[AUH] xz: upgrading to 5.8.4 SUCCEEDED

Hello,

this email is a notification from the Auto Upgrade Helper
that the automatic attempt to upgrade the recipe(s) *xz* to *5.8.4* has Succeeded.

Next steps:
    - apply the patch: git am 0001-xz-upgrade-5.8.3-5.8.4.patch
    - check the changes to upstream patches and summarize them in the commit message,
    - compile an image that contains the package
    - perform some basic sanity tests
    - amend the patch and sign it off: git commit -s --reset-author --amend
    - send it to the appropriate mailing list

Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.

Please review the attached files for further information and build/update failures.
Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler

Regards,
The Upgrade Helper

-- >8 --
From 814fffc75f24ce9ab49ceae29ba4be2cae8ef9ba Mon Sep 17 00:00:00 2001
From: Upgrade Helper <auh@yoctoproject.org>
Date: Thu, 10 Sep 2026 06:00:21 +0000
Subject: [PATCH] xz: upgrade 5.8.3 -> 5.8.4

Source: NEWS

5.8.4 (2026-09-09)

    IMPORTANT: This includes a fix for a security issue that affects all
    XZ Utils versions since 5.0.0. This and a few other fixes have also
    been committed to the old stable branches (v5.2, v5.4, and v5.6) in
    the xz Git repository. Those fixes are marked below. No new 5.2.x,
    5.4.x, or 5.6.x releases will be made.

    * liblzma:

        - lzma_alone_decoder(), lzma_lzip_decoder(),
          lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an
          invalid memory access after memory allocation has failed and
          the application reinitializes the existing decoder to decode
          a different file. This bug could at least result in a crash.
          This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending.
          (Also in v5.2, v5.4, and v5.6.)

        - lzma_stream_buffer_decode(): Fix wrong error code and,
          in debug builds, assertion failure. LZMA_BUF_ERROR could
          be returned with truncated inputs while LZMA_DATA_ERROR
          is the correct one in this function.
          (Also in v5.2, v5.4, and v5.6.)

        - Fix a performance issue in the typical use case of
          lzma_index_cat(). Internally liblzma calls it from
          lzma_file_info_decoder(), so that was affected too. The
          problem occurred if the input .xz file was created by
          concatenating a large number of .xz files. A crafted file
          could make "xz --list" very slow or effectively hang.
          Normal decompression doesn't use these functions and
          thus wasn't affected.
          (Also in v5.2, v5.4, and v5.6.)

        - Fix a theoretical integer overflow in lzma_index_cat().
          (Also in v5.2, v5.4, and v5.6.)

        - Fix bogus memory usage report in lzma_index_decoder() when
          the .xz Index is obviously invalid. A huge bogus value could
          cause an integer overflow in lzma_file_info_decoder()'s
          memory usage reporting due to a missing overflow check,
          making lzma_memused() report an incorrect tiny value. This
          bug didn't affect the memory usage limiter in these two
          decoders; only the reporting via lzma_memused() was affected.
          (Also in v5.2, v5.4, and v5.6.)

        - Fix a too low memory usage report in lzma_index_decoder()
          if lzma_memused() is called after a part of the Index has
          already been decoded. The typical use case is to call
          lzma_memused() immediately after LZMA_MEMLIMIT_ERROR,
          which did work correctly.

        - Fix copying of check type in lzma_index_dup(). Calling
          lzma_index_checks() on the duplicated lzma_index returned
          return garbage a result. lzma_index_dup() is rarely used;
          liblzma doesn't use it internally and xz itself doesn't use
          it either.
          (Also in v5.2, v5.4, and v5.6.)

        - lzma_file_info_decoder() and lzma_index_decoder(): Reject
          an obviously-

[Changelog truncated as it exceeds 3000 characters;
the full changelog can be found in an attachment to the AUH email]
---
 meta/recipes-extended/xz/{xz_5.8.3.bb => xz_5.8.4.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-extended/xz/{xz_5.8.3.bb => xz_5.8.4.bb} (97%)