[AUH] libmodulemd: upgrading to 2.15.4 SUCCEEDED

Hello,

this email is a notification from the Auto Upgrade Helper
that the automatic attempt to upgrade the recipe(s) *libmodulemd* to *2.15.4* has Succeeded.

Next steps:
    - apply the patch: git am 0001-libmodulemd-upgrade-2.15.3-2.15.4.patch
    - check the changes to upstream patches and summarize them in the commit message,
    - compile an image that contains the package
    - perform some basic sanity tests
    - amend the patch and sign it off: git commit -s --reset-author --amend
    - send it to the appropriate mailing list

Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.

Please review the attached files for further information and build/update failures.
Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler

Regards,
The Upgrade Helper

-- >8 --
From c70950dedf2f33c14778e314fcc71910f00c5fc1 Mon Sep 17 00:00:00 2001
From: Upgrade Helper <auh@yoctoproject.org>
Date: Sat, 7 Nov 2026 05:29:19 +0000
Subject: [PATCH] libmodulemd: upgrade 2.15.3 -> 2.15.4

2.15.4      2026-11-06

Possibly incompatible fixes:
- Compressed YAML files which decompress to much are rejected
  (CVE-2026-92823). If libmodulemd is built with "rpmio" feature,
  modulemd_module_index_update_from_file() decompresses compressed input
  files. Small compressed files can decompress to very large data. Then
  processing the large data consumes unexpectedly large amount of memory. This
  amplification of use of resources can be interpreted as a denial of service.
  To avoid it, a limit for decompressed data was imposed. The limit is
  a maximum of 64 MiB and 64 times the compressed size of the input file. When
  the limit is reached, a Glib warning is emitted and
  modulemd_module_index_update_from_file() returns FALSE. This flaw was added
  with aad63a59ca02be2cc7afb6e6c8a0c3bd5a036dd6 commit ("Add helpers for
  reading compressed files") and first released in 2.8.0 version.

- Introduce a recursion limit for YAML documents (CVE-2026-92822). Parsing
  a modulemd document with "xmd" YAML tree with enormously nested nodes may
  exhaust all heap or stack memory when duplicating subdocuments in
  modulemd_yaml_parse_document_type_internal(). This is fixed by adding
  a "recursion_limit" build-time option defining a maximal depth of acceptable
  YAML documents. Default is 64. This flaw was confirmed in current 2.15.3
  version and back to 1.4.0 version. Earlier versions might be affected as well.

Other fixes:
- Iterating over checksums in modulemd_module_stream_v2_emit_rpm_map() was
  fixed (CVE-2026-92824). When serializing a module index into a YAML string
  where a number of hash types was different from a number of hashes of
  a particular type in "rpm-map" modulemd-v2 YAML element, not all hashes were
  serialized or an invalid memory was read. This flaw was introduced with
  b5abf3bbedd211a403122fccfec192581e2bbe8f commit ("Add rpm-map to
  ModuleStreamV2") and first released in 2.2.0 version.
- Harden modulemd_module_add_translation() against null-pointer dereferences.
- Harden modulemd_module_add_obsoletes() against null-pointer dereferences.
---
 .../{libmodulemd_2.15.3.bb => libmodulemd_2.15.4.bb}            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/libmodulemd/{libmodulemd_2.15.3.bb => libmodulemd_2.15.4.bb} (94%)