Hello, This is a big series, hopefully this will make the patch queue more manageable.
In this series, there are 2 notable exceptions to the usual stable patches: * sbom-cve-check upgrade to 1.3.3 (and dependencies): * python3-shacl2code: upgrade 1.0.1 -> 1.1.0 * python3-spdx-python-model: update from version 0.0.5 to 0.0.6 * python3-sbom-cve-check: update to version 1.3.2 * python3-sbom-cve-check: update to version 1.3.3 * The most user-visible change: disputed CVE will now be ignored. * Work toward automatic upgrade of stable recipes: * recipeutils: add optional stable_upgrade parameter to get_recipe_upgrade_status * lib/oe/recipeutils: make stable_upgrade argument optional in get_recipe_upstream_version() * upstream-stable-release-point.bbclass: add bbclass for stable point upgrade * devtool/upgrade.py: add --stable option * systemd, glib-2.0, dbus, xz, git, perl, libxml2, python3, openssl, binutils, libgcrypt, sqlite3, lttng-tools, util-linux, lttng-ust, babeltrace2, lttng-modules: inherit upstream-stable-release-point Meaning they have stable policies that make good candidates for stable upgrades. 3 more worth mentioning: * "mesa: align x86 mesa config with LLVM graphics" will shrink mesa for users that disable DISTRO_FEATURES opengl, opencl and vulkan. * "kbd: Fix CVE-2026-72693" will remove a corner use-case using openvt -u and the root user. * "expat: upgrade 2.7.5 -> 2.8.3" has not only stable changes but this allow us to remove a lot of patch and handle CVEs that where not fixable with simple backports. Please review this set of changes for wrynose and have comments back by end of day Monday, September 21. As this is a big series, I'm okay with extending this if anyone asks. Passed a-full on autobuilder: https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/4761 qemuarm64-armhost failed on 16233 – AB-INT: 502/520 and other errors on yocto gits retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/8/builds/4700 qemux86-64-musl-ptest failed on 16348 – AB-INT PTEST: python3 ptest failure: in test_interrupt retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/110/builds/1211 (master has the fix that I need to backport for this one) The following changes since commit 883075157987ca300af59185b903d6d1977234c3: gawk: skip randtest in ptest suite (2026-09-10 14:53:48 +0200) are available in the Git repository at: https://git.openembedded.org/openembedded-core-contrib stable/wrynose-nut https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-nut for you to fetch changes up to b73335d791d8bf349080704699742435e6a22eb8: mesa: align x86 mesa config with LLVM graphics (2026-09-17 18:14:27 +0200) ---------------------------------------------------------------- Adarsh Jagadish Kamini (1): expat: upgrade 2.7.5 -> 2.8.3 Alexander Kanavin (3): python3-shacl2code: upgrade 1.0.1 -> 1.1.0 libslirp: fix upstream version check libslirp: upgrade 4.9.1 -> 4.9.3 AshishKumar Mishra (1): mesa: align x86 mesa config with LLVM graphics Benjamin Robin (3): python3-sbom-cve-check: update to version 1.3.3 sbom-cve-check-update-cvelist-native: update to version 2026-08-03 sbom-cve-check-update-nvd-native: update to version 2026.08.03-000011 Benjamin Robin (Schneider Electric) (4): python3-spdx-python-model: update from version 0.0.5 to 0.0.6 python3-sbom-cve-check: update to version 1.3.2 sbom-cve-check-update-cvelist-native: update to version 2026-06-24 sbom-cve-check-update-nvd-native: update to version 2026.06.24-000003 Bhavesh R Maheshwari (11): curl: Fix for CVE-2026-9079 ffmpeg: Fix for CVE-2026-64830 ffmpeg: Fix for CVE-2026-64831 ffmpeg: Fix for CVE-2026-64832 ffmpeg: Fix for CVE-2026-64833 ffmpeg: Fix for CVE-2026-64834 ffmpeg: Fix for CVE-2026-64835 ffmpeg: Fix for CVE-2026-65703 ffmpeg: Fix for CVE-2026-65704 ffmpeg: Fix for CVE-2026-65705 ffmpeg: Fix for CVE-2026-65706 Chen Qi (3): recipeutils: add optional stable_upgrade parameter to get_recipe_upgrade_status upstream-stable-release-point.bbclass: add bbclass for stable point upgrade devtool/upgrade.py: add --stable option Daniel Turull (17): systemd: inherit upstream-stable-release-point glib-2.0: inherit upstream-stable-release-point dbus: inherit upstream-stable-release-point xz: inherit upstream-stable-release-point git: inherit upstream-stable-release-point perl: inherit upstream-stable-release-point libxml2: inherit upstream-stable-release-point python3: inherit upstream-stable-release-point openssl: inherit upstream-stable-release-point binutils: inherit upstream-stable-release-point libgcrypt: inherit upstream-stable-release-point sqlite3: inherit upstream-stable-release-point lttng-tools: inherit upstream-stable-release-point util-linux: inherit upstream-stable-release-point lttng-ust: inherit upstream-stable-release-point babeltrace2: inherit upstream-stable-release-point lttng-modules: inherit upstream-stable-release-point Devansh Patel (3): vim: Fix CVE-2026-52858 regression python3-mako: correct CVE_PRODUCT mapping curl: set CVE_STATUS for CVE-2026-8458 Harish Sadineni (1): kernel-yocto-rust: Add clang toolchain check for riscv64 Himanshu Jadon (1): cmake-native: use bundled nghttp2 with bundled curl Jaipaul Cheernam (8): ca-certificates: upgrade 20260601 -> 20260816 libpcap: Fix CVE-2026-0799 libpcap: Fix CVE-2026-31912 libpcap: Fix CVE-2026-31911 libpcap: Fix CVE-2026-6244 libpcap: Fix CVE-2026-6554 libpcap: Fix CVE-2026-18313 libpcap: Fix CVE-2026-18238 Jakub Szczudlo (Nokia) (1): gnutls: fix CVE-2026-5419 Kyungjik Min (1): rootfs.py: fix run-postinsts removal on multilib images Peter Marko (8): golang: fix homepage python3-certifi: fix homepage libslirp: add tag in SRC_URI curl: patch CVE-2026-7009 curl: patch CVE-2026-8925 curl: patch CVE-2026-9080 curl: patch CVE-2026-9545 curl: patch CVE-2026-9546 Richard Purdie (1): wireless-regdb: upgrade 2026.05.30 -> 2026.09.03 Ross Burton (1): lib/oe/recipeutils: make stable_upgrade argument optional in get_recipe_upstream_version() Siddharth Doshi (5): libxml2: upgrade 2.15.3 -> 2.15.4 curl: Security Fix for CVE-2026-13608 curl: Security Fix for CVE-2026-18924 curl: Security Fix for CVE-2026-80229 curl: set CVE_STATUS for CVE-2026-82209 Tim Orling (2): sbom-cve-check-update-cvelist-native: -> 2026-07-23 sbom-cve-check-update-nvd-native: -> 2026.07.23-000007 Vijay Anusuri (3): python3-cryptography: Fix CVE-2026-69248 python3-cryptography: Fix CVE-2026-69249 kbd: Fix CVE-2026-72693 Wang Mingyu (1): sbom-cve-check-update-nvd-native: upgrade 2026.05.07-000006 -> 2026.06.09-000006 meta/classes-recipe/kernel-yocto-rust.bbclass | 10 + .../upstream-stable-release-point.bbclass | 21 + meta/lib/oe/recipeutils.py | 23 +- meta/lib/oe/rootfs.py | 3 +- .../libpcap/libpcap/01-CVE-2026-0799.patch | 67 ++ .../libpcap/libpcap/02-CVE-2026-31912.patch | 597 ++++++++++++++++++ .../libpcap/libpcap/03-CVE-2026-31911.patch | 45 ++ .../libpcap/libpcap/04-CVE-2026-6244.patch | 50 ++ .../libpcap/libpcap/05-CVE-2026-6554.patch | 94 +++ .../libpcap/libpcap/06-CVE-2026-18313.patch | 90 +++ .../libpcap/libpcap/07-CVE-2026-18238.patch | 222 +++++++ .../libpcap/libpcap_1.10.6.bb | 7 + .../openssl/openssl_3.5.8.bb | 5 + .../{libslirp_4.9.1.bb => libslirp_4.9.3.bb} | 8 +- meta/recipes-core/dbus/dbus_1.16.2.bb | 6 + .../expat/expat/CVE-2026-41080-1.patch | 517 --------------- .../expat/expat/CVE-2026-41080-2.patch | 33 - .../expat/expat/CVE-2026-45186-01.patch | 70 -- .../expat/expat/CVE-2026-45186-02.patch | 318 ---------- .../expat/expat/CVE-2026-45186-03.patch | 46 -- .../expat/expat/CVE-2026-45186-04.patch | 32 - .../expat/expat/CVE-2026-45186-05.patch | 32 - .../expat/expat/CVE-2026-45186-06.patch | 87 --- .../expat/expat/CVE-2026-45186-07.patch | 52 -- .../expat/expat/CVE-2026-56132_p1.patch | 90 --- .../expat/expat/CVE-2026-56132_p2.patch | 63 -- .../expat/expat/CVE-2026-56132_p3.patch | 77 --- .../expat/expat/CVE-2026-56132_p4.patch | 63 -- .../expat/expat/CVE-2026-56132_p5.patch | 58 -- .../expat/expat/CVE-2026-56403_p1.patch | 83 --- .../expat/expat/CVE-2026-56403_p2.patch | 40 -- .../expat/expat/CVE-2026-56404.patch | 47 -- .../expat/expat/CVE-2026-56405.patch | 32 - .../expat/CVE-2026-56406-dependent.patch | 58 -- .../expat/expat/CVE-2026-56406.patch | 37 -- .../expat/expat/CVE-2026-56407.patch | 44 -- .../expat/expat/CVE-2026-56408.patch | 36 -- .../expat/expat/CVE-2026-56409.patch | 53 -- .../expat/expat/CVE-2026-56410_p1.patch | 40 -- .../expat/expat/CVE-2026-56410_p2.patch | 41 -- .../expat/expat/CVE-2026-56411.patch | 47 -- meta/recipes-core/expat/expat_2.7.5.bb | 62 -- meta/recipes-core/expat/expat_2.8.3.bb | 33 + meta/recipes-core/glib-2.0/glib.inc | 4 +- .../recipes-core/kbd/kbd/CVE-2026-72693.patch | 155 +++++ meta/recipes-core/kbd/kbd_2.9.0.bb | 1 + .../libxml/libxml2/CVE-2026-11979.patch | 81 --- .../{libxml2_2.15.3.bb => libxml2_2.15.4.bb} | 7 +- meta/recipes-core/systemd/systemd.inc | 5 + meta/recipes-core/util-linux/util-linux.inc | 4 + meta/recipes-devtools/binutils/binutils.inc | 5 + .../cmake/cmake-native_4.3.1.bb | 2 + meta/recipes-devtools/git/git_2.53.0.bb | 4 + .../go/go-binary-native_1.26.7.bb | 2 +- meta/recipes-devtools/go/go-common.inc | 2 +- meta/recipes-devtools/perl/perl_5.42.0.bb | 2 +- .../python/python3-certifi_2026.2.25.bb | 2 +- .../python/python3-cryptography.bb | 2 + .../python3-cryptography/CVE-2026-69248.patch | 302 +++++++++ .../python3-cryptography/CVE-2026-69249.patch | 338 ++++++++++ .../python/python3-mako_1.3.12.bb | 2 + ...e_1.0.1.bb => python3-shacl2code_1.1.0.bb} | 2 +- ....bb => python3-spdx-python-model_0.0.6.bb} | 2 +- .../recipes-devtools/python/python3_3.14.7.bb | 4 + ...3.1.bb => python3-sbom-cve-check_1.3.3.bb} | 2 +- ...check-update-cvelist-native_2026-08-03.bb} | 2 +- ...ck-update-nvd-native_2026.08.03-000011.bb} | 2 +- meta/recipes-extended/xz/xz_5.8.2.bb | 4 + meta/recipes-graphics/mesa/mesa.bb | 8 +- .../recipes-kernel/lttng/babeltrace2_2.1.2.bb | 4 +- .../lttng/lttng-modules_2.14.4.bb | 6 + .../lttng/lttng-tools_2.14.1.bb | 2 +- meta/recipes-kernel/lttng/lttng-ust_2.14.0.bb | 4 +- ....05.30.bb => wireless-regdb_2026.09.03.bb} | 2 +- .../ffmpeg/ffmpeg/CVE-2026-64830.patch | 65 ++ .../ffmpeg/ffmpeg/CVE-2026-64831.patch | 36 ++ .../ffmpeg/ffmpeg/CVE-2026-64832.patch | 47 ++ .../ffmpeg/ffmpeg/CVE-2026-64833.patch | 36 ++ .../ffmpeg/ffmpeg/CVE-2026-64834.patch | 36 ++ .../ffmpeg/ffmpeg/CVE-2026-64835.patch | 45 ++ .../ffmpeg/ffmpeg/CVE-2026-65703.patch | 47 ++ .../ffmpeg/ffmpeg/CVE-2026-65704.patch | 35 + .../ffmpeg/ffmpeg/CVE-2026-65705_p1.patch | 68 ++ .../ffmpeg/ffmpeg/CVE-2026-65705_p2.patch | 115 ++++ .../ffmpeg/ffmpeg/CVE-2026-65706.patch | 52 ++ .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 11 + ...ertdata2pem.py-print-a-warning-for-e.patch | 6 +- ...icates-don-t-use-Debianisms-in-run-p.patch | 2 +- ...icates-use-relative-symlinks-from-ET.patch | 2 +- ...0260601.bb => ca-certificates_20260816.bb} | 2 +- .../curl/curl/CVE-2026-13608.patch | 48 ++ .../curl/curl/CVE-2026-18924.patch | 39 ++ .../curl/curl/CVE-2026-7009.patch | 50 ++ .../curl/curl/CVE-2026-80229.patch | 35 + .../curl/curl/CVE-2026-8925.patch | 57 ++ .../curl/curl/CVE-2026-9079.patch | 289 +++++++++ .../curl/curl/CVE-2026-9080.patch | 95 +++ .../curl/curl/CVE-2026-9545-01.patch | 157 +++++ .../curl/curl/CVE-2026-9545-02.patch | 67 ++ .../curl/curl/CVE-2026-9546-01.patch | 227 +++++++ .../curl/curl/CVE-2026-9546-02.patch | 218 +++++++ meta/recipes-support/curl/curl_8.19.0.bb | 13 + .../gnutls/gnutls/CVE-2026-5419.patch | 248 ++++++++ meta/recipes-support/gnutls/gnutls_3.8.12.bb | 1 + .../libgcrypt/libgcrypt_1.12.1.bb | 2 +- meta/recipes-support/sqlite/sqlite3.inc | 2 +- .../vim/files/CVE-2026-52858-regression.patch | 93 +++ meta/recipes-support/vim/vim.inc | 1 + scripts/lib/devtool/upgrade.py | 9 +- 109 files changed, 4379 insertions(+), 2280 deletions(-) create mode 100644 meta/classes-recipe/upstream-stable-release-point.bbclass create mode 100644 meta/recipes-connectivity/libpcap/libpcap/01-CVE-2026-0799.patch create mode 100644 meta/recipes-connectivity/libpcap/libpcap/02-CVE-2026-31912.patch create mode 100644 meta/recipes-connectivity/libpcap/libpcap/03-CVE-2026-31911.patch create mode 100644 meta/recipes-connectivity/libpcap/libpcap/04-CVE-2026-6244.patch create mode 100644 meta/recipes-connectivity/libpcap/libpcap/05-CVE-2026-6554.patch create mode 100644 meta/recipes-connectivity/libpcap/libpcap/06-CVE-2026-18313.patch create mode 100644 meta/recipes-connectivity/libpcap/libpcap/07-CVE-2026-18238.patch rename meta/recipes-connectivity/slirp/{libslirp_4.9.1.bb => libslirp_4.9.3.bb} (58%) delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-41080-1.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-41080-2.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-01.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-02.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-03.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-04.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-05.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-06.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-07.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p1.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p2.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p3.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p4.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p5.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56404.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56405.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56406-dependent.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56406.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56407.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56408.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56409.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56410_p2.patch delete mode 100644 meta/recipes-core/expat/expat/CVE-2026-56411.patch delete mode 100644 meta/recipes-core/expat/expat_2.7.5.bb create mode 100644 meta/recipes-core/expat/expat_2.8.3.bb create mode 100644 meta/recipes-core/kbd/kbd/CVE-2026-72693.patch delete mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-11979.patch rename meta/recipes-core/libxml/{libxml2_2.15.3.bb => libxml2_2.15.4.bb} (93%) create mode 100644 meta/recipes-devtools/python/python3-cryptography/CVE-2026-69248.patch create mode 100644 meta/recipes-devtools/python/python3-cryptography/CVE-2026-69249.patch rename meta/recipes-devtools/python/{python3-shacl2code_1.0.1.bb => python3-shacl2code_1.1.0.bb} (81%) rename meta/recipes-devtools/python/{python3-spdx-python-model_0.0.5.bb => python3-spdx-python-model_0.0.6.bb} (93%) rename meta/recipes-devtools/sbom-cve-check/{python3-sbom-cve-check_1.3.1.bb => python3-sbom-cve-check_1.3.3.bb} (82%) rename meta/recipes-devtools/sbom-cve-check/{sbom-cve-check-update-cvelist-native_2026-05-07.bb => sbom-cve-check-update-cvelist-native_2026-08-03.bb} (89%) rename meta/recipes-devtools/sbom-cve-check/{sbom-cve-check-update-nvd-native_2026.05.07-000006.bb => sbom-cve-check-update-nvd-native_2026.08.03-000011.bb} (89%) rename meta/recipes-kernel/wireless-regdb/{wireless-regdb_2026.05.30.bb => wireless-regdb_2026.09.03.bb} (94%) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64830.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64831.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64832.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64833.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64834.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64835.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65703.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65704.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65705_p1.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65705_p2.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65706.patch rename meta/recipes-support/ca-certificates/{ca-certificates_20260601.bb => ca-certificates_20260816.bb} (97%) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-13608.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-18924.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-7009.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80229.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8925.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-9079.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-9080.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-9545-01.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-9545-02.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-9546-01.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-9546-02.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-5419.patch create mode 100644 meta/recipes-support/vim/files/CVE-2026-52858-regression.patch
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#246096): https://lists.openembedded.org/g/openembedded-core/message/246096 Mute This Topic: https://lists.openembedded.org/mt/121305573/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
