000000
--- a/meta/recipes-graphics/igt-gpu-tools/igt-gpu-tools/0001-lib-meson.build-do-not-hardcode-the-build-directory-.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 5681532ed4e1b656219bf887bbeadbe3ee6d277d Mon Sep 17 00:00:00 2001
-From: Alexander Kanavin <alex@linutronix.de>
-Date: Thu, 18 Dec 2025 15:45:11 +0100
-Subject: [PATCH] lib/meson.build: do not hardcode the build directory into the
- installable library
-
-This breaks reproducibility, and is not otherwise appropriate, as the
-original directory may not exist. If there's a use case for referring to
-it, the location should be passed in with a command line switch or
-environment variable.
-
-imgdir is set elsewhere in meson.build to:
-
-imgdir = join_paths(build_root, 'data')
-
-and them IGT_IMGDIR is used thusly in lib/igt_core.h:
-
-/**
- * igt_fopen_data:
- * @filename: filename to open.
- *
- * Open a datafile for test, first try from installation directory,
- * then from build directory, and finally from current directory.
- */
-#define igt_fopen_data(filename) \
-        __igt_fopen_data(IGT_SRCDIR, IGT_DATADIR, IGT_IMGDIR, filename)
-
-Upstream-Status: Inappropriate [hack patching in a bogus dir; issue reported at https://gitlab.freedesktop.org/drm/igt-gpu-tools/-/issues/190]
-Signed-off-by: Alexander Kanavin <alex@linutronix.de>
----
- lib/meson.build | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/meson.build b/lib/meson.build
-index d1289a5e0..a8c15be8e 100644
---- a/lib/meson.build
-+++ b/lib/meson.build
-@@ -309,7 +309,7 @@ foreach f: lib_sources
- 	    '-DIGT_DATADIR="@0@"'.format(join_paths(prefix, datadir)),
- 	    '-DIGT_SRCDIR="@0@"'.format(srcdir),
- 	    '-DIGT_LOG_DOMAIN="@0@"'.format(f.split('.')[0]),
--            '-DIGT_IMGDIR="@0@"'.format(imgdir),
-+            '-DIGT_IMGDIR="/this/is/a/bogus/dir"',
- 	])
- 
-     lib_intermediates += lib
diff --git a/meta/recipes-graphics/igt-gpu-tools/igt-gpu-tools_2.5.bb b/meta/recipes-graphics/igt-gpu-tools/igt-gpu-tools_2.6.bb
similarity index 93%
rename from meta/recipes-graphics/igt-gpu-tools/igt-gpu-tools_2.5.bb
rename to meta/recipes-graphics/igt-gpu-tools/igt-gpu-tools_2.6.bb
index f03bf4663048..d76c2355a1b2 100644
--- a/meta/recipes-graphics/igt-gpu-tools/igt-gpu-tools_2.5.bb
+++ b/meta/recipes-graphics/igt-gpu-tools/igt-gpu-tools_2.6.bb
@@ -9,10 +9,9 @@ LICENSE = "MIT"
 
 inherit meson pkgconfig
 
-SRCREV = "a8e2cbd2854d7980a9eccecc6e0c801d0824b88f"
+SRCREV = "916c79cfb7675ca01607dcd821f8c49d4f633a6f"
 
 SRC_URI = "git://gitlab.freedesktop.org/drm/igt-gpu-tools.git;protocol=https;branch=master;tag=v${PV} \
-           file://0001-lib-meson.build-do-not-hardcode-the-build-directory-.patch \
            "
 
 DEPENDS += "libdrm libpciaccess cairo udev glib-2.0 procps libunwind kmod openssl elfutils alsa-lib json-c bison-native pciutils jansson"

-- 
2.47.3

[PATCH 24/24] appstream: upgrade 1.2.0 -> 1.2.1

[Mathieu Dubois-Briand]

Released: 2026-09-28

Features:
 * curl: Include "libcurl" in UA string so AI bot protection hits us less
 * compose: Permit changing the downloader user agent
 * compose: Try to guess what media we actually downloaded if processing failed
 * Add support for elogind

Bugfixes:
 * meson: Make sed command cross-platform friendly
 * meson: Don't use any absolute include path to find libstemmer.h
 * system-info: Avoid overflow in physical memory total on 32-bit systems
 * compose: Flag a missing ffprobe as its own error
 * docs: Work around a rare DAPS race condition when building documentation
 * Resolve or skip failing tests on riscv64 & s390x
 * validator: Fix validation of `references` elements
 * tests: Relax fontconfig orthography data check for 2.18.3 bug

Miscellaneous:
 * compose: Move media detection to the worker process

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
---
 .../appstream/0001-remove-hardcoded-path.patch     | 32 ----------------------
 .../appstream/0002-Do-not-build-qt-tests.patch     |  4 +--
 ..._PREFIX_DIR-in-qt-cmake-AppStreamQtConfig.patch |  4 +--
 .../{appstream_1.2.0.bb => appstream_1.2.1.bb}     | 12 ++++----
 4 files changed, 9 insertions(+), 43 deletions(-)

diff --git a/meta/recipes-support/appstream/appstream/0001-remove-hardcoded-path.patch b/meta/recipes-support/appstream/appstream/0001-remove-hardcoded-path.patch
deleted file mode 100644
index d0cb5cf6f495..000000000000
--- a/meta/recipes-support/appstream/appstream/0001-remove-hardcoded-path.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 0a532ef29855599e4761923bb38069e98d78e25f Mon Sep 17 00:00:00 2001
-From: Markus Volk <f_l_k@t-online.de>
-Date: Mon, 12 Dec 2022 15:42:42 +0100
-Subject: [PATCH] remove hardcoded path
-
-Signed-off-by: Markus Volk <f_l_k@t-online.de>
-
-Dont include hardcoded path. This fixes:
-| cc1: error: include location "/usr/include" is unsafe for cross-compilation [-Werror=poison-system-directories]
-
-Upstream-Status: Inappropriate [oe-specific]
----
- meson.build | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/meson.build b/meson.build
-index 004dce3..cefb852 100644
---- a/meson.build
-+++ b/meson.build
-@@ -229,10 +229,10 @@ endif
- stemmer_inc_dirs = include_directories()
- if get_option('stemming')
-     stemmer_lib = cc.find_library('stemmer', required: true)
--    stemmer_inc_dirs = include_directories(['/usr/include'])
-+    stemmer_inc_dirs = include_directories([''])
-     if not cc.has_header('libstemmer.h')
-         if cc.has_header('libstemmer/libstemmer.h')
--            stemmer_inc_dirs = include_directories('/usr/include/libstemmer')
-+            stemmer_inc_dirs = include_directories('')
-         else
-             error('Unable to find Snowball header "libstemmer.h". Please ensure libstemmer/Snowball is installed properly in order to continue.')
-         endif
diff --git a/meta/recipes-support/appstream/appstream/0002-Do-not-build-qt-tests.patch b/meta/recipes-support/appstream/appstream/0002-Do-not-build-qt-tests.patch
index 861d9552a50e..5f35a8bf2300 100644
--- a/meta/recipes-support/appstream/appstream/0002-Do-not-build-qt-tests.patch
+++ b/meta/recipes-support/appstream/appstream/0002-Do-not-build-qt-tests.patch
@@ -1,4 +1,4 @@
-From 0d387b6cb8907dd377212de187fbe749b40eedb4 Mon Sep 17 00:00:00 2001
+From 1110cb5c658de30c63642929c1128ab4f9b9b98e Mon Sep 17 00:00:00 2001
 From: Marc Ferland <marc.ferland@sonatest.com>
 Date: Fri, 26 Jul 2024 15:41:00 -0400
 Subject: [PATCH] Do not build qt/tests
@@ -23,7 +23,7 @@ Signed-off-by: Marc Ferland <marc.ferland@sonatest.com>
  1 file changed, 2 deletions(-)
 
 diff --git a/qt/meson.build b/qt/meson.build
-index 488fe60..83c2715 100644
+index 488fe60b61c0..83c2715c5fe7 100644
 --- a/qt/meson.build
 +++ b/qt/meson.build
 @@ -144,5 +144,3 @@ install_data (
diff --git a/meta/recipes-support/appstream/appstream/0003-Fix-PACKAGE_PREFIX_DIR-in-qt-cmake-AppStreamQtConfig.patch b/meta/recipes-support/appstream/appstream/0003-Fix-PACKAGE_PREFIX_DIR-in-qt-cmake-AppStreamQtConfig.patch
index 9f06f789162e..3774bfa7c617 100644
--- a/meta/recipes-support/appstream/appstream/0003-Fix-PACKAGE_PREFIX_DIR-in-qt-cmake-AppStreamQtConfig.patch
+++ b/meta/recipes-support/appstream/appstream/0003-Fix-PACKAGE_PREFIX_DIR-in-qt-cmake-AppStreamQtConfig.patch
@@ -1,4 +1,4 @@
-From 2c0758a84741e6e91cfd1ba70e9017ba4e76143a Mon Sep 17 00:00:00 2001
+From b8d73820cdb685089c0f805c7ca8163b21a78acd Mon Sep 17 00:00:00 2001
 From: Marc Ferland <marc.ferland@sonatest.com>
 Date: Mon, 29 Jul 2024 09:35:51 -0400
 Subject: [PATCH] Fix PACKAGE_PREFIX_DIR in qt/cmake/AppStreamQtConfig.cmake.in
@@ -39,7 +39,7 @@ Signed-off-by: Marc Ferland <marc.ferland@sonatest.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/qt/cmake/AppStreamQtConfig.cmake.in b/qt/cmake/AppStreamQtConfig.cmake.in
-index 63df65f..5ab2d0e 100644
+index 63df65f25676..5ab2d0ec7bd3 100644
 --- a/qt/cmake/AppStreamQtConfig.cmake.in
 +++ b/qt/cmake/AppStreamQtConfig.cmake.in
 @@ -1,5 +1,5 @@
diff --git a/meta/recipes-support/appstream/appstream_1.2.0.bb b/meta/recipes-support/appstream/appstream_1.2.1.bb
similarity index 80%
rename from meta/recipes-support/appstream/appstream_1.2.0.bb
rename to meta/recipes-support/appstream/appstream_1.2.1.bb
index 4a1c23e760fd..fcfc1aea6ccd 100644
--- a/meta/recipes-support/appstream/appstream_1.2.0.bb
+++ b/meta/recipes-support/appstream/appstream_1.2.1.bb
@@ -18,13 +18,11 @@ inherit meson gobject-introspection gettext gi-docgen pkgconfig vala bash-comple
 GIR_MESON_OPTION = "gir"
 GIDOCGEN_MESON_OPTION = "apidocs"
 
-SRC_URI = " \
-	https://www.freedesktop.org/software/appstream/releases/AppStream-${PV}.tar.xz \
-	file://0001-remove-hardcoded-path.patch \
-	file://0002-Do-not-build-qt-tests.patch \
-	file://0003-Fix-PACKAGE_PREFIX_DIR-in-qt-cmake-AppStreamQtConfig.patch \
-"
-SRC_URI[sha256sum] = "901919378910550271feb2d826034c9af6522f3ad218de04d3d6d35ddba5cb45"
+SRC_URI = "https://www.freedesktop.org/software/appstream/releases/AppStream-${PV}.tar.xz \
+           file://0002-Do-not-build-qt-tests.patch \
+           file://0003-Fix-PACKAGE_PREFIX_DIR-in-qt-cmake-AppStreamQtConfig.patch \
+           "
+SRC_URI[sha256sum] = "7df664fd3ad3b1640c6a0ff77fa84f9fabe264111bf1fe8f5df3444d6d4caaca"
 
 S = "${UNPACKDIR}/AppStream-${PV}"
 

-- 
2.47.3

Re: [OE-core] [PATCH 14/24] spirv-tools: upgrade 1.4.357.0 -> 1.4.363.0

[Mathieu Dubois-Briand]

On Wed Sep 30, 2026 at 10:16 AM CEST, Mathieu Dubois-Briand via lists.openembedded.org wrote:
> v2026.4 2026-09-09
>   - Optimizer
>     - Add pass to convert typed pointers to untyped pointers (`--convert-to-
>       untyped`)
>     - Support optimizing shaders using SPV_KHR_opacity_micromap across dead-code
>       elimination and local passes
>     - Add folding rule to dissolve OpCopyLogical of OpCompositeConstruct in
>       simplification pass
>     - Harden optimizer passes against ID overflow (#6851, #6852, #6857, #6858,
>       #6863)
>     - Filter duplicate decorations during module serialization to binary
>     - Correctness fixes for vector constant folding size and OpSelect folding
>       pre-SPIR-V 1.4 (#6798, #6827)
>     - Stability fixes for IRContext analysis handling, debug info stripping, and
>       eliminate dead functions (#6765, #6797, #6799)
>   - Validator
>     - Support and validate SPV_EXT_cooperative_matrix_maintenance1
>     - Support and validate SPV_QCOM_image_processing3 and OpImageGatherQCOM
>     - Add validation for NonSemantic.DebugPrintf extended instruction set
>     - Validate OpAbortKHR explicit layout message type and require scalar
>       packing (#6854, #6859)
>     - Tighten relaxed block layout alignments and add explicit alignment VUIDs
>       (#6819, #6853)
>     - Validate Offset decoration on Input/Output storage classes and add VUID
>       12509 (#6835, #6855)
>     - Allow OpExtInstWithForwardRefsKHR in generic non-semantic instruction sets
>     - Restrict Workgroup execution scope to OpGroupNonUniformRotateKHR for non-
>       uniform group operations
>     - Validate OpControlBarrierArriveEXT execution and memory scopes
>     - Allow Generic pointer casts to and from CodeSectionINTEL storage class
>     - Allow BFloat16 and FP8 result types in OpExtInst
>     - Validate OpSourceContinued order following OpSource
>     - Correctness fixes for >64-bit integer constant evaluation and
>       AliasScopeINTELMask/NoAliasINTELMask operand counting (#6816, #6791,
>       #6865)
>     - Validate ArrayStride on OpConstantDataKHR result types
>     - Add validation for UTFEncodedKHR decoration on array types
>     - Validate that OpAbortKHR Message Type is a concrete type
>   - Linker
>     - Detect duplicate exported definitions without imports to prevent ODR
>       violations
>   - Assembler/Disassembler
>     - Initialize parsed operand floating-point encoding to ensure deterministic
>       disassembly of literal floats
>
> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
> ---
>  .../spir/{spirv-tools_1.4.357.0.bb => spirv-tools_1.4.363.0.bb}      | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/meta/recipes-graphics/spir/spirv-tools_1.4.357.0.bb b/meta/recipes-graphics/spir/spirv-tools_1.4.363.0.bb
> similarity index 93%
> rename from meta/recipes-graphics/spir/spirv-tools_1.4.357.0.bb
> rename to meta/recipes-graphics/spir/spirv-tools_1.4.363.0.bb
> index d9f6d2926788..a5b08684f0d4 100644
> --- a/meta/recipes-graphics/spir/spirv-tools_1.4.357.0.bb
> +++ b/meta/recipes-graphics/spir/spirv-tools_1.4.363.0.bb
> @@ -7,9 +7,8 @@ SECTION = "graphics"
>  LICENSE  = "Apache-2.0"
>  LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
>  
> -SRCREV = "9a49b0883b9b635689a85b5647dbfcb223268151"
> -SRC_URI = "git://github.com/KhronosGroup/SPIRV-Tools.git;branch=vulkan-sdk-1.4.357;protocol=https;tag=vulkan-sdk-${PV} \
> -"
> +SRCREV = "ef96ed763b43b59b33b31b362f09a02b729fa1c9"
> +SRC_URI = "git://github.com/KhronosGroup/SPIRV-Tools.git;branch=main;protocol=https;tag=vulkan-sdk-${PV}"
>  PE = "1"
>  # These recipes need to be updated in lockstep with each other:
>  # glslang, vulkan-headers, vulkan-loader, vulkan-tools, spirv-headers, spirv-tools


This is broken on Debian 12. I will come with a fix.

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [OE-core] [PATCH 22/24] libpcre2: upgrade 10.48 -> 10.49

[Yoann Congal]

On Wed Sep 30, 2026 at 10:16 AM CEST, Mathieu Dubois-Briand via lists.openembedded.org wrote:
> Version 10.49 28-September-2026
> -------------------------------
>
> This is a security-only release, to address GHSA-r9hj-j2rw-4q3m.
>
> Compared to 10.48, this release has only a minimal code change to prevent an
> out-of-bounds write with arbitrary data. An attacker-controlled regex pattern
> is required, and applications are only affected if using the
> pcre2_jit_stack_create() and pcre2_jit_stack_assign() APIs to provide a growable
> JIT stack, and then matching against a pattern with unusually high JIT stack
> usage, such as a large number of capturing groups.
>
> The implications of an out-of-bounds write could include arbitrary code
> execution.
>
> The issue is not a regression and affects releases 10.48 and earlier.
>
> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
> ---
>  meta/recipes-support/libpcre/{libpcre2_10.48.bb => libpcre2_10.49.bb} | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/meta/recipes-support/libpcre/libpcre2_10.48.bb b/meta/recipes-support/libpcre/libpcre2_10.49.bb
> similarity index 96%
> rename from meta/recipes-support/libpcre/libpcre2_10.48.bb
> rename to meta/recipes-support/libpcre/libpcre2_10.49.bb
> index 56791171c238..5fa7c3db3b4c 100644
> --- a/meta/recipes-support/libpcre/libpcre2_10.48.bb
> +++ b/meta/recipes-support/libpcre/libpcre2_10.49.bb
> @@ -20,7 +20,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/pcre2-${PV}/pcre2-${PV}.tar.bz2 \
>  GITHUB_BASE_URI = "https://github.com/PCRE2Project/pcre2/releases"
>  UPSTREAM_CHECK_REGEX = "releases/tag/pcre2-(?P<pver>\d+(\.\d+)+)$"
>  
> -SRC_URI[sha256sum] = "b6c68fdf6f3ac31388b50aa89ff0fc49c00c987c16e7b5146491d12003f2c8ed"
> +SRC_URI[sha256sum] = "53c156e1ba416a20da8e65395daa132da0d80e76910424caca3fcdae7831d384"
>  
>  CVE_PRODUCT = "pcre2"
>  

Hello,

Shouldn't this patch have removed 
meta/recipes-support/libpcre/libpcre2/testoutput3C ?

See: https://git.openembedded.org/openembedded-core/commit/?id=3c447001749427b151dc2e6f08c790bac77b1c43

Regards,
-- 
Yoann Congal
Smile ECS

Re: [OE-core] [PATCH 22/24] libpcre2: upgrade 10.48 -> 10.49

[Mathieu Dubois-Briand]

On Mon Oct 5, 2026 at 11:06 AM CEST, Yoann Congal via lists.openembedded.org wrote:
> On Wed Sep 30, 2026 at 10:16 AM CEST, Mathieu Dubois-Briand via lists.openembedded.org wrote:
>> Version 10.49 28-September-2026
>> -------------------------------
>>
>> This is a security-only release, to address GHSA-r9hj-j2rw-4q3m.
>>
>> Compared to 10.48, this release has only a minimal code change to prevent an
>> out-of-bounds write with arbitrary data. An attacker-controlled regex pattern
>> is required, and applications are only affected if using the
>> pcre2_jit_stack_create() and pcre2_jit_stack_assign() APIs to provide a growable
>> JIT stack, and then matching against a pattern with unusually high JIT stack
>> usage, such as a large number of capturing groups.
>>
>> The implications of an out-of-bounds write could include arbitrary code
>> execution.
>>
>> The issue is not a regression and affects releases 10.48 and earlier.
>>
>> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
>> ---
>>  meta/recipes-support/libpcre/{libpcre2_10.48.bb => libpcre2_10.49.bb} | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/meta/recipes-support/libpcre/libpcre2_10.48.bb b/meta/recipes-support/libpcre/libpcre2_10.49.bb
>> similarity index 96%
>> rename from meta/recipes-support/libpcre/libpcre2_10.48.bb
>> rename to meta/recipes-support/libpcre/libpcre2_10.49.bb
>> index 56791171c238..5fa7c3db3b4c 100644
>> --- a/meta/recipes-support/libpcre/libpcre2_10.48.bb
>> +++ b/meta/recipes-support/libpcre/libpcre2_10.49.bb
>> @@ -20,7 +20,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/pcre2-${PV}/pcre2-${PV}.tar.bz2 \
>>  GITHUB_BASE_URI = "https://github.com/PCRE2Project/pcre2/releases"
>>  UPSTREAM_CHECK_REGEX = "releases/tag/pcre2-(?P<pver>\d+(\.\d+)+)$"
>>  
>> -SRC_URI[sha256sum] = "b6c68fdf6f3ac31388b50aa89ff0fc49c00c987c16e7b5146491d12003f2c8ed"
>> +SRC_URI[sha256sum] = "53c156e1ba416a20da8e65395daa132da0d80e76910424caca3fcdae7831d384"
>>  
>>  CVE_PRODUCT = "pcre2"
>>  
>
> Hello,
>
> Shouldn't this patch have removed 
> meta/recipes-support/libpcre/libpcre2/testoutput3C ?
>
> See: https://git.openembedded.org/openembedded-core/commit/?id=3c447001749427b151dc2e6f08c790bac77b1c43
>
> Regards,

Hi,

I assumed it had to stay for this release, but my tests are proving me
wrong. I will send a patch to remove it.

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com