[OE-core][scarthgap 0/8] Patch review

[Steve Sakoman <steve@sakoman.com>]

Please review this set of changes for scarthgap and have comments back by
end of day Tuesday, April 15

Passed a-full on autobuilder:

https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1386

Note: there was a failure during oe-selftest-fedora cve_check which is related to NFS issues on the autobuilder infrastructure and not this patch set

The following changes since commit 4003b5faa1e5acfa025e1d0df4e021e06cf8724c:

  mc: set ac_cv_path_ZIP to avoid buildpaths QA issues (2025-04-01 08:10:07 -0700)

are available in the Git repository at:

  https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
  https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut

Archana Polampalli (2):
  go: fix CVE-2025-22870
  ghostscript: upgrade 10.04.0 -> 10.05.0

Changqing Li (1):
  patch.py: set commituser and commitemail for addNote

Hitendra Prajapati (1):
  go: fix CVE-2025-22871

Peter Marko (4):
  ofono: patch CVE-2024-7537
  cve-update-nvd2-native: add workaround for json5 style list
  xz: upgrade 5.4.6 -> 5.4.7
  xz: patch CVE-2025-31115

 meta/lib/oe/patch.py                          |  14 +-
 .../ofono/ofono/CVE-2024-7537.patch           |  59 ++++++
 meta/recipes-connectivity/ofono/ofono_2.4.bb  |   1 +
 .../meta/cve-update-nvd2-native.bb            |   5 +
 meta/recipes-devtools/go/go-1.22.12.inc       |   2 +
 .../go/go/CVE-2025-22870.patch                |  80 ++++++++
 .../go/go/CVE-2025-22871.patch                | 172 ++++++++++++++++++
 ...ript_10.04.0.bb => ghostscript_10.05.0.bb} |   2 +-
 .../xz/xz/CVE-2025-31115-01.patch             |  29 +++
 .../xz/xz/CVE-2025-31115-02.patch             | 152 ++++++++++++++++
 .../xz/xz/CVE-2025-31115-03.patch             |  98 ++++++++++
 .../xz/xz/CVE-2025-31115-04.patch             |  56 ++++++
 .../xz/{xz_5.4.6.bb => xz_5.4.7.bb}           |   8 +-
 13 files changed, 669 insertions(+), 9 deletions(-)
 create mode 100644 meta/recipes-connectivity/ofono/ofono/CVE-2024-7537.patch
 create mode 100644 meta/recipes-devtools/go/go/CVE-2025-22870.patch
 create mode 100644 meta/recipes-devtools/go/go/CVE-2025-22871.patch
 rename meta/recipes-extended/ghostscript/{ghostscript_10.04.0.bb => ghostscript_10.05.0.bb} (97%)
 create mode 100644 meta/recipes-extended/xz/xz/CVE-2025-31115-01.patch
 create mode 100644 meta/recipes-extended/xz/xz/CVE-2025-31115-02.patch
 create mode 100644 meta/recipes-extended/xz/xz/CVE-2025-31115-03.patch
 create mode 100644 meta/recipes-extended/xz/xz/CVE-2025-31115-04.patch
 rename meta/recipes-extended/xz/{xz_5.4.6.bb => xz_5.4.7.bb} (89%)

-- 
2.43.0