mbox

[wrynose,00/19] Patch review

Message ID cover.1787576160.git.yoann.congal@smile.fr
State Not Applicable, archived
Headers show

Pull-request

https://git.openembedded.org/openembedded-core-contrib stable/wrynose-nut

Message

Yoann Congal Aug. 24, 2026, 12:59 p.m. UTC 
Hello,

(I'm back from holidays. This is a series prepared by Fabien. Thanks to
him for handling things while I was away :) )

Please review this set of changes for wrynose and have comments back by
end of day Wednesday, August 26.

Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/4542

The following changes since commit ef022bf82d79015802309d14c28b13373ebe53f5:

  build-appliance-image: Update to wrynose head revisions (2026-08-18 08:40:33 +0100)

are available in the Git repository at:

  https://git.openembedded.org/openembedded-core-contrib stable/wrynose-nut
  https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-nut

for you to fetch changes up to f7397af248e1e338929d70a910b0fbc2341528ec:

  mirrors: Disable YP mirrors on autobuilder (2026-08-21 18:06:46 +0200)

----------------------------------------------------------------

Adarsh Jagadish Kamini (1):
  libssh2: fix CVE-2026-58050

Deepak Rathore (2):
  curl: fix CVE-2026-4873
  nghttp2: set status for CVE-2026-58055

Jaipaul Cheernam (6):
  libssh2: fix CVE-2026-66032
  libssh2: fix CVE-2026-66033
  libssh2: fix CVE-2026-66034
  libssh2: fix CVE-2026-66035
  binutils: Patch for CVE-2026-15003
  binutils: fix CVE-2026-18220

Michal Sieron (1):
  rpcbind: Drop dependency on quota

Peter Marko (6):
  busybox: patch CVE-2026-38754
  libsndfile1: patch CVE-2026-37555
  bison: patch CVE-2026-56389
  cpio: patch CVE-2026-66485
  cpio: patch CVE-2026-66484
  cpio: patch CVE-2026-66486

Richard Purdie (3):
  rpcbind: upgrade 1.2.8 -> 1.2.9
  oeqa/maturin: Update dependency version
  mirrors: Disable YP mirrors on autobuilder

 meta/classes-global/mirrors.bbclass           |  19 +-
 .../yocto-autobuilder/autobuilder.conf        |   1 +
 .../files/maturin/guessing-game/Cargo.toml    |   2 +-
 .../busybox/busybox/CVE-2026-38754.patch      | 155 ++++++
 meta/recipes-core/busybox/busybox_1.37.0.bb   |   1 +
 .../binutils/binutils-2.46.inc                |   2 +
 .../binutils/binutils/CVE-2026-15003.patch    | 402 ++++++++++++++
 .../binutils/binutils/CVE-2026-18220.patch    |  65 +++
 .../bison/bison/CVE-2026-56389.patch          |  56 ++
 meta/recipes-devtools/bison/bison_3.8.2.bb    |   1 +
 meta/recipes-extended/cpio/cpio_2.15.bb       |   3 +
 .../cpio/files/CVE-2026-66484.patch           |  28 +
 .../cpio/files/CVE-2026-66485.patch           | 210 ++++++++
 .../cpio/files/CVE-2026-66486.patch           | 497 ++++++++++++++++++
 .../0001-systemd-use-EnvironmentFile.patch    |   7 +-
 ...pcbind_add_option_to_fix_port_number.patch |  25 +-
 .../{rpcbind_1.2.8.bb => rpcbind_1.2.9.bb}    |   4 +-
 .../libsndfile1/CVE-2026-37555.patch          |  44 ++
 .../libsndfile/libsndfile1_1.2.2.bb           |   1 +
 .../curl/curl/CVE-2026-4873.patch             |  52 ++
 meta/recipes-support/curl/curl_8.19.0.bb      |   1 +
 .../libssh2/libssh2/CVE-2026-58050.patch      |  45 ++
 .../libssh2/libssh2/CVE-2026-66032.patch      |  36 ++
 .../libssh2/libssh2/CVE-2026-66033.patch      |  45 ++
 .../libssh2/libssh2/CVE-2026-66034.patch      |  40 ++
 .../libssh2/libssh2/CVE-2026-66035.patch      |  56 ++
 .../recipes-support/libssh2/libssh2_1.11.1.bb |   5 +
 .../recipes-support/nghttp2/nghttp2_1.68.1.bb |   2 +
 28 files changed, 1776 insertions(+), 29 deletions(-)
 create mode 100644 meta/recipes-core/busybox/busybox/CVE-2026-38754.patch
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-15003.patch
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-18220.patch
 create mode 100644 meta/recipes-devtools/bison/bison/CVE-2026-56389.patch
 create mode 100644 meta/recipes-extended/cpio/files/CVE-2026-66484.patch
 create mode 100644 meta/recipes-extended/cpio/files/CVE-2026-66485.patch
 create mode 100644 meta/recipes-extended/cpio/files/CVE-2026-66486.patch
 rename meta/recipes-extended/rpcbind/{rpcbind_1.2.8.bb => rpcbind_1.2.9.bb} (95%)
 create mode 100644 meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2026-37555.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-4873.patch
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-58050.patch
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66032.patch
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch