[OE-core][whinlatter 00/18] Patch review

[Steve Sakoman <steve@sakoman.com>]

Please review this set of changes for whinlatter and have comments back by
end of day Tuesday December 23

Passed a-full on autobuilder:

https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/2893

Note: there was a failure in the Send QA Email task, but this is an known
issue that also is present on the master branch

The following changes since commit 8519978592483bb096ed5192fff7af6c887b799e:

  build-appliance-image: Update to whinlatter head revisions (2025-11-26 13:33:50 +0000)

are available in the Git repository at:

  https://git.openembedded.org/openembedded-core-contrib stable/whinlatter-nut
  https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/whinlatter-nut

Bruce Ashfield (8):
  linux-yocto/6.12: update to v6.12.57
  linux-yocto/6.12: update CVE exclusions (6.12.57)
  linux-yocto/6.12: update to v6.12.58
  linux-yocto/6.12: update CVE exclusions (6.12.58)
  linux-yocto/6.12: update to v6.12.59
  linux-yocto/6.12: update CVE exclusions (6.12.59)
  linux-yocto/6.12: update to v6.12.60
  linux-yocto/6.12: update CVE exclusions (6.12.60)

Chen Qi (1):
  xserver-nodm-init: avoid race condition related to udev

Deepesh Varatharajan (1):
  binutils: Fix CVE-2025-11494

Jayasurya Maganuru (2):
  create-spdx-image-3.0: Image SPDX/SBOM tasks are retained for eSDK
    installation
  populate_sdk_ext: keep SDK_TARGETS so SPDX/SBOM tasks remain in locked
    sigs

Martin Jansa (1):
  cross.bbclass: Propagate dependencies to outhash

Moritz Haase (1):
  curl: Use host CA bundle by default for native(sdk) builds

Paul Barker (1):
  cve-update: Avoid NFS caching issues

Peter Marko (1):
  go: upgrade 1.25.4 -> 1.25.5

Stefano Tondo (1):
  spdx30_tasks: Fix SPDX_CUSTOM_ANNOTATION_VARS implementation

Vijay Anusuri (1):
  libssh2: fix regression in KEX method validation (GH-1553)

 .../create-spdx-image-3.0.bbclass             |   2 +-
 meta/classes-recipe/cross.bbclass             |  36 ++
 meta/classes-recipe/populate_sdk_ext.bbclass  |   9 +
 meta/lib/oe/spdx30_tasks.py                   |   4 +-
 meta/lib/oeqa/selftest/cases/spdx.py          |  85 +++-
 .../recipes-core/meta/cve-update-db-native.bb |   9 +-
 .../meta/cve-update-nvd2-native.bb            |   9 +-
 .../binutils/binutils-2.45.inc                |   1 +
 .../binutils/0018-CVE-2025-11494.patch        |  43 ++
 .../go/{go-1.25.4.inc => go-1.25.5.inc}       |   2 +-
 ...e_1.25.4.bb => go-binary-native_1.25.5.bb} |   6 +-
 ..._1.25.4.bb => go-cross-canadian_1.25.5.bb} |   0
 ...{go-cross_1.25.4.bb => go-cross_1.25.5.bb} |   0
 ...osssdk_1.25.4.bb => go-crosssdk_1.25.5.bb} |   0
 ...runtime_1.25.4.bb => go-runtime_1.25.5.bb} |   0
 .../go/{go_1.25.4.bb => go_1.25.5.bb}         |   0
 .../xserver-nodm-init/xserver-nodm.service.in |   2 +
 .../linux/cve-exclusion_6.12.inc              | 412 +++++++++++++++++-
 .../linux/linux-yocto-rt_6.12.bb              |   6 +-
 .../linux/linux-yocto-tiny_6.12.bb            |   6 +-
 meta/recipes-kernel/linux/linux-yocto_6.12.bb |  28 +-
 meta/recipes-support/curl/curl_8.17.0.bb      |  11 +-
 ...rror-if-user-KEX-methods-are-invalid.patch |  73 ++++
 .../recipes-support/libssh2/libssh2_1.11.1.bb |   1 +
 24 files changed, 682 insertions(+), 63 deletions(-)
 create mode 100644 meta/recipes-devtools/binutils/binutils/0018-CVE-2025-11494.patch
 rename meta/recipes-devtools/go/{go-1.25.4.inc => go-1.25.5.inc} (91%)
 rename meta/recipes-devtools/go/{go-binary-native_1.25.4.bb => go-binary-native_1.25.5.bb} (79%)
 rename meta/recipes-devtools/go/{go-cross-canadian_1.25.4.bb => go-cross-canadian_1.25.5.bb} (100%)
 rename meta/recipes-devtools/go/{go-cross_1.25.4.bb => go-cross_1.25.5.bb} (100%)
 rename meta/recipes-devtools/go/{go-crosssdk_1.25.4.bb => go-crosssdk_1.25.5.bb} (100%)
 rename meta/recipes-devtools/go/{go-runtime_1.25.4.bb => go-runtime_1.25.5.bb} (100%)
 rename meta/recipes-devtools/go/{go_1.25.4.bb => go_1.25.5.bb} (100%)
 create mode 100644 meta/recipes-support/libssh2/libssh2/0001-Return-error-if-user-KEX-methods-are-invalid.patch

-- 
2.43.0