From: Yoann Congal <yoann.congal@smile.fr>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][scarthgap 00/55] Patch review
Date: Thu, 15 Oct 2026 07:02:23 +0200 [thread overview]
Message-ID: <cover.1792020605.git.yoann.congal@smile.fr> (raw)
Please review this set of changes for scarthgap and have comments back by
end of day Friday, October 16.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/4934
* reproducible failed with #15898 – New sstate.yp.org CDN revealed partial sstate reproducibility tests false-positive error
But the test warns about a missing sstate object from the reproducibleB
build that is supposed to rebuild everything anyway, then, rebuilds the
recipe. So, there is no issue with the series.
The following changes since commit b4f06303e55c7270a8482a610927a1c41d5dbf9c:
build-appliance-image: Update to scarthgap head revisions (2026-10-07 16:20:29 +0100)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-review
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-review
for you to fetch changes up to c9b000059a37241c5b97426f0aadc012b13bd20f:
python3-click: fix CVE-2026-7246 (2026-10-14 18:37:11 +0200)
----------------------------------------------------------------
Babanpreet Singh (3):
devtool: standard: fix update-recipe/finish --initial-rev override
oeqa/selftest/devtool: cover update-recipe --initial-rev
qemu: restore 64-bit file lock handling for 32-bit guests
Darsh Kelaiya (2):
python3-py: ignore CVE-2022-42969
python3-click: fix CVE-2026-7246
Devansh Patel (5):
curl: set CVE_STATUS for CVE-2026-9547
curl: set CVE_STATUS for CVE-2026-12064
curl: fix CVE-2026-8286
curl: ignore CVE-2026-8924
python3-py: correct CVE_PRODUCT mapping
Gaël PORTAY (1):
connman: fix syslog identity with glibc
Hetvi Thakar (13):
libxml2: Fix CVE-2026-86137
libxml2: Fix CVE-2026-86138
libxml2: mark CVE-2026-86139 fixed
libxml2: Fix CVE-2026-86140
libxml2: Fix CVE-2026-86141
libxml2: Fix CVE-2026-86142
libxml2: Fix CVE-2026-86143
libxml2: Fix CVE-2026-86144
vim: set CVE_STATUS for CVE-2026-51400
vim: set CVE_STATUS for CVE-2026-51401
openssh: fix CVE-2026-73283
openssh: fix CVE-2026-73282
openssh: fix CVE-2026-73281
Jaipaul Cheernam (7):
libpcap: Fix CVE-2026-0799
libpcap: Fix CVE-2026-31912
libpcap: Fix CVE-2026-31911
libpcap: Fix CVE-2026-6244
libpcap: Fix CVE-2026-6554
libpcap: Fix CVE-2026-18313
libpcap: Fix CVE-2026-18238
Jakub Szczudlo (Nokia) (5):
gnutls: fix CVE-2026-42012
gnutls: fix CVE-2026-42013
gnutls: fix CVE-2026-42014
gnutls: fix CVE-2026-42015
gnutls: fix CVE-2026-5260
Peter Marko (14):
libpng: patch CVE-2026-33416 regression
dhcpcd: set status for CVE-2026-56116
mesa: patch CVE-2026-40393
systemd: patch CVE-2026-4105
libsolv: patch CVE-2026-48863
expat: patch CVE-2026-66046 and CVE-2026-76641
expat: patch CVE-2026-76956
expat: patch CVE-2026-76957
expat: patch CVE-2026-93990
openssh: set status for CVE-2026-55653
openssh: set status for CVE-2026-55655
openssh: set status for CVE-2026-55654
alsa-lib: patch CVE-2026-90781
openssl: upgrade 3.5.8 -> 3.5.9
Rohini Sangam (1):
gstreamer1.0-plugins-bad: Security fix for CVE-2026-3082
Ross Burton (1):
libaio: update SRC_URI
Suresh H A (1):
systemd: replace a bunch of assert() with friendlier checks
Vijay Anusuri (2):
python3: upgrade 3.12.14 -> 3.12.15
tzdata/tzcode-native: upgrade 2026c -> 2026d
meta/lib/oeqa/selftest/cases/devtool.py | 27 +-
.../connman/connman_1.42.bb | 5 +-
.../dhcpcd/dhcpcd_10.0.6.bb | 2 +
.../libpcap/libpcap/01-CVE-2026-0799.patch | 67 ++
.../libpcap/libpcap/02-CVE-2026-31912.patch | 591 ++++++++++++++++++
.../libpcap/libpcap/03-CVE-2026-31911.patch | 47 ++
.../libpcap/libpcap/04-CVE-2026-6244.patch | 49 ++
.../libpcap/libpcap/05-CVE-2026-6554.patch | 92 +++
.../libpcap/libpcap/06-CVE-2026-18313.patch | 84 +++
.../libpcap/libpcap/07-CVE-2026-18238.patch | 222 +++++++
.../libpcap/libpcap_1.10.4.bb | 7 +
.../openssh/openssh/CVE-2026-73281.patch | 76 +++
.../openssh/openssh/CVE-2026-73282.patch | 80 +++
.../openssh/openssh/CVE-2026-73283.patch | 42 ++
.../openssh/openssh_9.6p1.bb | 6 +
.../{openssl_3.5.8.bb => openssl_3.5.9.bb} | 2 +-
.../expat/expat/CVE-2026-66046-01.patch | 107 ++++
.../expat/expat/CVE-2026-66046-02.patch | 90 +++
.../expat/expat/CVE-2026-76641.patch | 160 +++++
.../expat/expat/CVE-2026-76956.patch | 26 +
.../expat/expat/CVE-2026-76957-01.patch | 121 ++++
.../expat/expat/CVE-2026-76957-02.patch | 85 +++
.../expat/expat/CVE-2026-93990-01.patch | 191 ++++++
.../expat/expat/CVE-2026-93990-02.patch | 328 ++++++++++
meta/recipes-core/expat/expat_2.8.3.bb | 8 +
.../libxml/libxml2/CVE-2026-86137.patch | 63 ++
.../libxml/libxml2/CVE-2026-86138.patch | 52 ++
.../libxml/libxml2/CVE-2026-86140.patch | 56 ++
.../libxml/libxml2/CVE-2026-86141.patch | 35 ++
.../libxml/libxml2/CVE-2026-86142.patch | 40 ++
.../libxml/libxml2/CVE-2026-86143.patch | 96 +++
.../libxml/libxml2/CVE-2026-86144.patch | 225 +++++++
meta/recipes-core/libxml/libxml2_2.12.10.bb | 12 +
...a-bunch-of-assert-with-friendlier-ch.patch | 108 ++++
.../systemd/systemd/CVE-2026-4105.patch | 32 +
meta/recipes-core/systemd/systemd_255.22.bb | 2 +
.../CVE-2026-7246-regression.patch | 124 ++++
.../python/python3-click/CVE-2026-7246.patch | 201 ++++++
.../python/python3-click_8.1.7.bb | 6 +-
.../python/python3-py_1.11.0.bb | 3 +-
...{python3_3.12.14.bb => python3_3.12.15.bb} | 2 +-
meta/recipes-devtools/qemu/qemu.inc | 3 +-
...all.c-drop-64-suffix-from-flock64-Co.patch | 225 +++++++
...ce-use-of-lfs64-related-functions-an.patch | 355 -----------
...-eliminate-other-explicit-LFS-usages.patch | 107 ++++
.../recipes-extended/libaio/libaio_0.3.113.bb | 2 +-
.../libsolv/libsolv/CVE-2026-48863.patch | 25 +
.../libsolv/libsolv_0.7.28.bb | 1 +
meta/recipes-extended/timezone/timezone.inc | 6 +-
.../mesa/files/CVE-2026-40393-01.patch | 126 ++++
.../mesa/files/CVE-2026-40393-02.patch | 119 ++++
.../mesa/files/CVE-2026-40393-03.patch | 103 +++
.../mesa/files/CVE-2026-40393-04.patch | 54 ++
meta/recipes-graphics/mesa/mesa.inc | 4 +
.../alsa/alsa-lib/CVE-2026-90781.patch | 41 ++
.../alsa/alsa-lib_1.2.11.bb | 1 +
.../CVE-2026-3082.patch | 46 ++
.../gstreamer1.0-plugins-bad_1.22.12.bb | 1 +
.../libpng/files/CVE-2026-33416-05.patch | 58 ++
.../libpng/libpng_1.6.42.bb | 1 +
.../curl/curl/CVE-2026-8286.patch | 60 ++
meta/recipes-support/curl/curl_8.7.1.bb | 4 +
.../gnutls/gnutls/CVE-2026-42012-pre1.patch | 69 ++
.../gnutls/gnutls/CVE-2026-42012-pre2.patch | 162 +++++
.../gnutls/gnutls/CVE-2026-42012-pre3.patch | 129 ++++
.../gnutls/gnutls/CVE-2026-42012.patch | 48 ++
.../gnutls/gnutls/CVE-2026-42013-pre1.patch | 56 ++
.../gnutls/gnutls/CVE-2026-42013.patch | 74 +++
.../gnutls/gnutls/CVE-2026-42014.patch | 60 ++
.../gnutls/gnutls/CVE-2026-42015.patch | 43 ++
.../gnutls/gnutls/CVE-2026-5260_p1.patch | 69 ++
.../gnutls/gnutls/CVE-2026-5260_p2.patch | 33 +
meta/recipes-support/gnutls/gnutls_3.8.4.bb | 10 +
meta/recipes-support/vim/vim.inc | 4 +
scripts/lib/devtool/standard.py | 4 +
75 files changed, 5308 insertions(+), 367 deletions(-)
create mode 100644 meta/recipes-connectivity/libpcap/libpcap/01-CVE-2026-0799.patch
create mode 100644 meta/recipes-connectivity/libpcap/libpcap/02-CVE-2026-31912.patch
create mode 100644 meta/recipes-connectivity/libpcap/libpcap/03-CVE-2026-31911.patch
create mode 100644 meta/recipes-connectivity/libpcap/libpcap/04-CVE-2026-6244.patch
create mode 100644 meta/recipes-connectivity/libpcap/libpcap/05-CVE-2026-6554.patch
create mode 100644 meta/recipes-connectivity/libpcap/libpcap/06-CVE-2026-18313.patch
create mode 100644 meta/recipes-connectivity/libpcap/libpcap/07-CVE-2026-18238.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-73281.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-73282.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-73283.patch
rename meta/recipes-connectivity/openssl/{openssl_3.5.8.bb => openssl_3.5.9.bb} (99%)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-66046-01.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-66046-02.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-76641.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-76956.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-76957-01.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-76957-02.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-93990-01.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-93990-02.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86138.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86140.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86141.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86142.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86143.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86144.patch
create mode 100644 meta/recipes-core/systemd/systemd/0023-journal-replace-a-bunch-of-assert-with-friendlier-ch.patch
create mode 100644 meta/recipes-core/systemd/systemd/CVE-2026-4105.patch
create mode 100644 meta/recipes-devtools/python/python3-click/CVE-2026-7246-regression.patch
create mode 100644 meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch
rename meta/recipes-devtools/python/{python3_3.12.14.bb => python3_3.12.15.bb} (99%)
create mode 100644 meta/recipes-devtools/qemu/qemu/0001-linux-user-syscall.c-drop-64-suffix-from-flock64-Co.patch
delete mode 100644 meta/recipes-devtools/qemu/qemu/0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/0002-linux-user-syscall.c-eliminate-other-explicit-LFS-usages.patch
create mode 100644 meta/recipes-extended/libsolv/libsolv/CVE-2026-48863.patch
create mode 100644 meta/recipes-graphics/mesa/files/CVE-2026-40393-01.patch
create mode 100644 meta/recipes-graphics/mesa/files/CVE-2026-40393-02.patch
create mode 100644 meta/recipes-graphics/mesa/files/CVE-2026-40393-03.patch
create mode 100644 meta/recipes-graphics/mesa/files/CVE-2026-40393-04.patch
create mode 100644 meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-90781.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2026-3082.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2026-33416-05.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre1.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre2.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre3.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42012.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42014.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42015.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-5260_p1.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-5260_p2.patch
next reply other threads:[~2026-10-15 5:03 UTC|newest]
Thread overview: 56+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-15 5:02 Yoann Congal [this message]
2026-10-15 5:02 ` [OE-core][scarthgap 01/55] libaio: update SRC_URI Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 02/55] gnutls: fix CVE-2026-42012 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 03/55] gnutls: fix CVE-2026-42013 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 04/55] gnutls: fix CVE-2026-42014 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 05/55] gnutls: fix CVE-2026-42015 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 06/55] gnutls: fix CVE-2026-5260 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 07/55] gstreamer1.0-plugins-bad: Security fix for CVE-2026-3082 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 08/55] devtool: standard: fix update-recipe/finish --initial-rev override Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 09/55] oeqa/selftest/devtool: cover update-recipe --initial-rev Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 10/55] libpng: patch CVE-2026-33416 regression Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 11/55] dhcpcd: set status for CVE-2026-56116 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 12/55] mesa: patch CVE-2026-40393 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 13/55] systemd: patch CVE-2026-4105 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 14/55] libxml2: Fix CVE-2026-86137 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 15/55] libxml2: Fix CVE-2026-86138 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 16/55] libxml2: mark CVE-2026-86139 fixed Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 17/55] libxml2: Fix CVE-2026-86140 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 18/55] libxml2: Fix CVE-2026-86141 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 19/55] libxml2: Fix CVE-2026-86142 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 20/55] libxml2: Fix CVE-2026-86143 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 21/55] libxml2: Fix CVE-2026-86144 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 22/55] libsolv: patch CVE-2026-48863 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 23/55] expat: patch CVE-2026-66046 and CVE-2026-76641 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 24/55] expat: patch CVE-2026-76956 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 25/55] expat: patch CVE-2026-76957 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 26/55] expat: patch CVE-2026-93990 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 27/55] vim: set CVE_STATUS for CVE-2026-51400 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 28/55] vim: set CVE_STATUS for CVE-2026-51401 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 29/55] curl: set CVE_STATUS for CVE-2026-9547 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 30/55] curl: set CVE_STATUS for CVE-2026-12064 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 31/55] curl: fix CVE-2026-8286 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 32/55] curl: ignore CVE-2026-8924 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 33/55] python3: upgrade 3.12.14 -> 3.12.15 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 34/55] openssh: fix CVE-2026-73283 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 35/55] openssh: fix CVE-2026-73282 Yoann Congal
2026-10-15 5:02 ` [OE-core][scarthgap 36/55] openssh: fix CVE-2026-73281 Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 37/55] openssh: set status for CVE-2026-55653 Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 38/55] openssh: set status for CVE-2026-55655 Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 39/55] openssh: set status for CVE-2026-55654 Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 40/55] tzdata/tzcode-native: upgrade 2026c -> 2026d Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 41/55] alsa-lib: patch CVE-2026-90781 Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 42/55] openssl: upgrade 3.5.8 -> 3.5.9 Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 43/55] connman: fix syslog identity with glibc Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 44/55] systemd: replace a bunch of assert() with friendlier checks Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 45/55] qemu: restore 64-bit file lock handling for 32-bit guests Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 46/55] libpcap: Fix CVE-2026-0799 Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 47/55] libpcap: Fix CVE-2026-31912 Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 48/55] libpcap: Fix CVE-2026-31911 Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 49/55] libpcap: Fix CVE-2026-6244 Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 50/55] libpcap: Fix CVE-2026-6554 Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 51/55] libpcap: Fix CVE-2026-18313 Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 52/55] libpcap: Fix CVE-2026-18238 Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 53/55] python3-py: correct CVE_PRODUCT mapping Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 54/55] python3-py: ignore CVE-2022-42969 Yoann Congal
2026-10-15 5:03 ` [OE-core][scarthgap 55/55] python3-click: fix CVE-2026-7246 Yoann Congal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1792020605.git.yoann.congal@smile.fr \
--to=yoann.congal@smile.fr \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox