linux/poky.git/meta/recipes-devtools, branch scarthgap

pseudo: Upgrade 1.9.6 -> 1.9.7

2026-06-10T13:35:21+00:00

Pulls in fixes to rename/renameat/renameat2: Changqing Li (1): renameat2/renameat: only ignore when both old and new path are not in PSEUDO_INCLUDE_PATHS Mark Hatle (4): run_tests.sh: Allow the user to specify specific tests to run tests: Add mv then hardlink testing rename: only ignore when both old and new path are not in PSEUDO_INCLUDE_PATHS Makefile.in: Bump version to 1.9.7 (From OE-Core rev: e2864ea1ac022e43af92badc701fa1e2a9571f46) Signed-off-by: Richard Purdie (cherry picked from commit 17567738711d525d9f2b85e54ace2048901e4c34) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

pseudo: Update 1.9.5 -> 1.9.6

2026-06-10T13:35:21+00:00

Pulls in the changes: * Makefile.in: Bump version to 1.9.6 * pseudo_util.c: Fix symlink processing for symlinkat and related * test: Add test symlinkat and related * ports/unix: realpath: Fix chroot processing * test: Add test cases for canonicalize functions * ports/unix: fts_open: Fix chroot behavior * ports/unix: fts_*: Certain functions were incorrectly returning stat data * test: Add fts test case * test: Add test for linkat chroot path stripping * linkat: Avoid a segmentation fault * Only copy xattrs on a rename if it's cross-filesystem (From OE-Core rev: 1414f3513099a9a956ec4f602354aa00008e2aff) Signed-off-by: Richard Purdie (cherry picked from commit 50e769a598e79ed4600f7362d5f40799a48f9273) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

pseudo: Upgrade to 1.9.5

2026-06-10T13:35:21+00:00

This adds a wrapper for the __open_2 function This was breaking shadow and the real reason for the open() call changes. Add the missing wrapper to properly fix this. (From OE-Core rev: 876e6497f3323d74d9ac8ce303ed5165a7fda283) Signed-off-by: Richard Purdie (cherry picked from commit 8ea63d320aba32d3894cace9e71e850bdff1d6b2) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

pseudo: Upgrade to 1.9.4

2026-06-10T13:35:21+00:00

Update to pull in a full openat2 wrapper which works on Fedora 44. This update includes the commits: * Makefile.in: Bump version to 1.9.4 * test: Add renameat2 test cases * test: Add openat2 test cases * makewrappers/openat2: Add preserve_path option * openat2: Implement openat2 wrapper * ports/linux/guts/renameat2.c: Add comment why this isn't implemented * Add b4 configuration * pseudo_setupenvp: Handle malloc failure safely * pseudo_setupenvp: Allocate space for new env vars if needed (From OE-Core rev: 9075b66e1f9161407056924954b3d5507f6d8384) Signed-off-by: Richard Purdie (cherry picked from commit b2bd1d114fafe1e797149e02e4c08194d529cfde) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

perl: link to the system zlib instead of a vendored copy

2026-06-10T13:35:20+00:00

The perl module Compress-Raw-Zlib defaults to using a vendored copy of the zlib sources which has a number of CVEs. A newer version of perl updates this to zlib 1.3.2 to resolve them, but we should be linking to our zlib recipe instead of the vendored code. This mitigates CVE-2026-4176 so mark it as not appropriate. (From OE-Core rev: 6e83e5520f415fc6ca9029a8aaa0af31cd832a90) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit bf515229043685d4f00c965eb3e0236c37b6b403) Signed-off-by: Sudhir Dumbhare Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

python3-requests: backport fix for CVE-2026-25645

2026-06-10T13:35:20+00:00

When unpacking zip files requests uses predictable paths. Backport a fix to use randomly generated pathnames to mitigate injection attacks. (From OE-Core rev: b23ec9773d67f8767904731afa86fe5ede08f97f) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit fe846d71b647fb06e6a87cb45a2dd9b0889e2891) Signed-off-by: Deepak Rathore Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

cargo: set CVE_PRODUCT

2026-06-10T13:35:20+00:00

This removes mediawiki:cargo CVEs from CVE metrics. * CVE-2026-39837, CVE-2026-39839, CVE-2026-39840, CVE-2026-39841 (From OE-Core rev: 98088c90b6e37ab27e7b4b2546abe9ecd863c02e) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (cherry picked from commit a5cb71e7df95925a5c342c341e699e244b1b84f6) Signed-off-by: Himanshu Jadon Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

apt: Add CVE_PRODUCT to support product name

2026-05-12T20:31:34+00:00

- Keep both the older deprecated debian:apt alias and the active debian:advanced_package_tool identity in CVE_PRODUCT. - This preserves completeness and avoids missing CVEs in case older aliases are still used in NVD records. (From OE-Core rev: 28d3ab81b9386bda16e196ed2934967843413186) Signed-off-by: Himanshu Jadon Signed-off-by: Richard Purdie (cherry picked from commit 4c777220ee5740b800f4128da79c24f7e42c7b88) Signed-off-by: Himanshu Jadon [FT: Rebase onto scarthgap-next] Signed-off-by: Fabien Thomas Signed-off-by: Paul Barker

rsync: fix for CVE-2026-41035

2026-05-12T20:31:33+00:00

Pick patch from [1] also mentioned at Debian report in [2] [1] https://github.com/RsyncProject/rsync/commit/bb0a8118c2d2ab01140bac5e4e327e5e1ef90c9c [2] https://security-tracker.debian.org/tracker/CVE-2026-41035 [3] https://nvd.nist.gov/vuln/detail/CVE-2026-41035 (From OE-Core rev: b2b51c4f8521ac4fa490e96257142826f2dfda25) Signed-off-by: Hitendra Prajapati Signed-off-by: Fabien Thomas Signed-off-by: Paul Barker

binutils: fix CVE-2025-69648

2026-05-12T20:31:33+00:00

Backport upstream fix for CVE-2025-69648 [1]. [1] https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=598704a00cbac5e85c2bedd363357b5bf6fcee33 (From OE-Core rev: a905532db94aa09b17ec6445d8b5702f278f22bd) Signed-off-by: Adarsh Jagadish Kamini Signed-off-by: Fabien Thomas Signed-off-by: Paul Barker