Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *libpcre2* to *10.49* has Succeeded.
Next steps:
- apply the patch: git am 0001-libpcre2-upgrade-10.48-10.49.patch
- check the changes to upstream patches and summarize them in the commit
message,
- compile an image that contains the package
- perform some basic sanity tests
- amend the patch and sign it off: git commit -s --reset-author --amend
- send it to the appropriate mailing list
Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.
Please review the attached files for further information and build/update
failures.
Any problem please file a bug at
https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler
Regards,
The Upgrade Helper
-- >8 --
>From 5aaa53e9188f5e46ed743d97a73d020055724357 Mon Sep 17 00:00:00 2001
From: Upgrade Helper <[email protected]>
Date: Tue, 29 Sep 2026 06:18:33 +0000
Subject: [PATCH] libpcre2: upgrade 10.48 -> 10.49
Version 10.49 28-September-2026
-------------------------------
This is a security-only release, to address GHSA-r9hj-j2rw-4q3m.
Compared to 10.48, this release has only a minimal code change to prevent an
out-of-bounds write with arbitrary data. An attacker-controlled regex pattern
is required, and applications are only affected if using the
pcre2_jit_stack_create() and pcre2_jit_stack_assign() APIs to provide a growable
JIT stack, and then matching against a pattern with unusually high JIT stack
usage, such as a large number of capturing groups.
The implications of an out-of-bounds write could include arbitrary code
execution.
The issue is not a regression and affects releases 10.48 and earlier.
---
.../libpcre/{libpcre2_10.48.bb => libpcre2_10.49.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-support/libpcre/{libpcre2_10.48.bb => libpcre2_10.49.bb}
(96%)
diff --git a/meta/recipes-support/libpcre/libpcre2_10.48.bb
b/meta/recipes-support/libpcre/libpcre2_10.49.bb
similarity index 96%
rename from meta/recipes-support/libpcre/libpcre2_10.48.bb
rename to meta/recipes-support/libpcre/libpcre2_10.49.bb
index d5daff03c0..8e0c44fb4c 100644
--- a/meta/recipes-support/libpcre/libpcre2_10.48.bb
+++ b/meta/recipes-support/libpcre/libpcre2_10.49.bb
@@ -19,7 +19,7 @@ SRC_URI =
"${GITHUB_BASE_URI}/download/pcre2-${PV}/pcre2-${PV}.tar.bz2 \
GITHUB_BASE_URI = "https://github.com/PCRE2Project/pcre2/releases";
UPSTREAM_CHECK_REGEX = "releases/tag/pcre2-(?P<pver>\d+(\.\d+)+)$"
-SRC_URI[sha256sum] =
"b6c68fdf6f3ac31388b50aa89ff0fc49c00c987c16e7b5146491d12003f2c8ed"
+SRC_URI[sha256sum] =
"53c156e1ba416a20da8e65395daa132da0d80e76910424caca3fcdae7831d384"
CVE_PRODUCT = "pcre2"
--
2.47.1
0001-libpcre2-upgrade-10.48-10.49.patch
Description: Binary data
packages/x86-64-v3-poky-linux/libpcre2: PV changed from "10.48" to "10.49" packages/x86-64-v3-poky-linux/libpcre2: SRC_URI changed from "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.48/pcre2-10.48.tar.bz2 file://run-ptest" to "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.49/pcre2-10.49.tar.bz2 file://run-ptest" packages/x86-64-v3-poky-linux/libpcre2: PKGV changed from 10.48 [default] to 10.49 [default] packages/x86-64-v3-poky-linux/libpcre2/libpcre2-16: PV changed from "10.48" to "10.49" packages/x86-64-v3-poky-linux/libpcre2/libpcre2-16: PKGV changed from 10.48 [default] to 10.49 [default] packages/x86-64-v3-poky-linux/libpcre2/libpcre2-16: FILELIST: removed "/usr/lib/libpcre2-16.so.0.16.0", added "/usr/lib/libpcre2-16.so.0.16.1" packages/x86-64-v3-poky-linux/libpcre2/libpcre2-32: PV changed from "10.48" to "10.49" packages/x86-64-v3-poky-linux/libpcre2/libpcre2-32: PKGV changed from 10.48 [default] to 10.49 [default] packages/x86-64-v3-poky-linux/libpcre2/libpcre2-32: FILELIST: removed "/usr/lib/libpcre2-32.so.0.16.0", added "/usr/lib/libpcre2-32.so.0.16.1" packages/x86-64-v3-poky-linux/libpcre2/libpcre2-dbg: PKGSIZE changed from 4418400 to 4418552 (+0%) packages/x86-64-v3-poky-linux/libpcre2/libpcre2-dbg: PV changed from "10.48" to "10.49" packages/x86-64-v3-poky-linux/libpcre2/libpcre2-dbg: PKGV changed from 10.48 [default] to 10.49 [default] packages/x86-64-v3-poky-linux/libpcre2/libpcre2-dbg: FILELIST: removed "/usr/lib/.debug/libpcre2-8.so.0.16.0 /usr/lib/.debug/libpcre2-posix.so.3.0.8 /usr/lib/.debug/libpcre2-32.so.0.16.0 /usr/lib/.debug/libpcre2-16.so.0.16.0", added "/usr/lib/.debug/libpcre2-8.so.0.16.1 /usr/lib/.debug/libpcre2-32.so.0.16.1 /usr/lib/.debug/libpcre2-posix.so.3.0.9 /usr/lib/.debug/libpcre2-16.so.0.16.1" packages/x86-64-v3-poky-linux/libpcre2/libpcre2-dev: PV changed from "10.48" to "10.49" packages/x86-64-v3-poky-linux/libpcre2/libpcre2-dev: PKGV changed from 10.48 [default] to 10.49 [default] packages/x86-64-v3-poky-linux/libpcre2/libpcre2-doc: PKGSIZE changed from 2865434 to 2867518 (+0%) packages/x86-64-v3-poky-linux/libpcre2/libpcre2-doc: PV changed from "10.48" to "10.49" packages/x86-64-v3-poky-linux/libpcre2/libpcre2-doc: PKGV changed from 10.48 [default] to 10.49 [default] packages/x86-64-v3-poky-linux/libpcre2/libpcre2-locale: PV changed from "10.48" to "10.49" packages/x86-64-v3-poky-linux/libpcre2/libpcre2-locale: PKGV changed from 10.48 [default] to 10.49 [default] packages/x86-64-v3-poky-linux/libpcre2/libpcre2-ptest: PV changed from "10.48" to "10.49" packages/x86-64-v3-poky-linux/libpcre2/libpcre2-ptest: PKGV changed from 10.48 [default] to 10.49 [default] packages/x86-64-v3-poky-linux/libpcre2/libpcre2-src: PKGSIZE changed from 2925848 to 2926731 (+0%) packages/x86-64-v3-poky-linux/libpcre2/libpcre2-src: PV changed from "10.48" to "10.49" packages/x86-64-v3-poky-linux/libpcre2/libpcre2-src: PKGV changed from 10.48 [default] to 10.49 [default] packages/x86-64-v3-poky-linux/libpcre2/libpcre2-src: FILELIST: directory renamed /usr/src/debug/libpcre2/10.48/src -> /usr/src/debug/libpcre2/10.49/src packages/x86-64-v3-poky-linux/libpcre2/libpcre2-staticdev: PV changed from "10.48" to "10.49" packages/x86-64-v3-poky-linux/libpcre2/libpcre2-staticdev: PKGV changed from 10.48 [default] to 10.49 [default] packages/x86-64-v3-poky-linux/libpcre2/libpcre2: PV changed from "10.48" to "10.49" packages/x86-64-v3-poky-linux/libpcre2/libpcre2: PKGV changed from 10.48 [default] to 10.49 [default] packages/x86-64-v3-poky-linux/libpcre2/libpcre2: FILELIST: removed "/usr/lib/libpcre2-8.so.0.16.0 /usr/lib/libpcre2-posix.so.3.0.8", added "/usr/lib/libpcre2-posix.so.3.0.9 /usr/lib/libpcre2-8.so.0.16.1" packages/x86-64-v3-poky-linux/libpcre2/pcre2grep-doc: PV changed from "10.48" to "10.49" packages/x86-64-v3-poky-linux/libpcre2/pcre2grep-doc: PKGV changed from 10.48 [default] to 10.49 [default] packages/x86-64-v3-poky-linux/libpcre2/pcre2grep: PV changed from "10.48" to "10.49" packages/x86-64-v3-poky-linux/libpcre2/pcre2grep: PKGV changed from 10.48 [default] to 10.49 [default] packages/x86-64-v3-poky-linux/libpcre2/pcre2test-doc: PV changed from "10.48" to "10.49" packages/x86-64-v3-poky-linux/libpcre2/pcre2test-doc: PKGV changed from 10.48 [default] to 10.49 [default] packages/x86-64-v3-poky-linux/libpcre2/pcre2test: PV changed from "10.48" to "10.49" packages/x86-64-v3-poky-linux/libpcre2/pcre2test: PKGV changed from 10.48 [default] to 10.49 [default] Changes to packages/x86-64-v3-poky-linux/libpcre2 (sysroot): /usr/lib/libpcre2-16.so.0 changed symlink target from libpcre2-16.so.0.16.0 to libpcre2-16.so.0.16.1 /usr/lib/libpcre2-16.so changed symlink target from libpcre2-16.so.0.16.0 to libpcre2-16.so.0.16.1 /usr/lib/libpcre2-32.so.0 changed symlink target from libpcre2-32.so.0.16.0 to libpcre2-32.so.0.16.1 /usr/lib/libpcre2-32.so changed symlink target from libpcre2-32.so.0.16.0 to libpcre2-32.so.0.16.1 /usr/lib/libpcre2-8.so.0 changed symlink target from libpcre2-8.so.0.16.0 to libpcre2-8.so.0.16.1 /usr/lib/libpcre2-8.so changed symlink target from libpcre2-8.so.0.16.0 to libpcre2-8.so.0.16.1 /usr/lib/libpcre2-posix.so.3 changed symlink target from libpcre2-posix.so.3.0.8 to libpcre2-posix.so.3.0.9 /usr/lib/libpcre2-posix.so changed symlink target from libpcre2-posix.so.3.0.8 to libpcre2-posix.so.3.0.9 /usr/lib/libpcre2-8.so.0.16.0 moved to /usr/lib/libpcre2-8.so.0.16.1 /usr/lib/libpcre2-posix.so.3.0.8 moved to /usr/lib/libpcre2-posix.so.3.0.9 /usr/lib/libpcre2-16.so.0.16.1 was added /usr/lib/libpcre2-32.so.0.16.1 was added /usr/lib/libpcre2-16.so.0.16.0 was removed /usr/lib/libpcre2-32.so.0.16.0 was removed Changes to packages/x86_64-linux/libpcre2-native (sysroot): /usr/lib/libpcre2-16.so.0 changed symlink target from libpcre2-16.so.0.16.0 to libpcre2-16.so.0.16.1 /usr/lib/libpcre2-16.so changed symlink target from libpcre2-16.so.0.16.0 to libpcre2-16.so.0.16.1 /usr/lib/libpcre2-32.so.0 changed symlink target from libpcre2-32.so.0.16.0 to libpcre2-32.so.0.16.1 /usr/lib/libpcre2-32.so changed symlink target from libpcre2-32.so.0.16.0 to libpcre2-32.so.0.16.1 /usr/lib/libpcre2-8.so.0 changed symlink target from libpcre2-8.so.0.16.0 to libpcre2-8.so.0.16.1 /usr/lib/libpcre2-8.so changed symlink target from libpcre2-8.so.0.16.0 to libpcre2-8.so.0.16.1 /usr/lib/libpcre2-posix.so.3 changed symlink target from libpcre2-posix.so.3.0.8 to libpcre2-posix.so.3.0.9 /usr/lib/libpcre2-posix.so changed symlink target from libpcre2-posix.so.3.0.8 to libpcre2-posix.so.3.0.9 /usr/lib/libpcre2-8.so.0.16.0 moved to /usr/lib/libpcre2-8.so.0.16.1 /usr/lib/libpcre2-posix.so.3.0.8 moved to /usr/lib/libpcre2-posix.so.3.0.9 /usr/lib/libpcre2-16.so.0.16.1 was added /usr/lib/libpcre2-32.so.0.16.1 was added /usr/lib/libpcre2-16.so.0.16.0 was removed /usr/lib/libpcre2-32.so.0.16.0 was removed
Version 10.49 28-September-2026 ------------------------------- This is a security-only release, to address GHSA-r9hj-j2rw-4q3m. Compared to 10.48, this release has only a minimal code change to prevent an out-of-bounds write with arbitrary data. An attacker-controlled regex pattern is required, and applications are only affected if using the pcre2_jit_stack_create() and pcre2_jit_stack_assign() APIs to provide a growable JIT stack, and then matching against a pattern with unusually high JIT stack usage, such as a large number of capturing groups. The implications of an out-of-bounds write could include arbitrary code execution. The issue is not a regression and affects releases 10.48 and earlier.
packages/x86-64-v3-poky-linux/libpcre2/libpcre2-16: FILELIST: removed "/usr/lib/libpcre2-16.so.0.16.0", added "/usr/lib/libpcre2-16.so.0.16.1" packages/x86-64-v3-poky-linux/libpcre2/libpcre2-32: FILELIST: removed "/usr/lib/libpcre2-32.so.0.16.0", added "/usr/lib/libpcre2-32.so.0.16.1" packages/x86-64-v3-poky-linux/libpcre2/libpcre2: FILELIST: removed "/usr/lib/libpcre2-posix.so.3.0.8 /usr/lib/libpcre2-8.so.0.16.0", added "/usr/lib/libpcre2-posix.so.3.0.9 /usr/lib/libpcre2-8.so.0.16.1" Changes to packages/x86-64-v3-poky-linux/libpcre2 (sysroot): /usr/lib/libpcre2-16.so.0 changed symlink target from libpcre2-16.so.0.16.0 to libpcre2-16.so.0.16.1 /usr/lib/libpcre2-16.so changed symlink target from libpcre2-16.so.0.16.0 to libpcre2-16.so.0.16.1 /usr/lib/libpcre2-32.so.0 changed symlink target from libpcre2-32.so.0.16.0 to libpcre2-32.so.0.16.1 /usr/lib/libpcre2-32.so changed symlink target from libpcre2-32.so.0.16.0 to libpcre2-32.so.0.16.1 /usr/lib/libpcre2-8.so.0 changed symlink target from libpcre2-8.so.0.16.0 to libpcre2-8.so.0.16.1 /usr/lib/libpcre2-8.so changed symlink target from libpcre2-8.so.0.16.0 to libpcre2-8.so.0.16.1 /usr/lib/libpcre2-posix.so.3 changed symlink target from libpcre2-posix.so.3.0.8 to libpcre2-posix.so.3.0.9 /usr/lib/libpcre2-posix.so changed symlink target from libpcre2-posix.so.3.0.8 to libpcre2-posix.so.3.0.9 /usr/lib/libpcre2-8.so.0.16.0 moved to /usr/lib/libpcre2-8.so.0.16.1 /usr/lib/libpcre2-posix.so.3.0.8 moved to /usr/lib/libpcre2-posix.so.3.0.9 /usr/lib/libpcre2-16.so.0.16.1 was added /usr/lib/libpcre2-32.so.0.16.1 was added /usr/lib/libpcre2-16.so.0.16.0 was removed /usr/lib/libpcre2-32.so.0.16.0 was removed Changes to packages/x86_64-linux/libpcre2-native (sysroot): /usr/lib/libpcre2-16.so.0 changed symlink target from libpcre2-16.so.0.16.0 to libpcre2-16.so.0.16.1 /usr/lib/libpcre2-16.so changed symlink target from libpcre2-16.so.0.16.0 to libpcre2-16.so.0.16.1 /usr/lib/libpcre2-32.so.0 changed symlink target from libpcre2-32.so.0.16.0 to libpcre2-32.so.0.16.1 /usr/lib/libpcre2-32.so changed symlink target from libpcre2-32.so.0.16.0 to libpcre2-32.so.0.16.1 /usr/lib/libpcre2-8.so.0 changed symlink target from libpcre2-8.so.0.16.0 to libpcre2-8.so.0.16.1 /usr/lib/libpcre2-8.so changed symlink target from libpcre2-8.so.0.16.0 to libpcre2-8.so.0.16.1 /usr/lib/libpcre2-posix.so.3 changed symlink target from libpcre2-posix.so.3.0.8 to libpcre2-posix.so.3.0.9 /usr/lib/libpcre2-posix.so changed symlink target from libpcre2-posix.so.3.0.8 to libpcre2-posix.so.3.0.9 /usr/lib/libpcre2-8.so.0.16.0 moved to /usr/lib/libpcre2-8.so.0.16.1 /usr/lib/libpcre2-posix.so.3.0.8 moved to /usr/lib/libpcre2-posix.so.3.0.9 /usr/lib/libpcre2-16.so.0.16.1 was added /usr/lib/libpcre2-32.so.0.16.1 was added /usr/lib/libpcre2-16.so.0.16.0 was removed /usr/lib/libpcre2-32.so.0.16.0 was removed
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#246837): https://lists.openembedded.org/g/openembedded-core/message/246837 Mute This Topic: https://lists.openembedded.org/mt/121486195/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
