[OE-core][wrynose 00/56] Patch review

[OE-core][wrynose 00/56] Patch review

[Yoann Congal]

This is the first part of the patches pending fro wrynose. I think there
will be one or two review cycles before returning to a more usual rhythm.

Please review this set of changes for wrynose and have comments back by
end of day Tuesday, September 1.

Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/4604

The following changes since commit f7397af248e1e338929d70a910b0fbc2341528ec:

  mirrors: Disable YP mirrors on autobuilder (2026-08-21 18:06:46 +0200)

are available in the Git repository at:

  https://git.openembedded.org/openembedded-core-contrib stable/wrynose-nut
  https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-nut

for you to fetch changes up to 00c66f1d38a234f7738c2eb8fafa41b4f057a865:

  pseudo: 1.9.10 -> 1.9.11 (2026-08-28 17:24:32 +0200)

----------------------------------------------------------------

Adarsh Jagadish Kamini (1):
  glibc: stable 2.43 branch updates

Alexander Kanavin (2):
  gstreamer1.0: disable an intermittently failing test
  gstreamer1.0: upgrade 1.28.2 -> 1.28.4 (the remaining pieces)

Bhavesh R Maheshwari (10):
  vim: Fix for CVE-2026-55693
  vim: Fix for CVE-2026-55895
  vim: Fix for CVE-2026-57451
  vim: Fix for CVE-2026-57453
  vim: Fix for CVE-2026-57454
  vim: Fix for CVE-2026-57455
  vim: Fix for CVE-2026-57456
  vim: Fix for CVE-2026-59856
  vim: Fix for CVE-2026-59857
  vim: Fix for CVE-2026-59858

Bruce Ashfield (1):
  kern-tools: bump SRCREV for conditional 'depends on X if Y' support

Deepak Rathore (6):
  curl: fix CVE-2026-8286
  curl: set CVE_STATUS for CVE-2026-8924
  curl: fix CVE-2026-8927
  curl: fix CVE-2026-8932
  curl: set CVE_STATUS for CVE-2026-9547
  curl: set CVE_STATUS for CVE-2026-12064

Hetvi Thakar (5):
  wget: Fix CVE-2026-58469
  wget: Fix CVE-2026-58471
  wget: Fix CVE-2026-58472
  patch: Fix CVE-2026-56289
  patch: Fix CVE-2026-56288

Jaipaul Cheernam (2):
  perl: fix CVE-2026-13221
  perl: fix CVE-2026-57432

Leonid Iziumtsev (1):
  coreutils: fix CVE-2026-56391

Peter Marko (10):
  openssh: set status for CVE-2026-55653
  connman: remove connection_manager from CVE_PRODUCTS
  gstreamer1.0*: upgrade 1.28.4 -> 1.28.5
  ffmpeg: upgrade 8.0.1 -> 8.0.3
  ffmpeg: set status for CVE-2026-8461 and CVE-2026-40962
  libsoup: patch CVE-2026-4271
  diffutils: patch CVE-2026-53910
  p11-kit: set status for CVE-2026-13757
  libxml2: set status for CVE-2026-6732
  python3-cryptography(-vectors): upgrade 46.0.5 -> 46.0.7

Richard Purdie (15):
  gst-devtools: upgrade 1.28.2 -> 1.28.4
  gstreamer1.0-libav: upgrade 1.28.2 -> 1.28.4
  gstreamer1.0-python: upgrade 1.28.2 -> 1.28.4
  gstreamer1.0: upgrade 1.28.2 -> 1.28.4
  xserver-xorg: upgrade 21.1.22 -> 21.1.23
  xserver-xorg: upgrade 21.1.23 -> 21.1.24
  ruby: upgrade 4.0.2 -> 4.0.3
  ruby: upgrade 4.0.3 -> 4.0.5
  xwayland: upgrade 24.1.11 -> 24.1.12
  xwayland: upgrade 24.1.12 -> 24.1.13
  p11-kit: upgrade 0.26.2 -> 0.26.4
  libxml2: upgrade 2.15.2 -> 2.15.3
  pseudo: Add in openat2, exec and linkat fixes
  pseudo: Update to 1.9.10
  pseudo: 1.9.10 -> 1.9.11

Sudhir Dumbhare (1):
  binutils: fix CVE-2026-3441 and CVE-2026-3442

Tim Orling (1):
  python3-pyasn1: upgrade 0.6.3 -> 0.6.4

Wang Mingyu (1):
  python3-pyasn1: upgrade 0.6.2 -> 0.6.3

 .../connman/connman_2.0.bb                    |    2 -
 .../openssh/openssh_10.3p1.bb                 |    1 +
 .../coreutils/coreutils/CVE-2026-56391.patch  |   66 +
 meta/recipes-core/coreutils/coreutils_9.10.bb |    1 +
 meta/recipes-core/glibc/glibc-version.inc     |    2 +-
 meta/recipes-core/glibc/glibc_2.43.bb         |    1 +
 ...-installation-directories-in-libxml2.patch |   12 +-
 .../libxml/libxml2/install-tests.patch        |    9 +-
 .../{libxml2_2.15.2.bb => libxml2_2.15.3.bb}  |    3 +-
 .../binutils/binutils-2.46.inc                |    1 +
 .../CVE-2026-3441_CVE-2026-3442.patch         |   51 +
 meta/recipes-devtools/patch/patch.inc         |    6 +-
 .../patch/patch/CVE-2026-56288.patch          |   75 ++
 .../patch/patch/CVE-2026-56289.patch          |   36 +
 .../perl/files/CVE-2026-13221.patch           |   75 ++
 .../perl/files/CVE-2026-57432-01.patch        |   52 +
 .../perl/files/CVE-2026-57432-02.patch        |   34 +
 meta/recipes-devtools/perl/perl_5.42.0.bb     |    3 +
 meta/recipes-devtools/pseudo/pseudo_git.bb    |    4 +-
 .../python/python3-cryptography-common.inc    |    2 +-
 .../python/python3-cryptography-vectors.bb    |    2 +-
 .../python/python3-cryptography.bb            |    2 +-
 ...yasn1_0.6.2.bb => python3-pyasn1_0.6.4.bb} |    2 +-
 ...save-the-original-name-and-timestamp.patch |    5 +-
 ...x-cross-compilation-of-external-gems.patch |    6 +-
 ...ine-REG_S1-and-REG_S2-for-musl-riscv.patch |    4 +-
 ...Obey-LDFLAGS-for-the-link-of-libruby.patch |    6 +-
 ...doc-build-reproducible-documentation.patch |   15 +-
 ...-list-of-object-files-in-generated-M.patch |    6 +-
 ...eproducible-change-fixing-784225-too.patch |    6 +-
 .../0006-Make-gemspecs-reproducible.patch     |   13 +-
 ..._rm_r_no_permissions-test-under-root.patch |    4 +-
 .../ruby/{ruby_4.0.2.bb => ruby_4.0.5.bb}     |    2 +-
 .../diffutils/CVE-2026-53910-01.patch         |   67 +
 .../diffutils/CVE-2026-53910-02.patch         |   35 +
 .../diffutils/diffutils_3.12.bb               |    9 +
 .../wget/CVE-2026-58469-regression_p1.patch   |   39 +
 .../wget/CVE-2026-58469-regression_p2.patch   |   26 +
 .../wget/wget/CVE-2026-58469.patch            |   53 +
 .../wget/wget/CVE-2026-58471.patch            |   71 +
 .../wget/wget/CVE-2026-58472-regression.patch |  233 ++++
 .../wget/wget/CVE-2026-58472.patch            |   74 ++
 meta/recipes-extended/wget/wget_1.25.0.bb     |    6 +
 ...-Intel-ddx-only-for-pre-gen4-hardwar.patch |    2 +-
 ...org_21.1.22.bb => xserver-xorg_21.1.24.bb} |    2 +-
 ...wayland_24.1.11.bb => xwayland_24.1.13.bb} |    2 +-
 .../kern-tools/kern-tools-native_git.bb       |    2 +-
 .../{ffmpeg_8.0.1.bb => ffmpeg_8.0.3.bb}      |    4 +-
 ...ct-has-a-different-signature-on-musl.patch |    2 +-
 ...tools_1.28.2.bb => gst-devtools_1.28.5.bb} |    2 +-
 ...001-Make-player-examples-installable.patch |   21 +-
 ...mples_1.28.2.bb => gst-examples_1.28.5.bb} |    2 +-
 ...1.28.2.bb => gstreamer1.0-libav_1.28.5.bb} |    2 +-
 ...ialized-warnings-when-compiling-with.patch |    4 +-
 ...-avoid-including-sys-poll.h-directly.patch |    2 +-
 ...issing-opencv-data-dir-in-yocto-buil.patch |    4 +-
 ...added-buffers-in-wl_shm-buffer-creat.patch |    5 +-
 ....bb => gstreamer1.0-plugins-bad_1.28.5.bb} |    2 +-
 ...et-caps-from-src-pad-when-query-caps.patch |    6 +-
 ...parse-enhance-SSA-text-lines-parsing.patch |    2 +-
 ...iv-fb-Make-sure-config.h-is-included.patch |    2 +-
 ...bb => gstreamer1.0-plugins-base_1.28.5.bb} |    2 +-
 ...bb => gstreamer1.0-plugins-good_1.28.5.bb} |    2 +-
 ...bb => gstreamer1.0-plugins-ugly_1.28.5.bb} |    2 +-
 ....28.2.bb => gstreamer1.0-python_1.28.5.bb} |    2 +-
 ....bb => gstreamer1.0-rtsp-server_1.28.5.bb} |    2 +-
 ...spect-the-idententaion-used-in-meson.patch |    2 +-
 ...ts-add-support-for-install-the-tests.patch |    6 +-
 ...s-use-a-dictionaries-for-environment.patch |    2 +-
 ...er-script-to-run-the-installed_tests.patch |    2 +-
 .../gstreamer/gstreamer1.0/run-ptest          |    4 +
 ...er1.0_1.28.2.bb => gstreamer1.0_1.28.5.bb} |    4 +-
 .../curl/curl/CVE-2026-8286.patch             |   81 ++
 .../curl/curl/CVE-2026-8927.patch             |  349 +++++
 .../curl/curl/CVE-2026-8932-dependent.patch   |   71 +
 .../curl/curl/CVE-2026-8932.patch             | 1148 +++++++++++++++++
 meta/recipes-support/curl/curl_8.19.0.bb      |    7 +
 .../libsoup/libsoup/CVE-2026-4271.patch       |  362 ++++++
 meta/recipes-support/libsoup/libsoup_3.6.6.bb |    1 +
 .../{p11-kit_0.26.2.bb => p11-kit_0.26.4.bb}  |    3 +-
 .../vim/files/CVE-2026-55693.patch            |  103 ++
 .../vim/files/CVE-2026-55895.patch            |  106 ++
 .../vim/files/CVE-2026-57451.patch            |  192 +++
 .../vim/files/CVE-2026-57453.patch            |  269 ++++
 .../vim/files/CVE-2026-57454.patch            |  203 +++
 .../vim/files/CVE-2026-57455.patch            |   87 ++
 .../vim/files/CVE-2026-57456.patch            |  164 +++
 .../vim/files/CVE-2026-59856.patch            |  118 ++
 .../vim/files/CVE-2026-59857.patch            |  125 ++
 .../vim/files/CVE-2026-59858.patch            |  149 +++
 meta/recipes-support/vim/vim.inc              |   10 +
 91 files changed, 4659 insertions(+), 109 deletions(-)
 create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch
 rename meta/recipes-core/libxml/{libxml2_2.15.2.bb => libxml2_2.15.3.bb} (95%)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-3441_CVE-2026-3442.patch
 create mode 100644 meta/recipes-devtools/patch/patch/CVE-2026-56288.patch
 create mode 100644 meta/recipes-devtools/patch/patch/CVE-2026-56289.patch
 create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-13221.patch
 create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-57432-01.patch
 create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-57432-02.patch
 rename meta/recipes-devtools/python/{python3-pyasn1_0.6.2.bb => python3-pyasn1_0.6.4.bb} (83%)
 rename meta/recipes-devtools/ruby/{ruby_4.0.2.bb => ruby_4.0.5.bb} (98%)
 create mode 100644 meta/recipes-extended/diffutils/diffutils/CVE-2026-53910-01.patch
 create mode 100644 meta/recipes-extended/diffutils/diffutils/CVE-2026-53910-02.patch
 create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p1.patch
 create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p2.patch
 create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58469.patch
 create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58471.patch
 create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58472-regression.patch
 create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58472.patch
 rename meta/recipes-graphics/xorg-xserver/{xserver-xorg_21.1.22.bb => xserver-xorg_21.1.24.bb} (92%)
 rename meta/recipes-graphics/xwayland/{xwayland_24.1.11.bb => xwayland_24.1.13.bb} (96%)
 rename meta/recipes-multimedia/ffmpeg/{ffmpeg_8.0.1.bb => ffmpeg_8.0.3.bb} (97%)
 rename meta/recipes-multimedia/gstreamer/{gst-devtools_1.28.2.bb => gst-devtools_1.28.5.bb} (95%)
 rename meta/recipes-multimedia/gstreamer/{gst-examples_1.28.2.bb => gst-examples_1.28.5.bb} (96%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-libav_1.28.2.bb => gstreamer1.0-libav_1.28.5.bb} (91%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-plugins-bad_1.28.2.bb => gstreamer1.0-plugins-bad_1.28.5.bb} (99%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-plugins-base_1.28.2.bb => gstreamer1.0-plugins-base_1.28.5.bb} (98%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-plugins-good_1.28.2.bb => gstreamer1.0-plugins-good_1.28.5.bb} (97%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-plugins-ugly_1.28.2.bb => gstreamer1.0-plugins-ugly_1.28.5.bb} (94%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-python_1.28.2.bb => gstreamer1.0-python_1.28.5.bb} (91%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-rtsp-server_1.28.2.bb => gstreamer1.0-rtsp-server_1.28.5.bb} (90%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0_1.28.2.bb => gstreamer1.0_1.28.5.bb} (93%)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8927.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8932-dependent.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8932.patch
 create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2026-4271.patch
 rename meta/recipes-support/p11-kit/{p11-kit_0.26.2.bb => p11-kit_0.26.4.bb} (95%)
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-55693.patch
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-55895.patch
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-57451.patch
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-57453.patch
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-57454.patch
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-57455.patch
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-57456.patch
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-59856.patch
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-59857.patch
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-59858.patch

[OE-core][wrynose 01/56] binutils: fix CVE-2026-3441 and CVE-2026-3442

[Yoann Congal]

From: Sudhir Dumbhare <sudumbha@cisco.com>

This patch applies the upstream fix [1], which addresses two out-of-bounds
read issues in bfd/xcofflink.c within xcoff_link_add_symbols(). The changes
shown in [2] are referenced by [3] and [4].

[1] https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=c2bf7de1eb77a91d7a3c86d56408bf57de540faf
[2] https://sourceware.org/git/?p=binutils-gdb.git;a=blobdiff;f=bfd/xcofflink.c;h=1781182fa6a3f92e5e91996f8b0dcf3ab192679b;hp=fde21c9f9583baff05e72e390e6bb896d02f9d43;hb=c2bf7de1eb77a91d7a3c86d56408bf57de540faf;hpb=d7f532cb3a46527
[3] https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-3441
[4] https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-3442

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-3441
https://nvd.nist.gov/vuln/detail/CVE-2026-3442
https://www.suse.com/security/cve/CVE-2026-3441.html
https://www.suse.com/security/cve/CVE-2026-3442.html

Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../binutils/binutils-2.46.inc                |  1 +
 .../CVE-2026-3441_CVE-2026-3442.patch         | 51 +++++++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-3441_CVE-2026-3442.patch

diff --git a/meta/recipes-devtools/binutils/binutils-2.46.inc b/meta/recipes-devtools/binutils/binutils-2.46.inc
index f8d926b22e2..cae7c1c872e 100644
--- a/meta/recipes-devtools/binutils/binutils-2.46.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.46.inc
@@ -42,4 +42,5 @@ SRC_URI = "\
      file://CVE-2026-6846.patch \
      file://CVE-2026-15003.patch \
      file://CVE-2026-18220.patch \
+     file://CVE-2026-3441_CVE-2026-3442.patch \
 "
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2026-3441_CVE-2026-3442.patch b/meta/recipes-devtools/binutils/binutils/CVE-2026-3441_CVE-2026-3442.patch
new file mode 100644
index 00000000000..be63bb295cb
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2026-3441_CVE-2026-3442.patch
@@ -0,0 +1,51 @@
+From be1339394f1b64ba8b5d4f55343522cbea26131b Mon Sep 17 00:00:00 2001
+From: Alan Modra <amodra@gmail.com>
+Date: Sat, 28 Feb 2026 13:16:40 +1030
+Subject: [PATCH] xcofflink buffer overflows
+
+This fixes two fuzzed object file out-of-bounds accesses.
+
+	* xcofflink.c (xcoff_link_add_symbols): Properly bounds check
+	XTY_LD x_scnlen index.  Sanity check r_symndx before using it
+	to index sym hashes.
+
+CVE: CVE-2026-3441 CVE-2026-3442
+Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=c2bf7de1eb77a91d7a3c86d56408bf57de540faf]
+
+(cherry picked from commit c2bf7de1eb77a91d7a3c86d56408bf57de540faf)
+Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
+---
+ bfd/xcofflink.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/bfd/xcofflink.c b/bfd/xcofflink.c
+index 691acc854ae..e1716262871 100644
+--- a/bfd/xcofflink.c
++++ b/bfd/xcofflink.c
+@@ -1908,12 +1908,9 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info)
+ 	     follow its appropriate XTY_SD symbol.  The .set pseudo op can
+ 	     cause the XTY_LD to not follow the XTY_SD symbol. */
+ 	  {
+-	    bool bad;
+-
+-	    bad = false;
+-	    if (aux.x_csect.x_scnlen.u64
+-		>= (size_t) (esym - (bfd_byte *) obj_coff_external_syms (abfd)))
+-	      bad = true;
++	    bool bad = (aux.x_csect.x_scnlen.u64
++			>= ((esym - (bfd_byte *) obj_coff_external_syms (abfd))
++			    / symesz));
+ 	    if (! bad)
+ 	      {
+ 		section = xcoff_data (abfd)->csects[aux.x_csect.x_scnlen.u64];
+@@ -2279,6 +2276,7 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info)
+ 		 functions imported from dynamic objects.  */
+ 	      if (info->output_bfd->xvec == abfd->xvec
+ 		  && *rel_csect != bfd_und_section_ptr
++		  && (unsigned long) rel->r_symndx < obj_raw_syment_count (abfd)
+ 		  && obj_xcoff_sym_hashes (abfd)[rel->r_symndx] != NULL)
+ 		{
+ 		  struct xcoff_link_hash_entry *h;
+-- 
+2.51.0
+

[OE-core][wrynose 02/56] perl: fix CVE-2026-13221

[Yoann Congal]

From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>

This patch applies the upstream fix as referenced in [1], using the
commit shown in [2].

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-13221
[2] https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../perl/files/CVE-2026-13221.patch           | 75 +++++++++++++++++++
 meta/recipes-devtools/perl/perl_5.42.0.bb     |  1 +
 2 files changed, 76 insertions(+)
 create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-13221.patch

diff --git a/meta/recipes-devtools/perl/files/CVE-2026-13221.patch b/meta/recipes-devtools/perl/files/CVE-2026-13221.patch
new file mode 100644
index 00000000000..03396f3e434
--- /dev/null
+++ b/meta/recipes-devtools/perl/files/CVE-2026-13221.patch
@@ -0,0 +1,75 @@
+From 03f74bbbd3a68350d926ee93d56ee4808c28c4c7 Mon Sep 17 00:00:00 2001
+From: Karl Williamson <khw@cpan.org>
+Date: Thu, 26 Mar 2026 10:13:49 -0600
+Subject: [PATCH] regcomp_study: Don't create a trie that would overflow
+
+This addresses GH #23388
+
+The design of the trie compiling code is to batch extra long tries into
+smaller chunks that fit into whatever limitations there are.  However,
+this ticket shows that that isn't always being done.
+
+In this case, a bunch of branches that have TAIL operands can be
+combined together, and the final TAIL is used.  And the code requires
+that the delta between the first branch and this final TAIL fit into a
+16-bit field.  That is the root cause of this bug.
+
+I'm not familiar enough with the trie construction code to easily
+understand why the final tail needs to be used here.  So this patch
+simply doesn't optimize a sequence of branches into a trie that would
+overflow.
+
+This could be revisited by someone who knows more about this than I, or
+earlier in the development cycle.
+
+CVE: CVE-2026-13221
+Upstream-Status: Backport [https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7]
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ regcomp_study.c     | 10 ++++++++++
+ t/re/pat_advanced.t |  9 +++++++++
+ 2 files changed, 19 insertions(+)
+
+diff --git a/regcomp_study.c b/regcomp_study.c
+index db7ab3a409..a1b2c3d4e5 100644
+--- a/regcomp_study.c
++++ b/regcomp_study.c
+@@ -1933,6 +1933,16 @@ Perl_study_chunk(pTHX_
+                             tail = regnext( tail );
+                         }
+ 
++                        /* The code below currently saves the difference from
++                         * start to finish in a 16-bit field, causing
++                         * GH #23388.  This defeats the design of batching
++                         * tries into chunks that each fit.  khw thinks it is
++                         * too late in the 5.44 cycle to relook at the design,
++                         * so for now anyway, don't make a trie that would
++                         * overflow */
++                        if (tail - startbranch >= U16_MAX) {
++                            continue;
++                        }
+ 
+                         DEBUG_TRIE_COMPILE_r({
+                             regprop(RExC_rx, RExC_mysv, tail, NULL, pRExC_state);
+diff --git a/t/re/pat_advanced.t b/t/re/pat_advanced.t
+index 398680838d..c9e389ecb3 100644
+--- a/t/re/pat_advanced.t
++++ b/t/re/pat_advanced.t
+@@ -4898,6 +4898,15 @@ EOF_DEBUG_OUT
+         $x =~ s/^[\x{0301}\x{030C}]+//;
+     }
+ 
++    { # GH #23388
++        fresh_perl_is(<<~'PROG', , "", {}, "Avoid trie overflow");
++            my $x = join "|", "aaa".."mzz";
++            my $y = join "|", "naa".."zzz";
++            use re 'Debug';
++            "fnord" =~ m/(?:$x)|(?:$y)/;
++            PROG
++    }
++
+ 
+     # !!! NOTE that tests that aren't at all likely to crash perl should go
+     # a ways above, above these last ones.  There's a comment there that, like
+-- 
+2.43.0
diff --git a/meta/recipes-devtools/perl/perl_5.42.0.bb b/meta/recipes-devtools/perl/perl_5.42.0.bb
index 1833b7a352d..1a3451b747d 100644
--- a/meta/recipes-devtools/perl/perl_5.42.0.bb
+++ b/meta/recipes-devtools/perl/perl_5.42.0.bb
@@ -18,6 +18,7 @@ SRC_URI = "https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl \
            file://0001-cpan-Sys-Syslog-Makefile.PL-Fix-_PATH_LOG-for-determ.patch \
            file://CVE-2026-8376-01.patch \
            file://CVE-2026-8376-02.patch \
+           file://CVE-2026-13221.patch \
            "
 SRC_URI:append:class-native = " \
            file://perl-configpm-switch.patch \

[OE-core][wrynose 03/56] perl: fix CVE-2026-57432

[Yoann Congal]

From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>

This patch applies the upstream fix as referenced in [1], using the
commits shown in [2] and [3].

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-57432
[2] https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55
[3] https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../perl/files/CVE-2026-57432-01.patch        | 52 +++++++++++++++++++
 .../perl/files/CVE-2026-57432-02.patch        | 34 ++++++++++++
 meta/recipes-devtools/perl/perl_5.42.0.bb     |  2 +
 3 files changed, 88 insertions(+)
 create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-57432-01.patch
 create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-57432-02.patch

diff --git a/meta/recipes-devtools/perl/files/CVE-2026-57432-01.patch b/meta/recipes-devtools/perl/files/CVE-2026-57432-01.patch
new file mode 100644
index 00000000000..ef92b0d7b21
--- /dev/null
+++ b/meta/recipes-devtools/perl/files/CVE-2026-57432-01.patch
@@ -0,0 +1,52 @@
+From 5f7eb6bbbe0510964e3fb1d6bb691e5445913e55 Mon Sep 17 00:00:00 2001
+From: "Paul \"LeoNerd\" Evans" <leonerd@leonerd.org.uk>
+Date: Sat, 9 May 2026 17:18:43 +0100
+Subject: [PATCH] pp_pack.c: Avoid ssize_t overflow when calculating the size
+ of a structure
+
+If the user has requested a size that would overflow a SSize_t, then the
+only sensible thing to do is throw an exception, because the structure
+this implies couldn't possibly fit into memory anyway.
+
+CVE: CVE-2026-57432
+Upstream-Status: Backport [https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55]
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ pod/perldiag.pod | 6 ++++++
+ pp_pack.c        | 4 ++++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/pod/perldiag.pod b/pod/perldiag.pod
+index 841e22d580..d9231077363d 100644
+--- a/pod/perldiag.pod
++++ b/pod/perldiag.pod
+@@ -4880,6 +4880,12 @@ mixed-case attribute name, instead.  See L<attributes>.
+ (F) You can't specify a repeat count so large that it overflows your
+ signed integers.  See L<perlfunc/pack>.
+ 
++=item Pack template structure size is too large
++
++(F) You called C<pack> or C<unpack> to operate on a structure, whose
++computed size is too large to fit in memory.  This usually happens as a
++result of embedding a large number as the repeat count for an item.
++
+ =item page overflow
+ 
+ (W io) A single call to write() produced more lines than can fit on a
+diff --git a/pp_pack.c b/pp_pack.c
+index b5c0b261ef..6075e83aac 100644
+--- a/pp_pack.c
++++ b/pp_pack.c
+@@ -528,6 +528,10 @@ S_measure_struct(pTHX_ tempsym_t* symptr)
+                 break;
+             }
+         }
++        if ((size > 0) &&
++                ((len > SSize_t_MAX / size) ||         /* detect overflow of len * size */
++                 (len * size > SSize_t_MAX - total)))  /* detect overflow of total + len * size */
++            croak("Pack template structure size is too large");
+         total += len * size;
+     }
+     return total;
+-- 
+2.43.0
diff --git a/meta/recipes-devtools/perl/files/CVE-2026-57432-02.patch b/meta/recipes-devtools/perl/files/CVE-2026-57432-02.patch
new file mode 100644
index 00000000000..273a247a88f
--- /dev/null
+++ b/meta/recipes-devtools/perl/files/CVE-2026-57432-02.patch
@@ -0,0 +1,34 @@
+From 40754edc72dd3e513d758153c0e2f0215897740e Mon Sep 17 00:00:00 2001
+From: "Paul \"LeoNerd\" Evans" <leonerd@leonerd.org.uk>
+Date: Mon, 11 May 2026 12:25:33 +0100
+Subject: [PATCH] pp_pack.c: Avoid some other potential overflows when
+ calculating sizes
+
+CVE: CVE-2026-57432
+Upstream-Status: Backport [https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e]
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ pp_pack.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/pp_pack.c b/pp_pack.c
+index 6075e83aac..b2019902203a 100644
+--- a/pp_pack.c
++++ b/pp_pack.c
+@@ -515,12 +515,12 @@ S_measure_struct(pTHX_ tempsym_t* symptr)
+                 break;
+             case 'B':
+             case 'b':
+-                len = (len + 7)/8;
++                len = (len / 8) + !!(len % 8);
+                 size = 1;
+                 break;
+             case 'H':
+             case 'h':
+-                len = (len + 1)/2;
++                len = (len / 2) + !!(len % 2);
+                 size = 1;
+                 break;
+ 
+-- 
+2.43.0
diff --git a/meta/recipes-devtools/perl/perl_5.42.0.bb b/meta/recipes-devtools/perl/perl_5.42.0.bb
index 1a3451b747d..8716f1f2572 100644
--- a/meta/recipes-devtools/perl/perl_5.42.0.bb
+++ b/meta/recipes-devtools/perl/perl_5.42.0.bb
@@ -19,6 +19,8 @@ SRC_URI = "https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl \
            file://CVE-2026-8376-01.patch \
            file://CVE-2026-8376-02.patch \
            file://CVE-2026-13221.patch \
+           file://CVE-2026-57432-01.patch \
+           file://CVE-2026-57432-02.patch \
            "
 SRC_URI:append:class-native = " \
            file://perl-configpm-switch.patch \

[OE-core][wrynose 04/56] openssh: set status for CVE-2026-55653

[Yoann Congal]

From: Peter Marko <peter.marko@siemens.com>

Per [1] "Only an issue with FIPS patch which is not in Debian/upstream".

[1] https://security-tracker.debian.org/tracker/CVE-2026-55653

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-connectivity/openssh/openssh_10.3p1.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index b13488e2652..e6bc9e9a5b6 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -44,6 +44,7 @@ Red Hat Enterprise Linux 7 and when running in a Kerberos environment"
 CVE_STATUS[CVE-2008-3844] = "not-applicable-platform: Only applies to some distributed RHEL binaries."
 CVE_STATUS[CVE-2023-51767] = "upstream-wontfix: It was demonstrated on modified sshd and does not exist in upstream openssh https://bugzilla.mindrot.org/show_bug.cgi?id=3656#c1."
 CVE_STATUS[CVE-2026-3497] = "not-applicable-platform: Only affects GSSAPI Key Exchange patches used by some Linux distributions and does not exist in upstream openssh."
+CVE_STATUS[CVE-2026-55653] = "not-applicable-platform: Only applies to RHEL FIPS patches."
 CVE_STATUS[CVE-2026-59998] = "${@bb.utils.contains('PACKAGECONFIG', 'kerberos', 'unpatched', 'not-applicable-config: GSSAPI/Kerberos support is disabled in the default OpenSSH configuration', d)}"
 
 PAM_SRC_URI = "file://sshd"

[OE-core][wrynose 05/56] connman: remove connection_manager from CVE_PRODUCTS

[Yoann Congal]

From: Peter Marko <peter.marko@siemens.com>

The only CVE with this product/cpr is CVE-2013-10036 which is for
different connection manager and is showing up as false positive in CVE
reports with current sbom-cve-check tooling.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5b2046bf757622ae46e66691119cebc504113993)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-connectivity/connman/connman_2.0.bb | 2 --
 1 file changed, 2 deletions(-)

diff --git a/meta/recipes-connectivity/connman/connman_2.0.bb b/meta/recipes-connectivity/connman/connman_2.0.bb
index 6f7093301bf..920745afc32 100644
--- a/meta/recipes-connectivity/connman/connman_2.0.bb
+++ b/meta/recipes-connectivity/connman/connman_2.0.bb
@@ -14,8 +14,6 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=12f884d2ae1ff87c09e5b7ccc2c4ca7e \
 
 inherit autotools pkgconfig systemd update-rc.d update-alternatives
 
-CVE_PRODUCT = "connman connection_manager"
-
 DEPENDS  = "dbus glib-2.0"
 
 SRC_URI = "${KERNELORG_MIRROR}/linux/network/${BPN}/${BP}.tar.xz \

[OE-core][wrynose 06/56] wget: Fix CVE-2026-58469

[Yoann Congal]

From: Hetvi Thakar <hthakar@cisco.com>

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

It also includes the upstream follow-up fixes referenced in [3]
and [4]. These correct the trailing whitespace check introduced
by the original fix and add the required <ctype.h> include for
isspace().

[1] https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-58469
[3] https://gitlab.com/gnuwget/wget/-/commit/7b1cdecc49bc77bde220fc575c8a00386c3f3bcf
[4] https://gitlab.com/gnuwget/wget/-/commit/82d945ff5dc9942b78b2bf736aac298c24fe00a1

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../wget/CVE-2026-58469-regression_p1.patch   | 39 ++++++++++++++
 .../wget/CVE-2026-58469-regression_p2.patch   | 26 +++++++++
 .../wget/wget/CVE-2026-58469.patch            | 53 +++++++++++++++++++
 meta/recipes-extended/wget/wget_1.25.0.bb     |  3 ++
 4 files changed, 121 insertions(+)
 create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p1.patch
 create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p2.patch
 create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58469.patch

diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p1.patch b/meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p1.patch
new file mode 100644
index 00000000000..ecd8ea619ba
--- /dev/null
+++ b/meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p1.patch
@@ -0,0 +1,39 @@
+From 151beaf2210968aa38d7db61e788b1e33baf77b4 Mon Sep 17 00:00:00 2001
+From: ChenYanpan <chenyanpan@xfusion.com>
+Date: Wed, 8 Jul 2026 12:09:55 +0800
+Subject: [PATCH] * src/metalink.c (clean_metalink_string): Fix inverted
+ trailing-space check
+
+37a40fcb added an `end > beg' bound guard to prevent a buffer
+underflow, but accidentally flipped the condition from `isspace' to
+`!isspace'. The loop therefore walked back over non-space characters
+instead of trailing whitespace, collapsing any string without a
+trailing newline to "". Every Metalink/HTTP resource URL was wiped,
+so wget could not follow any mirror and
+testenv/Test-metalink-http.py failed ("Expected file test.meta not
+found"). Restore the `isspace' condition.
+
+Copyright-paperwork-exempt: Yes
+
+CVE: CVE-2026-58469
+Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/7b1cdecc49bc77bde220fc575c8a00386c3f3bcf]
+
+(cherry picked from commit 7b1cdecc49bc77bde220fc575c8a00386c3f3bcf)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ src/metalink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/metalink.c b/src/metalink.c
+index 2d6e5846..d1b8af0b 100644
+--- a/src/metalink.c
++++ b/src/metalink.c
+@@ -1061,7 +1061,7 @@ clean_metalink_string (char **str)
+   /* If we are at the end of the string, search the first legit
+      character going backward.  */
+   if (*end == '\0')
+-    while (end > beg && !isspace(*(end - 1)))
++    while (end > beg && isspace(*(end - 1)))
+       end--;
+ 
+   new = xmemdup0 (beg, end - beg);
diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p2.patch b/meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p2.patch
new file mode 100644
index 00000000000..cbb23050c49
--- /dev/null
+++ b/meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p2.patch
@@ -0,0 +1,26 @@
+From 2dba5e3dcd0546a6b06be58da56fbfd151015967 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
+Date: Thu, 9 Jul 2026 14:50:40 +0200
+Subject: [PATCH] * src/metalink.c: Include ctype.h
+
+CVE: CVE-2026-58469
+Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/82d945ff5dc9942b78b2bf736aac298c24fe00a1]
+
+(cherry picked from commit 82d945ff5dc9942b78b2bf736aac298c24fe00a1)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ src/metalink.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/metalink.c b/src/metalink.c
+index d1b8af0b..9bea18f7 100644
+--- a/src/metalink.c
++++ b/src/metalink.c
+@@ -46,6 +46,7 @@ as that of the covered work.  */
+ #include "c-strcase.h"
+ #include <errno.h>
+ #include <unistd.h> /* For unlink.  */
++#include <ctype.h>
+ #include <metalink/metalink_parser.h>
+ #ifdef HAVE_GPGME
+ #include <gpgme.h>
diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58469.patch b/meta/recipes-extended/wget/wget/CVE-2026-58469.patch
new file mode 100644
index 00000000000..dd7eec0b08b
--- /dev/null
+++ b/meta/recipes-extended/wget/wget/CVE-2026-58469.patch
@@ -0,0 +1,53 @@
+From 566d87c1202acb4c36bdec7404abcdd40f85bcad Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
+Date: Mon, 29 Jun 2026 18:32:02 +0200
+Subject: [PATCH] * src/metalink.c (clean_metalink_string): Fix buffer
+ underflow
+
+Reported-by: TristanInSec@gmail.com
+
+CVE: CVE-2026-58469
+Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826]
+
+(cherry picked from commit 37a40fcb450153f69537c7cbc2a7a4fb0b6f7826)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ src/metalink.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/src/metalink.c b/src/metalink.c
+index de2439c9..2d6e5846 100644
+--- a/src/metalink.c
++++ b/src/metalink.c
+@@ -1041,7 +1041,6 @@ void
+ clean_metalink_string (char **str)
+ {
+   int c;
+-  size_t len;
+   char *new, *beg, *end;
+ 
+   if (!str || !*str)
+@@ -1049,7 +1048,7 @@ clean_metalink_string (char **str)
+ 
+   beg = *str;
+ 
+-  while ((c = *beg) && (c == '\n' || c == '\r' || c == '\t' || c == ' '))
++  while (isspace(*beg))
+     beg++;
+ 
+   end = beg;
+@@ -1062,12 +1061,10 @@ clean_metalink_string (char **str)
+   /* If we are at the end of the string, search the first legit
+      character going backward.  */
+   if (*end == '\0')
+-    while ((c = *(end - 1)) && (c == '\n' || c == '\r' || c == '\t' || c == ' '))
++    while (end > beg && !isspace(*(end - 1)))
+       end--;
+ 
+-  len = end - beg;
+-
+-  new = xmemdup0 (beg, len);
++  new = xmemdup0 (beg, end - beg);
+   xfree (*str);
+   *str = new;
+ }
diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb
index f0d3458462e..fb777549653 100644
--- a/meta/recipes-extended/wget/wget_1.25.0.bb
+++ b/meta/recipes-extended/wget/wget_1.25.0.bb
@@ -15,6 +15,9 @@ DEPENDS += "autoconf-archive-native pod2man-native"
 
 SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \
            file://0002-improve-reproducibility.patch \
+           file://CVE-2026-58469.patch \
+           file://CVE-2026-58469-regression_p1.patch \
+           file://CVE-2026-58469-regression_p2.patch \
            "
 
 SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784"

[OE-core][wrynose 07/56] wget: Fix CVE-2026-58471

[Yoann Congal]

From: Hetvi Thakar <hthakar@cisco.com>

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-58471

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../wget/wget/CVE-2026-58471.patch            | 71 +++++++++++++++++++
 meta/recipes-extended/wget/wget_1.25.0.bb     |  1 +
 2 files changed, 72 insertions(+)
 create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58471.patch

diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58471.patch b/meta/recipes-extended/wget/wget/CVE-2026-58471.patch
new file mode 100644
index 00000000000..e306092a8ca
--- /dev/null
+++ b/meta/recipes-extended/wget/wget/CVE-2026-58471.patch
@@ -0,0 +1,71 @@
+From d22eee13f1fa56c4fdc9f21d5ea1db08dbaf9fe6 Mon Sep 17 00:00:00 2001
+From: Arkadi Vainbrand <arkadva8@gmail.com>
+Date: Tue, 13 Jan 2026 12:22:04 +0200
+Subject: [PATCH] Fix buffer size handling in filename conversion
+
+* src/url.c (convert_fname): Fix buffer overflow.
+
+Copyright-paperwork-exempt: Yes
+
+CVE: CVE-2026-58471
+Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee]
+
+Signed-off-by: Arkadi Vainbrand <arkadva8@gmail.com>
+(cherry picked from commit c2640fe5171c59f87c58dc9fcb195b2d18b010ee)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ src/url.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/src/url.c b/src/url.c
+index 2f27c48a..7e7a3cea 100644
+--- a/src/url.c
++++ b/src/url.c
+@@ -1603,7 +1603,7 @@ convert_fname (char *fname)
+   const char *from_encoding = opt.encoding_remote;
+   const char *to_encoding = opt.locale;
+   iconv_t cd;
+-  size_t len, done, inlen, outlen;
++  size_t len, inlen, outlen;
+   char *s;
+   const char *orig_fname;
+ 
+@@ -1625,7 +1625,6 @@ convert_fname (char *fname)
+   inlen = strlen (fname);
+   len = outlen = inlen * 2;
+   converted_fname = s = xmalloc (outlen + 1);
+-  done = 0;
+ 
+   for (;;)
+     {
+@@ -1633,7 +1632,7 @@ convert_fname (char *fname)
+       if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0
+           && iconv (cd, NULL, NULL, &s, &outlen) == 0)
+         {
+-          *(converted_fname + len - outlen - done) = '\0';
++          *s = '\0';
+           iconv_close (cd);
+           DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n",
+                    orig_fname, from_encoding, converted_fname, to_encoding));
+@@ -1656,10 +1655,17 @@ convert_fname (char *fname)
+         }
+       else if (errno == E2BIG) /* Output buffer full */
+         {
+-          done = len;
+-          len = outlen = done + inlen * 2;
+-          converted_fname = xrealloc (converted_fname, outlen + 1);
+-          s = converted_fname + done;
++          size_t used = s - converted_fname;
++          size_t newlen = used + inlen * 2 + 1;
++
++          /* Ensure we actually grow the buffer */
++          if (newlen <= len)
++            newlen = len * 2;
++
++          converted_fname = xrealloc (converted_fname, newlen + 1);
++          len = newlen;
++          s = converted_fname + used;
++          outlen = len - used;
+         }
+       else /* Weird, we got an unspecified error */
+         {
diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb
index fb777549653..25eea0f801b 100644
--- a/meta/recipes-extended/wget/wget_1.25.0.bb
+++ b/meta/recipes-extended/wget/wget_1.25.0.bb
@@ -18,6 +18,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \
            file://CVE-2026-58469.patch \
            file://CVE-2026-58469-regression_p1.patch \
            file://CVE-2026-58469-regression_p2.patch \
+           file://CVE-2026-58471.patch \
            "
 
 SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784"

[OE-core][wrynose 08/56] wget: Fix CVE-2026-58472

[Yoann Congal]

From: Hetvi Thakar <hthakar@cisco.com>

Apply the upstream fix referenced in [2] using the commit
listed in [1].
Also include the upstream follow-up commit [3], which fixes
encoded entity length handling and adds regression tests.

[1] https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-58472
[3] https://gitlab.com/gnuwget/wget/-/commit/f76978a51ba9365e7ecaed96c1cfb73197a38ca2

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../wget/wget/CVE-2026-58472-regression.patch | 233 ++++++++++++++++++
 .../wget/wget/CVE-2026-58472.patch            |  74 ++++++
 meta/recipes-extended/wget/wget_1.25.0.bb     |   2 +
 3 files changed, 309 insertions(+)
 create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58472-regression.patch
 create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58472.patch

diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58472-regression.patch b/meta/recipes-extended/wget/wget/CVE-2026-58472-regression.patch
new file mode 100644
index 00000000000..47dfe2b82c8
--- /dev/null
+++ b/meta/recipes-extended/wget/wget/CVE-2026-58472-regression.patch
@@ -0,0 +1,233 @@
+From f6202f6bf630796891e0f69a583dbab05f3cfd41 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
+Date: Thu, 2 Jul 2026 13:13:07 +0200
+Subject: [PATCH] Regression: Fix buffer overflow in html_quote_string()
+
+The regression has been introduced in commit dd692d9 and
+is not part of any release.
+
+The tests allow the address sanitizer to find the issue.
+
+* src/convert.c: Fix string size calculation.
+* tests/unit-tests.c: Added tests including tests for html_quote_string().
+* tests/unit-tests.h: Add definitions for the test functions.
+
+Reported-by: Trung Nguyen <trungnh@cystack.net>
+
+CVE: CVE-2026-58472
+Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/f76978a51ba9365e7ecaed96c1cfb73197a38ca2]
+
+(cherry picked from commit f76978a51ba9365e7ecaed96c1cfb73197a38ca2)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ src/convert.c      | 148 +++++++++++++++++++++++++++++++++++++++++++--
+ tests/unit-tests.c |   4 ++
+ tests/unit-tests.h |   4 ++
+ 3 files changed, 152 insertions(+), 4 deletions(-)
+
+diff --git a/src/convert.c b/src/convert.c
+index d1cbab88..386bded4 100644
+--- a/src/convert.c
++++ b/src/convert.c
+@@ -48,6 +48,9 @@ as that of the covered work.  */
+ #include "css-url.h"
+ #include "iri.h"
+ #include "xstrndup.h"
++#ifdef TESTING
++#include "../tests/unit-tests.h"
++#endif
+ 
+ static struct hash_table *dl_file_url_map;
+ struct hash_table *dl_url_file_map;
+@@ -1186,13 +1189,13 @@ html_quote_string (const char *s)
+   for (i = 0; *s; s++)
+     {
+       if (*s == '&')
+-        ok = INT_ADD_OK (i, 4, &i);     /* `amp;' */
++        ok = INT_ADD_OK (i, 4 + 1, &i);     /* `amp;' */
+       else if (*s == '<' || *s == '>')
+-        ok = INT_ADD_OK (i, 3, &i);     /* `lt;' and `gt;' */
++        ok = INT_ADD_OK (i, 3 + 1, &i);     /* `lt;' and `gt;' */
+       else if (*s == '\"')
+-        ok = INT_ADD_OK (i, 5, &i);     /* `quot;' */
++        ok = INT_ADD_OK (i, 5 + 1, &i);     /* `quot;' */
+       else if (*s == ' ')
+-        ok = INT_ADD_OK (i, 4, &i);     /* #32; */
++        ok = INT_ADD_OK (i, 4 + 1, &i);     /* #32; */
+       else
+         ok = INT_ADD_OK (i, 1, &i);
+ 
+@@ -1251,6 +1254,143 @@ html_quote_string (const char *s)
+   return res;
+ }
+ 
++#ifdef TESTING
++
++const char *
++test_construct_relative (void)
++{
++  static const struct {
++    const char *basefile;
++    const char *linkfile;
++    const char *expected;
++  } test_array[] = {
++    { "foo", "bar", "bar" },
++    { "A/foo", "A/bar", "bar" },
++    { "A/foo", "A/B/bar", "B/bar" },
++    { "A/X/foo", "A/Y/bar", "../Y/bar" },
++    { "X/", "Y/bar", "../Y/bar" },
++    { "/foo", "/bar", "bar" },
++    { "/a/b/c", "/a/b/d", "d" },
++    { "/a/b/c", "/a/b/c/d", "c/d" },
++    { "/a/b/c", "/a/b/c/d/e", "c/d/e" },
++    { "/a/b/c", "/x/y/z", "../../x/y/z" },
++    { "a/b", "c/d", "../c/d" },
++    { "./foo", "./bar", "bar" },
++  };
++
++  for (unsigned i = 0; i < countof (test_array); ++i)
++    {
++      char *result = construct_relative (test_array[i].basefile,
++                                         test_array[i].linkfile);
++      mu_assert ("test_construct_relative: wrong result",
++                 strcmp (result, test_array[i].expected) == 0);
++      xfree (result);
++    }
++
++  return NULL;
++}
++
++const char *
++test_match_except_index (void)
++{
++  static const struct {
++    const char *s1;
++    const char *s2;
++    bool expected;
++  } test_array[] = {
++    { "foo/index.html", "foo/", true },
++    { "foo/", "foo/index.html", true },
++    { "foo", "foo/index.html", true },
++    { "foo", "foo/", true },
++    { "foo", "foo", true },
++    { "/foo/index.html", "/foo/", true },
++    { "/foo/", "/foo/index.html", true },
++    { "/foo", "/foo/index.html", true },
++    { "/foo", "/foo/", true },
++    { "foo/bar", "foo/qux", false },
++    { "foo/bar", "bar/foo", false },
++  };
++
++  for (unsigned i = 0; i < countof (test_array); ++i)
++    {
++      bool result = match_except_index (test_array[i].s1, test_array[i].s2);
++      mu_assert ("test_match_except_index: wrong result",
++                 result == test_array[i].expected);
++    }
++
++  return NULL;
++}
++
++const char *
++test_find_fragment (void)
++{
++  static const struct {
++    const char *input;
++    int size;
++    bool has_fragment;
++    const char *fragment;
++  } test_array[] = {
++    { "http://example.com#section", 26, true, "#section" },
++    { "http://example.com", 18, false, NULL },
++    { "http://example.com?a=1#frag", 24, true, "#frag" },
++    { "http://example.com?a=1%26#frag", 28, true, "#frag" },
++    { "http://example.com?a=1&b=2#frag", 30, true, "#frag" },
++    { "a#b", 3, true, "#b" },
++    { "a", 1, false, NULL },
++  };
++  const char *bp, *ep;
++
++  for (unsigned i = 0; i < countof (test_array); ++i)
++    {
++      bool result = find_fragment (test_array[i].input,
++                                   test_array[i].size, &bp, &ep);
++      mu_assert ("test_find_fragment: wrong result",
++                 result == test_array[i].has_fragment);
++      if (test_array[i].has_fragment)
++        {
++          mu_assert ("test_find_fragment: wrong fragment", bp != NULL);
++          mu_assert ("test_find_fragment: fragment mismatch",
++                     strncmp (bp, test_array[i].fragment,
++                              strlen (test_array[i].fragment)) == 0 &&
++                     ep == test_array[i].input + test_array[i].size);
++        }
++    }
++
++  return NULL;
++}
++
++const char *
++test_html_quote_string (void)
++{
++  static const struct {
++    const char *input;
++    const char *expected;
++  } test_array[] = {
++    { "hello", "hello" },
++    { "a&b", "a&amp;b" },
++    { "<tag>", "&lt;tag&gt;" },
++    { "\"quote\"", "&quot;quote&quot;" },
++    { "space here", "space&#32;here" },
++    { "&<>\" ", "&amp;&lt;&gt;&quot;&#32;" },
++    { "no special", "no&#32;special" },
++    { "&&&&", "&amp;&amp;&amp;&amp;" },
++    { "<<>>", "&lt;&lt;&gt;&gt;" },
++    { "" , "" },
++  };
++
++  for (unsigned i = 0; i < countof (test_array); ++i)
++    {
++      char *result = html_quote_string (test_array[i].input);
++      mu_assert ("test_html_quote_string: wrong result",
++                 strcmp (result, test_array[i].expected) == 0);
++      xfree (result);
++    }
++
++  return NULL;
++}
++
++#endif /* TESTING */
++
+ /*
+  * vim: et ts=2 sw=2
+  */
+diff --git a/tests/unit-tests.c b/tests/unit-tests.c
+index 28b9328a..63b83bac 100644
+--- a/tests/unit-tests.c
++++ b/tests/unit-tests.c
+@@ -68,6 +68,10 @@ all_tests(void)
+ #endif
+   mu_run_test (test_parse_netrc);
+   mu_run_test (test_retr_rate);
++  mu_run_test (test_construct_relative);
++  mu_run_test (test_match_except_index);
++  mu_run_test (test_find_fragment);
++  mu_run_test (test_html_quote_string);
+ 
+   return NULL;
+ }
+diff --git a/tests/unit-tests.h b/tests/unit-tests.h
+index 44635f0c..8cd93097 100644
+--- a/tests/unit-tests.h
++++ b/tests/unit-tests.h
+@@ -64,6 +64,10 @@ const char *test_hsts_url_rewrite_congruent(void);
+ const char *test_hsts_read_database(void);
+ const char *test_parse_netrc(void);
+ const char *test_retr_rate(void);
++const char *test_construct_relative(void);
++const char *test_match_except_index(void);
++const char *test_find_fragment(void);
++const char *test_html_quote_string(void);
+ 
+ #endif /* TEST_H */
+ 
diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58472.patch b/meta/recipes-extended/wget/wget/CVE-2026-58472.patch
new file mode 100644
index 00000000000..fa014389949
--- /dev/null
+++ b/meta/recipes-extended/wget/wget/CVE-2026-58472.patch
@@ -0,0 +1,74 @@
+From 5a43952fc39f46bf1973608e014db8cc067de216 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
+Date: Mon, 29 Jun 2026 19:13:15 +0200
+Subject: [PATCH] * src/convert.c (html_quote_string): Fix integer+buffer
+ overflow
+
+Reported-by: TristanInSec@gmail.com
+
+CVE: CVE-2026-58472
+Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812]
+
+(cherry picked from commit dd692d9cea5335b181d877ae917fe6e75587a812)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ src/convert.c | 31 ++++++++++++++++++++++++-------
+ 1 file changed, 24 insertions(+), 7 deletions(-)
+
+diff --git a/src/convert.c b/src/convert.c
+index 2e5bc22b..d1cbab88 100644
+--- a/src/convert.c
++++ b/src/convert.c
+@@ -36,6 +36,7 @@ as that of the covered work.  */
+ #include <unistd.h>
+ #include <errno.h>
+ #include <assert.h>
++#include <intprops.h>
+ #include "convert.h"
+ #include "url.h"
+ #include "recur.h"
+@@ -1178,21 +1179,37 @@ html_quote_string (const char *s)
+ {
+   const char *b = s;
+   char *p, *res;
+-  int i;
++  size_t i;
++  int ok;
+ 
+   /* Pass through the string, and count the new size.  */
+-  for (i = 0; *s; s++, i++)
++  for (i = 0; *s; s++)
+     {
+       if (*s == '&')
+-        i += 4;                 /* `amp;' */
++        ok = INT_ADD_OK (i, 4, &i);     /* `amp;' */
+       else if (*s == '<' || *s == '>')
+-        i += 3;                 /* `lt;' and `gt;' */
++        ok = INT_ADD_OK (i, 3, &i);     /* `lt;' and `gt;' */
+       else if (*s == '\"')
+-        i += 5;                 /* `quot;' */
++        ok = INT_ADD_OK (i, 5, &i);     /* `quot;' */
+       else if (*s == ' ')
+-        i += 4;                 /* #32; */
++        ok = INT_ADD_OK (i, 4, &i);     /* #32; */
++      else
++        ok = INT_ADD_OK (i, 1, &i);
++
++      if (!ok)
++        {
++          DEBUGP (("Overflow detected in html_quote_string().\n"));
++          abort();
++        }
+     }
+-  res = xmalloc (i + 1);
++
++  if (!INT_ADD_OK (i, 1, &i))
++    {
++      DEBUGP (("Overflow detected in html_quote_string().\n"));
++      abort();
++    }
++
++  res = xmalloc (i);
+   s = b;
+   for (p = res; *s; s++)
+     {
diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb
index 25eea0f801b..dc4903429be 100644
--- a/meta/recipes-extended/wget/wget_1.25.0.bb
+++ b/meta/recipes-extended/wget/wget_1.25.0.bb
@@ -19,6 +19,8 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \
            file://CVE-2026-58469-regression_p1.patch \
            file://CVE-2026-58469-regression_p2.patch \
            file://CVE-2026-58471.patch \
+           file://CVE-2026-58472.patch \
+           file://CVE-2026-58472-regression.patch \
            "
 
 SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784"

[OE-core][wrynose 09/56] glibc: stable 2.43 branch updates

[Yoann Congal]

From: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>

Update SRCREV to pull the latest fixes from the upstream
release/2.43/master branch, including fixes for the following CVEs:

  CVE-2026-5435  resolv: More types as unknown in ns_sprintrrf
  CVE-2026-5450  stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]
  CVE-2026-5928  libio: Fix ungetwc operating on byte stream [BZ #33998]
  CVE-2026-6238  resolv: Fix buffer overreads in ns_sprintrrf
  CVE-2026-6791  posix: Fix stack overflow in wordexp tilde expansion (BZ 34091)

Commits between the old SRCREV (e9517114ac) and the new SRCREV (1c9988e525):

1c9988e525 rtld: cache cpuid results on the stack for intel
dae425b554 posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791)
8759917de5 resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
3a418da6a3 resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
e64ae5a591 resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
c9225a3e73 resolv: Check for inet_ntop failure in ns_sprintrrf
c46f7b2fd6 resolv: Improve formatting of unknown records in ns_sprintrrf
1d7d1a16b0 resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
349297a4eb resolv: Declare __p_class_syms, __p_type_syms for internal use
fdf10644d6 hppa: Fix missing call to __feraiseexcept (BZ 34306)
a6fa9a9594 arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)
fe0ccc9564 iconv: Suppress intermediate errors with //TRANSLIT (bug 34236)
22f3d24a6b Hurd: restore some SIOC ioctls
a13ebdbc7e Hurd: comment ioctls which cannot currently compile
446f708e4c Hurd: comment PF_ROUTE/AF_ROUTE defines
ced45fd472 Hurd: comment PF_LINK/AF_LINK defines
89cbf46693 elf: don't clobber ld.so.conf in tst-glibc-hwcaps-prepend-cache [BZ #34210]
18b97b03b7 Rename __unused fields to __glibc_reserved.
a47b5b2b3e math: Fix fma alignment when exponent difference is exactly 64 (BZ 34183)
4070d808be stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]
2890b35cd3 libio: Fix ungetwc operating on byte stream [BZ #33998]

Testing Results:
             Before    After    Diff
PASS         6609      6611      +2
XPASS        4         4          0
FAIL         131       132       +1
XFAIL        16        16         0
UNSUPPORTED  554       555       +1

Changes in testcases:

testcase-name                                before  after
resolv/tst-ns_sprintrr(new)                    -     PASS
nptl/tst-robustpi7                            PASS    FAIL

[Note: The uplift adds new testcases including resolv/tst-ns_sprintrr
from commit 8759917de5, which passes, accounting for the PASS and
UNSUPPORTED increases.

nptl/tst-robustpi7 shows as PASS->FAIL, but it is a flaky test under
QEMU user-mode emulation (PI robust-mutex handling). No nptl code was
changed in the SRCREV range.]

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-core/glibc/glibc-version.inc | 2 +-
 meta/recipes-core/glibc/glibc_2.43.bb     | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
index af3db54cee5..cf5a4440956 100644
--- a/meta/recipes-core/glibc/glibc-version.inc
+++ b/meta/recipes-core/glibc/glibc-version.inc
@@ -1,6 +1,6 @@
 SRCBRANCH ?= "release/2.43/master"
 PV = "2.43+git"
-SRCREV_glibc ?= "e9517114acc77c0b8af9da6700107df16882b701"
+SRCREV_glibc ?= "1c9988e52540c844928c6d93ff45305adc2c24a0"
 SRCREV_localedef ?= "cba02c503d7c853a38ccfb83c57e343ca5ecd7e5"
 
 GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
diff --git a/meta/recipes-core/glibc/glibc_2.43.bb b/meta/recipes-core/glibc/glibc_2.43.bb
index b84c55ca170..9f3a3814d0a 100644
--- a/meta/recipes-core/glibc/glibc_2.43.bb
+++ b/meta/recipes-core/glibc/glibc_2.43.bb
@@ -19,6 +19,7 @@ easier access for another. 'ASLR bypass itself is not a vulnerability.'"
 CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
 CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-15281 CVE-2026-0861 CVE-2026-0915 CVE-2026-4437 CVE-2026-4438 \
     CVE-2026-4046 \
+    CVE-2026-5435 CVE-2026-5450 CVE-2026-5928 CVE-2026-6238 CVE-2026-6791 \
 "
 CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash"
 

[OE-core][wrynose 10/56] patch: Fix CVE-2026-56289

[Yoann Congal]

From: Hetvi Thakar <hthakar@cisco.com>

This patch applies the upstream fix referenced by NVD in [2], using
the commit shown in [1].

[1] https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=faba04ef4f2b410257f76c1b9dc85e350929c4b9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56289

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 48c1aa91e829a87c398e8c012cde45cd8c1aab0a)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-devtools/patch/patch.inc         |  4 ++-
 .../patch/patch/CVE-2026-56289.patch          | 36 +++++++++++++++++++
 2 files changed, 39 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-devtools/patch/patch/CVE-2026-56289.patch

diff --git a/meta/recipes-devtools/patch/patch.inc b/meta/recipes-devtools/patch/patch.inc
index 44d3046fd87..738bec038dc 100644
--- a/meta/recipes-devtools/patch/patch.inc
+++ b/meta/recipes-devtools/patch/patch.inc
@@ -5,7 +5,9 @@ original files, producing patched versions."
 SECTION = "utils"
 HOMEPAGE = "http://savannah.gnu.org/projects/patch/"
 
-SRC_URI = "${GNU_MIRROR}/patch/patch-${PV}.tar.gz"
+SRC_URI = "${GNU_MIRROR}/patch/patch-${PV}.tar.gz \
+	   file://CVE-2026-56289.patch"
+
 S = "${UNPACKDIR}/patch-${PV}"
 
 inherit autotools update-alternatives
diff --git a/meta/recipes-devtools/patch/patch/CVE-2026-56289.patch b/meta/recipes-devtools/patch/patch/CVE-2026-56289.patch
new file mode 100644
index 00000000000..8f98c444fc6
--- /dev/null
+++ b/meta/recipes-devtools/patch/patch/CVE-2026-56289.patch
@@ -0,0 +1,36 @@
+From e89f7be0853836908226e1df746fe07ef7c46769 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Tue, 21 Apr 2026 13:16:10 -0700
+Subject: [PATCH] =?UTF-8?q?Don=E2=80=99t=20infloop=20on=20null=20ranges?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Problem reported by Michał Majchrowicz.
+* src/patch.c (locate_hunk): Don’t attempt to optimize
+matches of a null range.  Instead, apply all the checks
+we apply to non-null ranges.
+
+CVE: CVE-2026-56289
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=faba04ef4f2b410257f76c1b9dc85e350929c4b9]
+
+(cherry picked from commit faba04ef4f2b410257f76c1b9dc85e350929c4b9)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ src/patch.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/src/patch.c b/src/patch.c
+index e4d0524..1e7dfdc 100644
+--- a/src/patch.c
++++ b/src/patch.c
+@@ -1166,9 +1166,6 @@ locate_hunk (idx_t fuzz)
+     ptrdiff_t max_offset = MAX (max_pos_offset, max_neg_offset);
+     ptrdiff_t min_offset;
+ 
+-    if (!pat_lines)			/* null range matches always */
+-	return first_guess;
+-
+     /* Do not try lines <= 0.  */
+     if (first_guess <= max_neg_offset)
+ 	max_neg_offset = first_guess - 1;

[OE-core][wrynose 11/56] patch: Fix CVE-2026-56288

[Yoann Congal]

From: Hetvi Thakar <hthakar@cisco.com>

This patch applies the upstream fix referenced by NVD in [2], using
the commit shown in [1].

[1] https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=e6d6a4e021660679d7fc9150f981d4920f722313
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56288

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a30cd69993f9f48d5cf55e57181e49171f0a1b7a)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-devtools/patch/patch.inc         |  4 +-
 .../patch/patch/CVE-2026-56288.patch          | 75 +++++++++++++++++++
 2 files changed, 78 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-devtools/patch/patch/CVE-2026-56288.patch

diff --git a/meta/recipes-devtools/patch/patch.inc b/meta/recipes-devtools/patch/patch.inc
index 738bec038dc..a9675d53b45 100644
--- a/meta/recipes-devtools/patch/patch.inc
+++ b/meta/recipes-devtools/patch/patch.inc
@@ -6,7 +6,9 @@ SECTION = "utils"
 HOMEPAGE = "http://savannah.gnu.org/projects/patch/"
 
 SRC_URI = "${GNU_MIRROR}/patch/patch-${PV}.tar.gz \
-	   file://CVE-2026-56289.patch"
+	   file://CVE-2026-56289.patch \
+	   file://CVE-2026-56288.patch"
+
 
 S = "${UNPACKDIR}/patch-${PV}"
 
diff --git a/meta/recipes-devtools/patch/patch/CVE-2026-56288.patch b/meta/recipes-devtools/patch/patch/CVE-2026-56288.patch
new file mode 100644
index 00000000000..7219f5a3c7d
--- /dev/null
+++ b/meta/recipes-devtools/patch/patch/CVE-2026-56288.patch
@@ -0,0 +1,75 @@
+From 101a805510356092a6d2a864bb18d440fec57f0a Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Tue, 21 Apr 2026 10:05:02 -0700
+Subject: [PATCH] Avoid null pointer derefence with bad hunks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Problem reported by Michał Majchrowicz.
+* src/pch.c (another_hunk): Keep chars_read positive
+even with malformed hunks.
+
+CVE: CVE-2026-56288
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=e6d6a4e021660679d7fc9150f981d4920f722313]
+
+(cherry picked from commit e6d6a4e021660679d7fc9150f981d4920f722313)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ src/pch.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/src/pch.c b/src/pch.c
+index d9f5c61..41150fe 100644
+--- a/src/pch.c
++++ b/src/pch.c
+@@ -1694,7 +1694,8 @@ another_hunk (enum diff difftype, bool rev)
+ 		    p_end = filldst-1;
+ 		    malformed ();
+ 		}
+-		chars_read -= fillsrc == p_ptrn_lines && incomplete_line ();
++		chars_read -= (1 < chars_read && fillsrc == p_ptrn_lines
++			       && incomplete_line ());
+ 		p_Char[fillsrc] = ch;
+ 		p_line[fillsrc] = s;
+ 		p_len[fillsrc++] = chars_read;
+@@ -1711,7 +1712,8 @@ another_hunk (enum diff difftype, bool rev)
+ 		    malformed ();
+ 		}
+ 		context++;
+-		chars_read -= fillsrc == p_ptrn_lines && incomplete_line ();
++		chars_read -= (1 < chars_read && fillsrc == p_ptrn_lines
++			       && incomplete_line ());
+ 		p_Char[fillsrc] = ch;
+ 		p_line[fillsrc] = s;
+ 		p_len[fillsrc++] = chars_read;
+@@ -1725,7 +1727,8 @@ another_hunk (enum diff difftype, bool rev)
+ 		    p_end = fillsrc-1;
+ 		    malformed ();
+ 		}
+-		chars_read -= filldst == p_end && incomplete_line ();
++		chars_read -= (1 < chars_read && filldst == p_end
++			       && incomplete_line ());
+ 		p_Char[filldst] = ch;
+ 		p_line[filldst] = s;
+ 		p_len[filldst++] = chars_read;
+@@ -1808,7 +1811,8 @@ another_hunk (enum diff difftype, bool rev)
+ 	      fatal (("'<' followed by space or tab expected"
+ 		      " at line %td of patch"),
+ 		     p_input_line);
+-	    chars_read -= 2 + (i == p_ptrn_lines && incomplete_line ());
++	    chars_read -= 2 + (3 < chars_read && i == p_ptrn_lines
++			       && incomplete_line ());
+ 	    p_len[i] = chars_read;
+ 	    p_line[i] = savebuf (patchbuf + 2, chars_read);
+ 	    p_Char[i] = '-';
+@@ -1833,7 +1837,8 @@ another_hunk (enum diff difftype, bool rev)
+ 	      fatal (("'>' followed by space or tab expected"
+ 		      " at line %td of patch"),
+ 		     p_input_line);
+-	    chars_read -= 2 + (i == p_end && incomplete_line ());
++	    chars_read -= 2 + (3 < chars_read && i == p_end
++			       && incomplete_line ());
+ 	    p_len[i] = chars_read;
+ 	    p_line[i] = savebuf (patchbuf + 2, chars_read);
+ 	    p_Char[i] = '+';

[OE-core][wrynose 12/56] coreutils: fix CVE-2026-56391

[Yoann Congal]

From: Leonid Iziumtsev <leonid.iziumtsev@est.tech>

Backport patch to fix CVE-2026-56391.

Reference:
  https://nvd.nist.gov/vuln/detail/CVE-2026-56391

Upstream fix:
  https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371

Signed-off-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3a18c6f1d701196c6acd6470aabf3ddb89aaf926)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../coreutils/coreutils/CVE-2026-56391.patch  | 66 +++++++++++++++++++
 meta/recipes-core/coreutils/coreutils_9.10.bb |  1 +
 2 files changed, 67 insertions(+)
 create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch

diff --git a/meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch b/meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch
new file mode 100644
index 00000000000..85745bf5722
--- /dev/null
+++ b/meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch
@@ -0,0 +1,66 @@
+From dadd37b60ca43b436a2287d28d6497bcc5bf4b9a Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Tue, 28 Apr 2026 11:25:00 -0700
+Subject: [PATCH] uniq: fix read overrun with -w
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Problem reported by Michał Majchrowicz.
+* src/uniq.c (find_field): Fix typo.
+* tests/uniq/uniq.pl (add_z_variants): Test for the bug.
+
+CVE: CVE-2026-56391
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371]
+
+Backport Changes:
+- The NEWS file has not been updated.
+
+Signed-off-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
+---
+ THANKS.in          | 1 +
+ src/uniq.c         | 4 ++--
+ tests/uniq/uniq.pl | 3 +++
+ 3 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/THANKS.in b/THANKS.in
+index 35fee75..5a2fd35 100644
+--- a/THANKS.in
++++ b/THANKS.in
+@@ -459,6 +459,7 @@ Michail Litvak                      mci@owl.openwall.com
+ Michal Politowski                   mpol@charybda.icm.edu.pl
+ Michal Svec                         msvec@suse.cz
+ Michal Trunecka                     mtruneck@redhat.com
++Michał Majchrowicz                  mmajchrowicz@afine.com
+ Michel Robitaille                   robitail@IRO.UMontreal.CA
+ Michiel Bacchiani                   bacchian@raven.bu.edu
+ Mike Castle                         dalgoda@ix.netcom.com
+diff --git a/src/uniq.c b/src/uniq.c
+index 3046359..5834596 100644
+--- a/src/uniq.c
++++ b/src/uniq.c
+@@ -285,8 +285,8 @@ find_field (struct linebuffer const *line, idx_t *plen)
+   else
+     {
+       char *ep = lp;
+-      for (idx_t i = check_chars; 0 < i && lp < lim; i--)
+-        ep += mcel_scan (lp, lim).len;
++      for (idx_t i = check_chars; 0 < i && ep < lim; i--)
++        ep += mcel_scan (ep, lim).len;
+       len = ep - lp;
+     }
+ 
+diff --git a/tests/uniq/uniq.pl b/tests/uniq/uniq.pl
+index b558fb3..0df7ec6 100755
+--- a/tests/uniq/uniq.pl
++++ b/tests/uniq/uniq.pl
+@@ -234,6 +234,9 @@ my @Tests =
+         "  - 'separate'\n" .
+         "  - 'both'\n" .
+         "Try '$prog --help' for more information.\n"}],
++ # Test for read buffer overrun.
++ do { my $longline = "\360\237\230\200" . "A" x 255 . "\n";
++      ['146', '-w256', {IN  => $longline x 2}, {OUT => $longline}] },
+ );
+ 
+ # Locale related tests
diff --git a/meta/recipes-core/coreutils/coreutils_9.10.bb b/meta/recipes-core/coreutils/coreutils_9.10.bb
index 8109244f446..abee8df192d 100644
--- a/meta/recipes-core/coreutils/coreutils_9.10.bb
+++ b/meta/recipes-core/coreutils/coreutils_9.10.bb
@@ -16,6 +16,7 @@ inherit autotools gettext texinfo
 SRC_URI = "${GNU_MIRROR}/coreutils/${BP}.tar.xz \
            file://remove-usr-local-lib-from-m4.patch \
            file://run-ptest \
+           file://CVE-2026-56391.patch \
            "
 SRC_URI[sha256sum] = "16535a9adf0b10037364e2d612aad3d9f4eca3a344949ced74d12faf4bd51d25"
 

[OE-core][wrynose 13/56] vim: Fix for CVE-2026-55693

[Yoann Congal]

From: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>

Pick the patch from [1], also referenced in the NVD report [2].

[1] https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-55693

Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../vim/files/CVE-2026-55693.patch            | 103 ++++++++++++++++++
 meta/recipes-support/vim/vim.inc              |   1 +
 2 files changed, 104 insertions(+)
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-55693.patch

diff --git a/meta/recipes-support/vim/files/CVE-2026-55693.patch b/meta/recipes-support/vim/files/CVE-2026-55693.patch
new file mode 100644
index 00000000000..cc302d2a18a
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-55693.patch
@@ -0,0 +1,103 @@
+From d64909ac1939bc91784de7f9b8d7705623d59f64 Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Mon, 15 Jun 2026 19:39:08 +0000
+Subject: [PATCH] patch 9.2.0653: [security]: out-of-bounds write in
+ tree_count_words()
+
+Problem:  [security]: a crafted spell file can drive tree_count_words()
+          past the end of its MAXWLEN-sized depth arrays; the descent
+          loop has no depth bound.
+Solution: only descend while depth < MAXWLEN - 1, as the sibling trie
+          walkers already do; apply the same guard to sug_filltree().
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq
+
+Supported by AI.
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7]
+CVE: CVE-2026-55693
+
+Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
+---
+ src/spellfile.c                |  4 ++--
+ src/testdir/test_spellfile.vim | 27 +++++++++++++++++++++++++++
+ src/version.c                  |  2 ++
+ 3 files changed, 31 insertions(+), 2 deletions(-)
+
+diff --git a/src/spellfile.c b/src/spellfile.c
+index 5102dad5b..b3ee9c0d6 100644
+--- a/src/spellfile.c
++++ b/src/spellfile.c
+@@ -642,7 +642,7 @@ tree_count_words(char_u *byts, idx_T *idxs)
+ 		    ++curi[depth];
+ 		}
+ 	    }
+-	    else
++	    else if (depth < MAXWLEN - 1)
+ 	    {
+ 		// Normal char, go one level deeper to count the words.
+ 		++depth;
+@@ -5656,7 +5656,7 @@ sug_filltree(spellinfo_T *spin, slang_T *slang)
+ 		    ++curi[depth];
+ 		}
+ 	    }
+-	    else
++	    else if (depth < MAXWLEN - 1)
+ 	    {
+ 		// Normal char, go one level deeper.
+ 		tword[depth++] = c;
+diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
+index 8f3ef4907..5b2ed4efd 100644
+--- a/src/testdir/test_spellfile.vim
++++ b/src/testdir/test_spellfile.vim
+@@ -1197,4 +1197,31 @@ func Test_mkspell_no_buffer_overflow()
+ endfunc
+ 
+ 
++func Test_spell_sug_tree_count_words_overflow()
++  " A crafted .spl/.sug pair with a BY_INDEX self-cycle in the fold word tree
++  " parses cleanly (shared refs aren't recursed, so read_tree_node()'s depth
++  " cap never trips), but drove tree_count_words() past its MAXWLEN-sized depth
++  " arrays -> stack out-of-bounds write.  The walk only happens when
++  " spellsuggest() loads the matching .sug.  Reaching the assert == no OOB.
++  call mkdir('Xrtp/spell', 'pR')
++  " VIMspell + v50, SN_SUGFILE(ts), SN_END, LWORDTREE{node:1,BY_INDEX->0,'A'},
++  " empty KWORDTREE/PREFIXTREE
++  let spl = eval('0z56494D7370656C6C320B0000000008000000001234'
++        \ .. '5678FF000000020101000000410000000000000000')
++  " VIMsug + v1, matching ts, SUGWORDTREE word "a", empty SUGTABLE
++  let sug = 0z56494D737567010000000012345678000000040161010000000000
++  call writefile(spl, 'Xrtp/spell/xx.utf-8.spl', 'b')
++  call writefile(sug, 'Xrtp/spell/xx.utf-8.sug', 'b')
++
++  new
++  set runtimepath+=./Xrtp
++  set spelllang=xx
++  set spell
++  " Unpatched: OOB write here (ASan abort, or crash).  Patched: returns a list.
++  call assert_equal(v:t_list, type(spellsuggest('helloo')))
++
++  set spell& spelllang& runtimepath&
++  bwipe!
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/version.c b/src/version.c
+index 6eac3fc92..e7f323854 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -736,6 +736,8 @@ static int included_patches[] =
+ {   /* Add new patch number below this line */
+ /**/
+     671,
++/**/
++    653,
+ /**/
+     662,
+ /**/
+-- 
+2.53.0
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 20a5f7a0546..4189817a8d7 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -29,6 +29,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
            file://CVE-2026-47167.patch \
            file://CVE-2026-55892.patch \
            file://CVE-2026-57452.patch \
+           file://CVE-2026-55693.patch \
            "
 
 PV .= ".0340"

[OE-core][wrynose 14/56] vim: Fix for CVE-2026-55895

[Yoann Congal]

From: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>

Pick the patch from [1], also referenced in the NVD report [2].

[1] https://github.com/vim/vim/commit/55bc757a5d436e59d50fe43f7cda94b118f86cb2
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-55895

Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../vim/files/CVE-2026-55895.patch            | 106 ++++++++++++++++++
 meta/recipes-support/vim/vim.inc              |   1 +
 2 files changed, 107 insertions(+)
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-55895.patch

diff --git a/meta/recipes-support/vim/files/CVE-2026-55895.patch b/meta/recipes-support/vim/files/CVE-2026-55895.patch
new file mode 100644
index 00000000000..6bfb8ee1245
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-55895.patch
@@ -0,0 +1,106 @@
+From 7c320315fab914a26bccfbbe6caf1a721897aa9c Mon Sep 17 00:00:00 2001
+From: Yasuhiro Matsumoto <mattn.jp@gmail.com>
+Date: Tue, 16 Jun 2026 21:00:28 +0000
+Subject: [PATCH] patch 9.2.0663: [security]: runtime(netrw): code injection in
+ local file deletion
+
+Problem:  [security]: s:NetrwLocalRmFile() escapes only the backslash in
+          the file name before passing it to :execute, so a name
+          containing "|" injects arbitrary Ex commands when the file is
+          deleted (cipher-creator)
+Solution: Use fnameescape() to correctly escape the file name
+          (Yasuhiro Matsumoto).
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-vhh8-v6wx-hjjh
+
+Supported by AI
+
+Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/55bc757a5d436e59d50fe43f7cda94b118f86cb2]
+CVE: CVE-2026-55895
+
+Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
+---
+ .../pack/dist/opt/netrw/autoload/netrw.vim    |  5 +++--
+ src/testdir/test_plugin_netrw.vim             | 20 +++++++++++++++++++
+ src/version.c                                 |  2 ++
+ 3 files changed, 25 insertions(+), 2 deletions(-)
+
+diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+index a04120d5f..d7eca30e4 100644
+--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim
++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+@@ -24,6 +24,7 @@
+ " 2026 Mar 01 by Vim Project include portnumber in hostname checking #19533
+ " 2026 Apr 01 by Vim Project use fnameescape() with netrw#FileUrlEdit()
+ " 2026 Apr 05 by Vim Project Fix netrw#RFC2396() #19913
++" 2026 Jun 16 by Vim Project Fix filename escaping in local file deletion
+ " Copyright:  Copyright (C) 2016 Charles E. Campbell {{{1
+ "             Permission is hereby granted to use and distribute this code,
+ "             with or without modifications, provided that this copyright
+@@ -3061,7 +3062,7 @@ function s:NetrwBrowse(islocal,dirname)
+     elseif !a:islocal && dirname !~ '[\/]$' && dirname !~ '^"'
+         " s:NetrwBrowse :  remote regular file handler {{{3
+         if bufname(dirname) != ""
+-            exe "NetrwKeepj b ".bufname(dirname)
++            exe "NetrwKeepj b ".fnameescape(bufname(dirname))
+         else
+             " attempt transfer of remote regular file
+ 
+@@ -8770,7 +8771,7 @@ function s:NetrwLocalRmFile(path, fname, all)
+             call netrw#msg#Notify('ERROR', printf("unable to delete <%s>!", rmfile))
+         else
+             " Remove file only if there are no pending changes
+-            execute printf('silent! bwipeout %s', rmfile)
++            execute printf('silent! bwipeout %s', fnameescape(rmfile))
+         endif
+ 
+     elseif dir && (all || empty(ok))
+diff --git a/src/testdir/test_plugin_netrw.vim b/src/testdir/test_plugin_netrw.vim
+index cfce82f68..a0a3915f5 100644
+--- a/src/testdir/test_plugin_netrw.vim
++++ b/src/testdir/test_plugin_netrw.vim
+@@ -674,4 +674,24 @@ func Test_netrw_injection()
+   endtry
+ endfunc
+ 
++" Deleting a file whose name contains an Ex command separator must not let the
++" name inject commands into the :execute in s:NetrwLocalRmFile().
++func Test_netrw_local_rm_injection()
++  CheckUnix
++  let dir   = getcwd() . '/Xnetrwrm'
++  let fname = "x|let g:injected = 1"
++  call mkdir(dir, 'pR')
++  call writefile([], dir . '/' . fname)
++  try
++    call netrw#Call('NetrwLocalRmFile', dir, fname, 1)
++    call assert_false(exists('g:injected'), 'filename must not inject Ex commands')
++    " The file is removed before the sink, so its absence also confirms the
++    " vulnerable code path was actually exercised (not skipped on an error).
++    call assert_false(filereadable(dir . '/' . fname), 'crafted file must be deleted')
++  finally
++    call delete(dir . '/' . fname)
++    unlet! g:injected
++  endtry
++endfunc
++
+ " vim:ts=8 sts=2 sw=2 et
+diff --git a/src/version.c b/src/version.c
+index e7f323854..16a8b140d 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -736,6 +736,8 @@ static int included_patches[] =
+ {   /* Add new patch number below this line */
+ /**/
+     671,
++/**/
++    663,
+ /**/
+     653,
+ /**/
+-- 
+2.53.0
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 4189817a8d7..48edfc694f0 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -30,6 +30,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
            file://CVE-2026-55892.patch \
            file://CVE-2026-57452.patch \
            file://CVE-2026-55693.patch \
+           file://CVE-2026-55895.patch \
            "
 
 PV .= ".0340"

[OE-core][wrynose 15/56] vim: Fix for CVE-2026-57451

[Yoann Congal]

From: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>

Pick the patch from [1], also referenced in the NVD report [2].

[1] https://github.com/vim/vim/commit/b2338ca90643e2f01ecb6547c1172716aaec4f79
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-57451

Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../vim/files/CVE-2026-57451.patch            | 192 ++++++++++++++++++
 meta/recipes-support/vim/vim.inc              |   1 +
 2 files changed, 193 insertions(+)
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-57451.patch

diff --git a/meta/recipes-support/vim/files/CVE-2026-57451.patch b/meta/recipes-support/vim/files/CVE-2026-57451.patch
new file mode 100644
index 00000000000..415ae0dd6c4
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-57451.patch
@@ -0,0 +1,192 @@
+From c3c95d56f5f800484b83aaf200dd393196774198 Mon Sep 17 00:00:00 2001
+From: Yasuhiro Matsumoto <mattn.jp@gmail.com>
+Date: Wed, 17 Jun 2026 21:06:59 +0000
+Subject: [PATCH] patch 9.2.0670: [security]: Out-of-bounds read with text
+ properties
+
+Problem:  [security]: Out-of-bounds read with text properties
+          (cipher-creator)
+Solution: Add out-of-bound checks (Yasuhiro Matsumoto)
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-f36c-2qcp-7gpw
+
+Supported by AI
+
+Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/b2338ca90643e2f01ecb6547c1172716aaec4f79]
+CVE: CVE-2026-57451
+
+Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
+---
+ src/memline.c                  |  7 ++++
+ src/proto/textprop.pro         |  1 +
+ src/testdir/test_textprop2.vim | 59 ++++++++++++++++++++++++++++++++++
+ src/textprop.c                 | 20 ++++++++++++
+ src/version.c                  |  2 ++
+ 5 files changed, 89 insertions(+)
+
+diff --git a/src/memline.c b/src/memline.c
+index c15946a6e..07c7a07d3 100644
+--- a/src/memline.c
++++ b/src/memline.c
+@@ -3796,6 +3796,11 @@ adjust_text_props_for_delete(
+ 		uint16_t pc;
+ 
+ 		mch_memmove(&pc, text + textlen, PROP_COUNT_SIZE);
++		if (!text_prop_count_valid(pc, (size_t)(line_size - (long)textlen)))
++		{
++		    internal_error("text property count too large");
++		    return;
++		}
+ 		this_props_len = pc * (int)sizeof(textprop_T);
+ 	    }
+ 
+@@ -4034,6 +4039,8 @@ theend:
+ 	mch_memmove(&pc, textprop_save, PROP_COUNT_SIZE);
+ 	props_data = textprop_save + PROP_COUNT_SIZE;
+ 	props_bytes = pc * (int)sizeof(textprop_T);
++	if (!text_prop_count_valid(pc, (size_t)textprop_len))
++	    props_bytes = 0;
+ 
+ 	// Adjust text properties in the line above and below.
+ 	if (lnum > 1)
+diff --git a/src/proto/textprop.pro b/src/proto/textprop.pro
+index d3ecf6d14..a01c2f3b2 100644
+--- a/src/proto/textprop.pro
++++ b/src/proto/textprop.pro
+@@ -35,4 +35,5 @@ void clear_buf_prop_types(buf_T *buf);
+ int adjust_prop_columns(linenr_T lnum, colnr_T col, int bytes_added, int flags);
+ void adjust_props_for_split(linenr_T lnum_props, linenr_T lnum_top, int kept, int deleted, int at_eol);
+ void prepend_joined_props(unpacked_memline_T *um, linenr_T lnum, int last_line, long col, int removed);
++bool text_prop_count_valid(int prop_count, size_t propdata_len);
+ /* vim: set ft=c : */
+diff --git a/src/testdir/test_textprop2.vim b/src/testdir/test_textprop2.vim
+index 193a80841..48387d1c0 100644
+--- a/src/testdir/test_textprop2.vim
++++ b/src/testdir/test_textprop2.vim
+@@ -428,4 +428,63 @@ func Test_multiline_prop_delete_penultimate_line()
+   call s:CleanupPropTypes(['1', '2', '3'])
+ endfunc
+ 
++func s:ManipulateUndoBlob(name)
++  " Patch the saved old line in the undo file:
++  "   00 00 00 08 'QQQQQQQQ'  ->  00 00 00 27 'AAAA' NUL count=0xFFFF <32x00>
++  " i.e. textlen 8 text-only  ->  39-byte blob: text "AAAA", NUL, prop_count
++  "   0xFFFF, one zeroed textprop_T(32).  propdata_len becomes 34, count 65535.
++  let blob   = readfile(a:name, 'B')
++  let marker = 0z000000085151515151515151
++  let repl   = 0z000000274141414100FFFF + repeat(0z00, 32)
++  let mlen   = len(marker)
++  let idx    = -1
++  let i      = 0
++  while i <= len(blob) - mlen
++    if blob[i : i + mlen - 1] ==# marker
++      let idx = i
++      break
++    endif
++    let i += 1
++  endwhile
++  call assert_true(idx >= 0, 'saved-line marker not found in undo file')
++
++  let head = idx > 0 ? blob[0 : idx - 1] : 0z
++  call writefile(head + repl + blob[idx + mlen :], a:name)
++
++  exe "rundo" a:name
++endfunc
++
++" A crafted undo file can restore a line whose declared text-property count is
++" far larger than the data, making get_text_props() / consumers read past the
++" line buffer.  Restore such a line and force a consumer; reaching the asserts
++" (no ASan abort / crash) means the count is bounded.
++func Test_textprop_undo_bad_prop_count()
++  CheckFeature persistent_undo
++
++  new
++  call setline(1, ['QQQQQQQQ', 'DECOYLINE'])
++  let &ul = &ul
++  call setline(1, 'BBBB')           " undo step saves old line 1 = "QQQQQQQQ"
++  wundo Xtpundo
++  call s:ManipulateUndoBlob('Xtpundo')
++
++  undo
++
++  " Safety: prove the malicious line was actually restored before the consumer
++  " runs, so the test can't pass vacuously if the patch missed.
++  call assert_equal('AAAA', getline(1))
++
++  " Adding a property anywhere sets b_has_textprop, so get_text_props() will
++  " actually inspect line 1 instead of returning early.
++  call prop_type_add('Xtp', {})
++  call prop_add(2, 1, {'type': 'Xtp', 'length': 1})
++
++  " this caused OOB read, now it triggers internal error
++  call assert_fails('call prop_list(1)', ['E340:', 'corrupted'])
++
++  call prop_type_delete('Xtp')
++  bwipe!
++  call delete('Xtpundo')
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/textprop.c b/src/textprop.c
+index 33165a8e4..6b0ce45f2 100644
+--- a/src/textprop.c
++++ b/src/textprop.c
+@@ -109,6 +109,12 @@ um_goto_line(unpacked_memline_T *um, linenr_T lnum, int extra_props)
+     char_u	    *props_start;
+ 
+     mch_memmove(&prop_count, count_ptr, PROP_COUNT_SIZE);
++    if (!text_prop_count_valid(prop_count, propdata_len))
++    {
++	iemsg(e_text_property_info_corrupted);
++	um->buf = NULL;
++	return false;
++    }
+     proplen = (int)prop_count;
+     props_start = count_ptr + PROP_COUNT_SIZE;
+ 
+@@ -1235,6 +1241,11 @@ get_text_props(buf_T *buf, linenr_T lnum, char_u **props, int will_change)
+ 	return 0;
+     }
+     mch_memmove(&prop_count, text + textlen, PROP_COUNT_SIZE);
++    if (!text_prop_count_valid(prop_count, propdata_len))
++    {
++	iemsg(e_text_property_info_corrupted);
++	return 0;
++    }
+     *props = text + textlen + PROP_COUNT_SIZE;
+     return (int)prop_count;
+ }
+@@ -3219,4 +3230,13 @@ prepend_joined_props(
+     um_abort(&r_um);
+ }
+ 
++    bool
++text_prop_count_valid(int prop_count, size_t propdata_len)
++{
++    if (propdata_len < PROP_COUNT_SIZE)
++	return false;
++    return (size_t)prop_count * sizeof(textprop_T)
++		    <= propdata_len - PROP_COUNT_SIZE;
++}
++
+ #endif // FEAT_PROP_POPUP
+diff --git a/src/version.c b/src/version.c
+index 16a8b140d..a216b9b01 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -736,6 +736,8 @@ static int included_patches[] =
+ {   /* Add new patch number below this line */
+ /**/
+     671,
++/**/
++    670,
+ /**/
+     663,
+ /**/
+-- 
+2.53.0
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 48edfc694f0..0fc3ae5df08 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -31,6 +31,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
            file://CVE-2026-57452.patch \
            file://CVE-2026-55693.patch \
            file://CVE-2026-55895.patch \
+           file://CVE-2026-57451.patch \
            "
 
 PV .= ".0340"

[OE-core][wrynose 16/56] vim: Fix for CVE-2026-57453

[Yoann Congal]

From: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>

Pick the patch from [1], also referenced in the NVD report [2].

[1] https://github.com/vim/vim/commit/b2cc9be119d51212bf0d3f2a99
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-57453

Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../vim/files/CVE-2026-57453.patch            | 269 ++++++++++++++++++
 meta/recipes-support/vim/vim.inc              |   1 +
 2 files changed, 270 insertions(+)
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-57453.patch

diff --git a/meta/recipes-support/vim/files/CVE-2026-57453.patch b/meta/recipes-support/vim/files/CVE-2026-57453.patch
new file mode 100644
index 00000000000..46959d715ac
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-57453.patch
@@ -0,0 +1,269 @@
+From e1e4a712cb53b6f674ade81ba1384a37a31f3061 Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Sat, 20 Jun 2026 15:35:58 +0000
+Subject: [PATCH] patch 9.2.0678: [security]: potential powershell code
+ execution in zip.vim
+
+Problem:  [security]: potential powershell code execution in zip.vim
+          (DDugs)
+Solution: Cleanup zip.vim, introduce PSEscape() to escape() potential powershell code,
+          use consistent s:Escape() in the various PowerShell functions
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-x5fg-h5w9-9frf
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/b2cc9be119d51212bf0d3f2a99]
+CVE: CVE-2026-57453
+
+Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
+---
+ runtime/autoload/zip.vim | 78 +++++++++++++++++++---------------------
+ runtime/doc/pi_zip.txt   | 12 +------
+ src/version.c            |  2 ++
+ 3 files changed, 39 insertions(+), 53 deletions(-)
+
+diff --git a/runtime/autoload/zip.vim b/runtime/autoload/zip.vim
+index f4482fd7f..8738a7f68 100644
+--- a/runtime/autoload/zip.vim
++++ b/runtime/autoload/zip.vim
+@@ -22,6 +22,7 @@
+ " 2026 Mar 08 by Vim Project: Make ZipUpdatePS() check for powershell
+ " 2026 Apr 01 by Vim Project: Detect more path traversal attacks
+ " 2026 Apr 05 by Vim Project: Detect more path traversal attacks
++" 2026 Jun 20 by Vim Project: Fix wrong escaping for the powershell calls
+ " License:	Vim License  (see vim's :help license)
+ " Copyright:	Copyright (C) 2005-2019 Charles E. Campbell {{{1
+ "		Permission is hereby granted to use and distribute this code,
+@@ -49,15 +50,6 @@ let s:NOTE           = 0
+ 
+ " ---------------------------------------------------------------------
+ "  Global Values: {{{1
+-if !exists("g:zip_shq")
+- if &shq != ""
+-  let g:zip_shq= &shq
+- elseif has("unix")
+-  let g:zip_shq= "'"
+- else
+-  let g:zip_shq= '"'
+- endif
+-endif
+ if !exists("g:zip_zipcmd")
+  let g:zip_zipcmd= "zip"
+ endif
+@@ -133,7 +125,7 @@ function! s:ZipBrowsePS(zipfile)
+   " Browse the contents of a zip file using PowerShell's
+   " Equivalent `unzip -Z1 -- zipfile`
+   let cmds = [
+-        \ '$zip = [System.IO.Compression.ZipFile]::OpenRead(' . s:Escape(a:zipfile, 1) . ');',
++        \ '$zip = [System.IO.Compression.ZipFile]::OpenRead(' . s:PSEscape(a:zipfile) . ');',
+         \ '$zip.Entries | ForEach-Object { $_.FullName };',
+         \ '$zip.Dispose()'
+         \ ]
+@@ -147,16 +139,16 @@ function! s:ZipReadPS(zipfile, fname, tempfile)
+     call s:Mess('WarningMsg', "***warning*** PowerShell can display, but cannot update, files in archive subfolders")
+   endif
+   let cmds = [
+-        \ '$zip = [System.IO.Compression.ZipFile]::OpenRead(' . s:Escape(a:zipfile, 1) . ');',
+-        \ '$fileEntry = $zip.Entries | Where-Object { $_.FullName -eq ' . s:Escape(a:fname, 1) . ' };',
++        \ '$zip = [System.IO.Compression.ZipFile]::OpenRead(' . s:PSEscape(a:zipfile) . ');',
++        \ '$fileEntry = $zip.Entries | Where-Object { $_.FullName -eq ' . s:PSEscape(a:fname) . ' };',
+         \ '$stream = $fileEntry.Open();',
+-        \ '$fileStream = [System.IO.File]::Create(' . s:Escape(a:tempfile, 1) . ');',
++        \ '$fileStream = [System.IO.File]::Create(' . s:PSEscape(a:tempfile) . ');',
+         \ '$stream.CopyTo($fileStream);',
+         \ '$fileStream.Close();',
+         \ '$stream.Close();',
+         \ '$zip.Dispose()'
+         \ ]
+-  return 'pwsh -NoProfile -Command ' . s:Escape(join(cmds, ' '), 1)
++  return 'pwsh -NoProfile -Command ' . s:Escape(join(cmds, ' '))
+ endfunction
+ 
+ function! s:ZipUpdatePS(zipfile, fname)
+@@ -166,7 +158,7 @@ function! s:ZipUpdatePS(zipfile, fname)
+     call s:Mess('Error', "***error*** PowerShell cannot update files in archive subfolders")
+     return ':'
+   endif
+-  return 'Compress-Archive -Path ' . a:fname . ' -Update -DestinationPath ' . a:zipfile
++  return 'Compress-Archive -Path ' . s:PSEscape(a:fname) . ' -Update -DestinationPath ' . s:PSEscape(a:zipfile)
+ endfunction
+ 
+ function! s:ZipExtractFilePS(zipfile, fname)
+@@ -177,16 +169,16 @@ function! s:ZipExtractFilePS(zipfile, fname)
+     return ':'
+   endif
+   let cmds = [
+-        \ '$zip = [System.IO.Compression.ZipFile]::OpenRead(' . s:Escape(a:zipfile, 1) . ');',
+-        \ '$fileEntry = $zip.Entries | Where-Object { $_.FullName -eq ' . a:fname . ' };',
++        \ '$zip = [System.IO.Compression.ZipFile]::OpenRead(' . s:PSEscape(a:zipfile) . ');',
++        \ '$fileEntry = $zip.Entries | Where-Object { $_.FullName -eq ' . s:PSEscape(a:fname) . ' };',
+         \ '$stream = $fileEntry.Open();',
+-        \ '$fileStream = [System.IO.File]::Create(' . a:fname . ');',
++        \ '$fileStream = [System.IO.File]::Create(' . s:PSEscape(a:fname) . ');',
+         \ '$stream.CopyTo($fileStream);',
+         \ '$fileStream.Close();',
+         \ '$stream.Close();',
+         \ '$zip.Dispose()'
+         \ ]
+-  return 'pwsh -NoProfile -Command ' . s:Escape(join(cmds, ' '), 1)
++  return 'pwsh -NoProfile -Command ' . s:Escape(join(cmds, ' '))
+ endfunction
+ 
+ function! s:ZipDeleteFilePS(zipfile, fname)
+@@ -194,12 +186,12 @@ function! s:ZipDeleteFilePS(zipfile, fname)
+   " Equivalent to `zip -d zipfile fname`
+   let cmds = [
+         \ 'Add-Type -AssemblyName System.IO.Compression.FileSystem;',
+-        \ '$zip = [System.IO.Compression.ZipFile]::Open(' . s:Escape(a:zipfile, 1) . ', ''Update'');',
+-        \ '$entry = $zip.Entries | Where-Object { $_.Name -eq ' . s:Escape(a:fname, 1) . ' };',
++        \ '$zip = [System.IO.Compression.ZipFile]::Open(' . s:PSEscape(a:zipfile) . ', ''Update'');',
++        \ '$entry = $zip.Entries | Where-Object { $_.Name -eq ' . s:PSEscape(a:fname) . ' };',
+         \ 'if ($entry) { $entry.Delete(); $zip.Dispose() }',
+         \ 'else { $zip.Dispose() }'
+         \ ]
+-  return 'pwsh -NoProfile -Command ' . s:Escape(join(cmds, ' '), 1)
++  return 'pwsh -NoProfile -Command ' . s:Escape(join(cmds, ' '))
+ endfunction
+ 
+ " ----------------
+@@ -339,9 +331,9 @@ fun! zip#Read(fname,mode)
+   let temp = tempname()
+   let fn   = expand('%:p')
+ 
+-  let gnu_cmd = g:zip_unzipcmd . ' -p -- ' . s:Escape(zipfile, 0) . ' ' . s:Escape(fname, 0) . ' > ' . s:Escape(temp, 0)
+-  let gnu_cmd = 'call system(''' . substitute(gnu_cmd, "'", "''", 'g') . ''')'
+-  let ps_cmd = 'sil !' . s:ZipReadPS(zipfile, fname, temp)
++  let gnu_cmd = g:zip_unzipcmd . ' -p -- ' . s:Escape(zipfile) . ' ' . s:Escape(fname) . ' > ' . s:Escape(temp)
++  let gnu_cmd = 'call system(' . string(gnu_cmd) . ')'
++  let ps_cmd = 'call system(' . string(s:ZipReadPS(zipfile, fname, temp)) . ')'
+   call s:TryExecGnuFallBackToPs(g:zip_unzipcmd, gnu_cmd, ps_cmd)
+ 
+   sil exe 'keepalt file '.temp
+@@ -408,9 +400,9 @@ fun! zip#Write(fname)
+     " TODO: what to check on MS-Windows to avoid writing absolute paths?
+   endif
+   if fname =~ '^[.]\{1,2}/'
+-    let gnu_cmd = g:zip_zipcmd . ' -d ' . s:Escape(fnamemodify(zipfile,":p"),0) . ' ' . s:Escape(fname,0)
+-    let gnu_cmd = 'call system(''' . substitute(gnu_cmd, "'", "''", 'g') . ''')'
+-    let ps_cmd = $"call system({s:Escape(s:ZipDeleteFilePS(zipfile, fname), 1)})"
++    let gnu_cmd = g:zip_zipcmd . ' -d ' . s:Escape(fnamemodify(zipfile,":p")) . ' ' . s:Escape(fname)
++    let gnu_cmd = 'call system(' . string(gnu_cmd) . ')'
++    let ps_cmd = $"call system({string(s:ZipDeleteFilePS(zipfile, fname))})"
+     call s:TryExecGnuFallBackToPs(g:zip_zipcmd, gnu_cmd, ps_cmd)
+     let fname = fname->substitute('^\([.]\{1,2}/\)\+', '', 'g')
+     let need_rename = 1
+@@ -419,7 +411,7 @@ fun! zip#Write(fname)
+   if fname =~ '/'
+     let dirpath = substitute(fname,'/[^/]\+$','','e')
+     if has("win32unix") && executable("cygpath")
+-    let dirpath = substitute(system("cygpath ".s:Escape(dirpath,0)),'\n','','e')
++    let dirpath = substitute(system("cygpath ".s:Escape(dirpath)),'\n','','e')
+     endif
+     call mkdir(dirpath,"p")
+   endif
+@@ -430,16 +422,17 @@ fun! zip#Write(fname)
+   " don't overwrite files forcefully
+   exe "w ".fnameescape(fname)
+   if has("win32unix") && executable("cygpath")
+-    let zipfile = substitute(system("cygpath ".s:Escape(zipfile,0)),'\n','','e')
++    let zipfile = substitute(system("cygpath ".s:Escape(zipfile)),'\n','','e')
+   endif
+ 
+   if (has("win32") || has("win95") || has("win64") || has("win16")) && &shell !~? 'sh$'
+     let fname = substitute(fname, '[', '[[]', 'g')
+   endif
+ 
+-  let gnu_cmd = g:zip_zipcmd . ' -u '. s:Escape(fnamemodify(zipfile,":p"),0) . ' ' . s:Escape(fname,0)
++  let gnu_cmd = g:zip_zipcmd . ' -u '. s:Escape(fnamemodify(zipfile,":p")) . ' ' . s:Escape(fname)
+   let gnu_cmd = 'call system(''' . substitute(gnu_cmd, "'", "''", 'g') . ''')'
+-  let ps_cmd = s:ZipUpdatePS(s:Escape(fnamemodify(zipfile, ':p'), 0), s:Escape(fname, 0))
++  let zip = fnamemodify(zipfile, ':p')
++  let ps_cmd = s:ZipUpdatePS(zip, fname)
+   let ps_cmd = 'call system(''' . substitute(ps_cmd, "'", "''", 'g') . ''')'
+   call s:TryExecGnuFallBackToPs(g:zip_zipcmd, gnu_cmd, ps_cmd)
+   if &shell =~ 'pwsh'
+@@ -522,8 +515,8 @@ fun! zip#Extract()
+ 
+   " extract the file mentioned under the cursor
+   let gnu_cmd = g:zip_extractcmd . ' -o '. shellescape(b:zipfile) . ' ' . target
+-  let gnu_cmd = 'call system(''' . substitute(gnu_cmd, "'", "''", 'g') . ''')'
+-  let ps_cmd = $"call system({s:Escape(s:ZipExtractFilePS(b:zipfile, target), 1)})"
++  let gnu_cmd = 'call system(' . string(gnu_cmd) . ')'
++  let ps_cmd = 'call system(' . string(s:ZipExtractFilePS(b:zipfile, fname)) . ')'
+   call s:TryExecGnuFallBackToPs(g:zip_extractcmd, gnu_cmd, ps_cmd)
+ 
+   if v:shell_error != 0
+@@ -537,19 +530,20 @@ endfun
+ 
+ " ---------------------------------------------------------------------
+ " s:Escape: {{{2
+-fun! s:Escape(fname,isfilt)
+-  if exists("*shellescape")
+-   if a:isfilt
+-    let qnameq= shellescape(a:fname,1)
+-   else
+-    let qnameq= shellescape(a:fname)
+-   endif
++fun! s:Escape(fname, isfilt = 0)
++  if a:isfilt
++   let qnameq = shellescape(a:fname, 1)
+   else
+-   let qnameq= g:zip_shq.escape(a:fname,g:zip_shq).g:zip_shq
++   let qnameq = shellescape(a:fname)
+   endif
+   return qnameq
+ endfun
+ 
++" s:PSEscape: Escape a string for Powershell, shellescape() does not work here {{{2
++fun! s:PSEscape(str)
++  return "'" .. substitute(a:str, "'", "''", 'g') .. "'"
++endfun
++
+ " ---------------------------------------------------------------------
+ " s:ChgDir: {{{2
+ fun! s:ChgDir(newdir,errlvl,errmsg)
+diff --git a/runtime/doc/pi_zip.txt b/runtime/doc/pi_zip.txt
+index e9294b405..67c37721f 100644
+--- a/runtime/doc/pi_zip.txt
++++ b/runtime/doc/pi_zip.txt
+@@ -1,4 +1,4 @@
+-*pi_zip.txt*	For Vim version 9.2.  Last change: 2026 Apr 05
++*pi_zip.txt*	For Vim version 9.2.  Last change: 2026 Jun 20
+ 
+ 				+====================+
+ 				| Zip File Interface |
+@@ -48,16 +48,6 @@ Copyright: Copyright (C) 2005-2015 Charles E Campbell	 *zip-copyright*
+    If this variable exists and is true, the file window will not be
+    automatically maximized when opened.
+ 
+-							*g:zip_shq*
+-   Different operating systems may use one or more shells to execute
+-   commands.  Zip will try to guess the correct quoting mechanism to
+-   allow spaces and whatnot in filenames; however, if it is incorrectly
+-   guessing the quote to use for your setup, you may use >
+-	g:zip_shq
+-<   which by default is a single quote under Unix (') and a double quote
+-   under Windows (").  If you'd rather have no quotes, simply set
+-   g:zip_shq to the empty string (let g:zip_shq= "") in your <.vimrc>.
+-
+ 							*g:zip_unzipcmd*
+    Use this option to specify the program which does the duty of "unzip".
+    It's used during browsing. By default: >
+diff --git a/src/version.c b/src/version.c
+index a216b9b01..4d6908426 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -734,6 +734,8 @@ static char *(features[]) =
+ 
+ static int included_patches[] =
+ {   /* Add new patch number below this line */
++/**/
++    678,
+ /**/
+     671,
+ /**/
+-- 
+2.53.0
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 0fc3ae5df08..56a2004899a 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -32,6 +32,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
            file://CVE-2026-55693.patch \
            file://CVE-2026-55895.patch \
            file://CVE-2026-57451.patch \
+           file://CVE-2026-57453.patch \
            "
 
 PV .= ".0340"

[OE-core][wrynose 17/56] vim: Fix for CVE-2026-57454

[Yoann Congal]

From: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>

Pick the patch from [1], also referenced in the NVD report [2].

[1] https://github.com/vim/vim/commit/b3faeecc976d3031d7c0675623516ec60c30f949
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-57454

Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../vim/files/CVE-2026-57454.patch            | 203 ++++++++++++++++++
 meta/recipes-support/vim/vim.inc              |   1 +
 2 files changed, 204 insertions(+)
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-57454.patch

diff --git a/meta/recipes-support/vim/files/CVE-2026-57454.patch b/meta/recipes-support/vim/files/CVE-2026-57454.patch
new file mode 100644
index 00000000000..00af91067bf
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-57454.patch
@@ -0,0 +1,203 @@
+From a3eac666d37ccedb32ad3b0a6b86882208eb6b50 Mon Sep 17 00:00:00 2001
+From: Hirohito Higashi <h.east.727@gmail.com>
+Date: Sat, 20 Jun 2026 16:06:58 +0000
+Subject: [PATCH] patch 9.2.0679: [security]: Out-of-bounds read with text
+ property virtual text
+
+Problem:  [security]: Out-of-bounds read with text property virtual text.
+          A crafted undo file can declare a virtual-text property whose
+          offset points outside the line's property data, so reading the
+          virtual text reads out of bounds.  This completes the count-only
+          check added in 9.2.0670.
+Solution: Validate the virtual-text offset and length of each property
+          against the available property data before turning the offset
+          into a pointer.
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-ww8h-47xp-hp4w
+
+Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/b3faeecc976d3031d7c0675623516ec60c30f949]
+CVE: CVE-2026-57454
+
+Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
+---
+ src/proto/textprop.pro         |  1 +
+ src/testdir/test_textprop2.vim | 60 ++++++++++++++++++++++++++++++----
+ src/textprop.c                 | 36 ++++++++++++++++++++
+ src/version.c                  |  2 ++
+ 4 files changed, 92 insertions(+), 7 deletions(-)
+
+diff --git a/src/proto/textprop.pro b/src/proto/textprop.pro
+index a01c2f3b2..4e6fcc89a 100644
+--- a/src/proto/textprop.pro
++++ b/src/proto/textprop.pro
+@@ -36,4 +36,5 @@ int adjust_prop_columns(linenr_T lnum, colnr_T col, int bytes_added, int flags);
+ void adjust_props_for_split(linenr_T lnum_props, linenr_T lnum_top, int kept, int deleted, int at_eol);
+ void prepend_joined_props(unpacked_memline_T *um, linenr_T lnum, int last_line, long col, int removed);
+ bool text_prop_count_valid(int prop_count, size_t propdata_len);
++bool text_prop_vtext_valid(char_u *props, int prop_count, size_t propdata_len);
+ /* vim: set ft=c : */
+diff --git a/src/testdir/test_textprop2.vim b/src/testdir/test_textprop2.vim
+index 48387d1c0..5f8f87e29 100644
+--- a/src/testdir/test_textprop2.vim
++++ b/src/testdir/test_textprop2.vim
+@@ -428,14 +428,12 @@ func Test_multiline_prop_delete_penultimate_line()
+   call s:CleanupPropTypes(['1', '2', '3'])
+ endfunc
+ 
+-func s:ManipulateUndoBlob(name)
+-  " Patch the saved old line in the undo file:
+-  "   00 00 00 08 'QQQQQQQQ'  ->  00 00 00 27 'AAAA' NUL count=0xFFFF <32x00>
+-  " i.e. textlen 8 text-only  ->  39-byte blob: text "AAAA", NUL, prop_count
+-  "   0xFFFF, one zeroed textprop_T(32).  propdata_len becomes 34, count 65535.
++func s:ManipulateUndoBlob(name, repl)
++  " Replace the saved old line (00 00 00 08 'QQQQQQQQ') in the undo file with
++  " the crafted "repl" blob, then read it back in.
+   let blob   = readfile(a:name, 'B')
+   let marker = 0z000000085151515151515151
+-  let repl   = 0z000000274141414100FFFF + repeat(0z00, 32)
++  let repl   = a:repl
+   let mlen   = len(marker)
+   let idx    = -1
+   let i      = 0
+@@ -466,7 +464,10 @@ func Test_textprop_undo_bad_prop_count()
+   let &ul = &ul
+   call setline(1, 'BBBB')           " undo step saves old line 1 = "QQQQQQQQ"
+   wundo Xtpundo
+-  call s:ManipulateUndoBlob('Xtpundo')
++  " 39-byte blob: "AAAA" NUL count=0xFFFF, one zeroed textprop_T(32).
++  " propdata_len becomes 34 while the count claims 65535 properties.
++  call s:ManipulateUndoBlob('Xtpundo', 0z000000274141414100FFFF
++	\ + repeat(0z00, 32))
+ 
+   undo
+ 
+@@ -487,4 +488,49 @@ func Test_textprop_undo_bad_prop_count()
+   call delete('Xtpundo')
+ endfunc
+ 
++" A crafted undo file can restore a line whose virtual-text property declares an
++" out-of-range tp_text_offset.  Turning that offset into a pointer and reading
++" the virtual text would read past the line buffer.  Restore such a line and
++" force a consumer; reaching the asserts (no ASan abort / crash) means the
++" offset is bounded.
++func Test_textprop_undo_bad_vtext_offset()
++  CheckFeature persistent_undo
++
++  new
++  call setline(1, ['QQQQQQQQ', 'DECOYLINE'])
++  let &ul = &ul
++  call setline(1, 'BBBB')           " undo step saves old line 1 = "QQQQQQQQ"
++  wundo Xtpundo
++
++  " One textprop_T for a virtual text prop (tp_id < 0) whose tp_text_offset
++  " (0x00100000) points far past the 34-byte property data.  The count (1) is
++  " valid, so only the offset/length check can reject this.
++  let prop  = 0z01000000          " tp_col = 1
++  let prop += 0z04000000          " tp_len = 4
++  let prop += 0zFFFFFFFF          " tp_id = -1 (virtual text)
++  let prop += 0z00000000          " tp_type = 0
++  let prop += 0z00000000          " tp_flags = 0
++  let prop += 0z00000000          " tp_padleft = 0
++  let prop += 0z00001000          " u.tp_text_offset = 0x00100000
++  let prop += 0z00000000          " union upper bytes
++  call s:ManipulateUndoBlob('Xtpundo', 0z000000274141414100 + 0z0100 + prop)
++
++  undo
++
++  " Safety: prove the malicious line was actually restored before the consumer
++  " runs, so the test can't pass vacuously if the patch missed.
++  call assert_equal('AAAA', getline(1))
++
++  call prop_type_add('Xtp', {})
++  call prop_add(2, 1, {'type': 'Xtp', 'length': 1})
++
++  " this caused OOB read, now it is rejected as a corrupted (untrusted) undo
++  " file with a catchable error
++  call assert_fails('call prop_list(1)', 'E967:')
++
++  call prop_type_delete('Xtp')
++  bwipe!
++  call delete('Xtpundo')
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/textprop.c b/src/textprop.c
+index 6b0ce45f2..5959ecc45 100644
+--- a/src/textprop.c
++++ b/src/textprop.c
+@@ -118,6 +118,13 @@ um_goto_line(unpacked_memline_T *um, linenr_T lnum, int extra_props)
+     proplen = (int)prop_count;
+     props_start = count_ptr + PROP_COUNT_SIZE;
+ 
++    if (!text_prop_vtext_valid(props_start, proplen, propdata_len))
++    {
++	emsg(e_text_property_info_corrupted);
++	um->buf = NULL;
++	return false;
++    }
++
+     um->props = ALLOC_MULT(textprop_T, proplen + extra_props);
+     if (um->props == NULL)
+     {
+@@ -1246,6 +1253,12 @@ get_text_props(buf_T *buf, linenr_T lnum, char_u **props, int will_change)
+ 	iemsg(e_text_property_info_corrupted);
+ 	return 0;
+     }
++    if (!text_prop_vtext_valid(text + textlen + PROP_COUNT_SIZE,
++					   (int)prop_count, propdata_len))
++    {
++	emsg(e_text_property_info_corrupted);
++	return 0;
++    }
+     *props = text + textlen + PROP_COUNT_SIZE;
+     return (int)prop_count;
+ }
+@@ -3239,4 +3252,27 @@ text_prop_count_valid(int prop_count, size_t propdata_len)
+ 		    <= propdata_len - PROP_COUNT_SIZE;
+ }
+ 
++/*
++ * Return true when every virtual text property's offset and length stay within
++ * "propdata_len", so tp_text_offset can be safely turned into a pointer.
++ * "props" may be unaligned.
++ */
++    bool
++text_prop_vtext_valid(char_u *props, int prop_count, size_t propdata_len)
++{
++    for (int i = 0; i < prop_count; ++i)
++    {
++	textprop_T  prop;
++
++	mch_memmove(&prop, props + (size_t)i * sizeof(textprop_T),
++							  sizeof(textprop_T));
++	if (prop.tp_id >= 0 || prop.u.tp_text_offset <= 0)
++	    continue;
++	if (prop.tp_len < 0 || (size_t)prop.u.tp_text_offset
++				+ (size_t)prop.tp_len + 1 > propdata_len)
++	    return false;
++    }
++    return true;
++}
++
+ #endif // FEAT_PROP_POPUP
+diff --git a/src/version.c b/src/version.c
+index 4d6908426..80d3cc7f5 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -734,6 +734,8 @@ static char *(features[]) =
+ 
+ static int included_patches[] =
+ {   /* Add new patch number below this line */
++/**/
++    679,
+ /**/
+     678,
+ /**/
+-- 
+2.53.0
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 56a2004899a..93b8ba39700 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -33,6 +33,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
            file://CVE-2026-55895.patch \
            file://CVE-2026-57451.patch \
            file://CVE-2026-57453.patch \
+           file://CVE-2026-57454.patch \
            "
 
 PV .= ".0340"

[OE-core][wrynose 18/56] vim: Fix for CVE-2026-57455

[Yoann Congal]

From: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>

Pick the patch from [1], also referenced in the NVD report [2].

[1] https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-57455

Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../vim/files/CVE-2026-57455.patch            | 87 +++++++++++++++++++
 meta/recipes-support/vim/vim.inc              |  1 +
 2 files changed, 88 insertions(+)
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-57455.patch

diff --git a/meta/recipes-support/vim/files/CVE-2026-57455.patch b/meta/recipes-support/vim/files/CVE-2026-57455.patch
new file mode 100644
index 00000000000..8b5bd0e0e8b
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-57455.patch
@@ -0,0 +1,87 @@
+From f2744f3810cee1c63850e58f85cda299a2c20ce3 Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Sun, 21 Jun 2026 19:20:03 +0000
+Subject: [PATCH] patch 9.2.0698: [security]: Out-of-bounds write with
+ soundfold()
+
+Problem:  [security]: Out-of-bounds write with soundfold()
+          (cipher-creator)
+Solution: Add an abort condition to the for loop to validate the buffer
+          size.
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4
+
+Supported by AI
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b]
+CVE: CVE-2026-57455
+
+Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
+---
+ src/spell.c                    |  2 +-
+ src/testdir/test_spellfile.vim | 21 +++++++++++++++++++++
+ src/version.c                  |  2 ++
+ 3 files changed, 24 insertions(+), 1 deletion(-)
+
+diff --git a/src/spell.c b/src/spell.c
+index 72d1f0b52..e0fc17bfb 100644
+--- a/src/spell.c
++++ b/src/spell.c
+@@ -3270,7 +3270,7 @@ spell_soundfold_sofo(slang_T *slang, char_u *inword, char_u *res)
+     else
+     {
+ 	// The sl_sal_first[] table contains the translation.
+-	for (s = inword; (c = *s) != NUL; ++s)
++	for (s = inword; (c = *s) != NUL && ri < MAXWLEN - 1; ++s)
+ 	{
+ 	    if (VIM_ISWHITE(c))
+ 		c = ' ';
+diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
+index 5b2ed4efd..50afe3dfa 100644
+--- a/src/testdir/test_spellfile.vim
++++ b/src/testdir/test_spellfile.vim
+@@ -1224,4 +1224,25 @@ func Test_spell_sug_tree_count_words_overflow()
+   bwipe!
+ endfunc
+ 
++" A word longer than MAXWLEN must not overflow the soundfold result buffer in
++" the single-byte SOFO branch of spell_soundfold_sofo().
++func Test_soundfold_overflow()
++  let _enc=&enc
++  set enc=latin1
++  call writefile(['SOFOFROM ab', 'SOFOTO xy'], 'Xtest.aff', 'D')
++  call writefile(['1', 'foo'], 'Xtest.dic', 'D')
++  mkspell! Xtest Xtest
++  defer delete('Xtest.latin1.spl')
++  defer delete('Xtest.latin1.sug')
++  setl spelllang=Xtest.latin1.spl spell
++
++  " Before the fix the copy loop wrote one byte per input byte into a
++  " MAXWLEN (254) stack buffer with no upper bound, smashing the stack.
++  let sound = soundfold(repeat('ab', 300))
++  call assert_true(strlen(sound) < 254, 'soundfold result exceeds MAXWLEN')
++
++  set spell& spelllang&
++  let &enc = _enc
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/version.c b/src/version.c
+index 80d3cc7f5..d3b72595f 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -734,6 +734,8 @@ static char *(features[]) =
+ 
+ static int included_patches[] =
+ {   /* Add new patch number below this line */
++/**/
++    698,
+ /**/
+     679,
+ /**/
+-- 
+2.53.0
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 93b8ba39700..8c5a5e88a9c 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -34,6 +34,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
            file://CVE-2026-57451.patch \
            file://CVE-2026-57453.patch \
            file://CVE-2026-57454.patch \
+           file://CVE-2026-57455.patch \
            "
 
 PV .= ".0340"

[OE-core][wrynose 19/56] vim: Fix for CVE-2026-57456

[Yoann Congal]

From: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>

Pick the patch from [1], also referenced in the NVD report [2].

[1] https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-57456

Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../vim/files/CVE-2026-57456.patch            | 164 ++++++++++++++++++
 meta/recipes-support/vim/vim.inc              |   1 +
 2 files changed, 165 insertions(+)
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-57456.patch

diff --git a/meta/recipes-support/vim/files/CVE-2026-57456.patch b/meta/recipes-support/vim/files/CVE-2026-57456.patch
new file mode 100644
index 00000000000..253fff486d5
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-57456.patch
@@ -0,0 +1,164 @@
+From 88a735ff4fa7ff269ba4ca94a44e8cdaefa5df28 Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Sun, 21 Jun 2026 19:50:56 +0000
+Subject: [PATCH] patch 9.2.0699: [security]: possible code execution with
+ python complete
+
+Problem:  [security]: possible code execution with python complete
+          (morningbread)
+Solution: Use repr() to quote the doc strings correctly
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3
+
+Supported by AI
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8]
+CVE: CVE-2026-57456
+
+Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
+---
+ runtime/autoload/python3complete.vim        |  9 +++++----
+ runtime/autoload/pythoncomplete.vim         |  9 +++++----
+ src/testdir/test_plugin_python3complete.vim | 15 +++++++++++++++
+ src/version.c                               |  2 ++
+ 4 files changed, 27 insertions(+), 8 deletions(-)
+
+diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim
+index c4ef19d82..f90cca74b 100644
+--- a/runtime/autoload/python3complete.vim
++++ b/runtime/autoload/python3complete.vim
+@@ -2,7 +2,7 @@
+ " Maintainer: <vacancy>
+ " Previous Maintainer: Aaron Griffin <aaronmgriffin@gmail.com>
+ " Version: 0.10
+-" Last Updated: 2026 Jun 04
++" Last Updated: 2026 Jun 21
+ "
+ " Roland Puntaier: this file contains adaptations for python3 and is parallel to pythoncomplete.vim
+ "
+@@ -22,6 +22,7 @@
+ "     previous code passed buffer-supplied expressions to exec() which
+ "     Python evaluates at definition time, allowing arbitrary code
+ "     execution via crafted def/class headers
++"   * use repr() on doc strings to prevent code execution
+ "
+ " v 0.9
+ "   * Fixed docstring parsing for classes and functions
+@@ -335,7 +336,7 @@ class Scope(object):
+ 
+     def get_code(self):
+         str = ""
+-        if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
++        if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
+         str += 'class _PyCmplNoType:\n    def __getattr__(self,name):\n        return None\n'
+         for sub in self.subscopes:
+             str += sub.get_code()
+@@ -378,7 +379,7 @@ class Class(Scope):
+                        if _DOTTED_NAME_RE.match(s.strip())]
+         if len(safe_supers) > 0: str += '(%s)' % ','.join(safe_supers)
+         str += ':\n'
+-        if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
++        if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
+         if len(self.subscopes) > 0:
+             for s in self.subscopes: str += s.get_code()
+         else:
+@@ -401,7 +402,7 @@ class Function(Scope):
+         safe_params = [p for p in safe_params if p]
+         str = "%sdef %s(%s):\n" % \
+             (self.currentindent(),self.name,','.join(safe_params))
+-        if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
++        if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
+         str += "%spass\n" % self.childindent()
+         return str
+ 
+diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim
+index 39b1efd29..d2f5d57b0 100644
+--- a/runtime/autoload/pythoncomplete.vim
++++ b/runtime/autoload/pythoncomplete.vim
+@@ -2,7 +2,7 @@
+ " Maintainer: <vacancy>
+ " Previous Maintainer: Aaron Griffin <aaronmgriffin@gmail.com>
+ " Version: 0.10
+-" Last Updated: 2026 Jun 04
++" Last Updated: 2026 Jun 21
+ "
+ " Changes
+ " TODO:
+@@ -20,6 +20,7 @@
+ "     previous code passed buffer-supplied expressions to exec() which
+ "     Python evaluates at definition time, allowing arbitrary code
+ "     execution via crafted def/class headers
++"   * use repr() on doc strings to prevent code execution
+ "
+ " v 0.9
+ "   * Fixed docstring parsing for classes and functions
+@@ -350,7 +351,7 @@ class Scope(object):
+ 
+     def get_code(self):
+         str = ""
+-        if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
++        if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
+         str += 'class _PyCmplNoType:\n    def __getattr__(self,name):\n        return None\n'
+         for sub in self.subscopes:
+             str += sub.get_code()
+@@ -393,7 +394,7 @@ class Class(Scope):
+                        if _DOTTED_NAME_RE.match(s.strip())]
+         if len(safe_supers) > 0: str += '(%s)' % ','.join(safe_supers)
+         str += ':\n'
+-        if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
++        if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
+         if len(self.subscopes) > 0:
+             for s in self.subscopes: str += s.get_code()
+         else:
+@@ -416,7 +417,7 @@ class Function(Scope):
+         safe_params = [p for p in safe_params if p]
+         str = "%sdef %s(%s):\n" % \
+             (self.currentindent(),self.name,','.join(safe_params))
+-        if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
++        if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
+         str += "%spass\n" % self.childindent()
+         return str
+ 
+diff --git a/src/testdir/test_plugin_python3complete.vim b/src/testdir/test_plugin_python3complete.vim
+index e2b0c6616..590348ee4 100644
+--- a/src/testdir/test_plugin_python3complete.vim
++++ b/src/testdir/test_plugin_python3complete.vim
+@@ -221,4 +221,19 @@ func Test_python3complete_allow_import_on_runs_imports()
+         \ 'g:pythoncomplete_allow_import=1 did not run the buffer import')
+ endfunc
+ 
++func Test_python3complete_no_exec_via_class_docstring()
++  " A class-body docstring is emitted verbatim between triple quotes by
++  " get_code() and runs at class-definition time during exec().  A single-
++  " quoted source docstring lets an embedded """ survive doc()'s leading/
++  " trailing quote strip and break out of the generated literal.
++  let marker = tempname()
++  call s:CompleteAndExpectNoMarker([
++        \ 'class Foo:',
++        \ '    ''x"""+open("' . marker . '", "w").close()+"""y''',
++        \ '    pass',
++        \ 'Foo.',
++        \ ], marker,
++        \ 'class docstring expression was evaluated during omni-completion')
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/version.c b/src/version.c
+index d3b72595f..bf680c656 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -734,6 +734,8 @@ static char *(features[]) =
+ 
+ static int included_patches[] =
+ {   /* Add new patch number below this line */
++/**/
++    699,
+ /**/
+     698,
+ /**/
+-- 
+2.53.0
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 8c5a5e88a9c..0f1355f0fcc 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -35,6 +35,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
            file://CVE-2026-57453.patch \
            file://CVE-2026-57454.patch \
            file://CVE-2026-57455.patch \
+           file://CVE-2026-57456.patch \
            "
 
 PV .= ".0340"

[OE-core][wrynose 20/56] vim: Fix for CVE-2026-59856

[Yoann Congal]

From: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>

Pick the patch from [1], also referenced in the NVD report [2].

[1] https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59856

Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../vim/files/CVE-2026-59856.patch            | 118 ++++++++++++++++++
 meta/recipes-support/vim/vim.inc              |   1 +
 2 files changed, 119 insertions(+)
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-59856.patch

diff --git a/meta/recipes-support/vim/files/CVE-2026-59856.patch b/meta/recipes-support/vim/files/CVE-2026-59856.patch
new file mode 100644
index 00000000000..9e9bdf03c54
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-59856.patch
@@ -0,0 +1,118 @@
+From c532c40015db331fbcfdf4ef9dd717b13fc54d2e Mon Sep 17 00:00:00 2001
+From: Hirohito Higashi <h.east.727@gmail.com>
+Date: Fri, 26 Jun 2026 20:07:01 +0900
+Subject: [PATCH] patch 9.2.0736: potential command execution in PHP
+ omni-completion
+
+Problem:  With PHP omni-completion, a crafted file can potentially
+          execute arbitrary commands when completing a class member.
+Solution: Quote the class name before inserting it into the search()
+          pattern run via win_execute().
+
+Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24]
+CVE: CVE-2026-59856
+
+Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
+---
+ runtime/autoload/phpcomplete.vim        |  3 ++-
+ src/testdir/Make_all.mak                |  2 ++
+ src/testdir/test_plugin_phpcomplete.vim | 35 +++++++++++++++++++++++++
+ src/version.c                           |  2 ++
+ 4 files changed, 41 insertions(+), 1 deletion(-)
+ create mode 100644 src/testdir/test_plugin_phpcomplete.vim
+
+diff --git a/runtime/autoload/phpcomplete.vim b/runtime/autoload/phpcomplete.vim
+index 5b4263ae4..93f7d8b45 100644
+--- a/runtime/autoload/phpcomplete.vim
++++ b/runtime/autoload/phpcomplete.vim
+@@ -2082,7 +2082,8 @@ function! phpcomplete#GetClassContentsStructure(file_path, file_lines, class_nam
+ 	let result = []
+ 	let popup_id = popup_create(a:file_lines, {'hidden': v:true})
+ 
+-	call win_execute(popup_id, 'call search(''\c\(class\|interface\|trait\)\_s\+'.a:class_name.'\(\>\|$\)'')')
++	call win_execute(popup_id, 'call search('
++		\ . string('\c\(class\|interface\|trait\)\_s\+' . a:class_name . '\(\>\|$\)') . ')')
+ 	call win_execute(popup_id, "let cfline = line('.')")
+ 	call win_execute(popup_id, "call search('{')")
+ 	call win_execute(popup_id, "let endline = line('.')")
+diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
+index b06d1af43..b5735b6c3 100644
+--- a/src/testdir/Make_all.mak
++++ b/src/testdir/Make_all.mak
+@@ -250,6 +250,7 @@ NEW_TESTS = \
+ 	test_plugin_man \
+ 	test_plugin_matchparen \
+ 	test_plugin_netrw \
++	test_plugin_phpcomplete \
+ 	test_plugin_python3complete \
+ 	test_plugin_osc52 \
+ 	test_plugin_tar \
+@@ -529,6 +530,7 @@ NEW_TESTS_RES = \
+ 	test_plugin_man.res \
+ 	test_plugin_matchparen.res \
+ 	test_plugin_netrw.res \
++	test_plugin_phpcomplete.res \
+ 	test_plugin_python3complete.res \
+ 	test_plugin_osc52.res \
+ 	test_plugin_tar.res \
+diff --git a/src/testdir/test_plugin_phpcomplete.vim b/src/testdir/test_plugin_phpcomplete.vim
+new file mode 100644
+index 000000000..7f66be47b
+--- /dev/null
++++ b/src/testdir/test_plugin_phpcomplete.vim
+@@ -0,0 +1,35 @@
++" Tests for the PHP omni-completion plugin (runtime/autoload/phpcomplete.vim).
++
++" A buffer class name is interpolated into a search() pattern run via
++" win_execute().  Without escaping, "'" closes the string and "|" starts a new
++" Ex command, so the name runs as an Ex command during completion.
++func Test_phpcomplete_no_exec_via_class_name()
++  unlet! g:phpcomplete_injected
++  let lines = ['<?php', 'class x {}', '']
++  let payload = "x')|let g:phpcomplete_injected = 1|call search('"
++
++  try
++    call phpcomplete#GetClassContentsStructure('x.php', lines, payload)
++  catch
++  endtry
++
++  call assert_false(exists('g:phpcomplete_injected'),
++        \ 'class name was executed as an Ex command during completion')
++
++  unlet! g:phpcomplete_injected
++endfunc
++
++func Test_phpcomplete_class_lookup_still_works()
++  let lines = ['<?php', 'class Foo {', '    public $bar;', '}', '']
++  let result = phpcomplete#GetClassContentsStructure('Foo.php', lines, 'Foo')
++
++  call assert_equal(type([]), type(result),
++        \ 'GetClassContentsStructure did not return a list')
++  call assert_true(len(result) > 0, 'no class structure returned')
++  call assert_match('class Foo', result[0].content,
++        \ 'class body missing from returned content')
++  call assert_match('bar', result[0].content,
++        \ 'class member missing from returned content')
++endfunc
++
++" vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/version.c b/src/version.c
+index bf680c656..fbc2c8b15 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -734,6 +734,8 @@ static char *(features[]) =
+ 
+ static int included_patches[] =
+ {   /* Add new patch number below this line */
++/**/
++    736,
+ /**/
+     699,
+ /**/
+-- 
+2.53.0
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 0f1355f0fcc..f0e54d71e08 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -36,6 +36,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
            file://CVE-2026-57454.patch \
            file://CVE-2026-57455.patch \
            file://CVE-2026-57456.patch \
+           file://CVE-2026-59856.patch \
            "
 
 PV .= ".0340"

[OE-core][wrynose 21/56] vim: Fix for CVE-2026-59857

[Yoann Congal]

From: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>

Pick the patch from [1], also referenced in the NVD report [2].

[1] https://github.com/vim/vim/commit/d22ff1c955ff87e8273210eae125aab0e85b6c30
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59857

Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../vim/files/CVE-2026-59857.patch            | 125 ++++++++++++++++++
 meta/recipes-support/vim/vim.inc              |   1 +
 2 files changed, 126 insertions(+)
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-59857.patch

diff --git a/meta/recipes-support/vim/files/CVE-2026-59857.patch b/meta/recipes-support/vim/files/CVE-2026-59857.patch
new file mode 100644
index 00000000000..656a5be8884
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-59857.patch
@@ -0,0 +1,125 @@
+From 0665e4c6f2723757814da2114a3bc7c85c6e1271 Mon Sep 17 00:00:00 2001
+From: Hirohito Higashi <h.east.727@gmail.com>
+Date: Mon, 22 Jun 2026 13:00:36 +0900
+Subject: [PATCH] patch 9.2.0725: [security]: Stack out-of-bounds write in
+ spell_soundfold_sal()
+
+Problem:  [security]: A crafted spell file with non-collapsing SAL rules
+          can make soundfold() write one byte past the end of the
+          MAXWLEN result buffer.  This is the same class of
+          out-of-bounds write as GHSA-q8mh-6qm3-25g4 (fixed in 9.2.0698
+          for the SOFO branch), found while auditing the surrounding
+          code.
+Solution: Bound the single-byte SAL result writes and the terminating
+          NUL to MAXWLEN - 1, matching the SOFO branch.
+
+The single-byte branch of spell_soundfold_sal() guarded its writes with
+"reslen < MAXWLEN", allowing reslen to reach MAXWLEN (254).  The trailing
+"res[reslen] = NUL" then wrote at index 254 of the 254-byte stack buffer
+res[MAXWLEN], an off-by-one out-of-bounds write.  Input is case-folded to
+about 253 characters, so a 253-character argument together with a SAL map
+that does not collapse (collapse_result false) reaches the boundary.
+
+Related to previous issue
+[GHSA-q8mh-6qm3-25g4](https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4)
+(9.2.0698)
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2
+
+Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/d22ff1c955ff87e8273210eae125aab0e85b6c30]
+CVE: CVE-2026-59857
+
+Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
+---
+ src/spell.c                    |  6 +++---
+ src/testdir/test_spellfile.vim | 24 ++++++++++++++++++++++++
+ src/version.c                  |  2 ++
+ 3 files changed, 29 insertions(+), 3 deletions(-)
+
+diff --git a/src/spell.c b/src/spell.c
+index e0fc17bfb..34f5edb55 100644
+--- a/src/spell.c
++++ b/src/spell.c
+@@ -3513,7 +3513,7 @@ spell_soundfold_sal(slang_T *slang, char_u *inword, char_u *res)
+ 			// no '<' rule used
+ 			i += k - 1;
+ 			z = 0;
+-			while (*s != NUL && s[1] != NUL && reslen < MAXWLEN)
++			while (*s != NUL && s[1] != NUL && reslen < MAXWLEN - 1)
+ 			{
+ 			    if (reslen == 0 || res[reslen - 1] != *s)
+ 				res[reslen++] = *s;
+@@ -3523,7 +3523,7 @@ spell_soundfold_sal(slang_T *slang, char_u *inword, char_u *res)
+ 			c = *s;
+ 			if (strstr((char *)pf, "^^") != NULL)
+ 			{
+-			    if (c != NUL)
++			    if (c != NUL && reslen < MAXWLEN - 1)
+ 				res[reslen++] = c;
+ 			    STRMOVE(word, word + i + 1);
+ 			    i = 0;
+@@ -3542,7 +3542,7 @@ spell_soundfold_sal(slang_T *slang, char_u *inword, char_u *res)
+ 
+ 	if (z0 == 0)
+ 	{
+-	    if (k && !p0 && reslen < MAXWLEN && c != NUL
++	    if (k && !p0 && reslen < MAXWLEN - 1 && c != NUL
+ 		    && (!slang->sl_collapse || reslen == 0
+ 						     || res[reslen - 1] != c))
+ 		// condense only double letters
+diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
+index 50afe3dfa..3a93883b4 100644
+--- a/src/testdir/test_spellfile.vim
++++ b/src/testdir/test_spellfile.vim
+@@ -387,6 +387,30 @@ func Test_spellfile_format_error()
+   let &rtp = save_rtp
+ endfunc
+ 
++" An over-length soundfold() argument must not overflow the MAXWLEN result
++" buffer in the single-byte branch of spell_soundfold_sal().
++func Test_spellfile_soundfold_sal_overflow()
++  let save_enc = &encoding
++  set encoding=latin1
++  " A SAL map that appends without collapsing, so the result is not shorter
++  " than the input.
++  call writefile(['SET ISO8859-1', 'SAL collapse_result false',
++	\ 'SAL a aaaa', 'SAL b bbbb'], 'Xsal.aff')
++  call writefile(['2', 'hello', 'world'], 'Xsal.dic')
++  mkspell! Xsal Xsal
++  set spl=Xsal.latin1.spl spell
++
++  " 253 input characters hit the buffer boundary; the result must not exceed
++  " MAXWLEN - 1.
++  call assert_true(strlen(soundfold(repeat('a', 253))) <= 253)
++
++  set nospell spl& spelllang&
++  call delete('Xsal.aff')
++  call delete('Xsal.dic')
++  call delete('Xsal.latin1.spl')
++  let &encoding = save_enc
++endfunc
++
+ " Test for format errors in suggest file
+ func Test_sugfile_format_error()
+   let save_rtp = &rtp
+diff --git a/src/version.c b/src/version.c
+index fbc2c8b15..ceea0d5e7 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -736,6 +736,8 @@ static int included_patches[] =
+ {   /* Add new patch number below this line */
+ /**/
+     736,
++/**/
++    725,
+ /**/
+     699,
+ /**/
+-- 
+2.53.0
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index f0e54d71e08..9e2338fcb04 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -37,6 +37,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
            file://CVE-2026-57455.patch \
            file://CVE-2026-57456.patch \
            file://CVE-2026-59856.patch \
+           file://CVE-2026-59857.patch \
            "
 
 PV .= ".0340"

[OE-core][wrynose 22/56] vim: Fix for CVE-2026-59858

[Yoann Congal]

From: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>

Pick the patch from [1], also referenced in the NVD report [2].

[1] https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59858

Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../vim/files/CVE-2026-59858.patch            | 149 ++++++++++++++++++
 meta/recipes-support/vim/vim.inc              |   1 +
 2 files changed, 150 insertions(+)
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-59858.patch

diff --git a/meta/recipes-support/vim/files/CVE-2026-59858.patch b/meta/recipes-support/vim/files/CVE-2026-59858.patch
new file mode 100644
index 00000000000..f18637bd938
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-59858.patch
@@ -0,0 +1,149 @@
+From 09554668bd5ab31261a5c5585a0f58baa1080105 Mon Sep 17 00:00:00 2001
+From: Hirohito Higashi <h.east.727@gmail.com>
+Date: Fri, 26 Jun 2026 15:41:24 +0900
+Subject: [PATCH] patch 9.2.0735: [security]: arbitrary Ex command execution
+ during C omni-completion
+
+Problem:  [security]: With C omni-completion, a crafted tags file can execute
+          arbitrary Ex commands when completing a struct/union member
+          (cipher-creator)
+Solution: Escape the type field before inserting it into the :vimgrep
+          pattern so it cannot close the pattern and start a new command
+          (Hirohito Higashi).
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x
+
+Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>"
+Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e]
+CVE: CVE-2026-59858
+
+Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
+---
+ runtime/autoload/ccomplete.vim        |  2 +-
+ src/testdir/Make_all.mak              |  2 +
+ src/testdir/test_plugin_ccomplete.vim | 62 +++++++++++++++++++++++++++
+ src/version.c                         |  2 +
+ 4 files changed, 67 insertions(+), 1 deletion(-)
+ create mode 100644 src/testdir/test_plugin_ccomplete.vim
+
+diff --git a/runtime/autoload/ccomplete.vim b/runtime/autoload/ccomplete.vim
+index 51237be98..dc3388b52 100644
+--- a/runtime/autoload/ccomplete.vim
++++ b/runtime/autoload/ccomplete.vim
+@@ -600,7 +600,7 @@ def StructMembers( # {{{1
+         return []
+       endif
+       execute 'silent! keepjumps noautocmd '
+-        .. n .. 'vimgrep ' .. '/\t' .. typename .. '\(\t\|$\)/j '
++        .. n .. 'vimgrep ' .. '/\t' .. escape(typename, '/\') .. '\(\t\|$\)/j '
+         .. fnames
+ 
+       qflist = getqflist()
+diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
+index b5735b6c3..0cf2c4110 100644
+--- a/src/testdir/Make_all.mak
++++ b/src/testdir/Make_all.mak
+@@ -243,6 +243,7 @@ NEW_TESTS = \
+ 	test_partial \
+ 	test_paste \
+ 	test_perl \
++	test_plugin_ccomplete \
+ 	test_plugin_comment \
+ 	test_plugin_glvs \
+ 	test_plugin_helpcurwin \
+@@ -523,6 +524,7 @@ NEW_TESTS_RES = \
+ 	test_partial.res \
+ 	test_paste.res \
+ 	test_perl.res \
++	test_plugin_ccomplete.res \
+ 	test_plugin_comment.res \
+ 	test_plugin_glvs.res \
+ 	test_plugin_helpcurwin.res \
+diff --git a/src/testdir/test_plugin_ccomplete.vim b/src/testdir/test_plugin_ccomplete.vim
+new file mode 100644
+index 000000000..a635bd50b
+--- /dev/null
++++ b/src/testdir/test_plugin_ccomplete.vim
+@@ -0,0 +1,62 @@
++" Tests for the C omni-completion plugin (runtime/autoload/ccomplete.vim).
++
++func s:WriteTags(lines)
++  " Mark unsorted so lookup is a linear scan regardless of entry order.
++  let tagsfile = tempname()
++  call writefile(["!_TAG_FILE_SORTED\t0\t/0/"] + a:lines, tagsfile)
++  return tagsfile
++endfunc
++
++" A crafted typeref field is interpolated into the :vimgrep pattern in
++" StructMembers().  Without escaping, "/" closes the pattern and "|" starts a
++" new Ex command, so the field runs as an Ex command during completion.
++func Test_ccomplete_no_exec_via_typeref()
++  unlet! g:ccomplete_injected
++  let tagsfile = s:WriteTags([
++        \ "myvar\tmain.c\t/^x$/;\"\tv\ttyperef:x/|let g:ccomplete_injected = 1|\"",
++        \ ])
++
++  let save_tags = &tags
++  let &tags = tagsfile
++
++  new
++  call ccomplete#Complete(1, '')
++  call ccomplete#Complete(0, 'myvar.x')
++
++  call assert_false(exists('g:ccomplete_injected'),
++        \ 'typeref field was executed as an Ex command during omni-completion')
++
++  bwipe!
++  let &tags = save_tags
++  unlet! g:ccomplete_injected
++endfunc
++
++" A legitimate typeref must still drive struct-member completion: escaping the
++" field value must not break the normal path.
++func Test_ccomplete_typeref_completion_still_works()
++  let tagsfile = s:WriteTags([
++        \ "myvar\tmain.c\t/^x$/;\"\tv\ttyperef:struct:mystruct",
++        \ "alpha\tmain.c\t/^x$/;\"\tm\tstruct:mystruct",
++        \ "beta\tmain.c\t/^x$/;\"\tm\tstruct:mystruct",
++        \ ])
++
++  let save_tags = &tags
++  let &tags = tagsfile
++
++  new
++  call ccomplete#Complete(1, '')
++  let items = ccomplete#Complete(0, 'myvar.')
++
++  call assert_equal(type([]), type(items),
++        \ 'ccomplete#Complete did not return a list')
++  let names = map(copy(items), 'v:val.word')
++  call assert_true(index(names, 'alpha') >= 0,
++        \ 'struct member "alpha" missing from completion: ' . string(names))
++  call assert_true(index(names, 'beta') >= 0,
++        \ 'struct member "beta" missing from completion: ' . string(names))
++
++  bwipe!
++  let &tags = save_tags
++endfunc
++
++" vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/version.c b/src/version.c
+index ceea0d5e7..92cd53129 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -736,6 +736,8 @@ static int included_patches[] =
+ {   /* Add new patch number below this line */
+ /**/
+     736,
++/**/
++    735,
+ /**/
+     725,
+ /**/
+-- 
+2.53.0
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 9e2338fcb04..1da47d92430 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -38,6 +38,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
            file://CVE-2026-57456.patch \
            file://CVE-2026-59856.patch \
            file://CVE-2026-59857.patch \
+           file://CVE-2026-59858.patch \
            "
 
 PV .= ".0340"

[OE-core][wrynose 23/56] gst-devtools: upgrade 1.28.2 -> 1.28.4

[Yoann Congal]

From: Richard Purdie <richard.purdie@linuxfoundation.org>

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 4b7b0de6f53cf9e1aa12e008e7df50affc755cdd)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../0001-connect-has-a-different-signature-on-musl.patch        | 2 +-
 .../{gst-devtools_1.28.2.bb => gst-devtools_1.28.4.bb}          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 rename meta/recipes-multimedia/gstreamer/{gst-devtools_1.28.2.bb => gst-devtools_1.28.4.bb} (95%)

diff --git a/meta/recipes-multimedia/gstreamer/gst-devtools/0001-connect-has-a-different-signature-on-musl.patch b/meta/recipes-multimedia/gstreamer/gst-devtools/0001-connect-has-a-different-signature-on-musl.patch
index 34fcf6a30a4..a348624e490 100644
--- a/meta/recipes-multimedia/gstreamer/gst-devtools/0001-connect-has-a-different-signature-on-musl.patch
+++ b/meta/recipes-multimedia/gstreamer/gst-devtools/0001-connect-has-a-different-signature-on-musl.patch
@@ -1,4 +1,4 @@
-From 13b0d8e55ad490c8e867c740da2a00eb49319f8e Mon Sep 17 00:00:00 2001
+From bb36ab400ee8b84b8f604aa3314952b7df2aeda6 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Sun, 9 Sep 2018 17:38:10 -0700
 Subject: [PATCH] connect has a different signature on musl
diff --git a/meta/recipes-multimedia/gstreamer/gst-devtools_1.28.2.bb b/meta/recipes-multimedia/gstreamer/gst-devtools_1.28.4.bb
similarity index 95%
rename from meta/recipes-multimedia/gstreamer/gst-devtools_1.28.2.bb
rename to meta/recipes-multimedia/gstreamer/gst-devtools_1.28.4.bb
index cbe488a0499..9641e42d386 100644
--- a/meta/recipes-multimedia/gstreamer/gst-devtools_1.28.2.bb
+++ b/meta/recipes-multimedia/gstreamer/gst-devtools_1.28.4.bb
@@ -12,7 +12,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-devtools/gst-devtools-${PV}
            file://0001-connect-has-a-different-signature-on-musl.patch \
            "
 
-SRC_URI[sha256sum] = "8e012bdcb55503f466d53f1f05e13e8993c69811b9db77cd16a8f6467723bf91"
+SRC_URI[sha256sum] = "11d4f1188639d3a9762039065bbb7b2c309b7a8ecc6fa4aed12245568bf00db3"
 
 DEPENDS = "json-glib glib-2.0 glib-2.0-native gstreamer1.0 gstreamer1.0-plugins-base"
 RRECOMMENDS:${PN} = "git"

[OE-core][wrynose 24/56] gstreamer1.0-libav: upgrade 1.28.2 -> 1.28.4

[Yoann Congal]

From: Richard Purdie <richard.purdie@linuxfoundation.org>

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 62104c0ccf0aec7254f206fa9406b0a8f6715a86)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 ...streamer1.0-libav_1.28.2.bb => gstreamer1.0-libav_1.28.4.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-libav_1.28.2.bb => gstreamer1.0-libav_1.28.4.bb} (91%)

diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.28.2.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.28.4.bb
similarity index 91%
rename from meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.28.2.bb
rename to meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.28.4.bb
index 856c8838167..4898c421905 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.28.2.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.28.4.bb
@@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=69333daa044cb77e486cc36129f7a770 \
                     "
 
 SRC_URI = "https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-${PV}.tar.xz"
-SRC_URI[sha256sum] = "45ba65535870aa7c026119d2e90b35dc760e1cf6f50bffbfe8d71223a3043a4e"
+SRC_URI[sha256sum] = "bd17a5df2874a7a58bcbaf7b940223379ad9613624db8ead783db03e74bb904b"
 
 S = "${UNPACKDIR}/gst-libav-${PV}"
 

[OE-core][wrynose 25/56] gstreamer1.0-python: upgrade 1.28.2 -> 1.28.4

[Yoann Congal]

From: Richard Purdie <richard.purdie@linuxfoundation.org>

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 097965cc4e9bdeeb270a8f0540feb980996da357)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 ...reamer1.0-python_1.28.2.bb => gstreamer1.0-python_1.28.4.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-python_1.28.2.bb => gstreamer1.0-python_1.28.4.bb} (91%)

diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.28.2.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.28.4.bb
similarity index 91%
rename from meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.28.2.bb
rename to meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.28.4.bb
index 181e3d8ea45..555b3105942 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.28.2.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.28.4.bb
@@ -8,7 +8,7 @@ LICENSE = "LGPL-2.1-or-later"
 LIC_FILES_CHKSUM = "file://COPYING;md5=c34deae4e395ca07e725ab0076a5f740"
 
 SRC_URI = "https://gstreamer.freedesktop.org/src/${PNREAL}/${PNREAL}-${PV}.tar.xz"
-SRC_URI[sha256sum] = "12fdd8e19af97d797a6b2c195228e6c9edc4cddfa68274912b78ef66068ad822"
+SRC_URI[sha256sum] = "c4eb382720b4443fb801a53418dff0bd4cd7478716d5ced493504a675b4d09fd"
 
 DEPENDS = "gstreamer1.0 gstreamer1.0-plugins-base python3-pygobject gstreamer1.0-plugins-bad"
 RDEPENDS:${PN} += "gstreamer1.0 gstreamer1.0-plugins-base python3-pygobject"

[OE-core][wrynose 26/56] gstreamer1.0: upgrade 1.28.2 -> 1.28.4

[Yoann Congal]

From: Richard Purdie <richard.purdie@linuxfoundation.org>

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 53c2f2ac7e154225b096e7a421be5fe0eb4de29c)

* https://gstreamer.freedesktop.org/releases/1.28/#1.28.4
  This release only contains bugfixes and important security fixes.
* https://gstreamer.freedesktop.org/releases/1.28/#1.28.3
  This release only contains bugfixes and important security fixes.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../0001-tests-respect-the-idententaion-used-in-meson.patch | 2 +-
 .../0002-tests-add-support-for-install-the-tests.patch      | 6 +++---
 .../0003-tests-use-a-dictionaries-for-environment.patch     | 2 +-
 ...tests-add-helper-script-to-run-the-installed_tests.patch | 2 +-
 .../{gstreamer1.0_1.28.2.bb => gstreamer1.0_1.28.4.bb}      | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0_1.28.2.bb => gstreamer1.0_1.28.4.bb} (97%)

diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0/0001-tests-respect-the-idententaion-used-in-meson.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0/0001-tests-respect-the-idententaion-used-in-meson.patch
index e1d870b0405..de255bf7918 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0/0001-tests-respect-the-idententaion-used-in-meson.patch
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0/0001-tests-respect-the-idententaion-used-in-meson.patch
@@ -1,4 +1,4 @@
-From ad4c577ff8d29f6dbaf5ca2d013e9d21c44f9122 Mon Sep 17 00:00:00 2001
+From 4e6aae8cbddb4567388f8f19919c2c17e36e0356 Mon Sep 17 00:00:00 2001
 From: Jose Quaresma <quaresma.jose@gmail.com>
 Date: Sun, 11 Apr 2021 19:48:13 +0100
 Subject: [PATCH] tests: respect the idententaion used in meson
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0/0002-tests-add-support-for-install-the-tests.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0/0002-tests-add-support-for-install-the-tests.patch
index 720a6f0c97e..957356c2ba6 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0/0002-tests-add-support-for-install-the-tests.patch
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0/0002-tests-add-support-for-install-the-tests.patch
@@ -1,4 +1,4 @@
-From 92e7d4090fa458bf02d3418cd01c960982821e92 Mon Sep 17 00:00:00 2001
+From 34d24b8d66088d92ca306a488028dee82a6f6982 Mon Sep 17 00:00:00 2001
 From: Jose Quaresma <quaresma.jose@gmail.com>
 Date: Sun, 11 Apr 2021 19:48:13 +0100
 Subject: [PATCH] tests: add support for install the tests
@@ -19,10 +19,10 @@ Signed-off-by: Jose Quaresma <quaresma.jose@gmail.com>
  create mode 100644 tests/check/template.test.in
 
 diff --git a/meson.build b/meson.build
-index 8adc055..b5c9e5b 100644
+index abd0ad6..93cd692 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -667,6 +667,10 @@ if bashcomp_dep.found()
+@@ -661,6 +661,10 @@ if bashcomp_dep.found()
    endif
  endif
  
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0/0003-tests-use-a-dictionaries-for-environment.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0/0003-tests-use-a-dictionaries-for-environment.patch
index 1236290e2b6..bc6dfe353a3 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0/0003-tests-use-a-dictionaries-for-environment.patch
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0/0003-tests-use-a-dictionaries-for-environment.patch
@@ -1,4 +1,4 @@
-From 374c6ace83e9697aae0b21ba26f316b79279c39c Mon Sep 17 00:00:00 2001
+From f34bc3040b1564a3d39de4a4426326866c437dae Mon Sep 17 00:00:00 2001
 From: Jose Quaresma <quaresma.jose@gmail.com>
 Date: Sat, 24 Apr 2021 10:34:47 +0100
 Subject: [PATCH] tests: use a dictionaries for environment
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0/0004-tests-add-helper-script-to-run-the-installed_tests.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0/0004-tests-add-helper-script-to-run-the-installed_tests.patch
index df382a4445d..8eb4bc2a816 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0/0004-tests-add-helper-script-to-run-the-installed_tests.patch
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0/0004-tests-add-helper-script-to-run-the-installed_tests.patch
@@ -1,4 +1,4 @@
-From e31ab477eed061cc72ed6795b483795d53af6dfc Mon Sep 17 00:00:00 2001
+From ee4f5bd19394e055109486d88ff8e876c5c2572f Mon Sep 17 00:00:00 2001
 From: Jose Quaresma <quaresma.jose@gmail.com>
 Date: Sun, 2 May 2021 01:58:01 +0100
 Subject: [PATCH] tests: add helper script to run the installed_tests
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.28.2.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.28.4.bb
similarity index 97%
rename from meta/recipes-multimedia/gstreamer/gstreamer1.0_1.28.2.bb
rename to meta/recipes-multimedia/gstreamer/gstreamer1.0_1.28.4.bb
index 4e51418c987..d1f06a52338 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.28.2.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.28.4.bb
@@ -22,7 +22,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gstreamer/gstreamer-${PV}.tar.x
            file://0003-tests-use-a-dictionaries-for-environment.patch \
            file://0004-tests-add-helper-script-to-run-the-installed_tests.patch \
            "
-SRC_URI[sha256sum] = "ce5cd44d4ffeafdcc3dddaa072b2179c0b7cb1abf4e6c5d18d4375f8a39fe491"
+SRC_URI[sha256sum] = "f5adc7e8f448c10260b3b25aa101c9d540674c8d9a54c2b77a86d04f2b3b50dd"
 
 PACKAGECONFIG ??= "${@bb.utils.contains('PTEST_ENABLED', '1', 'tests', '', d)} \
                    check \

[OE-core][wrynose 27/56] gstreamer1.0: disable an intermittently failing test

[Yoann Congal]

From: Alexander Kanavin <alex@linutronix.de>

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 79ec3a84acc65594942ca9352fddf93d90952d71)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest b/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest
index 44dc350eb3b..83a78fabd0f 100755
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest
@@ -23,4 +23,8 @@ GST_CHECKS_IGNORE="$GST_CHECKS_IGNORE,parser_pull_short_read"
 # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3524
 GST_CHECKS_IGNORE="$GST_CHECKS_IGNORE,parser_convert_duration,parser_pull_frame_growth,parser_reverse_playback"
 
+# Intermittent fail
+# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5163
+GST_CHECKS_IGNORE="$GST_CHECKS_IGNORE,test_device_monitor"
+
 gnome-desktop-testing-runner --parallel=4 gstreamer "$@"

[OE-core][wrynose 28/56] gstreamer1.0: upgrade 1.28.2 -> 1.28.4 (the remaining pieces)

[Yoann Congal]

From: Alexander Kanavin <alex@linutronix.de>

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
((From OE-Core rev: 430c35bc1e4358173ab3b6d1e2e5e94f58357359)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 ...001-Make-player-examples-installable.patch | 21 +++++++++----------
 ...mples_1.28.2.bb => gst-examples_1.28.4.bb} |  2 +-
 ...ialized-warnings-when-compiling-with.patch |  4 ++--
 ...-avoid-including-sys-poll.h-directly.patch |  2 +-
 ...issing-opencv-data-dir-in-yocto-buil.patch |  4 ++--
 ...added-buffers-in-wl_shm-buffer-creat.patch |  5 +----
 ....bb => gstreamer1.0-plugins-bad_1.28.4.bb} |  2 +-
 ...et-caps-from-src-pad-when-query-caps.patch |  6 +++---
 ...parse-enhance-SSA-text-lines-parsing.patch |  2 +-
 ...iv-fb-Make-sure-config.h-is-included.patch |  2 +-
 ...bb => gstreamer1.0-plugins-base_1.28.4.bb} |  2 +-
 ...bb => gstreamer1.0-plugins-good_1.28.4.bb} |  2 +-
 ...bb => gstreamer1.0-plugins-ugly_1.28.4.bb} |  2 +-
 ....bb => gstreamer1.0-rtsp-server_1.28.4.bb} |  2 +-
 14 files changed, 27 insertions(+), 31 deletions(-)
 rename meta/recipes-multimedia/gstreamer/{gst-examples_1.28.2.bb => gst-examples_1.28.4.bb} (96%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-plugins-bad_1.28.2.bb => gstreamer1.0-plugins-bad_1.28.4.bb} (99%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-plugins-base_1.28.2.bb => gstreamer1.0-plugins-base_1.28.4.bb} (98%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-plugins-good_1.28.2.bb => gstreamer1.0-plugins-good_1.28.4.bb} (97%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-plugins-ugly_1.28.2.bb => gstreamer1.0-plugins-ugly_1.28.4.bb} (94%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-rtsp-server_1.28.2.bb => gstreamer1.0-rtsp-server_1.28.4.bb} (90%)

diff --git a/meta/recipes-multimedia/gstreamer/gst-examples/0001-Make-player-examples-installable.patch b/meta/recipes-multimedia/gstreamer/gst-examples/0001-Make-player-examples-installable.patch
index e12ca0b613d..e7862b40e79 100644
--- a/meta/recipes-multimedia/gstreamer/gst-examples/0001-Make-player-examples-installable.patch
+++ b/meta/recipes-multimedia/gstreamer/gst-examples/0001-Make-player-examples-installable.patch
@@ -1,4 +1,4 @@
-From 7924016fce2d0b435891a335cdae52fc939c7e3b Mon Sep 17 00:00:00 2001
+From 75ff9436c9ff965327d6dad256c0a1539435b13a Mon Sep 17 00:00:00 2001
 From: Jussi Kukkonen <jussi.kukkonen@intel.com>
 Date: Thu, 17 Aug 2017 11:07:02 +0300
 Subject: [PATCH] Make player examples installable
@@ -7,16 +7,15 @@ Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
 Upstream-Status: Denied [Upstream considers these code examples, for now a least]
 
 https://bugzilla.gnome.org/show_bug.cgi?id=777827
-
 ---
  playback/player/gst-play/meson.build | 1 +
  playback/player/gtk/meson.build      | 1 +
  2 files changed, 2 insertions(+)
 
-Index: gst-examples/playback/player/gst-play/meson.build
-===================================================================
---- gst-examples.orig/playback/player/gst-play/meson.build
-+++ gst-examples/playback/player/gst-play/meson.build
+diff --git a/playback/player/gst-play/meson.build b/playback/player/gst-play/meson.build
+index 5e80ca8dd4..129e5bdcbe 100644
+--- a/playback/player/gst-play/meson.build
++++ b/playback/player/gst-play/meson.build
 @@ -2,5 +2,6 @@ executable('gst-play',
      ['gst-play.c',
       'gst-play-kb.c',
@@ -24,11 +23,11 @@ Index: gst-examples/playback/player/gst-play/meson.build
 +    install: true,
      dependencies : [gst_dep, dependency('gstreamer-play-1.0'), m_dep])
  
-Index: gst-examples/playback/player/gtk/meson.build
-===================================================================
---- gst-examples.orig/playback/player/gtk/meson.build
-+++ gst-examples/playback/player/gtk/meson.build
-@@ -20,5 +20,6 @@ if gtk_dep.found()
+diff --git a/playback/player/gtk/meson.build b/playback/player/gtk/meson.build
+index 6892f15254..20d7505877 100644
+--- a/playback/player/gtk/meson.build
++++ b/playback/player/gtk/meson.build
+@@ -21,5 +21,6 @@ if gtk_dep.found()
         'gtk-video-renderer.h',
         'gtk-video-renderer.c'],
        c_args :  extra_c_args,
diff --git a/meta/recipes-multimedia/gstreamer/gst-examples_1.28.2.bb b/meta/recipes-multimedia/gstreamer/gst-examples_1.28.4.bb
similarity index 96%
rename from meta/recipes-multimedia/gstreamer/gst-examples_1.28.2.bb
rename to meta/recipes-multimedia/gstreamer/gst-examples_1.28.4.bb
index 304d71b6377..ad6374d3fb3 100644
--- a/meta/recipes-multimedia/gstreamer/gst-examples_1.28.2.bb
+++ b/meta/recipes-multimedia/gstreamer/gst-examples_1.28.4.bb
@@ -12,7 +12,7 @@ SRC_URI = "git://gitlab.freedesktop.org/gstreamer/gstreamer.git;protocol=https;b
            file://gst-player.desktop \
            "
 
-SRCREV = "43421c2a5b8ac5cceb52b11749df40301e1de5c0"
+SRCREV = "b46f881eaa8126eddfd21b5ae5512f8d4ff36255"
 
 S = "${UNPACKDIR}/${BP}/subprojects/gst-examples"
 
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/0001-fix-maybe-uninitialized-warnings-when-compiling-with.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/0001-fix-maybe-uninitialized-warnings-when-compiling-with.patch
index 307d6696451..f5eb011ffad 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/0001-fix-maybe-uninitialized-warnings-when-compiling-with.patch
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/0001-fix-maybe-uninitialized-warnings-when-compiling-with.patch
@@ -1,4 +1,4 @@
-From d24bb949e547a0ad69f3f47e4cf262a75bb9fe73 Mon Sep 17 00:00:00 2001
+From bcc4c0d84f573e5d53195a726b475d818759550d Mon Sep 17 00:00:00 2001
 From: Andre McCurdy <armccurdy@gmail.com>
 Date: Tue, 26 Jan 2016 15:16:01 -0800
 Subject: [PATCH] fix maybe-uninitialized warnings when compiling with -Os
@@ -11,7 +11,7 @@ Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/gst-libs/gst/codecparsers/gstvc1parser.c b/gst-libs/gst/codecparsers/gstvc1parser.c
-index ac8c378..3fc5298 100644
+index d91cc3f..c9058cd 100644
 --- a/gst-libs/gst/codecparsers/gstvc1parser.c
 +++ b/gst-libs/gst/codecparsers/gstvc1parser.c
 @@ -1732,7 +1732,7 @@ gst_vc1_parse_sequence_layer (const guint8 * data, gsize size,
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/0002-avoid-including-sys-poll.h-directly.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/0002-avoid-including-sys-poll.h-directly.patch
index 7da8994e3d9..ed0a248381d 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/0002-avoid-including-sys-poll.h-directly.patch
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/0002-avoid-including-sys-poll.h-directly.patch
@@ -1,4 +1,4 @@
-From 728238129a8a91cad857023d2e7131591321409d Mon Sep 17 00:00:00 2001
+From 86d9fc16f8d165e79d29ab1130e08663502dcd25 Mon Sep 17 00:00:00 2001
 From: Andre McCurdy <armccurdy@gmail.com>
 Date: Wed, 3 Feb 2016 18:05:41 -0800
 Subject: [PATCH] avoid including <sys/poll.h> directly
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/0004-opencv-resolve-missing-opencv-data-dir-in-yocto-buil.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/0004-opencv-resolve-missing-opencv-data-dir-in-yocto-buil.patch
index 1edcf07c146..78981c03714 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/0004-opencv-resolve-missing-opencv-data-dir-in-yocto-buil.patch
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/0004-opencv-resolve-missing-opencv-data-dir-in-yocto-buil.patch
@@ -1,4 +1,4 @@
-From 8f7a1c5591e27681f294ae5edf0f32689198abff Mon Sep 17 00:00:00 2001
+From 08cf48c1ad094a522b558f10d24d4aec670dcc88 Mon Sep 17 00:00:00 2001
 From: Andrey Zhizhikin <andrey.z@gmail.com>
 Date: Mon, 27 Jan 2020 10:22:35 +0000
 Subject: [PATCH] opencv: resolve missing opencv data dir in yocto build
@@ -17,7 +17,7 @@ Signed-off-by: Jose Quaresma <quaresma.jose@gmail.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/gst-libs/gst/opencv/meson.build b/gst-libs/gst/opencv/meson.build
-index 64e913e..42a0958 100644
+index 60cb12b..4046b70 100644
 --- a/gst-libs/gst/opencv/meson.build
 +++ b/gst-libs/gst/opencv/meson.build
 @@ -61,6 +61,9 @@ gstopencv_cargs += ['-DOPENCV_PREFIX="' + opencv_prefix + '"']
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/0005-wayland-handle-padded-buffers-in-wl_shm-buffer-creat.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/0005-wayland-handle-padded-buffers-in-wl_shm-buffer-creat.patch
index 2bb00e2b1d9..97b138a660c 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/0005-wayland-handle-padded-buffers-in-wl_shm-buffer-creat.patch
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/0005-wayland-handle-padded-buffers-in-wl_shm-buffer-creat.patch
@@ -1,4 +1,4 @@
-From 2af4bc8562f970207e3b1f6fc0b377ecf116a69c Mon Sep 17 00:00:00 2001
+From 8ff54f765defbb343340da5de3cf5c89e400a8ff Mon Sep 17 00:00:00 2001
 From: Tushar Darote <tdarote@qti.qualcomm.com>
 Date: Mon, 8 Jun 2026 18:05:51 +0530
 Subject: [PATCH] wayland: handle padded buffers in wl_shm buffer creation
@@ -233,6 +233,3 @@ index 3c5c3cc..cd9c964 100644
  
      g_object_unref (alloc);
    }
--- 
-2.34.1
-
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.2.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.4.bb
similarity index 99%
rename from meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.2.bb
rename to meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.4.bb
index 72f2cc73424..e224112d34c 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.2.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.4.bb
@@ -11,7 +11,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad
            file://0004-opencv-resolve-missing-opencv-data-dir-in-yocto-buil.patch \
            file://0005-wayland-handle-padded-buffers-in-wl_shm-buffer-creat.patch \
            "
-SRC_URI[sha256sum] = "6467e3964828f4d7d08bfe1fbb4d76287a1c8fa76674e59e101a149c020fefd7"
+SRC_URI[sha256sum] = "332b7320f30c60f2d5941446d03b9d05e3781f2c2561befbe88718bd777f0e47"
 
 S = "${UNPACKDIR}/gst-plugins-bad-${PV}"
 
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0001-ENGR00312515-get-caps-from-src-pad-when-query-caps.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0001-ENGR00312515-get-caps-from-src-pad-when-query-caps.patch
index 719c73d3e35..635c801cdc7 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0001-ENGR00312515-get-caps-from-src-pad-when-query-caps.patch
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0001-ENGR00312515-get-caps-from-src-pad-when-query-caps.patch
@@ -1,4 +1,4 @@
-From a37f0063103e98f5109132ea302b919b92e26a38 Mon Sep 17 00:00:00 2001
+From ae52c483980409c64b8bdd0c7b794533bcc0fec8 Mon Sep 17 00:00:00 2001
 From: zhouming <b42586@freescale.com>
 Date: Wed, 14 May 2014 10:16:20 +0800
 Subject: [PATCH] ENGR00312515: get caps from src pad when query caps
@@ -16,10 +16,10 @@ Signed-off-by: zhouming <b42586@freescale.com>
 diff --git a/gst-libs/gst/tag/gsttagdemux.c b/gst-libs/gst/tag/gsttagdemux.c
 old mode 100644
 new mode 100755
-index 975fe83..df82840
+index 16bf001..e17a144
 --- a/gst-libs/gst/tag/gsttagdemux.c
 +++ b/gst-libs/gst/tag/gsttagdemux.c
-@@ -1796,6 +1796,19 @@ gst_tag_demux_pad_query (GstPad * pad, GstObject * parent, GstQuery * query)
+@@ -1797,6 +1797,19 @@ gst_tag_demux_pad_query (GstPad * pad, GstObject * parent, GstQuery * query)
        }
        break;
      }
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0002-ssaparse-enhance-SSA-text-lines-parsing.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0002-ssaparse-enhance-SSA-text-lines-parsing.patch
index bf1e2a89e3b..4ce9f30d6a3 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0002-ssaparse-enhance-SSA-text-lines-parsing.patch
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0002-ssaparse-enhance-SSA-text-lines-parsing.patch
@@ -1,4 +1,4 @@
-From f892f0be8ae88acc6482f4b9a9a4db5f03b7adf8 Mon Sep 17 00:00:00 2001
+From 748c467f40d3f0072d9c139f9fdbbfdd56655c1e Mon Sep 17 00:00:00 2001
 From: Mingke Wang <mingke.wang@freescale.com>
 Date: Thu, 19 Mar 2015 14:17:10 +0800
 Subject: [PATCH] ssaparse: enhance SSA text lines parsing.
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0003-viv-fb-Make-sure-config.h-is-included.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0003-viv-fb-Make-sure-config.h-is-included.patch
index 1a988b99de3..a824235731f 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0003-viv-fb-Make-sure-config.h-is-included.patch
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0003-viv-fb-Make-sure-config.h-is-included.patch
@@ -1,4 +1,4 @@
-From 6f06f4b2f13f028250189225a46a39f402428930 Mon Sep 17 00:00:00 2001
+From 207df05a877717b1dd93a3a5903f0c58dd74c925 Mon Sep 17 00:00:00 2001
 From: Carlos Rafael Giani <crg7475@mailbox.org>
 Date: Tue, 21 May 2019 14:01:11 +0200
 Subject: [PATCH] viv-fb: Make sure config.h is included
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.28.2.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.28.4.bb
similarity index 98%
rename from meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.28.2.bb
rename to meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.28.4.bb
index 79cc4f312d9..d9f85417cd8 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.28.2.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.28.4.bb
@@ -11,7 +11,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-ba
            file://0003-viv-fb-Make-sure-config.h-is-included.patch \
            file://0002-ssaparse-enhance-SSA-text-lines-parsing.patch \
            "
-SRC_URI[sha256sum] = "4db76b3619280037a4047de7d9dbb38613a4272dcc40efb333257124635a888d"
+SRC_URI[sha256sum] = "a898afd5766172b0049e6781558e0689098bf87b9d82b846c652e571c01d60d8"
 
 S = "${UNPACKDIR}/gst-plugins-base-${PV}"
 
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.28.2.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.28.4.bb
similarity index 97%
rename from meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.28.2.bb
rename to meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.28.4.bb
index 366eb8189cc..9194cae297e 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.28.2.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.28.4.bb
@@ -6,7 +6,7 @@ BUGTRACKER = "https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/issues
 
 SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-${PV}.tar.xz"
 
-SRC_URI[sha256sum] = "1ace2d8ec74f632d82eab5006753a27fe0c2402db4ca94d63271e494b62f50bf"
+SRC_URI[sha256sum] = "c825ea737c59cea0e4a0c41da2388045ff5dd32d162220ac93a7a82ee4a04e61"
 
 S = "${UNPACKDIR}/gst-plugins-good-${PV}"
 
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.28.2.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.28.4.bb
similarity index 94%
rename from meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.28.2.bb
rename to meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.28.4.bb
index 1f3df47303f..4c0811a0561 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.28.2.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.28.4.bb
@@ -15,7 +15,7 @@ SRC_URI = " \
             https://gstreamer.freedesktop.org/src/gst-plugins-ugly/gst-plugins-ugly-${PV}.tar.xz \
             "
 
-SRC_URI[sha256sum] = "fe39a5ee7115e37de9eb65d899ec84c93e6e26ed3ffe25c6d5176cececbab572"
+SRC_URI[sha256sum] = "5486cd145c5af43259fd37caca59d048e2a67ddb07082ea8f50ef0f02a85f8a5"
 
 S = "${UNPACKDIR}/gst-plugins-ugly-${PV}"
 
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.28.2.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.28.4.bb
similarity index 90%
rename from meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.28.2.bb
rename to meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.28.4.bb
index 755c0c7d56b..338cf85e5e9 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.28.2.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.28.4.bb
@@ -10,7 +10,7 @@ PNREAL = "gst-rtsp-server"
 
 SRC_URI = "https://gstreamer.freedesktop.org/src/${PNREAL}/${PNREAL}-${PV}.tar.xz"
 
-SRC_URI[sha256sum] = "917c58b9ff14f91a6b5cd1c3af16c9fcfdf5d8d78d3d167c7e8fa5bdda35f947"
+SRC_URI[sha256sum] = "bfb6780542bf0d402736232aeae6c5a1b943c445775bf40305bcb86ca70705a0"
 
 S = "${UNPACKDIR}/${PNREAL}-${PV}"
 

[OE-core][wrynose 29/56] gstreamer1.0*: upgrade 1.28.4 -> 1.28.5

[Yoann Congal]

From: Peter Marko <peter.marko@siemens.com>

Handle CVE-2026-12891 and CVE-2026-12892.

Set their status explicitly as they are RedHat version-less CVEs.
Fix references are in Debian reports [1] and [2].

Refresh patches.

[1] https://security-tracker.debian.org/tracker/CVE-2026-12891
[2] https://security-tracker.debian.org/tracker/CVE-2026-12892

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8aed1d9b14d77d98adde2f6e345b690ab123b72b)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../{gst-devtools_1.28.4.bb => gst-devtools_1.28.5.bb}        | 2 +-
 .../{gst-examples_1.28.4.bb => gst-examples_1.28.5.bb}        | 2 +-
 ...reamer1.0-libav_1.28.4.bb => gstreamer1.0-libav_1.28.5.bb} | 2 +-
 ...ugins-bad_1.28.4.bb => gstreamer1.0-plugins-bad_1.28.5.bb} | 2 +-
 ...ins-base_1.28.4.bb => gstreamer1.0-plugins-base_1.28.5.bb} | 2 +-
 ...ins-good_1.28.4.bb => gstreamer1.0-plugins-good_1.28.5.bb} | 2 +-
 ...ins-ugly_1.28.4.bb => gstreamer1.0-plugins-ugly_1.28.5.bb} | 2 +-
 ...amer1.0-python_1.28.4.bb => gstreamer1.0-python_1.28.5.bb} | 2 +-
 ...sp-server_1.28.4.bb => gstreamer1.0-rtsp-server_1.28.5.bb} | 2 +-
 .../0002-tests-add-support-for-install-the-tests.patch        | 2 +-
 .../{gstreamer1.0_1.28.4.bb => gstreamer1.0_1.28.5.bb}        | 4 +++-
 11 files changed, 13 insertions(+), 11 deletions(-)
 rename meta/recipes-multimedia/gstreamer/{gst-devtools_1.28.4.bb => gst-devtools_1.28.5.bb} (95%)
 rename meta/recipes-multimedia/gstreamer/{gst-examples_1.28.4.bb => gst-examples_1.28.5.bb} (96%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-libav_1.28.4.bb => gstreamer1.0-libav_1.28.5.bb} (91%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-plugins-bad_1.28.4.bb => gstreamer1.0-plugins-bad_1.28.5.bb} (99%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-plugins-base_1.28.4.bb => gstreamer1.0-plugins-base_1.28.5.bb} (98%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-plugins-good_1.28.4.bb => gstreamer1.0-plugins-good_1.28.5.bb} (97%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-plugins-ugly_1.28.4.bb => gstreamer1.0-plugins-ugly_1.28.5.bb} (94%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-python_1.28.4.bb => gstreamer1.0-python_1.28.5.bb} (91%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0-rtsp-server_1.28.4.bb => gstreamer1.0-rtsp-server_1.28.5.bb} (90%)
 rename meta/recipes-multimedia/gstreamer/{gstreamer1.0_1.28.4.bb => gstreamer1.0_1.28.5.bb} (93%)

diff --git a/meta/recipes-multimedia/gstreamer/gst-devtools_1.28.4.bb b/meta/recipes-multimedia/gstreamer/gst-devtools_1.28.5.bb
similarity index 95%
rename from meta/recipes-multimedia/gstreamer/gst-devtools_1.28.4.bb
rename to meta/recipes-multimedia/gstreamer/gst-devtools_1.28.5.bb
index 9641e42d386..a0775e94add 100644
--- a/meta/recipes-multimedia/gstreamer/gst-devtools_1.28.4.bb
+++ b/meta/recipes-multimedia/gstreamer/gst-devtools_1.28.5.bb
@@ -12,7 +12,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-devtools/gst-devtools-${PV}
            file://0001-connect-has-a-different-signature-on-musl.patch \
            "
 
-SRC_URI[sha256sum] = "11d4f1188639d3a9762039065bbb7b2c309b7a8ecc6fa4aed12245568bf00db3"
+SRC_URI[sha256sum] = "7459045db31d6e44600bcbe011dc925750268870e7b90f7e7a0a3af4a21c09e5"
 
 DEPENDS = "json-glib glib-2.0 glib-2.0-native gstreamer1.0 gstreamer1.0-plugins-base"
 RRECOMMENDS:${PN} = "git"
diff --git a/meta/recipes-multimedia/gstreamer/gst-examples_1.28.4.bb b/meta/recipes-multimedia/gstreamer/gst-examples_1.28.5.bb
similarity index 96%
rename from meta/recipes-multimedia/gstreamer/gst-examples_1.28.4.bb
rename to meta/recipes-multimedia/gstreamer/gst-examples_1.28.5.bb
index ad6374d3fb3..dcdf7fd4331 100644
--- a/meta/recipes-multimedia/gstreamer/gst-examples_1.28.4.bb
+++ b/meta/recipes-multimedia/gstreamer/gst-examples_1.28.5.bb
@@ -12,7 +12,7 @@ SRC_URI = "git://gitlab.freedesktop.org/gstreamer/gstreamer.git;protocol=https;b
            file://gst-player.desktop \
            "
 
-SRCREV = "b46f881eaa8126eddfd21b5ae5512f8d4ff36255"
+SRCREV = "727ceb91886862d200f423baf36cde2bb7ce5b4d"
 
 S = "${UNPACKDIR}/${BP}/subprojects/gst-examples"
 
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.28.4.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.28.5.bb
similarity index 91%
rename from meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.28.4.bb
rename to meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.28.5.bb
index 4898c421905..bda9b213a37 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.28.4.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.28.5.bb
@@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=69333daa044cb77e486cc36129f7a770 \
                     "
 
 SRC_URI = "https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-${PV}.tar.xz"
-SRC_URI[sha256sum] = "bd17a5df2874a7a58bcbaf7b940223379ad9613624db8ead783db03e74bb904b"
+SRC_URI[sha256sum] = "452854656056f0b16511a1d9ad4f2679ff5e5a87c89f90cf7ee5dec005ddb1e4"
 
 S = "${UNPACKDIR}/gst-libav-${PV}"
 
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.4.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.5.bb
similarity index 99%
rename from meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.4.bb
rename to meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.5.bb
index e224112d34c..17e49ebbda2 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.4.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.5.bb
@@ -11,7 +11,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad
            file://0004-opencv-resolve-missing-opencv-data-dir-in-yocto-buil.patch \
            file://0005-wayland-handle-padded-buffers-in-wl_shm-buffer-creat.patch \
            "
-SRC_URI[sha256sum] = "332b7320f30c60f2d5941446d03b9d05e3781f2c2561befbe88718bd777f0e47"
+SRC_URI[sha256sum] = "d8af55faef2958c1a8663751475ee46f5164877cf4d8c5913ea906ef180aeb71"
 
 S = "${UNPACKDIR}/gst-plugins-bad-${PV}"
 
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.28.4.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.28.5.bb
similarity index 98%
rename from meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.28.4.bb
rename to meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.28.5.bb
index d9f85417cd8..813d1108fff 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.28.4.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.28.5.bb
@@ -11,7 +11,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-ba
            file://0003-viv-fb-Make-sure-config.h-is-included.patch \
            file://0002-ssaparse-enhance-SSA-text-lines-parsing.patch \
            "
-SRC_URI[sha256sum] = "a898afd5766172b0049e6781558e0689098bf87b9d82b846c652e571c01d60d8"
+SRC_URI[sha256sum] = "776f19228f91fd25bbf54d9850597e158507f594872a52b9b6814e2429b43eaa"
 
 S = "${UNPACKDIR}/gst-plugins-base-${PV}"
 
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.28.4.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.28.5.bb
similarity index 97%
rename from meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.28.4.bb
rename to meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.28.5.bb
index 9194cae297e..7b8087eecfd 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.28.4.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.28.5.bb
@@ -6,7 +6,7 @@ BUGTRACKER = "https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/issues
 
 SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-${PV}.tar.xz"
 
-SRC_URI[sha256sum] = "c825ea737c59cea0e4a0c41da2388045ff5dd32d162220ac93a7a82ee4a04e61"
+SRC_URI[sha256sum] = "58b45d24a1d77b39d7bb7d9ccc6e2d76bbf28618998c335c163f18e6f94a9324"
 
 S = "${UNPACKDIR}/gst-plugins-good-${PV}"
 
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.28.4.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.28.5.bb
similarity index 94%
rename from meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.28.4.bb
rename to meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.28.5.bb
index 4c0811a0561..451378cf72a 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.28.4.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.28.5.bb
@@ -15,7 +15,7 @@ SRC_URI = " \
             https://gstreamer.freedesktop.org/src/gst-plugins-ugly/gst-plugins-ugly-${PV}.tar.xz \
             "
 
-SRC_URI[sha256sum] = "5486cd145c5af43259fd37caca59d048e2a67ddb07082ea8f50ef0f02a85f8a5"
+SRC_URI[sha256sum] = "0ef4cf9c3c9a5e776a6ca8d190a31863391b681980252143b822b29aa831e120"
 
 S = "${UNPACKDIR}/gst-plugins-ugly-${PV}"
 
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.28.4.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.28.5.bb
similarity index 91%
rename from meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.28.4.bb
rename to meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.28.5.bb
index 555b3105942..d9179286a38 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.28.4.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.28.5.bb
@@ -8,7 +8,7 @@ LICENSE = "LGPL-2.1-or-later"
 LIC_FILES_CHKSUM = "file://COPYING;md5=c34deae4e395ca07e725ab0076a5f740"
 
 SRC_URI = "https://gstreamer.freedesktop.org/src/${PNREAL}/${PNREAL}-${PV}.tar.xz"
-SRC_URI[sha256sum] = "c4eb382720b4443fb801a53418dff0bd4cd7478716d5ced493504a675b4d09fd"
+SRC_URI[sha256sum] = "0ac461b5700b9766998aa686439064caf58ca4fdaf848dfd477b5a7700b176cc"
 
 DEPENDS = "gstreamer1.0 gstreamer1.0-plugins-base python3-pygobject gstreamer1.0-plugins-bad"
 RDEPENDS:${PN} += "gstreamer1.0 gstreamer1.0-plugins-base python3-pygobject"
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.28.4.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.28.5.bb
similarity index 90%
rename from meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.28.4.bb
rename to meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.28.5.bb
index 338cf85e5e9..0b6672c3a6f 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.28.4.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.28.5.bb
@@ -10,7 +10,7 @@ PNREAL = "gst-rtsp-server"
 
 SRC_URI = "https://gstreamer.freedesktop.org/src/${PNREAL}/${PNREAL}-${PV}.tar.xz"
 
-SRC_URI[sha256sum] = "bfb6780542bf0d402736232aeae6c5a1b943c445775bf40305bcb86ca70705a0"
+SRC_URI[sha256sum] = "7e19fddeb1261bebc3ec397857fedd5c77129b66ab52788fdadad05117566225"
 
 S = "${UNPACKDIR}/${PNREAL}-${PV}"
 
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0/0002-tests-add-support-for-install-the-tests.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0/0002-tests-add-support-for-install-the-tests.patch
index 957356c2ba6..5b52d66190d 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0/0002-tests-add-support-for-install-the-tests.patch
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0/0002-tests-add-support-for-install-the-tests.patch
@@ -22,7 +22,7 @@ diff --git a/meson.build b/meson.build
 index abd0ad6..93cd692 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -661,6 +661,10 @@ if bashcomp_dep.found()
+@@ -662,6 +662,10 @@ if bashcomp_dep.found()
    endif
  endif
  
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.28.4.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.28.5.bb
similarity index 93%
rename from meta/recipes-multimedia/gstreamer/gstreamer1.0_1.28.4.bb
rename to meta/recipes-multimedia/gstreamer/gstreamer1.0_1.28.5.bb
index d1f06a52338..2bdb1dc8025 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.28.4.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.28.5.bb
@@ -22,7 +22,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gstreamer/gstreamer-${PV}.tar.x
            file://0003-tests-use-a-dictionaries-for-environment.patch \
            file://0004-tests-add-helper-script-to-run-the-installed_tests.patch \
            "
-SRC_URI[sha256sum] = "f5adc7e8f448c10260b3b25aa101c9d540674c8d9a54c2b77a86d04f2b3b50dd"
+SRC_URI[sha256sum] = "a5a9f783809b17a8eb774f4a7695b2cb8cba6b15520129906f87eaf30e7f8469"
 
 PACKAGECONFIG ??= "${@bb.utils.contains('PTEST_ENABLED', '1', 'tests', '', d)} \
                    check \
@@ -72,5 +72,7 @@ RDEPENDS:${PN}-ptest:append:libc-glibc = " glibc-gconv-iso8859-5"
 CVE_PRODUCT = "gstreamer"
 
 CVE_STATUS[CVE-2026-5056] = "cpe-stable-backport: Fixed since 1.28.2"
+CVE_STATUS[CVE-2026-12891] = "cpe-stable-backport: Fixed since 1.28.5"
+CVE_STATUS[CVE-2026-12892] = "cpe-stable-backport: Fixed since 1.28.5"
 
 PTEST_BUILD_HOST_FILES = ""

[OE-core][wrynose 30/56] xserver-xorg: upgrade 21.1.22 -> 21.1.23

[Yoann Congal]

From: Richard Purdie <richard.purdie@linuxfoundation.org>

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: ad22af929c5928ac202cb84ef07ee25689f928b4)

Release notes:
* https://lists.x.org/archives/xorg-announce/2026-June/003702.html
* https://lists.x.org/archives/xorg-announce/2026-June/003703.html

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 ...1-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch | 2 +-
 .../{xserver-xorg_21.1.22.bb => xserver-xorg_21.1.23.bb}        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 rename meta/recipes-graphics/xorg-xserver/{xserver-xorg_21.1.22.bb => xserver-xorg_21.1.23.bb} (92%)

diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch
index 7d151aaa63f..4a5bf4ba437 100644
--- a/meta/recipes-graphics/xorg-xserver/xserver-xorg/0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch
@@ -1,4 +1,4 @@
-From 6d23037f48f3d534286fc2bda927c9b6ee5d1445 Mon Sep 17 00:00:00 2001
+From fec2a3c8922ee7526d59e9fa2c6ad0943018b7b0 Mon Sep 17 00:00:00 2001
 From: California Sullivan <california.l.sullivan@intel.com>
 Date: Fri, 16 Mar 2018 17:23:11 -0700
 Subject: [PATCH] xf86pciBus.c: use Intel ddx only for pre-gen4 hardware
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.22.bb b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.23.bb
similarity index 92%
rename from meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.22.bb
rename to meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.23.bb
index 6a9826d959a..d3c00e087e5 100644
--- a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.22.bb
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.23.bb
@@ -1,7 +1,7 @@
 require xserver-xorg.inc
 
 SRC_URI += " file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch"
-SRC_URI[sha256sum] = "1a242c8917c49ba29ccc1f6021613d8a2b9805dd0d271a66ae9d09f4b0bb06b3"
+SRC_URI[sha256sum] = "e39832e5617dadaf072fdf9f0e19e5d2e1c2a13607ac280bac1aba9f8fe14634"
 
 # These extensions are now integrated into the server, so declare the migration
 # path for in-place upgrades.

[OE-core][wrynose 31/56] xserver-xorg: upgrade 21.1.23 -> 21.1.24

[Yoann Congal]

From: Richard Purdie <richard.purdie@linuxfoundation.org>

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: a0bcc350b93bee2217cb723ccd6baba6fa252e0d)

Release notes:
* https://lists.x.org/archives/xorg-announce/2026-July/003716.html
* https://lists.x.org/archives/xorg-announce/2026-July/003718.html

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 ...1-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch | 2 +-
 .../{xserver-xorg_21.1.23.bb => xserver-xorg_21.1.24.bb}        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 rename meta/recipes-graphics/xorg-xserver/{xserver-xorg_21.1.23.bb => xserver-xorg_21.1.24.bb} (92%)

diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch
index 4a5bf4ba437..14831b1a9b9 100644
--- a/meta/recipes-graphics/xorg-xserver/xserver-xorg/0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch
@@ -1,4 +1,4 @@
-From fec2a3c8922ee7526d59e9fa2c6ad0943018b7b0 Mon Sep 17 00:00:00 2001
+From d387580194e91ad73f896a9669757612c8601c92 Mon Sep 17 00:00:00 2001
 From: California Sullivan <california.l.sullivan@intel.com>
 Date: Fri, 16 Mar 2018 17:23:11 -0700
 Subject: [PATCH] xf86pciBus.c: use Intel ddx only for pre-gen4 hardware
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.23.bb b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.24.bb
similarity index 92%
rename from meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.23.bb
rename to meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.24.bb
index d3c00e087e5..8d7f9ae14d2 100644
--- a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.23.bb
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.24.bb
@@ -1,7 +1,7 @@
 require xserver-xorg.inc
 
 SRC_URI += " file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch"
-SRC_URI[sha256sum] = "e39832e5617dadaf072fdf9f0e19e5d2e1c2a13607ac280bac1aba9f8fe14634"
+SRC_URI[sha256sum] = "1a4eb36ca65cc3b1b936566d677a9786e13c11cd5806e951ac55f3f5ce3984af"
 
 # These extensions are now integrated into the server, so declare the migration
 # path for in-place upgrades.

[OE-core][wrynose 32/56] ffmpeg: upgrade 8.0.1 -> 8.0.3

[Yoann Congal]

From: Peter Marko <peter.marko@siemens.com>

Changelog:
* https://github.com/FFmpeg/FFmpeg/blob/n8.0.2/Changelog
* https://github.com/FFmpeg/FFmpeg/blob/n8.0.3/Changelog

Resolves CVEs:
* CVE-2025-69693
* CVE-2026-30997
* CVE-2026-30998
* CVE-2026-30999
* CVE-2026-40962
* CVE-2026-8461

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../ffmpeg/{ffmpeg_8.0.1.bb => ffmpeg_8.0.3.bb}                 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-multimedia/ffmpeg/{ffmpeg_8.0.1.bb => ffmpeg_8.0.3.bb} (99%)

diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.1.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb
similarity index 99%
rename from meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.1.bb
rename to meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb
index b6d3ceb6dc3..f2a729fc41c 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.1.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb
@@ -28,7 +28,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \
            file://0002-ffbuild-common.mak-ensure-target-directories-are-cre.patch \
            "
 
-SRC_URI[sha256sum] = "05ee0b03119b45c0bdb4df654b96802e909e0a752f72e4fe3794f487229e5a41"
+SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818"
 
 # Build fails when thumb is enabled: https://bugzilla.yoctoproject.org/show_bug.cgi?id=7717
 ARM_INSTRUCTION_SET:armv4 = "arm"

[OE-core][wrynose 33/56] ffmpeg: set status for CVE-2026-8461 and CVE-2026-40962

[Yoann Congal]

From: Peter Marko <peter.marko@siemens.com>

[1] shows that CVE-2026-8461 was fixed by [2] backported as [3].
[4] shows that CVE-2026-40962 was fixed by [4] backported as [4].

[1] https://security-tracker.debian.org/tracker/CVE-2026-8461
[2] https://git.ffmpeg.org/gitweb/ffmpeg.git/c23d4da3128c279b714b282e6ec292e8755007e3
[3] https://git.ffmpeg.org/gitweb/ffmpeg.git/3e8f3537f957da011d7360acacc9941f3ce5c306
[4] https://security-tracker.debian.org/tracker/CVE-2026-40962
[5] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e392fb8c9c3949d975531d2b23c645d2465a7ebc
[6] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b14ba12669d75f5f73d8634c6db36e704144532

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb
index f2a729fc41c..8a6eb4eb863 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb
@@ -183,3 +183,5 @@ CVE_STATUS[CVE-2025-25469] = "fixed-version: these CVEs are fixed since v8.0"
 CVE_STATUS[CVE-2025-12343] = "fixed-version: this CVE are fixed since v8.0"
 CVE_STATUS[CVE-2025-59729] = "fixed-version: this CVE are fixed since v8.0"
 CVE_STATUS[CVE-2025-59730] = "fixed-version: this CVE are fixed since v8.0"
+CVE_STATUS[CVE-2026-8461] = "cpe-stable-backport: this CVE are fixed since v8.0.3"
+CVE_STATUS[CVE-2026-40962] = "cpe-stable-backport: this CVE are fixed since v8.0.2"

[OE-core][wrynose 34/56] libsoup: patch CVE-2026-4271

[Yoann Congal]

From: Peter Marko <peter.marko@siemens.com>

Pick patch which has closed gitlab issue for the CVE [1].
The issue is also referenced in [2]

[1] https://gitlab.gnome.org/GNOME/libsoup/-/work_items/496
[2] https://security-tracker.debian.org/tracker/CVE-2026-4271

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 704a1cd0b88ddea0fa790054c3752e82d3d4403d)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../libsoup/libsoup/CVE-2026-4271.patch       | 362 ++++++++++++++++++
 meta/recipes-support/libsoup/libsoup_3.6.6.bb |   1 +
 2 files changed, 363 insertions(+)
 create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2026-4271.patch

diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2026-4271.patch b/meta/recipes-support/libsoup/libsoup/CVE-2026-4271.patch
new file mode 100644
index 00000000000..ca377e03553
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup/CVE-2026-4271.patch
@@ -0,0 +1,362 @@
+From 489affa74c8a229b8a4dd541710d4a5debedb7b4 Mon Sep 17 00:00:00 2001
+From: Carlos Garcia Campos <cgarcia@igalia.com>
+Date: Mon, 16 Feb 2026 12:09:08 +0100
+Subject: [PATCH] server: protect message io while reading and writing
+
+Ensure the nghttp2 session is not destroyed while being used.
+
+Closes #496
+
+CVE: CVE-2026-4271
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/489affa74c8a229b8a4dd541710d4a5debedb7b4]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ .../http2/soup-server-message-io-http2.c      | 117 +++++++++++++-----
+ tests/http2-test.c                            |  54 ++++++++
+ 2 files changed, 141 insertions(+), 30 deletions(-)
+
+diff --git a/libsoup/server/http2/soup-server-message-io-http2.c b/libsoup/server/http2/soup-server-message-io-http2.c
+index 913afb46..6f8d1bb6 100644
+--- a/libsoup/server/http2/soup-server-message-io-http2.c
++++ b/libsoup/server/http2/soup-server-message-io-http2.c
+@@ -69,6 +69,8 @@ typedef struct {
+         GHashTable *messages;
+ 
+         guint in_callback;
++        guint protected;
++        gboolean destroyed;
+ } SoupServerMessageIOHTTP2;
+ 
+ static void soup_server_message_io_http2_send_response (SoupServerMessageIOHTTP2 *io,
+@@ -146,6 +148,8 @@ soup_server_message_io_http2_destroy (SoupServerMessageIO *iface)
+ {
+         SoupServerMessageIOHTTP2 *io = (SoupServerMessageIOHTTP2 *)iface;
+ 
++        io->destroyed = TRUE;
++
+         if (io->read_source) {
+                 g_source_destroy (io->read_source);
+                 g_source_unref (io->read_source);
+@@ -160,10 +164,14 @@ soup_server_message_io_http2_destroy (SoupServerMessageIO *iface)
+         }
+ 
+         g_clear_object (&io->iostream);
+-        g_clear_pointer (&io->session, nghttp2_session_del);
+-        g_clear_pointer (&io->messages, g_hash_table_unref);
++        io->istream = NULL;
++        io->ostream = NULL;
+ 
+-        g_free (io);
++        if (io->protected == 0) {
++                g_clear_pointer (&io->session, nghttp2_session_del);
++                g_clear_pointer (&io->messages, g_hash_table_unref);
++                g_free (io);
++        }
+ }
+ 
+ static void
+@@ -321,7 +329,33 @@ static const SoupServerMessageIOFuncs io_funcs = {
+         soup_server_message_io_http2_is_paused
+ };
+ 
++static void
++soup_server_message_io_http2_protect (SoupServerMessageIOHTTP2 *io)
++{
++        io->protected++;
++        g_object_ref (io->conn);
++}
++
+ static gboolean
++soup_server_message_io_http2_unprotect (SoupServerMessageIOHTTP2 *io)
++{
++        g_object_unref (io->conn);
++
++        if (--io->protected > 0)
++                return FALSE;
++
++        if (io->destroyed) {
++                g_clear_pointer (&io->session, nghttp2_session_del);
++                g_clear_pointer (&io->messages, g_hash_table_unref);
++                g_free (io);
++
++                return TRUE;
++        }
++
++        return FALSE;
++}
++
++static void
+ io_write (SoupServerMessageIOHTTP2 *io,
+           GError                  **error)
+ {
+@@ -336,51 +370,57 @@ io_write (SoupServerMessageIOHTTP2 *io,
+                 if (io->write_buffer_size == 0) {
+                         /* Done */
+                         io->write_buffer = NULL;
+-                        return TRUE;
++                        return;
+                 }
+         }
+ 
++        if (!io->ostream)
++                return;
++
+         gssize ret = g_pollable_stream_write (io->ostream,
+                                               io->write_buffer + io->written_bytes,
+                                               io->write_buffer_size - io->written_bytes,
+                                               FALSE, NULL, error);
+-        if (ret < 0)
+-                return FALSE;
+-
+-        io->written_bytes += ret;
+-        return TRUE;
++        if (ret > 0)
++                io->written_bytes += ret;
+ }
+ 
+ static gboolean
+ io_write_ready (GObject                  *stream,
+                 SoupServerMessageIOHTTP2 *io)
+ {
+-        SoupServerConnection *conn = io->conn;
+         GError *error = NULL;
+ 
+-        g_object_ref (conn);
++        soup_server_message_io_http2_protect (io);
++
++        while (!error) {
++                if (io->destroyed)
++                        break;
++
++                if (!nghttp2_session_want_write (io->session))
++                        break;
+ 
+-        while (!error && soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io && nghttp2_session_want_write (io->session))
+                 io_write (io, &error);
++        }
+ 
+         if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_WOULD_BLOCK)) {
+                 g_error_free (error);
+-                g_object_unref (conn);
++                soup_server_message_io_http2_unprotect (io);
+                 return G_SOURCE_CONTINUE;
+         }
+ 
+-        if (soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io) {
++        if (!io->destroyed) {
+                 if (error)
+                         h2_debug (io, NULL, "[SESSION] IO error: %s", error->message);
+ 
+                 g_clear_pointer (&io->write_source, g_source_unref);
+ 
+                 if (error || (!nghttp2_session_want_read (io->session) && !nghttp2_session_want_write (io->session)))
+-                        soup_server_connection_disconnect (conn);
++                        soup_server_connection_disconnect (io->conn);
+         }
+ 
+         g_clear_error (&error);
+-        g_object_unref (conn);
++        soup_server_message_io_http2_unprotect (io);
+ 
+         return G_SOURCE_REMOVE;
+ }
+@@ -390,13 +430,12 @@ static gboolean io_write_idle_cb (SoupServerMessageIOHTTP2* io);
+ static void
+ io_try_write (SoupServerMessageIOHTTP2 *io)
+ {
+-        SoupServerConnection *conn = io->conn;
+         GError *error = NULL;
+ 
+         if (io->write_source)
+                 return;
+ 
+-        if (io->in_callback && soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io) {
++        if (io->in_callback && !io->destroyed) {
+                 if (!nghttp2_session_want_write (io->session))
+                         return;
+ 
+@@ -416,12 +455,19 @@ io_try_write (SoupServerMessageIOHTTP2 *io)
+                 g_clear_pointer (&io->write_idle_source, g_source_unref);
+         }
+ 
+-        g_object_ref (conn);
++        soup_server_message_io_http2_protect (io);
++
++        while (!error) {
++                if (io->destroyed)
++                        break;
++
++                if (!nghttp2_session_want_write (io->session))
++                        break;
+ 
+-        while (!error && soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io && !io->in_callback && nghttp2_session_want_write (io->session))
+                 io_write (io, &error);
++        }
+ 
+-        if (soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io) {
++        if (!io->destroyed) {
+                 if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_WOULD_BLOCK)) {
+                         g_clear_error (&error);
+                         io->write_source = g_pollable_output_stream_create_source (G_POLLABLE_OUTPUT_STREAM (io->ostream), NULL);
+@@ -434,11 +480,11 @@ io_try_write (SoupServerMessageIOHTTP2 *io)
+                         h2_debug (io, NULL, "[SESSION] IO error: %s", error->message);
+ 
+                 if (error || (!nghttp2_session_want_read (io->session) && !nghttp2_session_want_write (io->session)))
+-                        soup_server_connection_disconnect (conn);
++                        soup_server_connection_disconnect (io->conn);
+         }
+ 
+         g_clear_error (&error);
+-        g_object_unref (conn);
++        soup_server_message_io_http2_unprotect (io);
+ }
+ 
+ static gboolean
+@@ -481,31 +527,37 @@ static gboolean
+ io_read_ready (GObject                  *stream,
+                SoupServerMessageIOHTTP2 *io)
+ {
+-        SoupServerConnection *conn = io->conn;
+         gboolean progress = TRUE;
+         GError *error = NULL;
+ 
+-        g_object_ref (conn);
++        soup_server_message_io_http2_protect (io);
++
++        while (progress) {
++                if (io->destroyed)
++                        break;
++
++                if (!nghttp2_session_want_read (io->session))
++                        break;
+ 
+-        while (progress && soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io && nghttp2_session_want_read (io->session))
+                 progress = io_read (io, &error);
++        }
+ 
+         if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_WOULD_BLOCK)) {
+                 g_error_free (error);
+-                g_object_unref (conn);
++                soup_server_message_io_http2_unprotect (io);
+                 return G_SOURCE_CONTINUE;
+         }
+ 
+-        if (soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io) {
++        if (!io->destroyed) {
+                 if (error)
+                         h2_debug (io, NULL, "[SESSION] IO error: %s", error->message);
+ 
+                 if (error || (!nghttp2_session_want_read (io->session) && !nghttp2_session_want_write (io->session)))
+-                        soup_server_connection_disconnect (conn);
++                        soup_server_connection_disconnect (io->conn);
+         }
+ 
+         g_clear_error (&error);
+-        g_object_unref (conn);
++        soup_server_message_io_http2_unprotect (io);
+ 
+         return G_SOURCE_REMOVE;
+ }
+@@ -931,5 +983,10 @@ soup_server_message_io_http2_new (SoupServerConnection  *conn,
+         nghttp2_submit_settings (io->session, NGHTTP2_FLAG_NONE, settings, G_N_ELEMENTS (settings));
+         io_try_write (io);
+ 
++#ifdef __clang_analyzer__
++        // Suppress false positive about io being destroyed here, since at this point we have only
++        // send the initial settings and not callback is called.
++        [[clang::suppress]]
++#endif
+         return (SoupServerMessageIO *)io;
+ }
+diff --git a/tests/http2-test.c b/tests/http2-test.c
+index 0846a0a6..d12b4bf7 100644
+--- a/tests/http2-test.c
++++ b/tests/http2-test.c
+@@ -1268,6 +1268,40 @@ do_broken_pseudo_header_test (Test *test, gconstpointer data)
+ 	g_uri_unref (uri);
+ }
+ 
++static void
++disconnect_on_got_headers (SoupServerMessage *msg, gpointer user_data)
++{
++        GUri *uri;
++        SoupServerConnection *conn;
++
++        uri = soup_server_message_get_uri (msg);
++        if (!g_str_equal (g_uri_get_path (uri), "/close-on-got-headers"))
++                return;
++
++        conn = soup_server_message_get_connection (msg);
++        soup_server_connection_disconnect (conn);
++}
++
++static void
++do_server_disconnect_on_got_headers_test (Test *test, gconstpointer data)
++{
++        SoupMessage *msg;
++        GUri *uri;
++        GBytes *response;
++        GError *error = NULL;
++
++        uri = g_uri_parse_relative (base_uri, "/close-on-got-headers", SOUP_HTTP_URI_FLAGS, NULL);
++        msg = soup_message_new_from_uri (SOUP_METHOD_GET, uri);
++
++        response = soup_test_session_async_send (test->session, msg, NULL, &error);
++        g_assert_error (error, G_IO_ERROR, G_IO_ERROR_PARTIAL_INPUT);
++
++        g_clear_error (&error);
++        g_bytes_unref (response);
++        g_object_unref (msg);
++        g_uri_unref (uri);
++}
++
+ static gboolean
+ unpause_message (SoupServerMessage *msg)
+ {
+@@ -1396,12 +1430,26 @@ server_handler (SoupServer        *server,
+                 shutdown (fd, SHUT_WR);
+ #endif
+ 
++                soup_server_message_set_response (msg, "text/plain",
++                                                  SOUP_MEMORY_STATIC,
++                                                  "Success!", 8);
++        } else if (strcmp (path, "/close-on-got-headers") == 0) {
+                 soup_server_message_set_response (msg, "text/plain",
+                                                   SOUP_MEMORY_STATIC,
+                                                   "Success!", 8);
+         }
+ }
+ 
++static void
++server_request_started (SoupServer           *server,
++                        SoupServerMessage    *msg,
++                        SoupServerConnection *conn,
++                        gpointer              user_data)
++{
++        g_signal_connect (msg, "got-headers",
++                          G_CALLBACK (disconnect_on_got_headers), NULL);
++}
++
+ static gboolean
+ server_basic_auth_callback (SoupAuthDomain    *auth_domain,
+                             SoupServerMessage *msg,
+@@ -1428,6 +1476,8 @@ main (int argc, char **argv)
+                 return 0;
+ 
+         server = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD | SOUP_TEST_SERVER_HTTP2);
++        g_signal_connect (server, "request-started",
++                          G_CALLBACK (server_request_started), NULL);
+         auth = soup_auth_domain_basic_new ("realm", "http2-test",
+                                            "auth-callback", server_basic_auth_callback,
+                                            NULL);
+@@ -1584,6 +1634,10 @@ main (int argc, char **argv)
+                     setup_session,
+                     do_broken_pseudo_header_test,
+                     teardown_session);
++        g_test_add ("/http2/server-disconnect-on-got-headers", Test, NULL,
++                    setup_session,
++                    do_server_disconnect_on_got_headers_test,
++                    teardown_session);
+ 
+ 	ret = g_test_run ();
+ 
diff --git a/meta/recipes-support/libsoup/libsoup_3.6.6.bb b/meta/recipes-support/libsoup/libsoup_3.6.6.bb
index d18a16379b3..e5c2d18ded7 100644
--- a/meta/recipes-support/libsoup/libsoup_3.6.6.bb
+++ b/meta/recipes-support/libsoup/libsoup_3.6.6.bb
@@ -20,6 +20,7 @@ SRC_URI += "file://CVE-2025-32049-1.patch \
             file://CVE-2026-1539.patch \
             file://CVE-2026-5119.patch \
             file://CVE-2026-2708.patch \
+            file://CVE-2026-4271.patch \
 "
 
 PROVIDES = "libsoup-3.0"

[OE-core][wrynose 35/56] python3-pyasn1: upgrade 0.6.2 -> 0.6.3

[Yoann Congal]

From: Wang Mingyu <wangmy@fujitsu.com>

Changelog:
==========
- CVE-2026-30922 (GHSA-jr27-m4p2-rc6r): Added nesting depth limit to ASN.1
  decoder to prevent stack overflow from deeply nested structures
- Fixed OverflowError from oversized BER length field
- Fixed DeprecationWarning stacklevel for deprecated attributes
- Fixed asDateTime incorrect fractional seconds parsing

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(From OE-Core rev: a82592f0a7d104f617f206fe0b9bcaf7f9df3efc)

Release notes:
* https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst#revision-063-released-16-03-2026
* CVE-2026-30922 (GHSA-jr27-m4p2-rc6r): Added nesting depth limit to
  ASN.1 decoder to prevent stack overflow from deeply nested structures
  (thanks for reporting, romanticpragmatism)
* Fixed OverflowError from oversized BER length field
* Fixed DeprecationWarning stacklevel for deprecated attributes
* Fixed asDateTime incorrect fractional seconds parsing

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../python/{python3-pyasn1_0.6.2.bb => python3-pyasn1_0.6.3.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/python/{python3-pyasn1_0.6.2.bb => python3-pyasn1_0.6.3.bb} (83%)

diff --git a/meta/recipes-devtools/python/python3-pyasn1_0.6.2.bb b/meta/recipes-devtools/python/python3-pyasn1_0.6.3.bb
similarity index 83%
rename from meta/recipes-devtools/python/python3-pyasn1_0.6.2.bb
rename to meta/recipes-devtools/python/python3-pyasn1_0.6.3.bb
index b44e8774474..60b38c57c55 100644
--- a/meta/recipes-devtools/python/python3-pyasn1_0.6.2.bb
+++ b/meta/recipes-devtools/python/python3-pyasn1_0.6.3.bb
@@ -3,7 +3,7 @@ HOMEPAGE = "http://pyasn1.sourceforge.net/"
 LICENSE = "BSD-2-Clause"
 LIC_FILES_CHKSUM = "file://LICENSE.rst;md5=190f79253908c986e6cacf380c3a5f6d"
 
-SRC_URI[sha256sum] = "9b59a2b25ba7e4f8197db7686c09fb33e658b98339fadb826e9512629017833b"
+SRC_URI[sha256sum] = "697a8ecd6d98891189184ca1fa05d1bb00e2f84b5977c481452050549c8a72cf"
 
 inherit pypi python_setuptools_build_meta ptest-python-pytest
 

[OE-core][wrynose 36/56] python3-pyasn1: upgrade 0.6.3 -> 0.6.4

[Yoann Congal]

From: Tim Orling <tim.orling@konsulko.com>

Upstream release notes:
https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst#revision-064-released-08-07-2026

Revision 0.6.4, released 08-07-2026
* CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity
  in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted
  substrate encoding many arcs could consume excessive CPU. Arcs are now
  accumulated in linear time; decoded values are unchanged (thanks for
  reporting, tynus2)
* CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to
  20 octets (140 bits), matching the OID arc limit introduced in 0.6.2.
  Unbounded tag IDs allowed a crafted substrate to consume excessive CPU
  and memory; longer tag IDs are now rejected with PyAsn1Error. Also fixed
  Tag and TagSet repr() failing on huge tag (thanks for reporting,
  mikeappsec) IDs due to the integer-to-string conversion limit (Python
  3.11+)
* CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU
  consumption in Real.__float__() for values with large base-10 exponents.
  Conversion no longer materializes huge intermediate integers; values too
  large to represent as a Python float raise OverflowError promptly, and
  prettyPrint() renders them as '<overflow>' as before. Also fixed base-10
  mantissa normalization to use exact integer arithmetic; mantissas larger
  than 2**53 could previously lose precision through float division (thanks
  for reporting, gvozdila)
* Pinned PyPI publish GitHub Action to an immutable commit

For full comparison of changes, see:
https://github.com/pyasn1/pyasn1/compare/v0.6.3...v0.6.4

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 3654efbe3e732b0ae0f44e4c71c2473e719f83ef)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../python/{python3-pyasn1_0.6.3.bb => python3-pyasn1_0.6.4.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/python/{python3-pyasn1_0.6.3.bb => python3-pyasn1_0.6.4.bb} (83%)

diff --git a/meta/recipes-devtools/python/python3-pyasn1_0.6.3.bb b/meta/recipes-devtools/python/python3-pyasn1_0.6.4.bb
similarity index 83%
rename from meta/recipes-devtools/python/python3-pyasn1_0.6.3.bb
rename to meta/recipes-devtools/python/python3-pyasn1_0.6.4.bb
index 60b38c57c55..086a21ffe87 100644
--- a/meta/recipes-devtools/python/python3-pyasn1_0.6.3.bb
+++ b/meta/recipes-devtools/python/python3-pyasn1_0.6.4.bb
@@ -3,7 +3,7 @@ HOMEPAGE = "http://pyasn1.sourceforge.net/"
 LICENSE = "BSD-2-Clause"
 LIC_FILES_CHKSUM = "file://LICENSE.rst;md5=190f79253908c986e6cacf380c3a5f6d"
 
-SRC_URI[sha256sum] = "697a8ecd6d98891189184ca1fa05d1bb00e2f84b5977c481452050549c8a72cf"
+SRC_URI[sha256sum] = "9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81"
 
 inherit pypi python_setuptools_build_meta ptest-python-pytest
 

[OE-core][wrynose 37/56] diffutils: patch CVE-2026-53910

[Yoann Congal]

From: Peter Marko <peter.marko@siemens.com>

Pick patches mentioned in NVD CVE report.

Adapt NEWS file to apply one of the patches.
Add special code to prevent build error dues to rebuild of manpage.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 3406d85634e5d793eb5c4f5ec9b7f03774a86d65)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../diffutils/CVE-2026-53910-01.patch         | 67 +++++++++++++++++++
 .../diffutils/CVE-2026-53910-02.patch         | 35 ++++++++++
 .../diffutils/diffutils_3.12.bb               |  9 +++
 3 files changed, 111 insertions(+)
 create mode 100644 meta/recipes-extended/diffutils/diffutils/CVE-2026-53910-01.patch
 create mode 100644 meta/recipes-extended/diffutils/diffutils/CVE-2026-53910-02.patch

diff --git a/meta/recipes-extended/diffutils/diffutils/CVE-2026-53910-01.patch b/meta/recipes-extended/diffutils/diffutils/CVE-2026-53910-01.patch
new file mode 100644
index 00000000000..b2da72b04c5
--- /dev/null
+++ b/meta/recipes-extended/diffutils/diffutils/CVE-2026-53910-01.patch
@@ -0,0 +1,67 @@
+From 73ed7ce85cc78effb94daf028c9af6b4e5252e50 Mon Sep 17 00:00:00 2001
+From: Collin Funk <collin.funk1@gmail.com>
+Date: Mon, 20 Apr 2026 23:43:51 -0700
+Subject: [PATCH] diff3: check for integer overflows when reading line numbers
+ from diff
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported by Michał Majchrowicz.
+* NEWS: Mention the bug fix.
+* src/diff3.c (readnum): Return nullptr if the line number would
+overflow.
+
+CVE: CVE-2026-53910
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=73ed7ce85cc78effb94daf028c9af6b4e5252e50]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ NEWS        | 8 ++++++++
+ THANKS      | 1 +
+ src/diff3.c | 3 ++-
+ 3 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/NEWS b/NEWS
+index a8115f7..bfe20d4 100644
+--- a/NEWS
++++ b/NEWS
+@@ -1,5 +1,13 @@
+ GNU diffutils NEWS                                    -*- outline -*-
+ 
++ * Noteworthy changes in release ?.? (????-??-??) [?]
++
++** Bug fixes
++
++  diff3 no longer overflows integers when reading line numbers from the
++  diff program.
++  [bug present since "the beginning"]
++
+ * Noteworthy changes in release 3.12 (2025-04-08) [stable]
+ 
+ ** Bug fixes
+diff --git a/THANKS b/THANKS
+index a96b68d..a372954 100644
+--- a/THANKS
++++ b/THANKS
+@@ -13,6 +13,7 @@ Chris Hanson <cph@gnu.org>
+ Jim Kingdon  <kingdon@panix.com>
+ Tom Lord  <lord@gnu.org>
+ David J. MacKenzie  <djm@gnu.org>
++Michał Majchrowicz  <mmajchrowicz@afine.com>
+ Roland McGrath  <roland@redhat.com>
+ Jim Meyering  <jim@meyering.net>
+ Gene Myers  <gene@eecs.berkeley.edu>
+diff --git a/src/diff3.c b/src/diff3.c
+index 1dfba37..1a74407 100644
+--- a/src/diff3.c
++++ b/src/diff3.c
+@@ -1020,7 +1020,8 @@ readnum (char *s, lin *pnum)
+ 
+   do
+     {
+-      num = c - '0' + num * 10;
++      if (ckd_mul (&num, num, 10) || ckd_add (&num, num, c - '0'))
++        return nullptr;
+       c = *++s;
+     }
+   while (c_isdigit (c));
diff --git a/meta/recipes-extended/diffutils/diffutils/CVE-2026-53910-02.patch b/meta/recipes-extended/diffutils/diffutils/CVE-2026-53910-02.patch
new file mode 100644
index 00000000000..7f87893f516
--- /dev/null
+++ b/meta/recipes-extended/diffutils/diffutils/CVE-2026-53910-02.patch
@@ -0,0 +1,35 @@
+From 9ff04d5b84743e331e80b589335a52c5480d1815 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Tue, 21 Apr 2026 00:30:50 -0700
+Subject: [PATCH] diff3: prevent overflow in line offsets
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Problem reported by Michał Majchrowicz.
+* src/diff3.c (readnum): Limit line numbers to LIN_MAX / 2.
+
+CVE: CVE-2026-53910
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=9ff04d5b84743e331e80b589335a52c5480d1815]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/diff3.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/diff3.c b/src/diff3.c
+index 4fed6a8..d32e6ad 100644
+--- a/src/diff3.c
++++ b/src/diff3.c
+@@ -1026,6 +1026,12 @@ readnum (char *s, lin *pnum)
+     }
+   while (c_isdigit (c));
+ 
++  /* Simplify overflow checking later, so that we can always add a
++     line number and a line count, or subtract two line numbers and
++     add 1 to the result, without worrying about overflow.  */
++  if (LIN_MAX / 2 < num)
++    return nullptr;
++
+   *pnum = num;
+   return s;
+ }
diff --git a/meta/recipes-extended/diffutils/diffutils_3.12.bb b/meta/recipes-extended/diffutils/diffutils_3.12.bb
index d00dd772ad7..5bf0540eabf 100644
--- a/meta/recipes-extended/diffutils/diffutils_3.12.bb
+++ b/meta/recipes-extended/diffutils/diffutils_3.12.bb
@@ -6,6 +6,8 @@ require diffutils.inc
 SRC_URI = "${GNU_MIRROR}/diffutils/diffutils-${PV}.tar.xz \
            file://run-ptest \
            file://0001-Skip-strip-trailing-cr-test-case.patch \
+           file://CVE-2026-53910-01.patch \
+           file://CVE-2026-53910-02.patch \
            "
 
 SRC_URI[sha256sum] = "7c8b7f9fc8609141fdea9cece85249d308624391ff61dedaf528fcb337727dfd"
@@ -21,6 +23,13 @@ inherit ptest
 
 RDEPENDS:${PN}-ptest += "make perl"
 
+# patch for CVE-2026-53910 touches source file, so build is trying to
+# refresh the manual, which is failing in cross-compile environment;
+# remove this code on next upgrade
+do_compile:prepend() {
+    touch ${S}/man/diff3.1
+}
+
 do_install_ptest() {
 	t=${D}${PTEST_PATH}
 	install -D ${S}/build-aux/test-driver $t/build-aux/test-driver

[OE-core][wrynose 38/56] ruby: upgrade 4.0.2 -> 4.0.3

[Yoann Congal]

From: Richard Purdie <richard.purdie@linuxfoundation.org>

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 783704523898316721b8fe0a74b47c69fd0b46d9)

Release notes:
* https://www.ruby-lang.org/en/news/2026/04/21/ruby-4-0-3-released/
* This release only contains ERB 6.0.1.1, which fixes CVE-2026-41316.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../0001-Don-t-save-the-original-name-and-timestamp.patch   | 5 +----
 .../0001-extmk-fix-cross-compilation-of-external-gems.patch | 6 +++---
 ...-vm_dump.c-Define-REG_S1-and-REG_S2-for-musl-riscv.patch | 4 ++--
 .../ruby/0002-Obey-LDFLAGS-for-the-link-of-libruby.patch    | 6 +++---
 .../ruby/0003-rdoc-build-reproducible-documentation.patch   | 5 +----
 ...b-mkmf.rb-sort-list-of-object-files-in-generated-M.patch | 6 +++---
 ...Mark-Gemspec-reproducible-change-fixing-784225-too.patch | 6 +++---
 .../ruby/ruby/0006-Make-gemspecs-reproducible.patch         | 5 +----
 ...0007-Skip-test_rm_r_no_permissions-test-under-root.patch | 4 ++--
 meta/recipes-devtools/ruby/{ruby_4.0.2.bb => ruby_4.0.3.bb} | 2 +-
 10 files changed, 20 insertions(+), 29 deletions(-)
 rename meta/recipes-devtools/ruby/{ruby_4.0.2.bb => ruby_4.0.3.bb} (98%)

diff --git a/meta/recipes-devtools/ruby/ruby/0001-Don-t-save-the-original-name-and-timestamp.patch b/meta/recipes-devtools/ruby/ruby/0001-Don-t-save-the-original-name-and-timestamp.patch
index 0f24d2ea0b8..2c48ca184d7 100644
--- a/meta/recipes-devtools/ruby/ruby/0001-Don-t-save-the-original-name-and-timestamp.patch
+++ b/meta/recipes-devtools/ruby/ruby/0001-Don-t-save-the-original-name-and-timestamp.patch
@@ -1,4 +1,4 @@
-From 2cedad6b2beb908a8fb80da0e45e5055dca65e99 Mon Sep 17 00:00:00 2001
+From 73edbaf1a89e05e92f91ed97348a65c4ce740cea Mon Sep 17 00:00:00 2001
 From: Changqing Li <changqing.li@windriver.com>
 Date: Fri, 27 Feb 2026 16:59:24 +0800
 Subject: [PATCH] Don't save the original name and timestamp
@@ -28,6 +28,3 @@ index 874c3ef..eb99a70 100755
  def Compressors.for(type)
    ext = File.extname(type)
    if compress = fetch(ext, nil)
--- 
-2.34.1
-
diff --git a/meta/recipes-devtools/ruby/ruby/0001-extmk-fix-cross-compilation-of-external-gems.patch b/meta/recipes-devtools/ruby/ruby/0001-extmk-fix-cross-compilation-of-external-gems.patch
index dc33fa9d802..3bf80b16136 100644
--- a/meta/recipes-devtools/ruby/ruby/0001-extmk-fix-cross-compilation-of-external-gems.patch
+++ b/meta/recipes-devtools/ruby/ruby/0001-extmk-fix-cross-compilation-of-external-gems.patch
@@ -1,4 +1,4 @@
-From 2d19806e1d221df9400b25bd67f3e0b7a21bb702 Mon Sep 17 00:00:00 2001
+From f2ea81d4707614309cda02be59dd6ccbde9b2441 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Andr=C3=A9=20Draszik?= <andre.draszik@jci.com>
 Date: Mon, 30 Sep 2019 16:57:01 +0100
 Subject: [PATCH] extmk: fix cross-compilation of external gems
@@ -16,10 +16,10 @@ Signed-off-by: André Draszik <andre.draszik@jci.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/ext/extmk.rb b/ext/extmk.rb
-index 1d16545..ad971ea 100755
+index 8f847f4..c8a8d9f 100755
 --- a/ext/extmk.rb
 +++ b/ext/extmk.rb
-@@ -434,8 +434,8 @@ else
+@@ -427,8 +427,8 @@ else
  end
  $ruby = [$ruby]
  $ruby << "-I'$(topdir)'"
diff --git a/meta/recipes-devtools/ruby/ruby/0001-vm_dump.c-Define-REG_S1-and-REG_S2-for-musl-riscv.patch b/meta/recipes-devtools/ruby/ruby/0001-vm_dump.c-Define-REG_S1-and-REG_S2-for-musl-riscv.patch
index 4f81d0a19d3..32d55cde9f0 100644
--- a/meta/recipes-devtools/ruby/ruby/0001-vm_dump.c-Define-REG_S1-and-REG_S2-for-musl-riscv.patch
+++ b/meta/recipes-devtools/ruby/ruby/0001-vm_dump.c-Define-REG_S1-and-REG_S2-for-musl-riscv.patch
@@ -1,4 +1,4 @@
-From a5c27826e7561eafcb8dab061e07349232457f10 Mon Sep 17 00:00:00 2001
+From 875543f1bc5da190543e2696a47cfaaf939e1549 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Tue, 25 Jan 2022 20:29:14 -0800
 Subject: [PATCH] vm_dump.c: Define REG_S1 and REG_S2 for musl/riscv
@@ -14,7 +14,7 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  1 file changed, 5 insertions(+)
 
 diff --git a/vm_dump.c b/vm_dump.c
-index 99339fd..8c5bb03 100644
+index e2b4804..0b7d868 100644
 --- a/vm_dump.c
 +++ b/vm_dump.c
 @@ -40,6 +40,11 @@
diff --git a/meta/recipes-devtools/ruby/ruby/0002-Obey-LDFLAGS-for-the-link-of-libruby.patch b/meta/recipes-devtools/ruby/ruby/0002-Obey-LDFLAGS-for-the-link-of-libruby.patch
index 8ef0c903e8b..11aec879343 100644
--- a/meta/recipes-devtools/ruby/ruby/0002-Obey-LDFLAGS-for-the-link-of-libruby.patch
+++ b/meta/recipes-devtools/ruby/ruby/0002-Obey-LDFLAGS-for-the-link-of-libruby.patch
@@ -1,4 +1,4 @@
-From 3949b3ff01c642b6b9ada9b12dd3083cc930544a Mon Sep 17 00:00:00 2001
+From c460fce052e04a8126f5e0554f68359ef986c5f8 Mon Sep 17 00:00:00 2001
 From: Christopher Larson <chris_larson@mentor.com>
 Date: Thu, 5 May 2016 10:59:07 -0700
 Subject: [PATCH] Obey LDFLAGS for the link of libruby
@@ -10,10 +10,10 @@ Upstream-Status: Pending
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/template/Makefile.in b/template/Makefile.in
-index 6b97279..a49b53d 100644
+index 443c394..5f706db 100644
 --- a/template/Makefile.in
 +++ b/template/Makefile.in
-@@ -120,7 +120,7 @@ ENABLE_SHARED = @ENABLE_SHARED@
+@@ -129,7 +129,7 @@ ENABLE_SHARED = @ENABLE_SHARED@
  LDSHARED = @LIBRUBY_LDSHARED@
  DLDSHARED = @DLDSHARED@
  XDLDFLAGS = @DLDFLAGS@
diff --git a/meta/recipes-devtools/ruby/ruby/0003-rdoc-build-reproducible-documentation.patch b/meta/recipes-devtools/ruby/ruby/0003-rdoc-build-reproducible-documentation.patch
index bf57f97d7e9..863960839dd 100644
--- a/meta/recipes-devtools/ruby/ruby/0003-rdoc-build-reproducible-documentation.patch
+++ b/meta/recipes-devtools/ruby/ruby/0003-rdoc-build-reproducible-documentation.patch
@@ -1,4 +1,4 @@
-From 02cd20470448676d97d77c2e6789ecce43f0e21c Mon Sep 17 00:00:00 2001
+From 3a335538594d0eb3da6155a64b473a46fd06ce76 Mon Sep 17 00:00:00 2001
 From: Christian Hofstaedtler <zeha@debian.org>
 Date: Tue, 10 Oct 2017 15:04:34 -0300
 Subject: [PATCH] rdoc: build reproducible documentation
@@ -38,6 +38,3 @@ index 065caa4..cfa1f33 100644
            gz.orig_name = dest.basename.to_s
            gz.write data
            gz.close
--- 
-2.34.1
-
diff --git a/meta/recipes-devtools/ruby/ruby/0004-lib-mkmf.rb-sort-list-of-object-files-in-generated-M.patch b/meta/recipes-devtools/ruby/ruby/0004-lib-mkmf.rb-sort-list-of-object-files-in-generated-M.patch
index 5ca182313b5..2c1f857d75a 100644
--- a/meta/recipes-devtools/ruby/ruby/0004-lib-mkmf.rb-sort-list-of-object-files-in-generated-M.patch
+++ b/meta/recipes-devtools/ruby/ruby/0004-lib-mkmf.rb-sort-list-of-object-files-in-generated-M.patch
@@ -1,4 +1,4 @@
-From 932489b67ce9cdf5590a17927ea40d9ea6623668 Mon Sep 17 00:00:00 2001
+From e94b898d11e3bd5c412aa3b772040870cddf36c7 Mon Sep 17 00:00:00 2001
 From: Reiner Herrmann <reiner@reiner-h.de>
 Date: Tue, 10 Oct 2017 15:06:13 -0300
 Subject: [PATCH] lib/mkmf.rb: sort list of object files in generated Makefile
@@ -17,10 +17,10 @@ Signed-off-by: Reiner Herrmann <reiner@reiner-h.de>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/lib/mkmf.rb b/lib/mkmf.rb
-index 99f3764..62377b6 100644
+index 38a5a15..ead7f0c 100644
 --- a/lib/mkmf.rb
 +++ b/lib/mkmf.rb
-@@ -2480,7 +2480,7 @@ LOCAL_LIBS = #{$LOCAL_LIBS}
+@@ -2493,7 +2493,7 @@ LOCAL_LIBS = #{$LOCAL_LIBS}
  LIBS = #{$LIBRUBYARG} #{$libs} #{$LIBS}
  ORIG_SRCS = #{orig_srcs.collect(&File.method(:basename)).join(' ')}
  SRCS = $(ORIG_SRCS) #{(srcs - orig_srcs).collect(&File.method(:basename)).join(' ')}
diff --git a/meta/recipes-devtools/ruby/ruby/0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch b/meta/recipes-devtools/ruby/ruby/0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch
index fd7d3340f3c..746d1022928 100644
--- a/meta/recipes-devtools/ruby/ruby/0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch
+++ b/meta/recipes-devtools/ruby/ruby/0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch
@@ -1,4 +1,4 @@
-From 410331577481f331074405e9629ca8db5303aaa8 Mon Sep 17 00:00:00 2001
+From f21e09b9c8f5975887cd85e3ec4dcf9838f62575 Mon Sep 17 00:00:00 2001
 From: Lucas Kanashiro <kanashiro@debian.org>
 Date: Fri, 1 Nov 2019 15:25:17 -0300
 Subject: [PATCH] Make gemspecs reproducible
@@ -12,10 +12,10 @@ Upstream-Status: Backport [debian]
  1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/lib/rubygems/specification.rb b/lib/rubygems/specification.rb
-index 0b905a7..a102e3c 100644
+index 503f0a4..5d33b09 100644
 --- a/lib/rubygems/specification.rb
 +++ b/lib/rubygems/specification.rb
-@@ -1709,7 +1709,9 @@ class Gem::Specification < Gem::BasicSpecification
+@@ -1705,7 +1705,9 @@ class Gem::Specification < Gem::BasicSpecification
                  raise(Gem::InvalidSpecificationException,
                        "invalid date format in specification: #{date.inspect}")
                end
diff --git a/meta/recipes-devtools/ruby/ruby/0006-Make-gemspecs-reproducible.patch b/meta/recipes-devtools/ruby/ruby/0006-Make-gemspecs-reproducible.patch
index aac2bc1502d..cdfa2144d7f 100644
--- a/meta/recipes-devtools/ruby/ruby/0006-Make-gemspecs-reproducible.patch
+++ b/meta/recipes-devtools/ruby/ruby/0006-Make-gemspecs-reproducible.patch
@@ -1,4 +1,4 @@
-From 4d25e9ce0b2795009dd066d7959cf51c4292a343 Mon Sep 17 00:00:00 2001
+From 2a18efc076a20bc270215a802d72618ad0605f91 Mon Sep 17 00:00:00 2001
 From: Lucas Kanashiro <kanashiro@debian.org>
 Date: Fri, 1 Nov 2019 15:25:17 -0300
 Subject: [PATCH] Make gemspecs reproducible
@@ -78,6 +78,3 @@ index cabc916..f9581b8 100644
    spec.authors       = ["Akinori MUSHA", "Hajimu UMEMOTO"]
    spec.email         = ["knu@idaemons.org", "ume@mahoroba.org"]
  
--- 
-2.34.1
-
diff --git a/meta/recipes-devtools/ruby/ruby/0007-Skip-test_rm_r_no_permissions-test-under-root.patch b/meta/recipes-devtools/ruby/ruby/0007-Skip-test_rm_r_no_permissions-test-under-root.patch
index 780b59092f2..93b74068588 100644
--- a/meta/recipes-devtools/ruby/ruby/0007-Skip-test_rm_r_no_permissions-test-under-root.patch
+++ b/meta/recipes-devtools/ruby/ruby/0007-Skip-test_rm_r_no_permissions-test-under-root.patch
@@ -1,4 +1,4 @@
-From eb5a5db74d29fd6369e9871ba1bb254aa0f22f42 Mon Sep 17 00:00:00 2001
+From 4a48511f45606eff4e03f004fb6aea6f8ccd1eaf Mon Sep 17 00:00:00 2001
 From: Jiaying Song <jiaying.song.cn@windriver.com>
 Date: Mon, 7 Jul 2025 15:05:57 +0800
 Subject: [PATCH] Skip test_rm_r_no_permissions test under root
@@ -13,7 +13,7 @@ Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/test/fileutils/test_fileutils.rb b/test/fileutils/test_fileutils.rb
-index d2096a0..80e3368 100644
+index 92308d9..5db74f4 100644
 --- a/test/fileutils/test_fileutils.rb
 +++ b/test/fileutils/test_fileutils.rb
 @@ -768,8 +768,8 @@ class TestFileUtils < Test::Unit::TestCase
diff --git a/meta/recipes-devtools/ruby/ruby_4.0.2.bb b/meta/recipes-devtools/ruby/ruby_4.0.3.bb
similarity index 98%
rename from meta/recipes-devtools/ruby/ruby_4.0.2.bb
rename to meta/recipes-devtools/ruby/ruby_4.0.3.bb
index 89d8d5b1551..56f167379cb 100644
--- a/meta/recipes-devtools/ruby/ruby_4.0.2.bb
+++ b/meta/recipes-devtools/ruby/ruby_4.0.3.bb
@@ -48,7 +48,7 @@ do_configure:prepend() {
 
 DEPENDS:append:libc-musl = " libucontext"
 
-SRC_URI[sha256sum] = "51502b26b50b68df4963336ca41e368cde92c928faf91654de4c4c1791f82aac"
+SRC_URI[sha256sum] = "77964acc370d5c8375b9502e5ba6c13c03ef91ab9eb9f521c84fb42b9c9a6b0f"
 
 PACKAGECONFIG ??= ""
 PACKAGECONFIG += "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}"

[OE-core][wrynose 39/56] ruby: upgrade 4.0.3 -> 4.0.5

[Yoann Congal]

From: Richard Purdie <richard.purdie@linuxfoundation.org>

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: e176e2295bb6c4ac186c6c7187606827fbd5ffee)

Release notes:
* https://www.ruby-lang.org/en/news/2026/05/11/ruby-4-0-4-released/
* This is a routine update that includes bugfixes.
* https://www.ruby-lang.org/en/news/2026/05/20/ruby-4-0-5-released/
* This release only contains a security fix for CVE-2026-46727:
  Use-after-free in pthread-based getaddrinfo timeout handler and a
  build system regression in Ruby 4.0.4 under C locale

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 ...-Don-t-save-the-original-name-and-timestamp.patch |  2 +-
 ...xtmk-fix-cross-compilation-of-external-gems.patch |  2 +-
 ...p.c-Define-REG_S1-and-REG_S2-for-musl-riscv.patch |  2 +-
 .../0002-Obey-LDFLAGS-for-the-link-of-libruby.patch  |  2 +-
 .../0003-rdoc-build-reproducible-documentation.patch | 12 ++++++------
 ...rb-sort-list-of-object-files-in-generated-M.patch |  2 +-
 ...mspec-reproducible-change-fixing-784225-too.patch |  6 +++---
 .../ruby/ruby/0006-Make-gemspecs-reproducible.patch  | 10 +++++-----
 ...ip-test_rm_r_no_permissions-test-under-root.patch |  2 +-
 .../ruby/{ruby_4.0.3.bb => ruby_4.0.5.bb}            |  2 +-
 10 files changed, 21 insertions(+), 21 deletions(-)
 rename meta/recipes-devtools/ruby/{ruby_4.0.3.bb => ruby_4.0.5.bb} (98%)

diff --git a/meta/recipes-devtools/ruby/ruby/0001-Don-t-save-the-original-name-and-timestamp.patch b/meta/recipes-devtools/ruby/ruby/0001-Don-t-save-the-original-name-and-timestamp.patch
index 2c48ca184d7..b5bcfab9247 100644
--- a/meta/recipes-devtools/ruby/ruby/0001-Don-t-save-the-original-name-and-timestamp.patch
+++ b/meta/recipes-devtools/ruby/ruby/0001-Don-t-save-the-original-name-and-timestamp.patch
@@ -1,4 +1,4 @@
-From 73edbaf1a89e05e92f91ed97348a65c4ce740cea Mon Sep 17 00:00:00 2001
+From efd3a6d0f0cef4b2313a106f1a00e7d4a597d510 Mon Sep 17 00:00:00 2001
 From: Changqing Li <changqing.li@windriver.com>
 Date: Fri, 27 Feb 2026 16:59:24 +0800
 Subject: [PATCH] Don't save the original name and timestamp
diff --git a/meta/recipes-devtools/ruby/ruby/0001-extmk-fix-cross-compilation-of-external-gems.patch b/meta/recipes-devtools/ruby/ruby/0001-extmk-fix-cross-compilation-of-external-gems.patch
index 3bf80b16136..e00ce7bb73f 100644
--- a/meta/recipes-devtools/ruby/ruby/0001-extmk-fix-cross-compilation-of-external-gems.patch
+++ b/meta/recipes-devtools/ruby/ruby/0001-extmk-fix-cross-compilation-of-external-gems.patch
@@ -1,4 +1,4 @@
-From f2ea81d4707614309cda02be59dd6ccbde9b2441 Mon Sep 17 00:00:00 2001
+From 7c1f11416499ce7cd1e6874840df2498e922ab78 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Andr=C3=A9=20Draszik?= <andre.draszik@jci.com>
 Date: Mon, 30 Sep 2019 16:57:01 +0100
 Subject: [PATCH] extmk: fix cross-compilation of external gems
diff --git a/meta/recipes-devtools/ruby/ruby/0001-vm_dump.c-Define-REG_S1-and-REG_S2-for-musl-riscv.patch b/meta/recipes-devtools/ruby/ruby/0001-vm_dump.c-Define-REG_S1-and-REG_S2-for-musl-riscv.patch
index 32d55cde9f0..8ae4202e601 100644
--- a/meta/recipes-devtools/ruby/ruby/0001-vm_dump.c-Define-REG_S1-and-REG_S2-for-musl-riscv.patch
+++ b/meta/recipes-devtools/ruby/ruby/0001-vm_dump.c-Define-REG_S1-and-REG_S2-for-musl-riscv.patch
@@ -1,4 +1,4 @@
-From 875543f1bc5da190543e2696a47cfaaf939e1549 Mon Sep 17 00:00:00 2001
+From 4b66682db87a92d20c5ef0a00ea6eef41526d0cc Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Tue, 25 Jan 2022 20:29:14 -0800
 Subject: [PATCH] vm_dump.c: Define REG_S1 and REG_S2 for musl/riscv
diff --git a/meta/recipes-devtools/ruby/ruby/0002-Obey-LDFLAGS-for-the-link-of-libruby.patch b/meta/recipes-devtools/ruby/ruby/0002-Obey-LDFLAGS-for-the-link-of-libruby.patch
index 11aec879343..af4f7684427 100644
--- a/meta/recipes-devtools/ruby/ruby/0002-Obey-LDFLAGS-for-the-link-of-libruby.patch
+++ b/meta/recipes-devtools/ruby/ruby/0002-Obey-LDFLAGS-for-the-link-of-libruby.patch
@@ -1,4 +1,4 @@
-From c460fce052e04a8126f5e0554f68359ef986c5f8 Mon Sep 17 00:00:00 2001
+From e1cb706a8653c632419803f8d36f3dd2d787face Mon Sep 17 00:00:00 2001
 From: Christopher Larson <chris_larson@mentor.com>
 Date: Thu, 5 May 2016 10:59:07 -0700
 Subject: [PATCH] Obey LDFLAGS for the link of libruby
diff --git a/meta/recipes-devtools/ruby/ruby/0003-rdoc-build-reproducible-documentation.patch b/meta/recipes-devtools/ruby/ruby/0003-rdoc-build-reproducible-documentation.patch
index 863960839dd..5c038a50cc2 100644
--- a/meta/recipes-devtools/ruby/ruby/0003-rdoc-build-reproducible-documentation.patch
+++ b/meta/recipes-devtools/ruby/ruby/0003-rdoc-build-reproducible-documentation.patch
@@ -1,4 +1,4 @@
-From 3a335538594d0eb3da6155a64b473a46fd06ce76 Mon Sep 17 00:00:00 2001
+From 8476953b735fabad857ddfe78dd3ffcbef4028c5 Mon Sep 17 00:00:00 2001
 From: Christian Hofstaedtler <zeha@debian.org>
 Date: Tue, 10 Oct 2017 15:04:34 -0300
 Subject: [PATCH] rdoc: build reproducible documentation
@@ -13,13 +13,13 @@ Signed-off-by: Christian Hofstaedtler <zeha@debian.org>
 rebase to version 4.0.1
 Signed-off-by: Changqing Li <changqing.li@windriver.com>
 ---
- .bundle/gems/rdoc-7.0.3/lib/rdoc/generator/json_index.rb | 4 ++--
+ .bundle/gems/rdoc-7.0.4/lib/rdoc/generator/json_index.rb | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)
 
-diff --git a/.bundle/gems/rdoc-7.0.3/lib/rdoc/generator/json_index.rb b/.bundle/gems/rdoc-7.0.3/lib/rdoc/generator/json_index.rb
-index 065caa4..cfa1f33 100644
---- a/.bundle/gems/rdoc-7.0.3/lib/rdoc/generator/json_index.rb
-+++ b/.bundle/gems/rdoc-7.0.3/lib/rdoc/generator/json_index.rb
+diff --git a/.bundle/gems/rdoc-7.0.4/lib/rdoc/generator/json_index.rb b/.bundle/gems/rdoc-7.0.4/lib/rdoc/generator/json_index.rb
+index c61391d..9115dbd 100644
+--- a/.bundle/gems/rdoc-7.0.4/lib/rdoc/generator/json_index.rb
++++ b/.bundle/gems/rdoc-7.0.4/lib/rdoc/generator/json_index.rb
 @@ -176,7 +176,7 @@ class RDoc::Generator::JsonIndex
      debug_msg "Writing gzipped search index to %s" % outfile
  
diff --git a/meta/recipes-devtools/ruby/ruby/0004-lib-mkmf.rb-sort-list-of-object-files-in-generated-M.patch b/meta/recipes-devtools/ruby/ruby/0004-lib-mkmf.rb-sort-list-of-object-files-in-generated-M.patch
index 2c1f857d75a..0ba10724cb0 100644
--- a/meta/recipes-devtools/ruby/ruby/0004-lib-mkmf.rb-sort-list-of-object-files-in-generated-M.patch
+++ b/meta/recipes-devtools/ruby/ruby/0004-lib-mkmf.rb-sort-list-of-object-files-in-generated-M.patch
@@ -1,4 +1,4 @@
-From e94b898d11e3bd5c412aa3b772040870cddf36c7 Mon Sep 17 00:00:00 2001
+From 9fa6d40d1f7eed5be981c034c3f36bd4a3b5efab Mon Sep 17 00:00:00 2001
 From: Reiner Herrmann <reiner@reiner-h.de>
 Date: Tue, 10 Oct 2017 15:06:13 -0300
 Subject: [PATCH] lib/mkmf.rb: sort list of object files in generated Makefile
diff --git a/meta/recipes-devtools/ruby/ruby/0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch b/meta/recipes-devtools/ruby/ruby/0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch
index 746d1022928..4a10f861dc7 100644
--- a/meta/recipes-devtools/ruby/ruby/0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch
+++ b/meta/recipes-devtools/ruby/ruby/0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch
@@ -1,4 +1,4 @@
-From f21e09b9c8f5975887cd85e3ec4dcf9838f62575 Mon Sep 17 00:00:00 2001
+From 265381bc616fa281a58b3761c33620c465884ca8 Mon Sep 17 00:00:00 2001
 From: Lucas Kanashiro <kanashiro@debian.org>
 Date: Fri, 1 Nov 2019 15:25:17 -0300
 Subject: [PATCH] Make gemspecs reproducible
@@ -12,10 +12,10 @@ Upstream-Status: Backport [debian]
  1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/lib/rubygems/specification.rb b/lib/rubygems/specification.rb
-index 503f0a4..5d33b09 100644
+index 2db9352..925b7a0 100644
 --- a/lib/rubygems/specification.rb
 +++ b/lib/rubygems/specification.rb
-@@ -1705,7 +1705,9 @@ class Gem::Specification < Gem::BasicSpecification
+@@ -1714,7 +1714,9 @@ class Gem::Specification < Gem::BasicSpecification
                  raise(Gem::InvalidSpecificationException,
                        "invalid date format in specification: #{date.inspect}")
                end
diff --git a/meta/recipes-devtools/ruby/ruby/0006-Make-gemspecs-reproducible.patch b/meta/recipes-devtools/ruby/ruby/0006-Make-gemspecs-reproducible.patch
index cdfa2144d7f..92439ffd7a8 100644
--- a/meta/recipes-devtools/ruby/ruby/0006-Make-gemspecs-reproducible.patch
+++ b/meta/recipes-devtools/ruby/ruby/0006-Make-gemspecs-reproducible.patch
@@ -1,4 +1,4 @@
-From 2a18efc076a20bc270215a802d72618ad0605f91 Mon Sep 17 00:00:00 2001
+From 40236d16b640b0c522a550b628cbfb6ee0cdc972 Mon Sep 17 00:00:00 2001
 From: Lucas Kanashiro <kanashiro@debian.org>
 Date: Fri, 1 Nov 2019 15:25:17 -0300
 Subject: [PATCH] Make gemspecs reproducible
@@ -13,7 +13,7 @@ Signed-off-by: Changqing Li <changqing.li@windriver.com>
 ---
  .bundle/gems/bigdecimal-4.0.1/bigdecimal.gemspec | 1 +
  .bundle/gems/fiddle-1.1.8/fiddle.gemspec         | 1 +
- .bundle/gems/rdoc-7.0.3/rdoc.gemspec             | 1 +
+ .bundle/gems/rdoc-7.0.4/rdoc.gemspec             | 1 +
  ext/io/console/io-console.gemspec                | 1 +
  lib/ipaddr.gemspec                               | 1 +
  5 files changed, 5 insertions(+)
@@ -42,10 +42,10 @@ index 0092f52..f77c224 100644
    spec.authors       = ["Aaron Patterson", "SHIBATA Hiroshi"]
    spec.email         = ["aaron@tenderlovemaking.com", "hsbt@ruby-lang.org"]
  
-diff --git a/.bundle/gems/rdoc-7.0.3/rdoc.gemspec b/.bundle/gems/rdoc-7.0.3/rdoc.gemspec
+diff --git a/.bundle/gems/rdoc-7.0.4/rdoc.gemspec b/.bundle/gems/rdoc-7.0.4/rdoc.gemspec
 index ada9341..5871ec2 100644
---- a/.bundle/gems/rdoc-7.0.3/rdoc.gemspec
-+++ b/.bundle/gems/rdoc-7.0.3/rdoc.gemspec
+--- a/.bundle/gems/rdoc-7.0.4/rdoc.gemspec
++++ b/.bundle/gems/rdoc-7.0.4/rdoc.gemspec
 @@ -7,6 +7,7 @@ end
  
  Gem::Specification.new do |s|
diff --git a/meta/recipes-devtools/ruby/ruby/0007-Skip-test_rm_r_no_permissions-test-under-root.patch b/meta/recipes-devtools/ruby/ruby/0007-Skip-test_rm_r_no_permissions-test-under-root.patch
index 93b74068588..cb77fffe562 100644
--- a/meta/recipes-devtools/ruby/ruby/0007-Skip-test_rm_r_no_permissions-test-under-root.patch
+++ b/meta/recipes-devtools/ruby/ruby/0007-Skip-test_rm_r_no_permissions-test-under-root.patch
@@ -1,4 +1,4 @@
-From 4a48511f45606eff4e03f004fb6aea6f8ccd1eaf Mon Sep 17 00:00:00 2001
+From ccb40b4715abfb6c53d431bf421ccfbcdbc4ff93 Mon Sep 17 00:00:00 2001
 From: Jiaying Song <jiaying.song.cn@windriver.com>
 Date: Mon, 7 Jul 2025 15:05:57 +0800
 Subject: [PATCH] Skip test_rm_r_no_permissions test under root
diff --git a/meta/recipes-devtools/ruby/ruby_4.0.3.bb b/meta/recipes-devtools/ruby/ruby_4.0.5.bb
similarity index 98%
rename from meta/recipes-devtools/ruby/ruby_4.0.3.bb
rename to meta/recipes-devtools/ruby/ruby_4.0.5.bb
index 56f167379cb..a0981bf622c 100644
--- a/meta/recipes-devtools/ruby/ruby_4.0.3.bb
+++ b/meta/recipes-devtools/ruby/ruby_4.0.5.bb
@@ -48,7 +48,7 @@ do_configure:prepend() {
 
 DEPENDS:append:libc-musl = " libucontext"
 
-SRC_URI[sha256sum] = "77964acc370d5c8375b9502e5ba6c13c03ef91ab9eb9f521c84fb42b9c9a6b0f"
+SRC_URI[sha256sum] = "7d6149079a63f8ae1d326c9fa65c6019ba2dc3155eae7b39159817911c88958e"
 
 PACKAGECONFIG ??= ""
 PACKAGECONFIG += "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}"

[OE-core][wrynose 40/56] xwayland: upgrade 24.1.11 -> 24.1.12

[Yoann Congal]

From: Richard Purdie <richard.purdie@linuxfoundation.org>

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: c8b621ec16840082b31cf76378b9940851a9d45c)

Release Notes:
* https://lists.x.org/archives/xorg-announce/2026-June/003702.html
* https://lists.x.org/archives/xorg-announce/2026-June/003704.html

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../xwayland/{xwayland_24.1.11.bb => xwayland_24.1.12.bb}       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-graphics/xwayland/{xwayland_24.1.11.bb => xwayland_24.1.12.bb} (96%)

diff --git a/meta/recipes-graphics/xwayland/xwayland_24.1.11.bb b/meta/recipes-graphics/xwayland/xwayland_24.1.12.bb
similarity index 96%
rename from meta/recipes-graphics/xwayland/xwayland_24.1.11.bb
rename to meta/recipes-graphics/xwayland/xwayland_24.1.12.bb
index eabf66ffec7..52572bfd21c 100644
--- a/meta/recipes-graphics/xwayland/xwayland_24.1.11.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_24.1.12.bb
@@ -10,7 +10,7 @@ LICENSE = "MIT & Adobe-Display-PostScript & BSD-3-Clause & DEC-3-Clause & HPND &
 LIC_FILES_CHKSUM = "file://COPYING;md5=f8778cfcd90ece0e4b225f30182227ca"
 
 SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz"
-SRC_URI[sha256sum] = "27115a1a8819078409bf6fecfeb7724e8137bd36426de7005a5b3aae0a2138ff"
+SRC_URI[sha256sum] = "6df02c511b92c1b9848734d9d1b03a4c24f8375ba3cada44e9684a21b5f78e21"
 
 UPSTREAM_CHECK_REGEX = "xwayland-(?P<pver>\d+(\.(?!90\d)\d+)+)\.tar"
 

[OE-core][wrynose 41/56] xwayland: upgrade 24.1.12 -> 24.1.13

[Yoann Congal]

From: Richard Purdie <richard.purdie@linuxfoundation.org>

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: f93929ba6cae77b6e28dce24c63a7501bdbd4cda)

Release:
* https://lists.x.org/archives/xorg-announce/2026-July/003716.html
* https://lists.x.org/archives/xorg-announce/2026-July/003717.html

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../xwayland/{xwayland_24.1.12.bb => xwayland_24.1.13.bb}       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-graphics/xwayland/{xwayland_24.1.12.bb => xwayland_24.1.13.bb} (96%)

diff --git a/meta/recipes-graphics/xwayland/xwayland_24.1.12.bb b/meta/recipes-graphics/xwayland/xwayland_24.1.13.bb
similarity index 96%
rename from meta/recipes-graphics/xwayland/xwayland_24.1.12.bb
rename to meta/recipes-graphics/xwayland/xwayland_24.1.13.bb
index 52572bfd21c..41bf1687a28 100644
--- a/meta/recipes-graphics/xwayland/xwayland_24.1.12.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_24.1.13.bb
@@ -10,7 +10,7 @@ LICENSE = "MIT & Adobe-Display-PostScript & BSD-3-Clause & DEC-3-Clause & HPND &
 LIC_FILES_CHKSUM = "file://COPYING;md5=f8778cfcd90ece0e4b225f30182227ca"
 
 SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz"
-SRC_URI[sha256sum] = "6df02c511b92c1b9848734d9d1b03a4c24f8375ba3cada44e9684a21b5f78e21"
+SRC_URI[sha256sum] = "173aea3d6f79609164c04528e1c8e4c9b60fcd59391c3c9dad4667297d727fb6"
 
 UPSTREAM_CHECK_REGEX = "xwayland-(?P<pver>\d+(\.(?!90\d)\d+)+)\.tar"
 

[OE-core][wrynose 42/56] p11-kit: upgrade 0.26.2 -> 0.26.4

[Yoann Congal]

From: Richard Purdie <richard.purdie@linuxfoundation.org>

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 4e58b57cdc5e25d6cb12b658f09fea7c91835430)

Release Notes:
* https://github.com/p11-glue/p11-kit/releases/tag/0.26.4
  * Build fix
  * Update translations
* https://github.com/p11-glue/p11-kit/releases/tag/0.26.3
  * server: fixed stack exhaustion via unbounded recursion in RPC
    attribute parsing by enforcing a recursion depth limit
    (CVE-2026-13757)
  * fixed confusing error message when trying to store an existing cert
    with trust anchor
  * fixed assert when parsing p11-kit files with value (")
  * fixed numerous memory management issues
  * Build and test fixes

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../p11-kit/{p11-kit_0.26.2.bb => p11-kit_0.26.4.bb}            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-support/p11-kit/{p11-kit_0.26.2.bb => p11-kit_0.26.4.bb} (97%)

diff --git a/meta/recipes-support/p11-kit/p11-kit_0.26.2.bb b/meta/recipes-support/p11-kit/p11-kit_0.26.4.bb
similarity index 97%
rename from meta/recipes-support/p11-kit/p11-kit_0.26.2.bb
rename to meta/recipes-support/p11-kit/p11-kit_0.26.4.bb
index 5f553f11bbb..5a42d0dc508 100644
--- a/meta/recipes-support/p11-kit/p11-kit_0.26.2.bb
+++ b/meta/recipes-support/p11-kit/p11-kit_0.26.4.bb
@@ -12,7 +12,7 @@ DEPENDS:append = "${@' glib-2.0' if d.getVar('GTKDOC_ENABLED') == 'True' else ''
 
 SRC_URI = "gitsm://github.com/p11-glue/p11-kit;branch=master;protocol=https;tag=${PV} \
            "
-SRCREV = "8e6e4e6d64d9fe91c62b0052c105b2b72d4c24ef"
+SRCREV = "a14788849d1ef44422d679534a13821eab5bb5f4"
 
 PACKAGECONFIG ??= ""
 PACKAGECONFIG[manpages] = "-Dman=true,-Dman=false,libxslt-native"

[OE-core][wrynose 43/56] p11-kit: set status for CVE-2026-13757

[Yoann Congal]

From: Peter Marko <peter.marko@siemens.com>

This is a RedHat version-less CVE.
Per [1] this is fixed in 0.26.3.

[1] https://security-tracker.debian.org/tracker/CVE-2026-13757

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 3bb664fbba47febc9c26dd7f7965e508870a023f)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-support/p11-kit/p11-kit_0.26.4.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-support/p11-kit/p11-kit_0.26.4.bb b/meta/recipes-support/p11-kit/p11-kit_0.26.4.bb
index 5a42d0dc508..fde122d3ca5 100644
--- a/meta/recipes-support/p11-kit/p11-kit_0.26.4.bb
+++ b/meta/recipes-support/p11-kit/p11-kit_0.26.4.bb
@@ -44,3 +44,4 @@ BBCLASSEXTEND = "native nativesdk"
 CFLAGS += "-Wno-error=incompatible-pointer-types"
 
 CVE_STATUS[CVE-2026-2100] = "fixed-version: fixed since 0.26.2"
+CVE_STATUS[CVE-2026-13757] = "fixed-version: fixed since 0.26.3"

[OE-core][wrynose 44/56] libxml2: upgrade 2.15.2 -> 2.15.3

[Yoann Congal]

From: Richard Purdie <richard.purdie@linuxfoundation.org>

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: fd9928e49da740d11f402e13b00cf5401c81d5cd)

Release Notes:
* https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.15.3/NEWS#L3
  * Security
    * parser: Pass userData to SAX text callbacks in xmlParseReference (type-confusion)
    * entities: copy children in xmlCopyEntity
    * c14n: Fix Type confusion in xmlC14NProcessAttrsAxis
    * python: Do not decref string after adding to the list (double-free / use-after-free)
    * c14n: Reuse tmp_str, xmlStrcat reallocates *cur (double-free)
   * Improvements
     * schemas: Fix relative schemaLocation resolution in XSI assembly in streaming mode
     * xmlreader: propagate reader resource loaders to validator parsers
     * python: Make python bindings python2 compatible
     * xmlregexp: Fix escape-sequence character range matching
     * xmlreader: Free input in xmlReaderForFd (memory-leak)
     * xmlstring: Free cur on every error for xmlStrncat (memory-leak)
     * catalog: Free xmlCatalogResolveCache on cleanup (memory leak)
     * Fix nanohttp.c build when --without-output
     * test: fix mismatched signed/unsigned comparison

Signed-off-by: Peter Marko <peter.marko@siemens.com>
[YC: fixed the changelog. Note: those "improvements" are bugfixes]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 ...ake-Fix-installation-directories-in-libxml2.patch | 12 ++++++------
 meta/recipes-core/libxml/libxml2/install-tests.patch |  9 +++------
 .../libxml/{libxml2_2.15.2.bb => libxml2_2.15.3.bb}  |  2 +-
 3 files changed, 10 insertions(+), 13 deletions(-)
 rename meta/recipes-core/libxml/{libxml2_2.15.2.bb => libxml2_2.15.3.bb} (97%)

diff --git a/meta/recipes-core/libxml/libxml2/0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch b/meta/recipes-core/libxml/libxml2/0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch
index 627f8472c38..d19b284866d 100644
--- a/meta/recipes-core/libxml/libxml2/0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch
+++ b/meta/recipes-core/libxml/libxml2/0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch
@@ -1,4 +1,4 @@
-From 1a7e177a7315c856a2f0e3c2a17ee0fd9e297bc9 Mon Sep 17 00:00:00 2001
+From 803e6f21d3d7ef6399f6ffe58cd28fa6dc7b94e9 Mon Sep 17 00:00:00 2001
 From: Peter Marko <peter.marko@siemens.com>
 Date: Mon, 26 May 2025 21:11:14 +0200
 Subject: [PATCH] Revert "cmake: Fix installation directories in
@@ -15,10 +15,10 @@ Signed-off-by: Peter Marko <peter.marko@siemens.com>
  3 files changed, 7 insertions(+), 18 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index aaa02e3..fb241bb 100644
+index d8dc4e1..633334a 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1065,17 +1065,6 @@ AC_SUBST(XML_PRIVATE_LIBS)
+@@ -1008,17 +1008,6 @@ AC_SUBST(XML_PRIVATE_LIBS)
  AC_SUBST(XML_PRIVATE_CFLAGS)
  AC_SUBST(XML_INCLUDEDIR)
  
@@ -37,7 +37,7 @@ index aaa02e3..fb241bb 100644
  AC_DEFINE_UNQUOTED([XML_SYSCONFDIR], ["$XML_SYSCONFDIR"],
                     [System configuration directory (/etc)])
 diff --git a/libxml2-config.cmake.in b/libxml2-config.cmake.in
-index e040a75..dc0d6b8 100644
+index ff6433f..b775cfe 100644
 --- a/libxml2-config.cmake.in
 +++ b/libxml2-config.cmake.in
 @@ -24,17 +24,20 @@
@@ -66,10 +66,10 @@ index e040a75..dc0d6b8 100644
  set(LIBXML2_LIBRARIES ${LIBXML2_LIBRARY})
  set(LIBXML2_INCLUDE_DIRS ${LIBXML2_INCLUDE_DIR})
 diff --git a/meson.build b/meson.build
-index 98bc6e3..3ef0bd0 100644
+index 2cfecb6..f78da31 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -599,9 +599,6 @@ config_cmake = configuration_data()
+@@ -593,9 +593,6 @@ config_cmake = configuration_data()
  config_cmake.set('LIBXML_MAJOR_VERSION', v_maj)
  config_cmake.set('LIBXML_MINOR_VERSION', v_min)
  config_cmake.set('LIBXML_MICRO_VERSION', v_mic)
diff --git a/meta/recipes-core/libxml/libxml2/install-tests.patch b/meta/recipes-core/libxml/libxml2/install-tests.patch
index 9269536af00..996ade614e2 100644
--- a/meta/recipes-core/libxml/libxml2/install-tests.patch
+++ b/meta/recipes-core/libxml/libxml2/install-tests.patch
@@ -1,4 +1,4 @@
-From 3381232bab7217b9cb47e7cc765c8380192069b0 Mon Sep 17 00:00:00 2001
+From c6b547e06beb0f0ba99e30d036f055eaed9ec4dc Mon Sep 17 00:00:00 2001
 From: Ross Burton <ross.burton@arm.com>
 Date: Fri, 17 Oct 2025 14:15:36 +0800
 Subject: [PATCH] add yocto-specific install-ptest target
@@ -15,10 +15,10 @@ Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
  1 file changed, 8 insertions(+)
 
 diff --git a/Makefile.am b/Makefile.am
-index 19ec305..64bf28a 100644
+index 0a2a729..7ca5bad 100644
 --- a/Makefile.am
 +++ b/Makefile.am
-@@ -29,6 +29,14 @@ check_PROGRAMS = \
+@@ -30,6 +30,14 @@ check_PROGRAMS = \
  	testparser \
  	testrecurse
  
@@ -33,6 +33,3 @@ index 19ec305..64bf28a 100644
  bin_PROGRAMS = xmllint
  
  bin_SCRIPTS = xml2-config
--- 
-2.34.1
-
diff --git a/meta/recipes-core/libxml/libxml2_2.15.2.bb b/meta/recipes-core/libxml/libxml2_2.15.3.bb
similarity index 97%
rename from meta/recipes-core/libxml/libxml2_2.15.2.bb
rename to meta/recipes-core/libxml/libxml2_2.15.3.bb
index 9181949ea54..02507d80422 100644
--- a/meta/recipes-core/libxml/libxml2_2.15.2.bb
+++ b/meta/recipes-core/libxml/libxml2_2.15.3.bb
@@ -21,7 +21,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
            file://CVE-2026-11979.patch \
            "
 
-SRC_URI[archive.sha256sum] = "c8b9bc81f8b590c33af8cc6c336dbff2f53409973588a351c95f1c621b13d09d"
+SRC_URI[archive.sha256sum] = "78262a6e7ac170d6528ebfe2efccdf220191a5af6a6cd61ea4a9a9a5042c7a07"
 SRC_URI[testtar.sha256sum] = "c6b2d42ee50b8b236e711a97d68e6c4b5c8d83e69a2be4722379f08702ea7273"
 
 CVE_STATUS[CVE-2025-6170] = "fixed-version: fixed in version 2.14.5"

[OE-core][wrynose 45/56] libxml2: set status for CVE-2026-6732

[Yoann Congal]

From: Peter Marko <peter.marko@siemens.com>

This is a version-less RedHat CVE.
[1] points to [2] and [3].
These were backported as [4] and [5] in v2.15.3.

[1] https://security-tracker.debian.org/tracker/CVE-2026-6732
[2] https://gitlab.gnome.org/GNOME/libxml2/-/commit/226b560837b90dea9b14431eca6e6fda8fb01ab4
[3] https://gitlab.gnome.org/GNOME/libxml2/-/commit/7cea3fd1557437b88f2c7b5e1b71a2d5fb152b55
[4] https://gitlab.gnome.org/GNOME/libxml2/-/commit/ad0f009a8366860272acb8e05c41a401798f2855
[5] https://gitlab.gnome.org/GNOME/libxml2/-/commit/65d0fe61c6f36ee40431aeb041ea703e839ff60d

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 7a75c7c8485cb9225f1714c4c08e1fd05a95f145)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-core/libxml/libxml2_2.15.3.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-core/libxml/libxml2_2.15.3.bb b/meta/recipes-core/libxml/libxml2_2.15.3.bb
index 02507d80422..abf9889b3f3 100644
--- a/meta/recipes-core/libxml/libxml2_2.15.3.bb
+++ b/meta/recipes-core/libxml/libxml2_2.15.3.bb
@@ -25,6 +25,7 @@ SRC_URI[archive.sha256sum] = "78262a6e7ac170d6528ebfe2efccdf220191a5af6a6cd61ea4
 SRC_URI[testtar.sha256sum] = "c6b2d42ee50b8b236e711a97d68e6c4b5c8d83e69a2be4722379f08702ea7273"
 
 CVE_STATUS[CVE-2025-6170] = "fixed-version: fixed in version 2.14.5"
+CVE_STATUS[CVE-2026-6732] = "fixed-version: fixed in version 2.15.3"
 
 BINCONFIG = "${bindir}/xml2-config"
 

[OE-core][wrynose 46/56] python3-cryptography(-vectors): upgrade 46.0.5 -> 46.0.7

[Yoann Congal]

From: Peter Marko <peter.marko@siemens.com>

Both releases consists of single commit on [1]
Changelog [2]:

* 46.0.7 - 2026-01-27
  * SECURITY ISSUE: Fixed an issue where non-contiguous buffers could
    be passed to APIs that accept Python buffers, which could lead to
    buffer overflow. CVE-2026-39892
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL
    3.5.6.
* 46.0.6 - 2026-03-25
  * SECURITY ISSUE: Fixed a bug where name constraints were not applied
    to peer names during verification when the leaf certificate contains
    a wildcard DNS SAN. Ordinary X.509 topologies are not affected by
    this bug, including those used by the Web PKI. Credit to Oleh Konko
    (1seal) for reporting the issue. CVE-2026-34073

[1] https://github.com/pyca/cryptography/commits/46.0.x/
[2] https://github.com/pyca/cryptography/blob/46.0.7/CHANGELOG.rst

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-devtools/python/python3-cryptography-common.inc | 2 +-
 meta/recipes-devtools/python/python3-cryptography-vectors.bb | 2 +-
 meta/recipes-devtools/python/python3-cryptography.bb         | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/meta/recipes-devtools/python/python3-cryptography-common.inc b/meta/recipes-devtools/python/python3-cryptography-common.inc
index 4e4434bd669..0515cf77058 100644
--- a/meta/recipes-devtools/python/python3-cryptography-common.inc
+++ b/meta/recipes-devtools/python/python3-cryptography-common.inc
@@ -3,4 +3,4 @@
 #
 # Additionally AUH will detect that they share this .inc file and
 # perform a lockstep upgrade for both.
-PV = "46.0.5"
+PV = "46.0.7"
diff --git a/meta/recipes-devtools/python/python3-cryptography-vectors.bb b/meta/recipes-devtools/python/python3-cryptography-vectors.bb
index 800bf1b0e0d..9047e690ea7 100644
--- a/meta/recipes-devtools/python/python3-cryptography-vectors.bb
+++ b/meta/recipes-devtools/python/python3-cryptography-vectors.bb
@@ -12,7 +12,7 @@ require python3-cryptography-common.inc
 SRC_URI += "file://0001-pyproject.toml-bump-uv_build-version-requirement.patch \
             file://0001-bump-uv_build-to-0.10.0-14271.patch \
 "
-SRC_URI[sha256sum] = "ffbccee9455201c01b37c63d65d9f83b362d40c2bed9caac248ebbdfa4e4fc7c"
+SRC_URI[sha256sum] = "08f3d13846fdd86d4c1138a88c695cee203b3dd3825c784d64a3b06d000cdda1"
 
 PYPI_PACKAGE = "cryptography_vectors"
 
diff --git a/meta/recipes-devtools/python/python3-cryptography.bb b/meta/recipes-devtools/python/python3-cryptography.bb
index 42e8c5ff19c..7f9bde15d03 100644
--- a/meta/recipes-devtools/python/python3-cryptography.bb
+++ b/meta/recipes-devtools/python/python3-cryptography.bb
@@ -11,7 +11,7 @@ LDSHARED += "-pthread"
 # NOTE: Make sure to keep this recipe at the same version as python3-cryptography-vectors
 #       Upgrade both recipes at the same time
 require python3-cryptography-common.inc
-SRC_URI[sha256sum] = "abace499247268e3757271b2f1e244b36b06f8515cf27c4d49468fc9eb16e93d"
+SRC_URI[sha256sum] = "e4cfd68c5f3e0bfdad0d38e023239b96a2fe84146481852dffbcca442c245aa5"
 
 SRC_URI += "file://0001-pyproject.toml-remove-benchmark-disable-option.patch \
             file://check-memfree.py \

[OE-core][wrynose 47/56] kern-tools: bump SRCREV for conditional 'depends on X if Y' support

[Yoann Congal]

From: Bruce Ashfield <bruce.ashfield@gmail.com>

Pull in the yocto-kernel-tools fix for the kernel's conditional Kconfig
dependency syntax (kernel commit 76df6815dab7, first in v7.0). Without it,
do_kernel_configcheck fails on v7.0+ trees once a config uses the syntax
(drivers/hv MSHV_ROOT):

    drivers/hv/Kconfig:77: error: couldn't parse
    'depends on HYPERV_VMBUS if HYPERV_VMBUS': extra tokens at end of line

This SRCREV also carries the symbol_why.py/kconf_check audit hardening
(surface parse failures instead of swallowing them) and the new hermetic
Kconfiglib self-test.

(cherry picked from commit 4f592ee59e90e536af33648112658dafe00f5d0e)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: $ git log --format=changelog a4a362d9f4f0..96a8d58bcd260
  * kern-tools: add Kconfiglib self-test
  * symbol_why, kconf_check: surface parse failures and add a parse self-test
  * Kconfiglib: support conditional 'depends on X if Y' dependencies
  * kgit-create-buckets: update classification for 6.19 kernel
]
---
 meta/recipes-kernel/kern-tools/kern-tools-native_git.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-kernel/kern-tools/kern-tools-native_git.bb b/meta/recipes-kernel/kern-tools/kern-tools-native_git.bb
index bd903160507..2e13e4ca31b 100644
--- a/meta/recipes-kernel/kern-tools/kern-tools-native_git.bb
+++ b/meta/recipes-kernel/kern-tools/kern-tools-native_git.bb
@@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "\
 
 DEPENDS += "git-replacement-native"
 
-SRCREV = "a4a362d9f4f0abc8ab145a8673166b9bd875731a"
+SRCREV = "96a8d58bcd260f104c193a81b727818424d7b263"
 PV = "0.3+git"
 
 inherit native

[OE-core][wrynose 48/56] curl: fix CVE-2026-8286

[Yoann Congal]

From: Deepak Rathore <deeratho@cisco.com>

This patch applies the upstream curl security fix backport for
CVE-2026-8286. The upstream fix commit is referenced in [1],
and the public curl advisory is referenced in [2]. The backported
commit link is also recorded in the embedded patch header.

[1] https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16
[2] https://curl.se/docs/CVE-2026-8286.html

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../curl/curl/CVE-2026-8286.patch             | 81 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.19.0.bb      |  1 +
 2 files changed, 82 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-8286.patch b/meta/recipes-support/curl/curl/CVE-2026-8286.patch
new file mode 100644
index 00000000000..6fa42887a1c
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8286.patch
@@ -0,0 +1,81 @@
+From 90ff17f6bfe1d358c26fa25ab457bc420a9847b2 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Thu, 7 May 2026 10:30:07 +0200
+Subject: [PATCH] url: fix connection reuse for starttls protocols
+
+When a connection is tested for reuse in a transfer that *may* upgrade
+to TLS (commonly via STARTTLS), the SSL configuration must match the
+existing connection.
+
+Reported-by: Andrew Nesbit
+Closes #21522
+
+CVE: CVE-2026-8286
+Upstream-Status: Backport [https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16]
+
+Backport Changes:
+- Wrynose applies upstream commit [1] before this patch. That commit
+  adds req_tls to struct url_conn_match and initializes it in
+  url_attach_existing().
+- This backport replaces that local req_tls state with the upstream
+  may_tls/require_tls split and updates url_match_ssl_use(),
+  url_match_ssl_config(), and url_attach_existing() to preserve the
+  upstream STARTTLS reuse behavior on the Wrynose 8.19.0 codebase.
+
+[1] https://github.com/curl/curl/commit/507e7be573b0a76fca597b75ff7cb27a66e7d865
+
+(cherry picked from commit a86efdd7ca5433de9231e650f18247de8319ad16)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/url.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index 4ebff50ef1..6c1375f8e3 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -745,7 +745,11 @@ struct url_conn_match {
+   BIT(want_proxy_ntlm_http);
+   BIT(want_nego_http);
+   BIT(want_proxy_nego_http);
+-  BIT(req_tls); /* require TLS use from a clear-text start */
++  BIT(may_tls); /* May upgrade clear-text connection to TLS, can only reuse
++                 * connections that have matching TLS configuration.
++                 * Always TRUE if `req_tls` is TRUE. */
++  BIT(require_tls); /* Requires TLS use from a clear-text start, can only
++                 * reuse connections that have TLS. */
+   BIT(wait_pipe);
+   BIT(force_reuse);
+   BIT(seen_pending_conn);
+@@ -897,7 +901,7 @@ static bool url_match_ssl_use(struct connectdata *conn,
+        (get_protocol_family(conn->scheme) != m->needle->scheme->protocol))
+       return FALSE;
+   }
+-  else if(m->req_tls)
++  else if(m->require_tls)
+     /* a clear-text STARTTLS protocol with required TLS */
+     return FALSE;
+   return TRUE;
+@@ -1090,8 +1094,8 @@ static bool url_match_destination(struct connectdata *conn,
+ static bool url_match_ssl_config(struct connectdata *conn,
+                                  struct url_conn_match *m)
+ {
+-  /* If talking TLS, conn needs to use the same SSL options. */
+-  if((m->needle->scheme->flags & PROTOPT_SSL) &&
++  /* If talking/upgrading to TLS, conn needs to use the same SSL options. */
++  if(((m->needle->scheme->flags & PROTOPT_SSL) || m->may_tls) &&
+      !Curl_ssl_conn_config_match(m->data, conn, FALSE)) {
+     DEBUGF(infof(m->data, "Connection #%" FMT_OFF_T
+                  " has different SSL parameters, cannot reuse",
+@@ -1364,7 +1368,8 @@ static bool url_attach_existing(struct Curl_easy *data,
+     (needle->scheme->protocol & PROTO_FAMILY_HTTP);
+ #endif
+ #endif
+-  match.req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
++  match.require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
++  match.may_tls = data->set.use_ssl > CURLUSESSL_NONE;
+ 
+   /* Find a connection in the pool that matches what "data + needle"
+    * requires. If a suitable candidate is found, it is attached to "data". */
+-- 
+2.35.6
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 5ba881bd762..ae57776eab8 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -23,6 +23,7 @@ SRC_URI = " \
     file://CVE-2026-6429.patch \
     file://CVE-2026-7168.patch \
     file://CVE-2026-4873.patch \
+    file://CVE-2026-8286.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \

[OE-core][wrynose 49/56] curl: set CVE_STATUS for CVE-2026-8924

[Yoann Congal]

From: Deepak Rathore <deeratho@cisco.com>

Analysis:
- CVE-2026-8924 protects cookie domain handling when public
  suffix list support is enabled in curl. [1]
- Wrynose curl 8.19.0 is configured with --without-libpsl,
  so the PSL check path is not built by the default recipe. [2]
- Hence mark this CVE as not-applicable-config for the default
  Wrynose recipe configuration.

Reference:
[1] https://curl.se/docs/CVE-2026-8924.html
[2] https://git.openembedded.org/openembedded-core/tree/meta/recipes-support/curl/curl_8.19.0.bb?h=wrynose

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-support/curl/curl_8.19.0.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index ae57776eab8..5bec405eb76 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -35,6 +35,7 @@ SRC_URI[sha256sum] = "4eb41489790d19e190d7ac7e18e82857cdd68af8f4e66b292ced562d33
 # Curl has used many names over the years...
 CVE_PRODUCT = "haxx:curl haxx:libcurl curl:curl curl:libcurl libcurl:libcurl daniel_stenberg:curl"
 CVE_STATUS[CVE-2024-32928] = "ignored: CURLOPT_SSL_VERIFYPEER was disabled on google cloud services causing a potential man in the middle attack"
+CVE_STATUS[CVE-2026-8924] = "not-applicable-config: public suffix list support is disabled by the recipe with --without-libpsl"
 CVE_STATUS[CVE-2026-10536] = "${@bb.utils.contains('PACKAGECONFIG', 'nghttp2', 'unpatched', 'not-applicable-config: applicable only with HTTP/2', d)}"
 
 inherit autotools pkgconfig binconfig multilib_header ptest

[OE-core][wrynose 50/56] curl: fix CVE-2026-8927

[Yoann Congal]

From: Deepak Rathore <deeratho@cisco.com>

This patch applies the upstream curl security fix backport for
CVE-2026-8927. The upstream fix commit is referenced in [1],
and the public curl advisory is referenced in [2]. The backported
commit link is also recorded in the embedded patch header.

[1] https://github.com/curl/curl/commit/5c225384b8d52c67ce8259c6e4203bc57aacb567
[2] https://curl.se/docs/CVE-2026-8927.html

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../curl/curl/CVE-2026-8927.patch             | 349 ++++++++++++++++++
 meta/recipes-support/curl/curl_8.19.0.bb      |   1 +
 2 files changed, 350 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8927.patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-8927.patch b/meta/recipes-support/curl/curl/CVE-2026-8927.patch
new file mode 100644
index 00000000000..653d908eb5d
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8927.patch
@@ -0,0 +1,349 @@
+From c3e9c57b5cd128f33250caf86184e23dc1e8c4e5 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Thu, 30 Jul 2026 04:29:18 -0700
+Subject: [PATCH] url: detect proxy changes read from environment
+
+When a proxy is set from an environment variable, detect if that proxy
+is not the same as previously and flush state.
+
+Verified by test1647: verify changing proxy with env variables and make
+sure Digest state is flushed in the second use
+
+Closes #21666
+
+CVE: CVE-2026-8927
+Upstream-Status: Backport [https://github.com/curl/curl/commit/5c225384b8d52c67ce8259c6e4203bc57aacb567]
+
+Backport Changes:
+- Kept Wrynose test registry ordering and added only the new upstream
+  test1647/lib1647 regression test entries.
+- Added the explicit vauth/vauth.h include because Wrynose's url.c did
+  not already include the Digest cleanup prototype used by this fix.
+- Placed the env proxy comparison before parse_proxy() because Wrynose
+  frees the temporary proxy string immediately after parse_proxy() copies
+  it.
+
+(cherry picked from commit 5c225384b8d52c67ce8259c6e4203bc57aacb567)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/url.c                  |  12 ++++
+ lib/urldata.h              |   1 +
+ tests/data/Makefile.am     |   2 +-
+ tests/data/test1647        | 103 +++++++++++++++++++++++++++++++
+ tests/libtest/Makefile.inc |   1 +
+ tests/libtest/lib1647.c    | 120 +++++++++++++++++++++++++++++++++++++
+ 6 files changed, 238 insertions(+), 1 deletion(-)
+ create mode 100644 tests/data/test1647
+ create mode 100644 tests/libtest/lib1647.c
+
+diff --git a/lib/url.c b/lib/url.c
+index 6c1375f8e3..1cd3955e64 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -99,6 +99,7 @@
+ #include "headers.h"
+ #include "curlx/strerr.h"
+ #include "curlx/strparse.h"
++#include "vauth/vauth.h"
+ 
+ /* And now for the protocols */
+ #include "ftp.h"
+@@ -326,6 +327,9 @@ CURLcode Curl_close(struct Curl_easy **datap)
+   Curl_freeset(data);
+   Curl_headers_cleanup(data);
+   Curl_netrc_cleanup(&data->state.netrc);
++#ifndef CURL_DISABLE_DIGEST_AUTH
++  curlx_free(data->state.envproxy);
++#endif
+   curlx_free(data);
+   return CURLE_OK;
+ }
+@@ -2354,6 +2358,14 @@ static CURLcode create_conn_helper_init_proxy(struct Curl_easy *data,
+   if(proxy || socksproxy) {
+     long ptype = conn->http_proxy.proxytype;
+     if(proxy) {
++#ifndef CURL_DISABLE_DIGEST_AUTH
++      if(!Curl_safecmp(data->state.envproxy, proxy)) {
++        /* proxy changed */
++        Curl_auth_digest_cleanup(&data->state.proxydigest);
++        curlx_free(data->state.envproxy);
++        data->state.envproxy = curlx_strdup(proxy);
++      }
++#endif
+       result = parse_proxy(data, conn, proxy, ptype);
+       Curl_safefree(proxy); /* parse_proxy copies the proxy string */
+       if(result)
+diff --git a/lib/urldata.h b/lib/urldata.h
+index d71337c8f6..65005c4b34 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -959,6 +959,7 @@ struct UrlState {
+   void (*prev_signal)(int sig);
+ #endif
+ #ifndef CURL_DISABLE_DIGEST_AUTH
++  char *envproxy; /* last proxy string used for proxy-related state */
+   struct digestdata digest;      /* state data for host Digest auth */
+   struct digestdata proxydigest; /* state data for proxy Digest auth */
+ #endif
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index 1e84b26820..bcee03b938 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -218,7 +218,7 @@ test1620 test1621 test1622 test1623 test1624 \
+ \
+ test1630 test1631 test1632 test1633 test1634 test1635 test1636 test1637 \
+ \
+-test1640 test1641 test1642 test1643 \
++test1640 test1641 test1642 test1643 test1647 \
+ \
+ test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \
+ test1658 \
+diff --git a/tests/data/test1647 b/tests/data/test1647
+new file mode 100644
+index 0000000000..a87487fa9f
+--- /dev/null
++++ b/tests/data/test1647
+@@ -0,0 +1,103 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP GET
++HTTP proxy
++HTTP proxy Digest auth
++multi
++</keywords>
++</info>
++
++# Server-side
++<reply>
++
++# this is returned first since we get no proxy-auth
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 407 Authorization Required to proxy me my dear
++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
++Content-Length: 33
++
++And you should ignore this data.
++</data>
++
++# then this is returned when we get proxy-auth
++<data1000 crlf="headers">
++HTTP/1.1 200 OK
++Content-Length: 21
++Server: no
++
++Nice proxy auth sir!
++</data1000>
++
++<connect crlf="headers">
++HTTP/1.1 401 OK
++Content-Length: 21
++Server: no
++
++Denied access. Leave
++</connect>
++
++</reply>
++
++# Client-side
++<client>
++<server>
++http
++https-proxy
++https
++</server>
++# tool is what to use instead of 'curl'
++<tool>
++lib%TESTNUMBER
++</tool>
++<features>
++!SSPI
++crypto
++proxy
++digest
++Debug
++</features>
++<setenv>
++http_proxy=%HOSTIP:%HTTPPORT
++https_proxy=https://%HOSTIP:%HTTPSPROXYPORT
++CURL_ENTROPY=99376
++</setenv>
++<name>
++HTTP proxy auth Digest, then change proxy with env var and do it again
++</name>
++<command>
++http://test.remote.example.com/path/%TESTNUMBER https://another.example.com:%HTTPSPORT/ daniel:monkey123 another:bump456
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
++Host: test.remote.example.com
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
++Host: test.remote.example.com
++Proxy-Authorization: Digest username="daniel", realm="weirdorealm", nonce="12345", uri="/path/%TESTNUMBER", response="7a1672891aff03248887b1a6674b8096"
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++</protocol>
++
++<proxy crlf="headers">
++CONNECT another.example.com:%HTTPSPORT HTTP/1.1
++Host: another.example.com:%HTTPSPORT
++Proxy-Connection: Keep-Alive
++
++</proxy>
++
++# CONNECT fails
++<errorcode>
++7
++</errorcode>
++</verify>
++</testcase>
+diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
+index 96b82bc059..e938b87bc5 100644
+--- a/tests/libtest/Makefile.inc
++++ b/tests/libtest/Makefile.inc
+@@ -100,6 +100,7 @@ TESTS_C = \
+   lib1582.c lib1588.c \
+   lib1591.c lib1592.c lib1593.c lib1594.c                     lib1597.c \
+   lib1598.c lib1599.c \
++  lib1647.c \
+   lib1662.c \
+   lib1900.c lib1901.c lib1902.c lib1903.c lib1905.c lib1906.c lib1907.c \
+   lib1908.c           lib1910.c lib1911.c lib1912.c lib1913.c \
+diff --git a/tests/libtest/lib1647.c b/tests/libtest/lib1647.c
+new file mode 100644
+index 0000000000..8060e1bfe9
+--- /dev/null
++++ b/tests/libtest/lib1647.c
+@@ -0,0 +1,120 @@
++/***************************************************************************
++ *                                  _   _ ____  _
++ *  Project                     ___| | | |  _ \| |
++ *                             / __| | | | |_) | |
++ *                            | (__| |_| |  _ <| |___
++ *                             \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++/*
++ * argv1 = the first URL
++ * argv2 = URL2
++ * argv3 = credentials 1
++ * argv4 = credentials 2
++ */
++
++#include "first.h"
++
++/* this is meant to pick up the proxy from the environment variable */
++static CURLcode init1647(CURL *curl, const char *url, const char *userpwd)
++{
++  CURLcode result = CURLE_OK;
++
++  res_easy_setopt(curl, CURLOPT_URL, url);
++  if(result)
++    goto init_failed;
++
++  res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
++  if(result)
++    goto init_failed;
++
++  res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST);
++  if(result)
++    goto init_failed;
++
++  res_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
++  if(result)
++    goto init_failed;
++
++  res_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
++  if(result)
++    goto init_failed;
++
++  res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYPEER, 0L);
++  if(result)
++    goto init_failed;
++
++  res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYHOST, 0L);
++  if(result)
++    goto init_failed;
++
++  res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
++  if(result)
++    goto init_failed;
++
++  return CURLE_OK; /* success */
++
++init_failed:
++  return result; /* failure */
++}
++
++static CURLcode run1647(CURL *curl, const char *url, const char *userpwd)
++{
++  CURLcode result = CURLE_OK;
++
++  result = init1647(curl, url, userpwd);
++  if(result)
++    return result;
++
++  return curl_easy_perform(curl);
++}
++
++static CURLcode test_lib1647(const char *URL)
++{
++  CURLcode result = CURLE_OK;
++  CURL *curl = NULL;
++
++  res_global_init(CURL_GLOBAL_ALL);
++  if(result)
++    return result;
++
++  curl = curl_easy_init();
++  if(!curl) {
++    curl_mfprintf(stderr, "curl_easy_init() failed\n");
++    curl_global_cleanup();
++    return TEST_ERR_MAJOR_BAD;
++  }
++
++  start_test_timing();
++
++  curl_mprintf("--- First get '%s'\n", URL);
++  result = run1647(curl, URL, libtest_arg3);
++  if(result)
++    goto test_cleanup;
++
++  curl_mprintf("--- Then get '%s'\n", libtest_arg2);
++  result = run1647(curl, libtest_arg2, libtest_arg4);
++
++test_cleanup:
++
++  /* proper cleanup sequence - type PB */
++
++  curl_easy_cleanup(curl);
++  curl_global_cleanup();
++  return result;
++}
+-- 
+2.35.6
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 5bec405eb76..193366f657c 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -24,6 +24,7 @@ SRC_URI = " \
     file://CVE-2026-7168.patch \
     file://CVE-2026-4873.patch \
     file://CVE-2026-8286.patch \
+    file://CVE-2026-8927.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \

[OE-core][wrynose 51/56] curl: fix CVE-2026-8932

[Yoann Congal]

From: Deepak Rathore <deeratho@cisco.com>

This patch applies the upstream curl security fix backport for
CVE-2026-8932. The upstream dependency commit is referenced
in [1], the upstream fix commit is referenced in [2], and the
public curl advisory is referenced in [3]. The individual
backported commit links are recorded in the embedded patch
headers.

[1] https://github.com/curl/curl/commit/67bf021e97bbebadade7e40217a4967042ac6a07
[2] https://github.com/curl/curl/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e
[3] https://curl.se/docs/CVE-2026-8932.html

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed patch format]
---
 .../curl/curl/CVE-2026-8932-dependent.patch   |   71 +
 .../curl/curl/CVE-2026-8932.patch             | 1148 +++++++++++++++++
 meta/recipes-support/curl/curl_8.19.0.bb      |    2 +
 3 files changed, 1221 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8932-dependent.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8932.patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-8932-dependent.patch b/meta/recipes-support/curl/curl/CVE-2026-8932-dependent.patch
new file mode 100644
index 00000000000..2f364f23508
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8932-dependent.patch
@@ -0,0 +1,71 @@
+From a79f8dae1aa632155be430143b4685f0b91d1694 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Wed, 6 May 2026 23:59:22 +0200
+Subject: [PATCH] mbedtls: null terminate the private key blob
+
+Unfortunately, mbedtls_pk_parse_key() requires the data to be
+null-terminated if the data is PEM encoded (even when provided the exact
+length), so this function needs to make a copy that has one.
+
+Reported-by: Elise Vance
+Closes #21515
+
+CVE: CVE-2026-8932
+Upstream-Status: Backport [https://github.com/curl/curl/commit/67bf021e97bbebadade7e40217a4967042ac6a07]
+
+Backport Changes:
+- Added as a prerequisite for upstream commit [1] because Wrynose curl
+  8.19.0 did not already contain this mbedTLS private-key blob fix.
+
+[1] https://github.com/curl/curl/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e
+
+(cherry picked from commit 67bf021e97bbebadade7e40217a4967042ac6a07)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/vtls/mbedtls.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/lib/vtls/mbedtls.c b/lib/vtls/mbedtls.c
+index 2bac406c35..54f0ac9fd4 100644
+--- a/lib/vtls/mbedtls.c
++++ b/lib/vtls/mbedtls.c
+@@ -697,11 +697,17 @@ static CURLcode mbed_load_privkey(struct Curl_cfilter *cf,
+     }
+     else {
+       const struct curl_blob *ssl_key_blob = ssl_config->key_blob;
+-      const unsigned char *key_data =
+-        (const unsigned char *)ssl_key_blob->data;
+       const char *passwd = ssl_config->key_passwd;
++      /* Unfortunately, mbedtls_pk_parse_key() requires the data to be
++         null-terminated if the data is PEM encoded (even when provided the
++         exact length). */
++      unsigned char *newblob = curlx_memdup0(ssl_key_blob->data,
++                                             ssl_key_blob->len);
++      if(!newblob)
++        return CURLE_OUT_OF_MEMORY;
++
+ #if MBEDTLS_VERSION_NUMBER >= 0x04000000
+-      ret = mbedtls_pk_parse_key(&backend->pk, key_data, ssl_key_blob->len,
++      ret = mbedtls_pk_parse_key(&backend->pk, newblob, ssl_key_blob->len,
+                                  (const unsigned char *)passwd,
+                                  passwd ? strlen(passwd) : 0);
+       if(ret == 0 &&
+@@ -713,7 +719,7 @@ static CURLcode mbed_load_privkey(struct Curl_cfilter *cf,
+                                  PSA_KEY_USAGE_SIGN_HASH)))
+         ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
+ #else
+-      ret = mbedtls_pk_parse_key(&backend->pk, key_data, ssl_key_blob->len,
++      ret = mbedtls_pk_parse_key(&backend->pk, newblob, ssl_key_blob->len,
+                                  (const unsigned char *)passwd,
+                                  passwd ? strlen(passwd) : 0,
+                                  mbedtls_ctr_drbg_random,
+@@ -722,6 +728,7 @@ static CURLcode mbed_load_privkey(struct Curl_cfilter *cf,
+                        mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_ECKEY)))
+         ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
+ #endif
++      curlx_free(newblob);
+ 
+       if(ret) {
+         mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
+--
+2.35.6
diff --git a/meta/recipes-support/curl/curl/CVE-2026-8932.patch b/meta/recipes-support/curl/curl/CVE-2026-8932.patch
new file mode 100644
index 00000000000..8bf0865bc08
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8932.patch
@@ -0,0 +1,1148 @@
+From c1cf1ddf723cdfcbd071394a6b4e73ea995e100a Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <MegaManSec@users.noreply.github.com>
+Date: Tue, 14 Jul 2026 04:38:15 -0700
+Subject: [PATCH] tls: fix incomplete mTLS config in conn reuse and session
+ cache
+
+cert_type, key, key_type, key_passwd and key_blob lived in
+ssl_config_data but not in ssl_primary_config, so they were invisible to
+match_ssl_primary_config() and to the TLS session cache peer key.
+
+Two easy handles sharing a connection pool could reuse each other's
+authenticated connections when they differed only on SSLKEY, SSLKEYTYPE,
+KEYPASSWD, SSLCERTTYPE or SSLKEYBLOB. The second handle would silently
+inherit the first handle's authenticated identity.
+
+Promote all five fields into ssl_primary_config so the conn-reuse
+predicate and session cache key cover the complete client credential
+set. Also replace the fixed ":CCERT" session cache marker with the
+actual clientcert path so sessions are not shared across different
+client certificates.
+
+Verified by test 3303 and 3304
+
+Reported-By: Joshua Rogers (AISLE Research)
+Closes #21667
+
+CVE: CVE-2026-8932
+Upstream-Status: Backport [https://github.com/curl/curl/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e]
+
+Backport Changes:
+- Split prerequisite upstream commit [1] before this patch. This patch
+  now applies on top of that dependency and does not fold in the
+  mbedTLS private-key blob null-termination change.
+- Kept Wrynose Curl_safefree() helper usage and local result-variable
+  style while preserving the upstream mTLS credential matching and
+  session-cache key behavior.
+- Wrynose curl 8.19.0 does not have upstream Curl_peer. The
+  Curl_ssl_peer_key_build() helper keeps Wrynose connectdata and
+  conn_to_host/conn_to_port keying while adding the mTLS key fields.
+- Kept Wrynose test registry ordering and added only the new upstream
+  test3303/test3304 and unit3303/unit3304 regression test entries.
+
+[1] https://github.com/curl/curl/commit/67bf021e97bbebadade7e40217a4967042ac6a07
+
+(cherry picked from commit 7541ae569d82fb308a5e2d94916027da4fa3ba3e)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/ldap.c              |   4 +-
+ lib/urldata.h           |  10 +--
+ lib/vssh/libssh.c       |   6 +-
+ lib/vssh/libssh2.c      |   2 +-
+ lib/vtls/gtls.c         |  14 ++--
+ lib/vtls/mbedtls.c      |  24 +++---
+ lib/vtls/openssl.c      |   7 +-
+ lib/vtls/rustls.c       |  13 ++--
+ lib/vtls/schannel.c     |  10 +--
+ lib/vtls/vtls.c         |  37 ++++++---
+ lib/vtls/vtls_scache.c  | 105 +++++++++++++++++++++-----
+ lib/vtls/vtls_scache.h  |  16 ++++
+ lib/vtls/wolfssl.c      |  14 ++--
+ tests/data/Makefile.am  |   3 +
+ tests/data/test3303     |  20 +++++
+ tests/data/test3304     |  20 +++++
+ tests/unit/Makefile.inc |   3 +-
+ tests/unit/unit3303.c   | 127 +++++++++++++++++++++++++++++++
+ tests/unit/unit3304.c   | 163 ++++++++++++++++++++++++++++++++++++++++
+ 19 files changed, 517 insertions(+), 81 deletions(-)
+ create mode 100644 tests/data/test3303
+ create mode 100644 tests/data/test3304
+ create mode 100644 tests/unit/unit3303.c
+ create mode 100644 tests/unit/unit3304.c
+
+diff --git a/lib/ldap.c b/lib/ldap.c
+index e223078b03..5bf76572c8 100644
+--- a/lib/ldap.c
++++ b/lib/ldap.c
+@@ -329,8 +329,8 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
+ #ifdef LDAP_OPT_X_TLS
+     if(conn->ssl_config.verifypeer) {
+       /* OpenLDAP SDK supports BASE64 files. */
+-      if(data->set.ssl.cert_type &&
+-         !curl_strequal(data->set.ssl.cert_type, "PEM")) {
++      if(data->set.ssl.primary.cert_type &&
++         !curl_strequal(data->set.ssl.primary.cert_type, "PEM")) {
+         failf(data, "LDAP local: ERROR OpenLDAP only supports PEM cert-type");
+         result = CURLE_SSL_CERTPROBLEM;
+         goto quit;
+diff --git a/lib/urldata.h b/lib/urldata.h
+index 65005c4b34..dce181d99d 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -230,9 +230,14 @@ struct ssl_primary_config {
+   char *signature_algorithms; /* list of signature algorithms to use */
+   char *pinned_key;
+   char *CRLfile;         /* CRL to check certificate revocation */
++  char *cert_type;       /* format for certificate (default: PEM) */
++  char *key;             /* private key filename */
++  char *key_type;        /* format for private key (default: PEM) */
++  char *key_passwd;      /* plain text private key password */
+   struct curl_blob *cert_blob;
+   struct curl_blob *ca_info_blob;
+   struct curl_blob *issuercert_blob;
++  struct curl_blob *key_blob;
+ #ifdef USE_TLS_SRP
+   char *username; /* TLS username (for, e.g., SRP) */
+   char *password; /* TLS password (for, e.g., SRP) */
+@@ -252,11 +257,6 @@ struct ssl_config_data {
+   long certverifyresult; /* result from the certificate verification */
+   curl_ssl_ctx_callback fsslctx; /* function to initialize ssl ctx */
+   void *fsslctxp;        /* parameter for call back */
+-  char *cert_type; /* format for certificate (default: PEM) */
+-  char *key; /* private key filename */
+-  struct curl_blob *key_blob;
+-  char *key_type; /* format for private key (default: PEM) */
+-  char *key_passwd; /* plain text private key password */
+   BIT(certinfo);     /* gather lots of certificate info */
+   BIT(earlydata);    /* use TLS 1.3 early data */
+   BIT(enable_beast); /* allow this flaw for interoperability's sake */
+diff --git a/lib/vssh/libssh.c b/lib/vssh/libssh.c
+index 3a2a52e1f8..db767f7d00 100644
+--- a/lib/vssh/libssh.c
++++ b/lib/vssh/libssh.c
+@@ -791,7 +791,7 @@ static int myssh_in_AUTH_PKEY_INIT(struct Curl_easy *data,
+   /* Two choices, (1) private key was given on CMD,
+    * (2) use the "default" keys. */
+   if(data->set.str[STRING_SSH_PRIVATE_KEY]) {
+-    if(sshc->pubkey && !data->set.ssl.key_passwd) {
++    if(sshc->pubkey && !data->set.ssl.primary.key_passwd) {
+       rc = ssh_userauth_try_publickey(sshc->ssh_session, NULL, sshc->pubkey);
+       if(rc == SSH_AUTH_AGAIN)
+         return SSH_AGAIN;
+@@ -804,7 +804,7 @@ static int myssh_in_AUTH_PKEY_INIT(struct Curl_easy *data,
+ 
+     rc = ssh_pki_import_privkey_file(data->
+                                      set.str[STRING_SSH_PRIVATE_KEY],
+-                                     data->set.ssl.key_passwd, NULL,
++                                     data->set.ssl.primary.key_passwd, NULL,
+                                      NULL, &sshc->privkey);
+     if(rc != SSH_OK) {
+       failf(data, "Could not load private key file %s",
+@@ -817,7 +817,7 @@ static int myssh_in_AUTH_PKEY_INIT(struct Curl_easy *data,
+   }
+   else {
+     rc = ssh_userauth_publickey_auto(sshc->ssh_session, NULL,
+-                                     data->set.ssl.key_passwd);
++                                     data->set.ssl.primary.key_passwd);
+     if(rc == SSH_AUTH_AGAIN)
+       return SSH_AGAIN;
+ 
+diff --git a/lib/vssh/libssh2.c b/lib/vssh/libssh2.c
+index 63f5735b83..3c25fe7448 100644
+--- a/lib/vssh/libssh2.c
++++ b/lib/vssh/libssh2.c
+@@ -1144,7 +1144,7 @@ static CURLcode ssh_state_pkey_init(struct Curl_easy *data,
+       return CURLE_OUT_OF_MEMORY;
+     }
+ 
+-    sshc->passphrase = data->set.ssl.key_passwd;
++    sshc->passphrase = data->set.ssl.primary.key_passwd;
+     if(!sshc->passphrase)
+       sshc->passphrase = "";
+ 
+diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
+index a0a465c360..bfeb948542 100644
+--- a/lib/vtls/gtls.c
++++ b/lib/vtls/gtls.c
+@@ -988,10 +988,11 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf,
+       if(result)
+         return result;
+     }
+-    if(ssl_config->cert_type && curl_strequal(ssl_config->cert_type, "P12")) {
++    if(ssl_config->primary.cert_type &&
++       curl_strequal(ssl_config->primary.cert_type, "P12")) {
+       rc = gnutls_certificate_set_x509_simple_pkcs12_file(
+         gtls->shared_creds->creds, config->clientcert, GNUTLS_X509_FMT_DER,
+-        ssl_config->key_passwd ? ssl_config->key_passwd : "");
++        ssl_config->primary.key_passwd ? ssl_config->primary.key_passwd : "");
+       if(rc != GNUTLS_E_SUCCESS) {
+         failf(data,
+               "error reading X.509 potentially-encrypted key or certificate "
+@@ -1009,14 +1010,15 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf,
+       rc = gnutls_certificate_set_x509_key_file2(
+            gtls->shared_creds->creds,
+            config->clientcert,
+-           ssl_config->key ? ssl_config->key : config->clientcert,
+-           gnutls_do_file_type(ssl_config->cert_type),
+-           ssl_config->key_passwd,
++           ssl_config->primary.key ? ssl_config->primary.key :
++                                     config->clientcert,
++           gnutls_do_file_type(ssl_config->primary.cert_type),
++           ssl_config->primary.key_passwd,
+            supported_key_encryption_algorithms);
+       if(rc != GNUTLS_E_SUCCESS) {
+         failf(data,
+               "error reading X.509 %skey file: %s",
+-              ssl_config->key_passwd ? "potentially-encrypted " : "",
++              ssl_config->primary.key_passwd ? "potentially-encrypted " : "",
+               gnutls_strerror(rc));
+         return CURLE_SSL_CONNECT_ERROR;
+       }
+diff --git a/lib/vtls/mbedtls.c b/lib/vtls/mbedtls.c
+index 54f0ac9fd4..d2199df884 100644
+--- a/lib/vtls/mbedtls.c
++++ b/lib/vtls/mbedtls.c
+@@ -484,7 +484,7 @@ static CURLcode mbed_load_cacert(struct Curl_cfilter *cf,
+   const char * const ssl_capath = conn_config->CApath;
+ #ifdef MBEDTLS_PEM_PARSE_C
+   struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+-  const char * const ssl_cert_type = ssl_config->cert_type;
++  const char * const ssl_cert_type = ssl_config->primary.cert_type;
+ #endif
+   int ret = -1;
+   char errorbuf[128];
+@@ -579,7 +579,7 @@ static CURLcode mbed_load_clicert(struct Curl_cfilter *cf,
+   char * const ssl_cert = ssl_config->primary.clientcert;
+   const struct curl_blob *ssl_cert_blob = ssl_config->primary.cert_blob;
+ #ifdef MBEDTLS_PEM_PARSE_C
+-  const char * const ssl_cert_type = ssl_config->cert_type;
++  const char * const ssl_cert_type = ssl_config->primary.cert_type;
+ #endif
+   int ret = -1;
+   char errorbuf[128];
+@@ -660,12 +660,12 @@ static CURLcode mbed_load_privkey(struct Curl_cfilter *cf,
+ 
+   mbedtls_pk_init(&backend->pk);
+ 
+-  if(ssl_config->key || ssl_config->key_blob) {
+-    if(ssl_config->key) {
++  if(ssl_config->primary.key || ssl_config->primary.key_blob) {
++    if(ssl_config->primary.key) {
+ #ifdef MBEDTLS_FS_IO
+ #if MBEDTLS_VERSION_NUMBER >= 0x04000000
+-      ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->key,
+-                                     ssl_config->key_passwd);
++      ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->primary.key,
++                                     ssl_config->primary.key_passwd);
+       if(ret == 0 &&
+          !(mbedtls_pk_can_do_psa(&backend->pk,
+                                  PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_ANY_HASH),
+@@ -675,8 +675,8 @@ static CURLcode mbed_load_privkey(struct Curl_cfilter *cf,
+                                  PSA_KEY_USAGE_SIGN_HASH)))
+         ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
+ #else
+-      ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->key,
+-                                     ssl_config->key_passwd,
++      ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->primary.key,
++                                     ssl_config->primary.key_passwd,
+                                      mbedtls_ctr_drbg_random,
+                                      &rng.drbg);
+       if(ret == 0 && !(mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_RSA) ||
+@@ -687,7 +687,7 @@ static CURLcode mbed_load_privkey(struct Curl_cfilter *cf,
+       if(ret) {
+         mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
+         failf(data, "mbedTLS: error reading private key %s: (-0x%04X) %s",
+-              ssl_config->key, -ret, errorbuf);
++              ssl_config->primary.key, -ret, errorbuf);
+         return CURLE_SSL_CERTPROBLEM;
+       }
+ #else
+@@ -696,8 +696,8 @@ static CURLcode mbed_load_privkey(struct Curl_cfilter *cf,
+ #endif
+     }
+     else {
+-      const struct curl_blob *ssl_key_blob = ssl_config->key_blob;
+-      const char *passwd = ssl_config->key_passwd;
++      const struct curl_blob *ssl_key_blob = ssl_config->primary.key_blob;
++      const char *passwd = ssl_config->primary.key_passwd;
+       /* Unfortunately, mbedtls_pk_parse_key() requires the data to be
+          null-terminated if the data is PEM encoded (even when provided the
+          exact length). */
+@@ -931,7 +931,7 @@ static CURLcode mbed_configure_ssl(struct Curl_cfilter *cf,
+ #endif
+     );
+ 
+-  if(ssl_config->key || ssl_config->key_blob) {
++  if(ssl_config->primary.key || ssl_config->primary.key_blob) {
+     mbedtls_ssl_conf_own_cert(&backend->config, &backend->clicert,
+                               &backend->pk);
+   }
+diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
+index 50bf1e0476..9cbab14b41 100644
+--- a/lib/vtls/openssl.c
++++ b/lib/vtls/openssl.c
+@@ -3724,7 +3724,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
+   struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+   char * const ssl_cert = ssl_config->primary.clientcert;
+   const struct curl_blob *ssl_cert_blob = ssl_config->primary.cert_blob;
+-  const char * const ssl_cert_type = ssl_config->cert_type;
++  const char * const ssl_cert_type = ssl_config->primary.cert_type;
+   unsigned int ssl_version_min;
+   char error_buffer[256];
+ 
+@@ -3888,8 +3888,9 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
+   if(ssl_cert || ssl_cert_blob || ssl_cert_type) {
+     result = client_cert(data, octx->ssl_ctx,
+                          ssl_cert, ssl_cert_blob, ssl_cert_type,
+-                         ssl_config->key, ssl_config->key_blob,
+-                         ssl_config->key_type, ssl_config->key_passwd);
++                         ssl_config->primary.key, ssl_config->primary.key_blob,
++                         ssl_config->primary.key_type,
++                         ssl_config->primary.key_passwd);
+     if(result)
+       /* failf() is already done in client_cert() */
+       return result;
+diff --git a/lib/vtls/rustls.c b/lib/vtls/rustls.c
+index 061b444bce..564b10aa47 100644
+--- a/lib/vtls/rustls.c
++++ b/lib/vtls/rustls.c
+@@ -841,14 +841,14 @@ init_config_builder_client_auth(struct Curl_easy *data,
+   const struct rustls_certified_key *certified_key = NULL;
+   CURLcode result = CURLE_OK;
+ 
+-  if(conn_config->clientcert && !ssl_config->key) {
++  if(conn_config->clientcert && !ssl_config->primary.key) {
+     failf(data, "rustls: must provide key with certificate '%s'",
+           conn_config->clientcert);
+     return CURLE_SSL_CERTPROBLEM;
+   }
+-  else if(!conn_config->clientcert && ssl_config->key) {
++  else if(!conn_config->clientcert && ssl_config->primary.key) {
+     failf(data, "rustls: must provide certificate with key '%s'",
+-          ssl_config->key);
++          ssl_config->primary.key);
+     return CURLE_SSL_CERTPROBLEM;
+   }
+ 
+@@ -862,8 +862,9 @@ init_config_builder_client_auth(struct Curl_easy *data,
+     goto cleanup;
+   }
+ 
+-  if(!read_file_into(ssl_config->key, &key_contents)) {
+-    failf(data, "rustls: failed to read key file: '%s'", ssl_config->key);
++  if(!read_file_into(ssl_config->primary.key, &key_contents)) {
++    failf(data, "rustls: failed to read key file: '%s'",
++          ssl_config->primary.key);
+     result = CURLE_SSL_CERTPROBLEM;
+     goto cleanup;
+   }
+@@ -1053,7 +1054,7 @@ static CURLcode cr_init_backend(struct Curl_cfilter *cf,
+     }
+   }
+ 
+-  if(conn_config->clientcert || ssl_config->key) {
++  if(conn_config->clientcert || ssl_config->primary.key) {
+     result = init_config_builder_client_auth(data,
+                                              conn_config,
+                                              ssl_config,
+diff --git a/lib/vtls/schannel.c b/lib/vtls/schannel.c
+index 650a0e38ca..a4f57c7c0a 100644
+--- a/lib/vtls/schannel.c
++++ b/lib/vtls/schannel.c
+@@ -414,8 +414,8 @@ static CURLcode get_client_cert(struct Curl_easy *data,
+       }
+     }
+ 
+-    if((fInCert || blob) && data->set.ssl.cert_type &&
+-       !curl_strequal(data->set.ssl.cert_type, "P12")) {
++    if((fInCert || blob) && data->set.ssl.primary.cert_type &&
++       !curl_strequal(data->set.ssl.primary.cert_type, "P12")) {
+       failf(data, "schannel: certificate format compatibility error "
+             "for %s",
+             blob ? "(memory blob)" : data->set.ssl.primary.clientcert);
+@@ -465,15 +465,15 @@ static CURLcode get_client_cert(struct Curl_easy *data,
+       datablob.pbData = (BYTE *)certdata;
+       datablob.cbData = (DWORD)certsize;
+ 
+-      if(data->set.ssl.key_passwd)
+-        pwd_len = strlen(data->set.ssl.key_passwd);
++      if(data->set.ssl.primary.key_passwd)
++        pwd_len = strlen(data->set.ssl.primary.key_passwd);
+       pszPassword = (WCHAR *)curlx_malloc(sizeof(WCHAR) * (pwd_len + 1));
+       if(pszPassword) {
+         int str_w_len = 0;
+         if(pwd_len > 0)
+           str_w_len = MultiByteToWideChar(CP_UTF8,
+                                           MB_ERR_INVALID_CHARS,
+-                                          data->set.ssl.key_passwd,
++                                          data->set.ssl.primary.key_passwd,
+                                           (int)pwd_len,
+                                           pszPassword, (int)(pwd_len + 1));
+ 
+diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
+index f7201d18d6..6dcc67dccd 100644
+--- a/lib/vtls/vtls.c
++++ b/lib/vtls/vtls.c
+@@ -204,6 +204,7 @@ static bool match_ssl_primary_config(struct Curl_easy *data,
+      blobcmp(c1->cert_blob, c2->cert_blob) &&
+      blobcmp(c1->ca_info_blob, c2->ca_info_blob) &&
+      blobcmp(c1->issuercert_blob, c2->issuercert_blob) &&
++     blobcmp(c1->key_blob, c2->key_blob) &&
+      Curl_safecmp(c1->CApath, c2->CApath) &&
+      Curl_safecmp(c1->CAfile, c2->CAfile) &&
+      Curl_safecmp(c1->issuercert, c2->issuercert) &&
+@@ -217,7 +218,11 @@ static bool match_ssl_primary_config(struct Curl_easy *data,
+      curl_strequal(c1->curves, c2->curves) &&
+      curl_strequal(c1->signature_algorithms, c2->signature_algorithms) &&
+      curl_strequal(c1->CRLfile, c2->CRLfile) &&
+-     curl_strequal(c1->pinned_key, c2->pinned_key))
++     curl_strequal(c1->pinned_key, c2->pinned_key) &&
++     curl_strequal(c1->cert_type, c2->cert_type) &&
++     Curl_safecmp(c1->key, c2->key) &&
++     curl_strequal(c1->key_type, c2->key_type) &&
++     !Curl_timestrcmp(c1->key_passwd, c2->key_passwd))
+     return TRUE;
+ 
+   return FALSE;
+@@ -252,6 +257,7 @@ static bool clone_ssl_primary_config(struct ssl_primary_config *source,
+   CLONE_BLOB(cert_blob);
+   CLONE_BLOB(ca_info_blob);
+   CLONE_BLOB(issuercert_blob);
++  CLONE_BLOB(key_blob);
+   CLONE_STRING(CApath);
+   CLONE_STRING(CAfile);
+   CLONE_STRING(issuercert);
+@@ -262,6 +268,10 @@ static bool clone_ssl_primary_config(struct ssl_primary_config *source,
+   CLONE_STRING(curves);
+   CLONE_STRING(signature_algorithms);
+   CLONE_STRING(CRLfile);
++  CLONE_STRING(cert_type);
++  CLONE_STRING(key);
++  CLONE_STRING(key_type);
++  CLONE_STRING(key_passwd);
+ #ifdef USE_TLS_SRP
+   CLONE_STRING(username);
+   CLONE_STRING(password);
+@@ -282,9 +292,14 @@ static void free_primary_ssl_config(struct ssl_primary_config *sslc)
+   Curl_safefree(sslc->cert_blob);
+   Curl_safefree(sslc->ca_info_blob);
+   Curl_safefree(sslc->issuercert_blob);
++  Curl_safefree(sslc->key_blob);
+   Curl_safefree(sslc->curves);
+   Curl_safefree(sslc->signature_algorithms);
+   Curl_safefree(sslc->CRLfile);
++  Curl_safefree(sslc->cert_type);
++  Curl_safefree(sslc->key);
++  Curl_safefree(sslc->key_type);
++  Curl_safefree(sslc->key_passwd);
+ #ifdef USE_TLS_SRP
+   Curl_safefree(sslc->username);
+   Curl_safefree(sslc->password);
+@@ -336,12 +351,12 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+   sslc->primary.username = data->set.str[STRING_TLSAUTH_USERNAME];
+   sslc->primary.password = data->set.str[STRING_TLSAUTH_PASSWORD];
+ #endif
+-  sslc->cert_type = data->set.str[STRING_CERT_TYPE];
+-  sslc->key = data->set.str[STRING_KEY];
+-  sslc->key_type = data->set.str[STRING_KEY_TYPE];
+-  sslc->key_passwd = data->set.str[STRING_KEY_PASSWD];
++  sslc->primary.cert_type = data->set.str[STRING_CERT_TYPE];
++  sslc->primary.key = data->set.str[STRING_KEY];
++  sslc->primary.key_type = data->set.str[STRING_KEY_TYPE];
++  sslc->primary.key_passwd = data->set.str[STRING_KEY_PASSWD];
+   sslc->primary.clientcert = data->set.str[STRING_CERT];
+-  sslc->key_blob = data->set.blobs[BLOB_KEY];
++  sslc->primary.key_blob = data->set.blobs[BLOB_KEY];
+ 
+ #ifndef CURL_DISABLE_PROXY
+   sslc = &data->set.proxy_ssl;
+@@ -377,12 +392,12 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+   sslc->primary.issuercert = data->set.str[STRING_SSL_ISSUERCERT_PROXY];
+   sslc->primary.issuercert_blob = data->set.blobs[BLOB_SSL_ISSUERCERT_PROXY];
+   sslc->primary.CRLfile = data->set.str[STRING_SSL_CRLFILE_PROXY];
+-  sslc->cert_type = data->set.str[STRING_CERT_TYPE_PROXY];
+-  sslc->key = data->set.str[STRING_KEY_PROXY];
+-  sslc->key_type = data->set.str[STRING_KEY_TYPE_PROXY];
+-  sslc->key_passwd = data->set.str[STRING_KEY_PASSWD_PROXY];
++  sslc->primary.cert_type = data->set.str[STRING_CERT_TYPE_PROXY];
++  sslc->primary.key = data->set.str[STRING_KEY_PROXY];
++  sslc->primary.key_type = data->set.str[STRING_KEY_TYPE_PROXY];
++  sslc->primary.key_passwd = data->set.str[STRING_KEY_PASSWD_PROXY];
+   sslc->primary.clientcert = data->set.str[STRING_CERT_PROXY];
+-  sslc->key_blob = data->set.blobs[BLOB_KEY_PROXY];
++  sslc->primary.key_blob = data->set.blobs[BLOB_KEY_PROXY];
+ #ifdef USE_TLS_SRP
+   sslc->primary.username = data->set.str[STRING_TLSAUTH_USERNAME_PROXY];
+   sslc->primary.password = data->set.str[STRING_TLSAUTH_PASSWORD_PROXY];
+diff --git a/lib/vtls/vtls_scache.c b/lib/vtls/vtls_scache.c
+index 673abcfe0d..75e5b89553 100644
+--- a/lib/vtls/vtls_scache.c
++++ b/lib/vtls/vtls_scache.c
+@@ -50,6 +50,7 @@
+ struct Curl_ssl_scache_peer {
+   char *ssl_peer_key;      /* id for peer + relevant TLS configuration */
+   char *clientcert;
++  char *key_passwd;
+   char *srp_username;
+   char *srp_password;
+   struct Curl_llist sessions;
+@@ -123,6 +124,48 @@ out:
+   return r;
+ }
+ 
++static CURLcode cf_ssl_peer_key_add_mtls(struct dynbuf *buf,
++                                         struct ssl_primary_config *ssl,
++                                         bool *is_local)
++{
++  CURLcode result = CURLE_OK;
++  if(ssl->clientcert && ssl->clientcert[0]) {
++    result = cf_ssl_peer_key_add_path(buf, "CCERT", ssl->clientcert, is_local);
++    if(result)
++      goto out;
++  }
++  if(ssl->key && ssl->key[0]) {
++    result = cf_ssl_peer_key_add_path(buf, "KEY", ssl->key, is_local);
++    if(result)
++      goto out;
++  }
++  if(ssl->key_blob) {
++    result = cf_ssl_peer_key_add_hash(buf, "KEYBlob", ssl->key_blob);
++    if(result)
++      goto out;
++  }
++  if(ssl->cert_type && ssl->cert_type[0]) {
++    size_t i;
++    result = curlx_dyn_add(buf, ":CT-");
++    for(i = 0; !result && ssl->cert_type[i]; i++) {
++      char c = Curl_raw_toupper(ssl->cert_type[i]);
++      result = curlx_dyn_addn(buf, &c, 1);
++    }
++    if(result)
++      goto out;
++  }
++  if(ssl->key_type && ssl->key_type[0]) {
++    size_t i;
++    result = curlx_dyn_add(buf, ":KT-");
++    for(i = 0; !result && ssl->key_type[i]; i++) {
++      char c = Curl_raw_toupper(ssl->key_type[i]);
++      result = curlx_dyn_addn(buf, &c, 1);
++    }
++  }
++out:
++  return result;
++}
++
+ #define CURL_SSLS_LOCAL_SUFFIX     ":L"
+ #define CURL_SSLS_GLOBAL_SUFFIX    ":G"
+ 
+@@ -134,12 +177,12 @@ static bool cf_ssl_peer_key_is_global(const char *peer_key)
+          (peer_key[len - 2] == ':');
+ }
+ 
+-CURLcode Curl_ssl_peer_key_make(struct Curl_cfilter *cf,
+-                                const struct ssl_peer *peer,
+-                                const char *tls_id,
+-                                char **ppeer_key)
++CURLcode Curl_ssl_peer_key_build(struct ssl_primary_config *ssl,
++                                 const struct ssl_peer *peer,
++                                 const struct connectdata *conn,
++                                 const char *tls_id,
++                                 char **ppeer_key)
+ {
+-  struct ssl_primary_config *ssl = Curl_ssl_cf_get_primary_config(cf);
+   struct dynbuf buf;
+   size_t key_len;
+   bool is_local = FALSE;
+@@ -187,13 +230,13 @@ CURLcode Curl_ssl_peer_key_make(struct Curl_cfilter *cf,
+       goto out;
+   }
+   if(!ssl->verifypeer || !ssl->verifyhost) {
+-    if(cf->conn->bits.conn_to_host) {
+-      r = curlx_dyn_addf(&buf, ":CHOST-%s", cf->conn->conn_to_host.name);
++    if(conn && conn->bits.conn_to_host) {
++      r = curlx_dyn_addf(&buf, ":CHOST-%s", conn->conn_to_host.name);
+       if(r)
+         goto out;
+     }
+-    if(cf->conn->bits.conn_to_port) {
+-      r = curlx_dyn_addf(&buf, ":CPORT-%d", cf->conn->conn_to_port);
++    if(conn && conn->bits.conn_to_port) {
++      r = curlx_dyn_addf(&buf, ":CPORT-%d", conn->conn_to_port);
+       if(r)
+         goto out;
+     }
+@@ -260,11 +303,9 @@ CURLcode Curl_ssl_peer_key_make(struct Curl_cfilter *cf,
+       goto out;
+   }
+ 
+-  if(ssl->clientcert && ssl->clientcert[0]) {
+-    r = curlx_dyn_add(&buf, ":CCERT");
+-    if(r)
+-      goto out;
+-  }
++  r = cf_ssl_peer_key_add_mtls(&buf, ssl, &is_local);
++  if(r)
++    goto out;
+ #ifdef USE_TLS_SRP
+   if(ssl->username || ssl->password) {
+     r = curlx_dyn_add(&buf, ":SRP-AUTH");
+@@ -295,6 +336,15 @@ out:
+   return r;
+ }
+ 
++CURLcode Curl_ssl_peer_key_make(struct Curl_cfilter *cf,
++                                const struct ssl_peer *peer,
++                                const char *tls_id,
++                                char **ppeer_key)
++{
++  struct ssl_primary_config *ssl = Curl_ssl_cf_get_primary_config(cf);
++  return Curl_ssl_peer_key_build(ssl, peer, cf->conn, tls_id, ppeer_key);
++}
++
+ struct Curl_ssl_scache {
+   unsigned int magic;
+   struct Curl_ssl_scache_peer *peers;
+@@ -402,6 +452,7 @@ static void cf_ssl_scache_clear_peer(struct Curl_ssl_scache_peer *peer)
+   }
+   peer->sobj_free = NULL;
+   Curl_safefree(peer->clientcert);
++  Curl_safefree(peer->key_passwd);
+ #ifdef USE_TLS_SRP
+   Curl_safefree(peer->srp_username);
+   Curl_safefree(peer->srp_password);
+@@ -430,8 +481,8 @@ static void cf_ssl_cache_peer_update(struct Curl_ssl_scache_peer *peer)
+    * - its peer key is not yet known, because sessions were
+    *   imported using only the salt+hmac
+    * - the peer key is global, e.g. carrying no relative paths */
+-  peer->exportable = (!peer->clientcert && !peer->srp_username &&
+-                      !peer->srp_password &&
++  peer->exportable = (!peer->clientcert && !peer->key_passwd &&
++                      !peer->srp_username && !peer->srp_password &&
+                       (!peer->ssl_peer_key ||
+                        cf_ssl_peer_key_is_global(peer->ssl_peer_key)));
+ }
+@@ -440,6 +491,7 @@ static CURLcode
+ cf_ssl_scache_peer_init(struct Curl_ssl_scache_peer *peer,
+                         const char *ssl_peer_key,
+                         const char *clientcert,
++                        const char *key_passwd,
+                         const char *srp_username,
+                         const char *srp_password,
+                         const unsigned char *salt,
+@@ -468,6 +520,11 @@ cf_ssl_scache_peer_init(struct Curl_ssl_scache_peer *peer,
+     if(!peer->clientcert)
+       goto out;
+   }
++  if(key_passwd) {
++    peer->key_passwd = curlx_strdup(key_passwd);
++    if(!peer->key_passwd)
++      goto out;
++  }
+   if(srp_username) {
+     peer->srp_username = curlx_strdup(srp_username);
+     if(!peer->srp_username)
+@@ -598,7 +655,7 @@ static bool cf_ssl_scache_match_auth(struct Curl_ssl_scache_peer *peer,
+                                      struct ssl_primary_config *conn_config)
+ {
+   if(!conn_config) {
+-    if(peer->clientcert)
++    if(peer->clientcert || peer->key_passwd)
+       return FALSE;
+ #ifdef USE_TLS_SRP
+     if(peer->srp_username || peer->srp_password)
+@@ -608,6 +665,8 @@ static bool cf_ssl_scache_match_auth(struct Curl_ssl_scache_peer *peer,
+   }
+   else if(!Curl_safecmp(peer->clientcert, conn_config->clientcert))
+     return FALSE;
++  if(Curl_timestrcmp(peer->key_passwd, conn_config->key_passwd))
++    return FALSE;
+ #ifdef USE_TLS_SRP
+   if(Curl_timestrcmp(peer->srp_username, conn_config->username) ||
+      Curl_timestrcmp(peer->srp_password, conn_config->password))
+@@ -734,13 +793,21 @@ static CURLcode cf_ssl_add_peer(struct Curl_easy *data,
+ 
+   peer = cf_ssl_get_free_peer(scache);
+   if(peer) {
++    char buffer[64];
+     const char *ccert = conn_config ? conn_config->clientcert : NULL;
++    const char *kpasswd = conn_config ? conn_config->key_passwd : NULL;
+     const char *username = NULL, *password = NULL;
+ #ifdef USE_TLS_SRP
+     username = conn_config ? conn_config->username : NULL;
+     password = conn_config ? conn_config->password : NULL;
+ #endif
+-    result = cf_ssl_scache_peer_init(peer, ssl_peer_key, ccert,
++    if(!ccert && conn_config && conn_config->cert_blob) {
++      /* when using a client cert blob, create a name for it */
++      curl_msnprintf(buffer, sizeof(buffer),
++                     "cert-%p", conn_config->cert_blob->data);
++      ccert = buffer; /* data is strduped by cf_ssl_scache_peer_init */
++    }
++    result = cf_ssl_scache_peer_init(peer, ssl_peer_key, ccert, kpasswd,
+                                      username, password, NULL, NULL);
+     if(result)
+       goto out;
+@@ -1115,7 +1182,7 @@ CURLcode Curl_ssl_session_import(struct Curl_easy *data,
+     if(!peer) {
+       peer = cf_ssl_get_free_peer(scache);
+       if(peer) {
+-        r = cf_ssl_scache_peer_init(peer, ssl_peer_key, NULL,
++        r = cf_ssl_scache_peer_init(peer, ssl_peer_key, NULL, NULL,
+                                     NULL, NULL, salt, hmac);
+         if(r)
+           goto out;
+diff --git a/lib/vtls/vtls_scache.h b/lib/vtls/vtls_scache.h
+index b9db0f19b3..d33f2bb1a7 100644
+--- a/lib/vtls/vtls_scache.h
++++ b/lib/vtls/vtls_scache.h
+@@ -66,6 +66,22 @@ CURLcode Curl_ssl_peer_key_make(struct Curl_cfilter *cf,
+                                 const char *tls_id,
+                                 char **ppeer_key);
+ 
++/**
++ * Like Curl_ssl_peer_key_make() but takes the primary config and peer
++ * descriptors directly, without requiring a Curl_cfilter. Exposed for
++ * unit testing.
++ * @param ssl      the primary SSL config to key on
++ * @param peer     the peer the filter wants to talk to
++ * @param conn     connection data for connect-to keying, or NULL
++ * @param tls_id   identifier of TLS implementation for sessions
++ * @param ppeer_key on successful return, the key generated
++ */
++CURLcode Curl_ssl_peer_key_build(struct ssl_primary_config *ssl,
++                                 const struct ssl_peer *peer,
++                                 const struct connectdata *conn,
++                                 const char *tls_id,
++                                 char **ppeer_key);
++
+ /* Return if there is a session cache shall be used.
+  * An ssl session might not be configured or not available for
+  * "connect-only" transfers.
+diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c
+index aa841a754a..74bd247e68 100644
+--- a/lib/vtls/wolfssl.c
++++ b/lib/vtls/wolfssl.c
+@@ -919,10 +919,10 @@ static CURLcode client_certificate(struct Curl_easy *data,
+ #ifndef NO_FILESYSTEM
+   if(ssl_config->primary.cert_blob || ssl_config->primary.clientcert) {
+     const char *cert_file = ssl_config->primary.clientcert;
+-    const char *key_file = ssl_config->key;
++    const char *key_file = ssl_config->primary.key;
+     const struct curl_blob *cert_blob = ssl_config->primary.cert_blob;
+-    const struct curl_blob *key_blob = ssl_config->key_blob;
+-    int file_type = wssl_do_file_type(ssl_config->cert_type);
++    const struct curl_blob *key_blob = ssl_config->primary.key_blob;
++    int file_type = wssl_do_file_type(ssl_config->primary.cert_type);
+     int rc;
+ 
+     switch(file_type) {
+@@ -953,7 +953,7 @@ static CURLcode client_certificate(struct Curl_easy *data,
+       key_file = cert_file;
+     }
+     else
+-      file_type = wssl_do_file_type(ssl_config->key_type);
++      file_type = wssl_do_file_type(ssl_config->primary.key_type);
+ 
+     rc = key_blob ?
+       wolfSSL_CTX_use_PrivateKey_buffer(wctx->ssl_ctx, key_blob->data,
+@@ -967,8 +967,8 @@ static CURLcode client_certificate(struct Curl_easy *data,
+ #else /* NO_FILESYSTEM */
+   if(ssl_config->primary.cert_blob) {
+     const struct curl_blob *cert_blob = ssl_config->primary.cert_blob;
+-    const struct curl_blob *key_blob = ssl_config->key_blob;
+-    int file_type = wssl_do_file_type(ssl_config->cert_type);
++    const struct curl_blob *key_blob = ssl_config->primary.key_blob;
++    int file_type = wssl_do_file_type(ssl_config->primary.cert_type);
+     int rc;
+ 
+     switch(file_type) {
+@@ -993,7 +993,7 @@ static CURLcode client_certificate(struct Curl_easy *data,
+     if(!key_blob)
+       key_blob = cert_blob;
+     else
+-      file_type = wssl_do_file_type(ssl_config->key_type);
++      file_type = wssl_do_file_type(ssl_config->primary.key_type);
+ 
+     if(wolfSSL_CTX_use_PrivateKey_buffer(wctx->ssl_ctx, key_blob->data,
+                                          (long)key_blob->len,
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index 4fd7dfe912..2217666382 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -282,6 +282,9 @@ test3100 test3101 test3102 test3103 test3104 test3105 \
+ \
+ test3200 test3201 test3202 test3203 test3204 test3205 test3206 test3207 test3208 \
+ test3209 test3210 test3211 test3212 test3213 test3214 test3215 test3216 \
++\
++test3303 test3304 \
++\
+ test4000 test4001
+ 
+ EXTRA_DIST = $(TESTCASES) DISABLED data-xml1 data320.html \
+diff --git a/tests/data/test3303 b/tests/data/test3303
+new file mode 100644
+index 0000000000..697049f013
+--- /dev/null
++++ b/tests/data/test3303
+@@ -0,0 +1,20 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++unittest
++TLS
++mTLS
++</keywords>
++</info>
++
++# Client-side
++<client>
++<features>
++unittest
++</features>
++<name>
++conn-reuse match distinguishes mTLS key, cert_type, key_type and key_passwd fields
++</name>
++</client>
++</testcase>
+diff --git a/tests/data/test3304 b/tests/data/test3304
+new file mode 100644
+index 0000000000..4380c0819f
+--- /dev/null
++++ b/tests/data/test3304
+@@ -0,0 +1,20 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++unittest
++TLS
++mTLS
++</keywords>
++</info>
++
++# Client-side
++<client>
++<features>
++unittest
++</features>
++<name>
++TLS session cache peer key discriminates on mTLS key, key_type and cert_type fields
++</name>
++</client>
++</testcase>
+diff --git a/tests/unit/Makefile.inc b/tests/unit/Makefile.inc
+index 149636cbcc..bba30f6706 100644
+--- a/tests/unit/Makefile.inc
++++ b/tests/unit/Makefile.inc
+@@ -43,4 +43,5 @@ TESTS_C = \
+   unit1979.c unit1980.c \
+   unit2600.c unit2601.c unit2602.c unit2603.c unit2604.c unit2605.c \
+   unit3200.c                                             unit3205.c \
+-  unit3211.c unit3212.c unit3213.c unit3214.c            unit3216.c
++  unit3211.c unit3212.c unit3213.c unit3214.c            unit3216.c \
++  unit3303.c unit3304.c
+diff --git a/tests/unit/unit3303.c b/tests/unit/unit3303.c
+new file mode 100644
+index 0000000000..41bced542d
+--- /dev/null
++++ b/tests/unit/unit3303.c
+@@ -0,0 +1,127 @@
++/***************************************************************************
++ *                                  _   _ ____  _
++ *  Project                     ___| | | |  _ \| |
++ *                             / __| | | | |_) | |
++ *                            | (__| |_| |  _ <| |___
++ *                             \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++#include "unitcheck.h"
++#include "urldata.h"
++
++#ifdef USE_SSL
++#include "vtls/vtls.h"
++#endif
++
++static CURLcode test_unit3303(const char *arg)
++{
++  UNITTEST_BEGIN_SIMPLE
++
++#ifdef USE_SSL
++  {
++    CURL *curl;
++    struct connectdata *conn;
++    struct ssl_primary_config *primary;
++    char *saved;
++    static char alt_passwd[] = "wrong";
++    static char alt_key[]    = "other.key";
++    static char alt_ktype[]  = "DER";
++    static char alt_ctype[]  = "P12";
++
++    curl_global_init(CURL_GLOBAL_ALL);
++    curl = curl_easy_init();
++    if(!curl) {
++      curl_global_cleanup();
++      goto unit_test_abort;
++    }
++
++    curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem");
++    curl_easy_setopt(curl, CURLOPT_SSLKEY, "client.key");
++    curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "secret");
++    curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
++    curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, "PEM");
++
++    if(Curl_ssl_easy_config_complete((struct Curl_easy *)curl)) {
++      curl_easy_cleanup(curl);
++      curl_global_cleanup();
++      goto unit_test_abort;
++    }
++
++    conn = curlx_calloc(1, sizeof(*conn));
++    if(!conn || Curl_ssl_conn_config_init((struct Curl_easy *)curl, conn)) {
++      if(conn)
++        Curl_ssl_conn_config_cleanup(conn);
++      curlx_free(conn);
++      curl_easy_cleanup(curl);
++      curl_global_cleanup();
++      goto unit_test_abort;
++    }
++
++    /* Baseline: identical config must match. */
++    fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++                                           FALSE),
++                "identical mTLS config should match");
++
++    primary = &((struct Curl_easy *)curl)->set.ssl.primary;
++
++    /* Different key_passwd must not match. */
++    saved = primary->key_passwd;
++    primary->key_passwd = alt_passwd;
++    fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++                                            FALSE),
++                "different key_passwd must not reuse conn");
++    primary->key_passwd = saved;
++
++    /* Different key path must not match. */
++    saved = primary->key;
++    primary->key = alt_key;
++    fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++                                            FALSE),
++                "different key must not reuse conn");
++    primary->key = saved;
++
++    /* Different key type must not match. */
++    saved = primary->key_type;
++    primary->key_type = alt_ktype;
++    fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++                                            FALSE),
++                "different key_type must not reuse conn");
++    primary->key_type = saved;
++
++    /* Different cert type must not match. */
++    saved = primary->cert_type;
++    primary->cert_type = alt_ctype;
++    fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++                                            FALSE),
++                "different cert_type must not reuse conn");
++    primary->cert_type = saved;
++
++    /* All fields restored: must match again. */
++    fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++                                           FALSE),
++                "restored mTLS config should match");
++
++    Curl_ssl_conn_config_cleanup(conn);
++    curlx_free(conn);
++    curl_easy_cleanup(curl);
++    curl_global_cleanup();
++  }
++#endif /* USE_SSL */
++
++  UNITTEST_END_SIMPLE
++}
+diff --git a/tests/unit/unit3304.c b/tests/unit/unit3304.c
+new file mode 100644
+index 0000000000..4defa1e426
+--- /dev/null
++++ b/tests/unit/unit3304.c
+@@ -0,0 +1,163 @@
++/***************************************************************************
++ *                                  _   _ ____  _
++ *  Project                     ___| | | |  _ \| |
++ *                             / __| | | | |_) | |
++ *                            | (__| |_| |  _ <| |___
++ *                             \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++
++/* Unit tests for TLS session cache peer key discrimination on mTLS fields.
++ * Verifies that Curl_ssl_peer_key_build() produces distinct keys when two
++ * handles differ only on key, key_type or cert_type.  key_passwd is NOT
++ * embedded in the peer key; it is compared separately at session lookup via
++ * cf_ssl_scache_match_auth(), following the same pattern as SRP
++ * credentials. */
++
++#include "unitcheck.h"
++#include "urldata.h"
++
++#ifdef USE_SSL
++#include "vtls/vtls.h"
++#include "vtls/vtls_scache.h"
++#endif
++
++static CURLcode test_unit3304(const char *arg)
++{
++  UNITTEST_BEGIN_SIMPLE
++
++#ifdef USE_SSL
++  {
++    struct ssl_peer peer;
++    struct ssl_primary_config ssl;
++    char *key1 = NULL;
++    char *key2 = NULL;
++    static char base_hostname[] = "example.com";
++    static char base_cert[]     = "client.pem";
++    static char base_key[]      = "client.key";
++    static char base_passwd[]   = "secret";
++    static char base_ctype[]    = "PEM";
++    static char base_ktype[]    = "PEM";
++    static char alt_key[]       = "other.key";
++    static char alt_ktype[]     = "DER";
++    static char alt_ctype[]     = "P12";
++    static char lc_ctype[]      = "pem";
++    static char lc_ktype[]      = "pem";
++
++    memset(&peer, 0, sizeof(peer));
++    peer.hostname = base_hostname;
++    peer.port = 443;
++    peer.transport = TRNSPRT_TCP;
++
++    memset(&ssl, 0, sizeof(ssl));
++    ssl.verifypeer = TRUE;
++    ssl.verifyhost = TRUE;
++    ssl.clientcert = base_cert;
++    ssl.key        = base_key;
++    ssl.key_passwd = base_passwd;
++    ssl.cert_type  = base_ctype;
++    ssl.key_type   = base_ktype;
++
++    /* Baseline: same config produces same key. */
++    fail_unless(!Curl_ssl_peer_key_build(&ssl, &peer, NULL, "test", &key1),
++                "peer key build failed");
++    fail_unless(!Curl_ssl_peer_key_build(&ssl, &peer, NULL, "test", &key2),
++                "peer key build failed");
++    fail_unless(key1 && key2 && !strcmp(key1, key2),
++                "identical config should produce identical peer key");
++    curlx_free(key1); key1 = NULL;
++    curlx_free(key2); key2 = NULL;
++
++    /* key_passwd is NOT in the peer key: lookup uses timing-safe comparison
++     * via cf_ssl_scache_match_auth(), same as SRP credentials. */
++    fail_unless(!Curl_ssl_peer_key_build(&ssl, &peer, NULL, "test", &key1),
++                "peer key build failed");
++    ssl.key_passwd = NULL;
++    fail_unless(!Curl_ssl_peer_key_build(&ssl, &peer, NULL, "test", &key2),
++                "peer key build failed");
++    fail_unless(key1 && key2 && !strcmp(key1, key2),
++                "key_passwd must not affect the peer key");
++    curlx_free(key1); key1 = NULL;
++    curlx_free(key2); key2 = NULL;
++    ssl.key_passwd = base_passwd;
++
++    /* Different key path must produce a different peer key. */
++    fail_unless(!Curl_ssl_peer_key_build(&ssl, &peer, NULL, "test", &key1),
++                "peer key build failed");
++    ssl.key = alt_key;
++    fail_unless(!Curl_ssl_peer_key_build(&ssl, &peer, NULL, "test", &key2),
++                "peer key build failed");
++    fail_unless(key1 && key2 && strcmp(key1, key2),
++                "different key must produce different peer key");
++    curlx_free(key1); key1 = NULL;
++    curlx_free(key2); key2 = NULL;
++    ssl.key = base_key;
++
++    /* Different key_type must produce a different peer key. */
++    fail_unless(!Curl_ssl_peer_key_build(&ssl, &peer, NULL, "test", &key1),
++                "peer key build failed");
++    ssl.key_type = alt_ktype;
++    fail_unless(!Curl_ssl_peer_key_build(&ssl, &peer, NULL, "test", &key2),
++                "peer key build failed");
++    fail_unless(key1 && key2 && strcmp(key1, key2),
++                "different key_type must produce different peer key");
++    curlx_free(key1); key1 = NULL;
++    curlx_free(key2); key2 = NULL;
++    ssl.key_type = base_ktype;
++
++    /* Different cert_type must produce a different peer key. */
++    fail_unless(!Curl_ssl_peer_key_build(&ssl, &peer, NULL, "test", &key1),
++                "peer key build failed");
++    ssl.cert_type = alt_ctype;
++    fail_unless(!Curl_ssl_peer_key_build(&ssl, &peer, NULL, "test", &key2),
++                "peer key build failed");
++    fail_unless(key1 && key2 && strcmp(key1, key2),
++                "different cert_type must produce different peer key");
++    curlx_free(key1); key1 = NULL;
++    curlx_free(key2); key2 = NULL;
++    ssl.cert_type = base_ctype;
++
++    /* cert_type is case-insensitive: "PEM" and "pem" must produce the
++     * same peer key, consistent with the conn-reuse comparison. */
++    fail_unless(!Curl_ssl_peer_key_build(&ssl, &peer, NULL, "test", &key1),
++                "peer key build failed");
++    ssl.cert_type = lc_ctype;
++    fail_unless(!Curl_ssl_peer_key_build(&ssl, &peer, NULL, "test", &key2),
++                "peer key build failed");
++    fail_unless(key1 && key2 && !strcmp(key1, key2),
++                "cert_type case must not affect peer key");
++    curlx_free(key1); key1 = NULL;
++    curlx_free(key2); key2 = NULL;
++    ssl.cert_type = base_ctype;
++
++    /* key_type is case-insensitive: "PEM" and "pem" must produce the
++     * same peer key. */
++    fail_unless(!Curl_ssl_peer_key_build(&ssl, &peer, NULL, "test", &key1),
++                "peer key build failed");
++    ssl.key_type = lc_ktype;
++    fail_unless(!Curl_ssl_peer_key_build(&ssl, &peer, NULL, "test", &key2),
++                "peer key build failed");
++    fail_unless(key1 && key2 && !strcmp(key1, key2),
++                "key_type case must not affect peer key");
++    curlx_free(key1); key1 = NULL;
++    curlx_free(key2); key2 = NULL;
++  }
++#endif /* USE_SSL */
++
++  UNITTEST_END_SIMPLE
++}
+--
+2.35.6
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 193366f657c..994b1cff28f 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -25,6 +25,8 @@ SRC_URI = " \
     file://CVE-2026-4873.patch \
     file://CVE-2026-8286.patch \
     file://CVE-2026-8927.patch \
+    file://CVE-2026-8932-dependent.patch \
+    file://CVE-2026-8932.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \

[OE-core][wrynose 52/56] curl: set CVE_STATUS for CVE-2026-9547

[Yoann Congal]

From: Deepak Rathore <deeratho@cisco.com>

Analysis:
- CVE-2026-9547 is tied to the libssh backend. [1]
- Wrynose curl 8.19.0 does not enable or expose the libssh
  backend in the recipe. [2]
- Hence mark this CVE as not-applicable-config for the default
  Wrynose recipe configuration.

Reference:
[1] https://curl.se/docs/CVE-2026-9547.html
[2] https://git.openembedded.org/openembedded-core/tree/meta/recipes-support/curl/curl_8.19.0.bb?h=wrynose

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-support/curl/curl_8.19.0.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 994b1cff28f..72ea2298ea3 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -40,6 +40,7 @@ CVE_PRODUCT = "haxx:curl haxx:libcurl curl:curl curl:libcurl libcurl:libcurl dan
 CVE_STATUS[CVE-2024-32928] = "ignored: CURLOPT_SSL_VERIFYPEER was disabled on google cloud services causing a potential man in the middle attack"
 CVE_STATUS[CVE-2026-8924] = "not-applicable-config: public suffix list support is disabled by the recipe with --without-libpsl"
 CVE_STATUS[CVE-2026-10536] = "${@bb.utils.contains('PACKAGECONFIG', 'nghttp2', 'unpatched', 'not-applicable-config: applicable only with HTTP/2', d)}"
+CVE_STATUS[CVE-2026-9547] = "not-applicable-config: vulnerable libssh backend is not enabled by the recipe"
 
 inherit autotools pkgconfig binconfig multilib_header ptest
 

[OE-core][wrynose 53/56] curl: set CVE_STATUS for CVE-2026-12064

[Yoann Congal]

From: Deepak Rathore <deeratho@cisco.com>

Analysis:
- CVE-2026-12064 affects the curl command-line tool when
  SCP/SFTP protocol support is available. [1]
- Wrynose exposes SCP/SFTP only through the optional libssh2
  PACKAGECONFIG, which is disabled by default. [2]
- Hence mark this CVE as not-applicable-config for the default
  Wrynose recipe configuration, while reporting unpatched if
  libssh2 is explicitly enabled.

Reference:
[1] https://curl.se/docs/CVE-2026-12064.html
[2] https://git.openembedded.org/openembedded-core/tree/meta/recipes-support/curl/curl_8.19.0.bb?h=wrynose

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-support/curl/curl_8.19.0.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 72ea2298ea3..7497337cb95 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -41,6 +41,7 @@ CVE_STATUS[CVE-2024-32928] = "ignored: CURLOPT_SSL_VERIFYPEER was disabled on go
 CVE_STATUS[CVE-2026-8924] = "not-applicable-config: public suffix list support is disabled by the recipe with --without-libpsl"
 CVE_STATUS[CVE-2026-10536] = "${@bb.utils.contains('PACKAGECONFIG', 'nghttp2', 'unpatched', 'not-applicable-config: applicable only with HTTP/2', d)}"
 CVE_STATUS[CVE-2026-9547] = "not-applicable-config: vulnerable libssh backend is not enabled by the recipe"
+CVE_STATUS[CVE-2026-12064] = "${@bb.utils.contains('PACKAGECONFIG', 'libssh2', 'unpatched', 'not-applicable-config: SCP/SFTP support is not enabled in PACKAGECONFIG', d)}"
 
 inherit autotools pkgconfig binconfig multilib_header ptest
 

[OE-core][wrynose 54/56] pseudo: Add in openat2, exec and linkat fixes

[Yoann Congal]

From: Richard Purdie <richard.purdie@linuxfoundation.org>

Pull in:

 * linkat: Fix AT_EMPTY_PATH handling
 * makewrappers/openat2: Add noignore_path option
 * pseudo_util: Correctly free memory allocated by pseudo_setupenvp
 * exec*: Replace bash workaround to avoid memory corruption
 * pseudo_util: Clean up memory handling for setupenvp results
 * pseudo_util: Avoid a memory leak in pseudo_dropenv()
 * pseudo_util: Ensure pseudo_setupenvp handles memory consistently
 * pseudo_util: Avoid accidental free calls for without_libpseudo()
 * pseudo.h: Avoid accessing unallocated memory

[YOCTO #16316]

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 90f823defa32477c9dbd91d264f581fdf0ee4068)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-devtools/pseudo/pseudo_git.bb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/meta/recipes-devtools/pseudo/pseudo_git.bb b/meta/recipes-devtools/pseudo/pseudo_git.bb
index 45407b532d2..9f02d905681 100644
--- a/meta/recipes-devtools/pseudo/pseudo_git.bb
+++ b/meta/recipes-devtools/pseudo/pseudo_git.bb
@@ -1,6 +1,6 @@
 require pseudo.inc
 
-SRC_URI = "git://git.yoctoproject.org/pseudo;branch=master;protocol=https;tag=pseudo-${PV} \
+SRC_URI = "git://git.yoctoproject.org/pseudo;branch=master;protocol=https;branch=master \
            file://fallback-passwd \
            file://fallback-group \
            "
@@ -12,8 +12,8 @@ SRC_URI:append:class-nativesdk = " \
     file://older-glibc-symbols.patch"
 SRC_URI[prebuilt.sha256sum] = "ed9f456856e9d86359f169f46a70ad7be4190d6040282b84c8d97b99072485aa"
 
-SRCREV = "823895ba708c63f6ae4dcbfc266210f26c02c698"
-PV = "1.9.8"
+SRCREV = "ca47829825f297d7bf83665c0541a9de4aa78009"
+PV = "1.9.8+git"
 
 # largefile and 64bit time_t support adds these macros via compiler flags globally
 # remove them for pseudo since pseudo intercepts some of the functions which will be

[OE-core][wrynose 55/56] pseudo: Update to 1.9.10

[Yoann Congal]

From: Richard Purdie <richard.purdie@linuxfoundation.org>

Pulls in various important fixes:

Makefile.in: Bump to 1.9.10
test: various: Move to makefile compilation
test-bash-exec-env: Add bash env test case
test/test-openat2-func.c: Remove unusuaed saved_errno
pseudo_util.c: strchr now returns const char
pseudo_client: remove the unused pseudo_prefix_dir_fd
pseudo_client: step around all of pseudo's own fds in closefrom
pseudo_client: step fully past pseudo's own fds when computing startfd
makewrappers: Avoid efault workaround if using AT_EMPTY_PATH
ports/linux/guts: Add __open64_2 wrapper
Makefile.in: Bump to 1.9.9

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4232a7cc5fa28828fdf3223b3c0a6432c8c1e670)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-devtools/pseudo/pseudo_git.bb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/meta/recipes-devtools/pseudo/pseudo_git.bb b/meta/recipes-devtools/pseudo/pseudo_git.bb
index 9f02d905681..d0559f6c9f3 100644
--- a/meta/recipes-devtools/pseudo/pseudo_git.bb
+++ b/meta/recipes-devtools/pseudo/pseudo_git.bb
@@ -1,6 +1,6 @@
 require pseudo.inc
 
-SRC_URI = "git://git.yoctoproject.org/pseudo;branch=master;protocol=https;branch=master \
+SRC_URI = "git://git.yoctoproject.org/pseudo;branch=master;protocol=https;tag=pseudo-${PV} \
            file://fallback-passwd \
            file://fallback-group \
            "
@@ -12,8 +12,8 @@ SRC_URI:append:class-nativesdk = " \
     file://older-glibc-symbols.patch"
 SRC_URI[prebuilt.sha256sum] = "ed9f456856e9d86359f169f46a70ad7be4190d6040282b84c8d97b99072485aa"
 
-SRCREV = "ca47829825f297d7bf83665c0541a9de4aa78009"
-PV = "1.9.8+git"
+SRCREV = "2a5521e9573049864e07907415f1fee28232d90c"
+PV = "1.9.10"
 
 # largefile and 64bit time_t support adds these macros via compiler flags globally
 # remove them for pseudo since pseudo intercepts some of the functions which will be

[OE-core][wrynose 56/56] pseudo: 1.9.10 -> 1.9.11

[Yoann Congal]

From: Richard Purdie <richard.purdie@linuxfoundation.org>

Adds suport for a working close_range() intercept.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9a68d3f4bd0e80ea7e1ea745b6a10acd341dc7d8)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-devtools/pseudo/pseudo_git.bb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta/recipes-devtools/pseudo/pseudo_git.bb b/meta/recipes-devtools/pseudo/pseudo_git.bb
index d0559f6c9f3..d8466b018e1 100644
--- a/meta/recipes-devtools/pseudo/pseudo_git.bb
+++ b/meta/recipes-devtools/pseudo/pseudo_git.bb
@@ -12,8 +12,8 @@ SRC_URI:append:class-nativesdk = " \
     file://older-glibc-symbols.patch"
 SRC_URI[prebuilt.sha256sum] = "ed9f456856e9d86359f169f46a70ad7be4190d6040282b84c8d97b99072485aa"
 
-SRCREV = "2a5521e9573049864e07907415f1fee28232d90c"
-PV = "1.9.10"
+SRCREV = "ba8887e5f1e922f866681ec7dec1a00b602a9328"
+PV = "1.9.11"
 
 # largefile and 64bit time_t support adds these macros via compiler flags globally
 # remove them for pseudo since pseudo intercepts some of the functions which will be