[OE-core][scarthgap 0/5] Patch review

Steve Sakoman
2025-04-01T19:59:35Z

Please review this set of changes for scarthgap and have comments back by
end of day Thursday, April 3

Passed a-full on autobuilder:

https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1310

The following changes since commit 2f242f2a269bb18aab703f685e27f9c3ba761db8:

cve-update-nvd2-native: handle missing vulnStatus (2025-03-31 08:26:56 -0700)

are available in the Git repository at:

https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut

Martin Jansa (1):
mc: set ac_cv_path_ZIP to avoid buildpaths QA issues

Michael Halstead (1):
yocto-uninative: Update to 4.7 for glibc 2.41

Peter Marko (2):
expat: patch CVE-2024-8176
freetype: follow-up patch for CVE-2025-27363

Virendra Thakur (1):
rust-cross-canadian: Set CVE_STATUS ignore for CVE-2024-43402

meta/conf/distro/include/yocto-uninative.inc | 10 +-
...ests-Cover-indirect-entity-recursion.patch | 103 ++
.../expat/expat/CVE-2024-8176-01.patch | 1477 +++++++++++++++++
.../expat/expat/CVE-2024-8176-02.patch | 248 +++
meta/recipes-core/expat/expat_2.6.4.bb | 3 +
.../rust/rust-cross-canadian.inc | 4 +
meta/recipes-extended/mc/mc_4.8.31.bb | 1 +
.../freetype/freetype/CVE-2025-27363.patch | 33 +
.../freetype/freetype_2.13.2.bb | 4 +-
9 files changed, 1877 insertions(+), 6 deletions(-)
create mode 100644 meta/recipes-core/expat/expat/0001-tests-Cover-indirect-entity-recursion.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2024-8176-01.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2024-8176-02.patch
create mode 100644 meta/recipes-graphics/freetype/freetype/CVE-2025-27363.patch

--
2.43.0