diff mbox series

[meta-oe,2/2] ostree: Upgrade 2026.3 -> 2026.4

Message ID 20260908093043.249127-2-leon.anavi@konsulko.com
State New
Headers show
Series [meta-oe,1/2] valkey: Upgrade 9.1.1 -> 9.1.2 | expand

Commit Message

Leon Anavi Sept. 8, 2026, 9:30 a.m. UTC 
Upgrade to release 2026.4:

- This release reverts the static delta decompression-size safety
  margin introduced in 2026.3, which turned out to reject legitimate
  large deltas at apply time -- most visibly, Flathub Firefox
  updates were failing with Decompressed delta part exceeds
  configured limit

  Both the margin heuristic and the flat 512 MiB per-part
  decompression cap it fed into have been dropped for now. This
  deliberately reopens GHSA-7cgc-gp99-6jmm (unbounded decompression
  of a given delta part) until a precise, per-part exact-size-based
  replacement lands in a future release. The LZMA decoder memory
  limit (100 MiB) from that same advisory's fix is unaffected and
  remains in place.

- core: fixed a double-increment bug in
  _ostree_validate_structureof_xattrs that caused every other xattr
  entry to be skipped during validation, letting a crafted xattr
  array hide unsorted or duplicate entries in odd-indexed slots.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
---
 .../ostree/{ostree_2026.3.bb => ostree_2026.4.bb}               | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta-oe/recipes-extended/ostree/{ostree_2026.3.bb => ostree_2026.4.bb} (98%)
diff mbox series

Patch

diff --git a/meta-oe/recipes-extended/ostree/ostree_2026.3.bb b/meta-oe/recipes-extended/ostree/ostree_2026.4.bb
similarity index 98%
rename from meta-oe/recipes-extended/ostree/ostree_2026.3.bb
rename to meta-oe/recipes-extended/ostree/ostree_2026.4.bb
index 5e2e9ee078..b48fbb0a62 100644
--- a/meta-oe/recipes-extended/ostree/ostree_2026.3.bb
+++ b/meta-oe/recipes-extended/ostree/ostree_2026.4.bb
@@ -22,7 +22,7 @@  GITHUB_BASE_URI = "https://github.com/ostreedev/ostree/releases"
 SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/libostree-${PV}.tar.xz \
            file://run-ptest \
            "
-SRC_URI[sha256sum] = "e560e47631d1f703e9ed3425e8909ccd87fa2992422c07348ca88ec98943c8fb"
+SRC_URI[sha256sum] = "b26c9016eb03bb4ee52cc00c642d56e00fc79ae7faac6bf4aa317d7451339ef7"
 
 S = "${UNPACKDIR}/libostree-${PV}"