Please review this set of changes for scarthgap and have comments back by end of day Tuesday, October 6.
Note: this series includes an expat version upgrade. This is an exception to the usual stable policy, accepted because it should not break any existing code and help a lot with CVEs. Passed a-full on autobuilder: https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/4868 * qemux86-tc failed with Bug 14259 - AB-INT: NFS mounting issue on qemu oe-selftest glibc.GlibcSelfTestSystemEmulated.test_glibc that I reopened. Retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/28/builds/4746 * oe-selftest-fedora failed with Bug 16206 - [scarthgap] AB-INT: runtime_test.SystemTap.test_crosstap_* failures Retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/48/builds/4801 The following changes since commit 07ca97baad7b182849ee50f0bd629b68dc9f53b3: time64: enable 64-bit time/file-offset flags for 32-bit nativesdk (2026-09-24 08:54:34 +0200) are available in the Git repository at: https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-review https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-review for you to fetch changes up to 827730f97b522c4ab31dd2b7b5a33a4933c94750: python3-pyasn1: fix CVE-2026-59885 (2026-10-02 17:46:50 +0200) ---------------------------------------------------------------- Deepesh Varatharajan (1): glibc: Fix CVE-2026-6238 Devansh Patel (1): vim: Fix CVE-2026-28417 regressions Jakub Szczudlo (Nokia) (1): expat: upgrade 2.6.4 -> 2.8.3, exception security update Richard Purdie (2): sstate: Update mtime/atime for sig/siginfo files in sstate_checkhashes() sstate: Update unpack touch code to be consistent Tim Orling (1): at-spi2-core: RDEPENDS on gsettings-desktop-schemas Yogita Urade (2): python3-pyasn1: fix CVE-2026-30922 python3-pyasn1: fix CVE-2026-59885 meta/classes-global/sstate.bbclass | 16 +- ...ests-Cover-indirect-entity-recursion.patch | 103 -- .../expat/expat/CVE-2024-8176-01.patch | 1477 ----------------- .../expat/expat/CVE-2024-8176-02.patch | 248 --- .../expat/expat/CVE-2024-8176-03.patch | 35 - .../expat/expat/CVE-2024-8176-04.patch | 115 -- .../expat/expat/CVE-2024-8176-05.patch | 78 - .../expat/expat/CVE-2025-59375-00.patch | 52 - .../expat/expat/CVE-2025-59375-01.patch | 48 - .../expat/expat/CVE-2025-59375-02.patch | 109 -- .../expat/expat/CVE-2025-59375-03.patch | 127 -- .../expat/expat/CVE-2025-59375-04.patch | 62 - .../expat/expat/CVE-2025-59375-05.patch | 64 - .../expat/expat/CVE-2025-59375-06.patch | 68 - .../expat/expat/CVE-2025-59375-07.patch | 52 - .../expat/expat/CVE-2025-59375-08.patch | 577 ------- .../expat/expat/CVE-2025-59375-09.patch | 43 - .../expat/expat/CVE-2025-59375-10.patch | 54 - .../expat/expat/CVE-2025-59375-11.patch | 66 - .../expat/expat/CVE-2025-59375-12.patch | 58 - .../expat/expat/CVE-2025-59375-13.patch | 309 ---- .../expat/expat/CVE-2025-59375-14.patch | 122 -- .../expat/expat/CVE-2025-59375-15.patch | 70 - .../expat/expat/CVE-2025-59375-16.patch | 146 -- .../expat/expat/CVE-2025-59375-17.patch | 28 - .../expat/expat/CVE-2025-59375-18.patch | 74 - .../expat/expat/CVE-2025-59375-19.patch | 103 -- .../expat/expat/CVE-2025-59375-20.patch | 285 ---- .../expat/expat/CVE-2025-59375-21.patch | 196 --- .../expat/expat/CVE-2025-59375-22.patch | 37 - .../expat/expat/CVE-2025-59375-23.patch | 47 - .../expat/expat/CVE-2025-59375-24.patch | 36 - .../expat/expat/CVE-2026-24515-01.patch | 43 - .../expat/expat/CVE-2026-24515-02.patch | 117 -- .../expat/expat/CVE-2026-25210-01.patch | 27 - .../expat/expat/CVE-2026-25210-02.patch | 38 - .../expat/expat/CVE-2026-25210-03.patch | 28 - .../expat/expat/CVE-2026-32776.patch | 91 - .../expat/expat/CVE-2026-32777-01.patch | 49 - .../expat/expat/CVE-2026-32777-02.patch | 66 - .../expat/expat/CVE-2026-32778-01.patch | 91 - .../expat/expat/CVE-2026-32778-02.patch | 61 - .../expat/expat/CVE-2026-41080-01.patch | 50 - .../expat/expat/CVE-2026-41080-02.patch | 29 - .../expat/expat/CVE-2026-41080-03.patch | 467 ------ .../expat/expat/CVE-2026-45186-01.patch | 70 - .../expat/expat/CVE-2026-45186-02.patch | 318 ---- .../expat/expat/CVE-2026-45186-03.patch | 46 - .../expat/expat/CVE-2026-45186-04.patch | 32 - .../expat/expat/CVE-2026-45186-05.patch | 32 - .../expat/expat/CVE-2026-45186-06.patch | 87 - .../expat/expat/CVE-2026-45186-07.patch | 52 - .../expat/expat/CVE-2026-56132_p1.patch | 80 - .../expat/expat/CVE-2026-56132_p2.patch | 60 - .../expat/expat/CVE-2026-56132_p3.patch | 74 - .../expat/expat/CVE-2026-56132_p4.patch | 60 - .../expat/expat/CVE-2026-56132_p5.patch | 56 - .../expat/expat/CVE-2026-56403_p1.patch | 81 - .../expat/expat/CVE-2026-56403_p2.patch | 52 - .../expat/expat/CVE-2026-56404.patch | 45 - .../expat/expat/CVE-2026-56405.patch | 30 - .../expat/CVE-2026-56406-dependent.patch | 59 - .../expat/expat/CVE-2026-56406.patch | 34 - .../expat/expat/CVE-2026-56407.patch | 41 - .../expat/expat/CVE-2026-56408.patch | 29 - .../expat/expat/CVE-2026-56409.patch | 51 - .../expat/expat/CVE-2026-56410_p1.patch | 46 - .../expat/expat/CVE-2026-56410_p2.patch | 39 - .../expat/expat/CVE-2026-56411.patch | 50 - meta/recipes-core/expat/expat_2.6.4.bb | 104 -- meta/recipes-core/expat/expat_2.8.3.bb | 33 + .../glibc/glibc/0025-CVE-2026-6238-0001.patch | 59 + .../glibc/glibc/0026-CVE-2026-6238-0002.patch | 81 + .../glibc/glibc/0027-CVE-2026-6238-0003.patch | 58 + .../glibc/glibc/0028-CVE-2026-6238-0004.patch | 73 + .../glibc/glibc/0029-CVE-2026-6238-0005.patch | 69 + .../glibc/glibc/0030-CVE-2026-6238-0006.patch | 382 +++++ meta/recipes-core/glibc/glibc_2.39.bb | 6 + .../recipes-devtools/python/python-pyasn1.inc | 2 + .../python3-pyasn1/CVE-2026-30922.patch | 262 +++ .../python3-pyasn1/CVE-2026-59885.patch | 183 ++ .../atk/at-spi2-core_2.50.1.bb | 2 + .../files/CVE-2026-28417-regression_p1.patch | 78 + .../files/CVE-2026-28417-regression_p2.patch | 53 + meta/recipes-support/vim/vim.inc | 2 + 85 files changed, 1353 insertions(+), 7680 deletions(-) delete mode 100644 meta/recipes-core/expat/expat/0001-tests-Cover-indirect-entity-recursion.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2024-8176-01.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2024-8176-02.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2024-8176-03.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2024-8176-04.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2024-8176-05.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-00.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-01.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-02.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-03.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-04.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-05.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-06.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-07.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-08.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-09.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-10.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-11.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-12.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-13.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-14.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-15.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-16.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-17.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-18.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-19.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-20.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-21.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-22.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-23.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-24.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-24515-01.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-24515-02.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-25210-01.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-25210-02.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-25210-03.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-32776.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-32777-01.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-32777-02.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-32778-01.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-32778-02.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-41080-01.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-41080-02.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-41080-03.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-01.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-02.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-03.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-04.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-05.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-06.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-07.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p1.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p2.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p3.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p4.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p5.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56404.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56405.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56406-dependent.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56406.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56407.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56408.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56409.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56410_p2.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56411.patch delete mode 100644 meta/recipes-core/expat/expat_2.6.4.bb create mode 100644 meta/recipes-core/expat/expat_2.8.3.bb create mode 100644 meta/recipes-core/glibc/glibc/0025-CVE-2026-6238-0001.patch create mode 100644 meta/recipes-core/glibc/glibc/0026-CVE-2026-6238-0002.patch create mode 100644 meta/recipes-core/glibc/glibc/0027-CVE-2026-6238-0003.patch create mode 100644 meta/recipes-core/glibc/glibc/0028-CVE-2026-6238-0004.patch create mode 100644 meta/recipes-core/glibc/glibc/0029-CVE-2026-6238-0005.patch create mode 100644 meta/recipes-core/glibc/glibc/0030-CVE-2026-6238-0006.patch create mode 100644 meta/recipes-devtools/python/python3-pyasn1/CVE-2026-30922.patch create mode 100644 meta/recipes-devtools/python/python3-pyasn1/CVE-2026-59885.patch create mode 100644 meta/recipes-support/vim/files/CVE-2026-28417-regression_p1.patch create mode 100644 meta/recipes-support/vim/files/CVE-2026-28417-regression_p2.patch
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247177): https://lists.openembedded.org/g/openembedded-core/message/247177 Mute This Topic: https://lists.openembedded.org/mt/121569011/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
