Please review this set of changes for wrynose and have comments back by end of day Tuesday, July 7. Since this is a relatively big series, if you plan to review it but need more time to do so, ping me and I'll delay the pull-request.
Notable changes: * kernel upgrade -> v6.18.35 cherry-picked from master * clang/llvm upgrade -> 22.1.18 (following master) * Licensing fixes A previous version of the series, with 4 more patches that I removed and should not change test outcome, passed a-full on autobuilder: https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/4151 * oe-selftest-armhost failed with Bug 16236 - AB-INT: test_list_pkg_files: ResourceWarning: unclosed transport retried as https://autobuilder.yoctoproject.org/valkyrie/#/builders/23/builds/4280 I've started a new build with this version of the series: https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/4156 The following changes since commit 5d1aa5c806c061a2994f4decb59016610f093213: build-appliance-image: Update to wrynose head revisions (2026-06-24 14:17:46 +0100) are available in the Git repository at: https://git.openembedded.org/openembedded-core-contrib stable/wrynose-nut https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-nut for you to fetch changes up to 728e70d7c681402d8e797691825bfd9929aa79cb: clang/llvm: Upgrade to 22.1.8 release (2026-07-06 00:04:52 +0200) ---------------------------------------------------------------- Alexander Kanavin (1): strace: remove skip-bpf.patch Anil Dongare (4): cargo: Fix CVE-2026-5222 cargo: Fix CVE-2026-5223 cups: fix CVE-2026-27447 cups: fix CVE-2026-41079 Anton Skorup (1): libxml2: patch CVE-2026-11979 Ashishkumar Parmar (3): qemu: Fix CVE-2026-2243 qemu: Fix CVE-2026-0665 qemu: Fix CVE-2025-14876 Bruce Ashfield (8): linux-yocto/6.18: update to v6.18.25 linux-yocto/6.18: update to v6.18.26 linux-yocto/6.18: update to v6.18.28 linux-yocto/6.18: update to v6.18.32 linux-yocto/6.18: qat/intel configuration warning fixes linux-yocto/6.18: update to v6.18.33 linux-yocto/6.18: update to v6.18.34 linux-yocto/6.18: update to v6.18.35 Daniel Turull (3): libssh2: fix CVE-2026-55200 libssh2: fix CVE-2026-55199 bc: set CVE_PRODUCT Deepesh Varatharajan (1): clang/llvm: Upgrade to 22.1.8 release Hiago De Franco (1): nospdx: also drop do_create_recipe_sbom Himanshu Jadon (1): tar: Fix CVE-2026-5704 Hitendra Prajapati (2): vim: fix for CVE-2026-41411 & CVE-2026-44656 vim: fix for CVE-2026-45130 & CVE-2026-46483 Jaipaul Cheernam (2): binutils: Fix CVE-2026-6846 cmake-native: prevent host libidn2 contamination Jinwang Li (1): bluez5: fix set volume failure João Marcos Costa (1): ptest-packagelists.inc: disable glib-2.0 for RISCV64 Khem Raj (1): baremetal-helloworld: Fix override order Kris Gavvala (1): python3: skiptest tracemalloc_track_race Mengshi Wu (1): bluez5: fix gatt cache sync issue Nate Kent (1): sudo: fix pam-wheel sed for sudo 1.9.17p2 sudoers Otavio Salvador (1): quota: use native rpcgen and a single-word RPCGEN_CPP Peter Kjellerstedt (1): common-licenses/PHP-3.0: Correct the license text Richard Purdie (3): libxpm: upgrade 3.5.18 -> 3.5.19 python3-click: Fixes for new pytest and flaky ptest sstate: Reduce native sysroot execution race potential Roland Kovacs (1): gnupg: fix CVE-2026-57062 Ross Burton (2): tcl: disable the timer tests in run-ptest libjitterentropy: fix license statement Sai Sneha (1): i2c-tools: add LGPL-2.1-or-later license for libi2c Shubham Pushpkar (1): libsolv: Fix CVE-2026-9149 Siva Balasubramanian (1): qemuboot.bbclass: add missing task dependency on kernel deploy Theo Gaige (Schneider Electric) (5): dhcpcd: patch CVE-2026-56113 dhcpcd: patch CVE-2026-56114 dhcpcd: patch CVE-2026-56116 dhcpcd: patch CVE-2026-56117 perl: patch CVE-2026-8376 Walter Werner Schneider (1): devtool: provide explicit error for missing "script" command Wei Deng (1): bluez5: set L2CAP IMTU for OBEX profile listeners Wei Gao (1): dmidecode: fix x86-only tools being installed on ARM targets Xiaozhan Li (1): texinfo: add missing perl module runtime dependencies Xiuzhuo Shang (1): bluez5: Fix sending extra bytes with MGMT_OP_ADD_EXT_ADV_DATA Yoann Congal (1): dropbear: Add missing WTFPL & Unlicense in LICENSE and LIC_FILES_CHKSUM meta/classes-global/sstate.bbclass | 4 + meta/classes-recipe/nospdx.bbclass | 1 + meta/classes-recipe/qemuboot.bbclass | 1 + meta/conf/distro/include/maintainers.inc | 2 +- .../distro/include/ptest-packagelists.inc | 4 +- meta/files/common-licenses/PHP-3.0 | 76 +-- meta/recipes-connectivity/bluez5/bluez5.inc | 4 + ...sending-extra-bytes-with-MGMT_OP_ADD.patch | 33 ++ ...2CAP-IMTU-for-OBEX-profile-listeners.patch | 118 ++++ ...x-stored-gatt-cache-DB-Hash-value-no.patch | 84 +++ ...t-volume-failure-with-invalid-device.patch | 46 ++ .../dhcpcd/dhcpcd_10.3.1.bb | 4 + .../dhcpcd/files/CVE-2026-56113.patch | 92 +++ .../dhcpcd/files/CVE-2026-56114.patch | 34 ++ .../dhcpcd/files/CVE-2026-56116.patch | 31 + .../dhcpcd/files/CVE-2026-56117.patch | 167 ++++++ .../recipes-core/dropbear/dropbear_2025.89.bb | 8 +- .../libxml/libxml2/CVE-2026-11979.patch | 81 +++ meta/recipes-core/libxml/libxml2_2.15.2.bb | 1 + .../meta/nativesdk-buildtools-perl-dummy.bb | 2 + .../binutils/binutils-2.46.inc | 1 + .../binutils/binutils/CVE-2026-6846.patch | 59 ++ meta/recipes-devtools/clang/common-clang.inc | 2 +- meta/recipes-devtools/clang/common.inc | 2 +- .../cmake/cmake-native_4.3.1.bb | 1 + .../dmidecode/dmidecode_3.7.bb | 1 + .../i2c-tools/i2c-tools_4.4.bb | 5 +- .../perl/files/CVE-2026-8376-01.patch | 62 ++ .../perl/files/CVE-2026-8376-02.patch | 49 ++ meta/recipes-devtools/perl/perl_5.42.0.bb | 2 + ...7494c991c9197902fdf4995e11b2da3e9762.patch | 173 ++++++ .../python/python3-click/pytest-fix.patch | 29 + .../python/python3-click_8.3.1.bb | 1 + .../recipes-devtools/python/python3_3.14.5.bb | 7 + meta/recipes-devtools/qemu/qemu.inc | 4 + .../qemu/qemu/CVE-2025-14876_p1.patch | 52 ++ .../qemu/qemu/CVE-2025-14876_p2.patch | 56 ++ .../qemu/qemu/CVE-2026-0665.patch | 38 ++ .../qemu/qemu/CVE-2026-2243.patch | 45 ++ .../rust/files/CVE-2026-5222.patch | 92 +++ .../rust/files/CVE-2026-5223.patch | 125 ++++ meta/recipes-devtools/rust/rust-source.inc | 2 + .../strace/strace/skip-bpf.patch | 25 - meta/recipes-devtools/strace/strace_6.19.bb | 1 - meta/recipes-devtools/tcltk/tcl/run-ptest | 2 + meta/recipes-devtools/tcltk8/tcl8/run-ptest | 2 + .../baremetal-helloworld_git.bb | 2 +- meta/recipes-extended/bc/bc_1.08.2.bb | 3 + meta/recipes-extended/cups/cups.inc | 4 + .../cups/CVE-2026-27447-regression_p1.patch | 46 ++ .../cups/CVE-2026-27447-regression_p2.patch | 58 ++ .../cups/cups/CVE-2026-27447.patch | 120 ++++ .../cups/cups/CVE-2026-41079.patch | 73 +++ .../libsolv/libsolv/CVE-2026-9149.patch | 152 +++++ .../libsolv/libsolv_0.7.36.bb | 1 + meta/recipes-extended/quota/quota_4.11.bb | 6 +- meta/recipes-extended/sudo/sudo_1.9.17p2.bb | 2 +- .../tar/tar/CVE-2026-5704-dependent_p1.patch | 484 +++++++++++++++ .../tar/tar/CVE-2026-5704-dependent_p2.patch | 169 ++++++ .../tar/tar/CVE-2026-5704-regression.patch | 176 ++++++ .../tar/tar/CVE-2026-5704.patch | 556 ++++++++++++++++++ meta/recipes-extended/tar/tar_1.35.bb | 4 + meta/recipes-extended/texinfo/texinfo_7.3.bb | 4 + .../{libxpm_3.5.18.bb => libxpm_3.5.19.bb} | 2 +- .../linux/linux-yocto-rt_6.18.bb | 6 +- .../linux/linux-yocto-tiny_6.18.bb | 6 +- meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +- .../gnupg/gnupg/CVE-2026-57062.patch | 43 ++ meta/recipes-support/gnupg/gnupg_2.5.17.bb | 1 + .../libjitterentropy_3.6.3.bb | 3 +- .../libssh2/libssh2/CVE-2026-55199.patch | 44 ++ .../libssh2/libssh2/CVE-2026-55200.patch | 36 ++ .../recipes-support/libssh2/libssh2_1.11.1.bb | 2 + .../vim/files/CVE-2026-41411.patch | 75 +++ .../vim/files/CVE-2026-44656.patch | 124 ++++ .../vim/files/CVE-2026-45130.patch | 115 ++++ .../vim/files/CVE-2026-46483.patch | 77 +++ meta/recipes-support/vim/vim.inc | 4 + scripts/lib/devtool/__init__.py | 3 + 79 files changed, 3938 insertions(+), 118 deletions(-) create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-advertising-Fix-sending-extra-bytes-with-MGMT_OP_ADD.patch create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-profile-Set-L2CAP-IMTU-for-OBEX-profile-listeners.patch create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-src-device-Fix-stored-gatt-cache-DB-Hash-value-no.patch create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-transport-Fix-set-volume-failure-with-invalid-device.patch create mode 100644 meta/recipes-connectivity/dhcpcd/files/CVE-2026-56113.patch create mode 100644 meta/recipes-connectivity/dhcpcd/files/CVE-2026-56114.patch create mode 100644 meta/recipes-connectivity/dhcpcd/files/CVE-2026-56116.patch create mode 100644 meta/recipes-connectivity/dhcpcd/files/CVE-2026-56117.patch create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-11979.patch create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-6846.patch create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-8376-01.patch create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-8376-02.patch create mode 100644 meta/recipes-devtools/python/python3-click/ffcc7494c991c9197902fdf4995e11b2da3e9762.patch create mode 100644 meta/recipes-devtools/python/python3-click/pytest-fix.patch create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2025-14876_p1.patch create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2025-14876_p2.patch create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2026-0665.patch create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2026-2243.patch create mode 100644 meta/recipes-devtools/rust/files/CVE-2026-5222.patch create mode 100644 meta/recipes-devtools/rust/files/CVE-2026-5223.patch delete mode 100644 meta/recipes-devtools/strace/strace/skip-bpf.patch create mode 100644 meta/recipes-extended/cups/cups/CVE-2026-27447-regression_p1.patch create mode 100644 meta/recipes-extended/cups/cups/CVE-2026-27447-regression_p2.patch create mode 100644 meta/recipes-extended/cups/cups/CVE-2026-27447.patch create mode 100644 meta/recipes-extended/cups/cups/CVE-2026-41079.patch create mode 100644 meta/recipes-extended/libsolv/libsolv/CVE-2026-9149.patch create mode 100644 meta/recipes-extended/tar/tar/CVE-2026-5704-dependent_p1.patch create mode 100644 meta/recipes-extended/tar/tar/CVE-2026-5704-dependent_p2.patch create mode 100644 meta/recipes-extended/tar/tar/CVE-2026-5704-regression.patch create mode 100644 meta/recipes-extended/tar/tar/CVE-2026-5704.patch rename meta/recipes-graphics/xorg-lib/{libxpm_3.5.18.bb => libxpm_3.5.19.bb} (88%) create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2026-57062.patch create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-55199.patch create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-55200.patch create mode 100644 meta/recipes-support/vim/files/CVE-2026-41411.patch create mode 100644 meta/recipes-support/vim/files/CVE-2026-44656.patch create mode 100644 meta/recipes-support/vim/files/CVE-2026-45130.patch create mode 100644 meta/recipes-support/vim/files/CVE-2026-46483.patch
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#240154): https://lists.openembedded.org/g/openembedded-core/message/240154 Mute This Topic: https://lists.openembedded.org/mt/120131892/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
