From: Yoann Congal <yoann.congal@smile.fr>
To: openembedded-core@lists.openembedded.org
Cc: Paul Barker <paul@pbarker.dev>
Subject: [OE-core][scarthgap v2 00/12] Pull request (cover letter only)
Date: Thu, 17 Sep 2026 17:15:47 +0200 [thread overview]
Message-ID: <cover.1789657495.git.yoann.congal@smile.fr> (raw)
Those are the patches from the last patch review:
https://lore.kernel.org/all/cover.1789163914.git.yoann.congal@smile.fr/
Changes:
* Removed "go: Fix CVE-2026-33814"
see https://lore.kernel.org/openembedded-core/7ceb1874bae6aae6c4bb27b948a38c1015960739.camel@pbarker.dev/T/#m64e0e8296e4df92ef5bb835bcc923df9a844a1c5
* Rebased "go: Fix CVE-2026-39823"
Passed a-full on autobuilder:
The previous version of the branch built:
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/4718
> * oe-selftest-fedora fails with 16415 – AB-INT: github infrastructure issues
> I still need to backport fixes from master to wrynose, and then,
> scarthgap.
> * qemuarm64-ptest failed with 16267 – [scarthgap] AB-INT PTEST: python3 failure (test_wrong_cert_tls13)
> retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/61/builds/4516
> Note: this build was not rebased on the latest build-appliance update.
For tests of this updated branch, I only built go, the CVE-2026-33814
fix is isolated from the CVE-2026-39823 fix, its removal should not
impact tests results.
But, I could start an a-full or a sub-build if deemed needed.
The following changes since commit bb166ac536daa43602ce8962cd3eb137783b8dc9:
build-appliance-image: Update to scarthgap head revision (2026-09-11 14:32:15 +0100)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-next
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-next
for you to fetch changes up to 04f18f976b3809e195433b6b31a6121014bdc37c:
u-boot, u-boot-tools: Fix CVE-2026-46728 (2026-09-17 16:32:11 +0200)
----------------------------------------------------------------
Daniel Turull (1):
libarchive: mark CVE-2026-14164 as fixed-version
Darsh Kelaiya (1):
python3-lxml: fix CVE-2026-41066
Deepak Rathore (2):
binutils: fix CVE-2026-3441 and CVE-2026-3442
binutils: fix CVE-2026-4647
Devansh Patel (1):
u-boot: share CVE_PRODUCT with u-boot-tools
Gyorgy Sarvari (1):
python3-py: set CVE_PRODUCT
Hetvi Thakar (3):
python3-pip: Fix CVE-2026-8643
go: Fix CVE-2026-39823
u-boot, u-boot-tools: Fix CVE-2026-46728
Peter Marko (1):
openssl: upgrade 3.5.7 -> 3.5.8
Vijay Anusuri (1):
p11-kit: Fix CVE-2026-18938
Yoann Congal (1):
linux-yocto/6.6: update CVE exclusions (6.6.151)
.../u-boot/files/CVE-2026-46728.patch | 379 ++
meta/recipes-bsp/u-boot/u-boot-common.inc | 2 +
.../u-boot/u-boot-tools_2024.01.bb | 2 +
meta/recipes-bsp/u-boot/u-boot.inc | 2 -
meta/recipes-bsp/u-boot/u-boot_2024.01.bb | 1 +
.../{openssl_3.5.7.bb => openssl_3.5.8.bb} | 2 +-
.../binutils/binutils-2.42.inc | 2 +
.../CVE-2026-3441_CVE-2026-3442.patch | 51 +
.../binutils/binutils/CVE-2026-4647.patch | 228 +
meta/recipes-devtools/go/go-1.22.12.inc | 1 +
.../go/go/CVE-2026-39823.patch | 100 +
.../python/python3-lxml/CVE-2026-41066.patch | 262 +
.../python/python3-lxml_5.0.2.bb | 4 +-
.../CVE-2026-8643-regression_p1.patch | 34 +
.../CVE-2026-8643-regression_p2.patch | 69 +
.../python/python3-pip/CVE-2026-8643.patch | 79 +
.../python/python3-pip_24.0.bb | 3 +
.../python/python3-py_1.11.0.bb | 2 +
.../libarchive/libarchive_3.7.9.bb | 5 +
.../linux/cve-exclusion_6.6.inc | 4540 ++++++++++++++++-
.../p11-kit/files/CVE-2026-18938.patch | 52 +
.../recipes-support/p11-kit/p11-kit_0.25.3.bb | 1 +
22 files changed, 5742 insertions(+), 79 deletions(-)
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch
rename meta/recipes-connectivity/openssl/{openssl_3.5.7.bb => openssl_3.5.8.bb} (99%)
create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-3441_CVE-2026-3442.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-4647.patch
create mode 100644 meta/recipes-devtools/go/go/CVE-2026-39823.patch
create mode 100644 meta/recipes-devtools/python/python3-lxml/CVE-2026-41066.patch
create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2026-8643-regression_p1.patch
create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2026-8643-regression_p2.patch
create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2026-8643.patch
create mode 100644 meta/recipes-support/p11-kit/files/CVE-2026-18938.patch
reply other threads:[~2026-09-17 15:16 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1789657495.git.yoann.congal@smile.fr \
--to=yoann.congal@smile.fr \
--cc=openembedded-core@lists.openembedded.org \
--cc=paul@pbarker.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox