[OE-core][scarthgap 0/5] Patch review

[Steve Sakoman <steve@sakoman.com>]

Please review this set of changes for scarthgap and have comments back by
end of day Thursday, April 3

Passed a-full on autobuilder:

https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1310

The following changes since commit 2f242f2a269bb18aab703f685e27f9c3ba761db8:

  cve-update-nvd2-native: handle missing vulnStatus (2025-03-31 08:26:56 -0700)

are available in the Git repository at:

  https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
  https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut

Martin Jansa (1):
  mc: set ac_cv_path_ZIP to avoid buildpaths QA issues

Michael Halstead (1):
  yocto-uninative: Update to 4.7 for glibc 2.41

Peter Marko (2):
  expat: patch CVE-2024-8176
  freetype: follow-up patch for CVE-2025-27363

Virendra Thakur (1):
  rust-cross-canadian: Set CVE_STATUS ignore for CVE-2024-43402

 meta/conf/distro/include/yocto-uninative.inc  |   10 +-
 ...ests-Cover-indirect-entity-recursion.patch |  103 ++
 .../expat/expat/CVE-2024-8176-01.patch        | 1477 +++++++++++++++++
 .../expat/expat/CVE-2024-8176-02.patch        |  248 +++
 meta/recipes-core/expat/expat_2.6.4.bb        |    3 +
 .../rust/rust-cross-canadian.inc              |    4 +
 meta/recipes-extended/mc/mc_4.8.31.bb         |    1 +
 .../freetype/freetype/CVE-2025-27363.patch    |   33 +
 .../freetype/freetype_2.13.2.bb               |    4 +-
 9 files changed, 1877 insertions(+), 6 deletions(-)
 create mode 100644 meta/recipes-core/expat/expat/0001-tests-Cover-indirect-entity-recursion.patch
 create mode 100644 meta/recipes-core/expat/expat/CVE-2024-8176-01.patch
 create mode 100644 meta/recipes-core/expat/expat/CVE-2024-8176-02.patch
 create mode 100644 meta/recipes-graphics/freetype/freetype/CVE-2025-27363.patch

-- 
2.43.0