Weekly portage-stable package updates 2026-07-06 by github-actions[bot] · Pull Request #4131 · flatcar/scripts

github-actions · 2026-07-06T08:43:17Z

CI: https://jenkins.flatcar.org/job/container/job/sdk/109/cldsv/

Related PRs / interesting stuffs:

glib_stubs: undefine g_free vmware/open-vm-tools#796
docker updates mantle#894
https://bugs.gentoo.org/945877#c5
Added a new SELinux rule to the container policy to solve a CI issue

Fixes flatcar/Flatcar#2193
Fixes flatcar/Flatcar#2061
Fixes flatcar/Flatcar#2063
Fixes flatcar/Flatcar#2122
Fixes flatcar/Flatcar#2083
Fixes flatcar/Flatcar#2154
Fixes flatcar/Flatcar#2174
Fixes flatcar/Flatcar#2058
Fixes flatcar/Flatcar#1999
Fixes flatcar/Flatcar#2194
Fixes flatcar/Flatcar#1944
Fixes flatcar/Flatcar#2055
Fixes flatcar/Flatcar#2188
Fixes flatcar/Flatcar#2123
Fixes flatcar/Flatcar#2221

Partially addresses flatcar/Flatcar#2084
Partially addresses flatcar/Flatcar#2142

--

app-admin/eselect: [DEV]
- from 1.4.31 to 1.4.32
- release notes: https://gitweb.gentoo.org/proj/eselect.git/plain/NEWS?id=1ff2aea90d6cd2bb93019deb40d3c7c7a0b5c36f
app-arch/libarchive: [PROD] [DEV]
- from 3.8.7 to 3.8.8
- fixes CVE-2026-14164
  - update: libarchive Flatcar#2193
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- release notes: https://github.com/libarchive/libarchive/releases/tag/v3.8.8
app-containers/aardvark-dns: [SYSEXT-PODMAN]
- from 1.17.0 to 2.0.0
- fixes CVE-2026-35406
  - update: app-containers/aardvark-dns Flatcar#2221
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- build dependencies:
  - changes for dev-lang/rust with USE conditionals '||':
    - changed version constraint from >=1.87.0 to >=1.88.0
  - changes for dev-lang/rust-bin with USE conditionals '||':
    - changed version constraint from >=1.87.0 to >=1.88.0
- release notes: https://github.com/containers/aardvark-dns/releases/tag/v2.0.0 https://github.com/containers/aardvark-dns/releases/tag/v1.17.1
app-containers/conmon: [SYSEXT-PODMAN]
- from 2.1.13 to 2.2.1
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- added IUSE flag 'selinux'
- runtime dependencies:
  - added a dependency 'sec-policy/selinux-podman' for USE 'selinux?'
- release notes: https://github.com/containers/conmon/releases/tag/v2.2.1 https://github.com/containers/conmon/releases/tag/v2.2.0
app-containers/crun: [SYSEXT-PODMAN]
- from 1.21 to 1.28
- fixes CVE-2026-30892
  - update: crun Flatcar#2061
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- dependencies and runtime dependencies:
  - dropped a dependency 'dev-libs/yajl:='
  - added a dependency 'dev-libs/json-c:='
  - added a dependency 'sys-libs/error-standalone' for USE 'elibc_musl?'
- release notes: https://github.com/containers/crun/releases/tag/1.2{8..2}
app-containers/docker: [SYSEXT-DOCKER]
- from 28.2.2 to 29.1.3-r1
- fixes CVE-2024-25621, CVE-2025-52881
  - update: docker Flatcar#2142
- dependencies:
  - added a dependency 'net-firewall/nftables:='
- runtime dependencies:
  - changes for app-containers/containerd:
    - changed version constraint from >=1.7.27 to >=2.2.0
  - changes for app-containers/docker-cli weak blocker:
    - changed version constraint from <28.2.2 to <29.1.3
  - dropped a dependency '>=net-firewall/iptables-1.4'
  - added a dependency 'net-firewall/nftables:='
- dropped installation of udev rules
  - these were for devicemapper, which docker no longer supports
- release notes: https://github.com/moby/moby/releases/tag/docker-v29.1.3 https://github.com/moby/moby/releases/tag/docker-v29.1.2 https://github.com/moby/moby/releases/tag/docker-v29.1.1 https://github.com/moby/moby/releases/tag/docker-v29.1.0 https://github.com/moby/moby/releases/tag/docker-v29.0.0
app-containers/docker-cli: [SYSEXT-DOCKER]
- still at 29.1.3
- package became stable on 'amd64' and 'arm64'
  - dropped accept keywords from overlay profiles
app-containers/incus: [SYSEXT-INCUS]
- from 6.0.5-r1 to 7.2
- fixes a boatload of CVEs
  - update: incus Flatcar#2063
- package became unstable on 'amd64'
  - updated accept keywords in overlay profiles
- added IUSE flag 'selinux'
- build dependencies:
  - changes for dev-lang/go:
    - changed version constraint from >=1.21 to >=1.25.10
- runtime dependencies:
  - changes for dev-libs/cowsql:
    - changed version constraint from >=1.15.9 to >=1.15.7
  - added a dependency 'net-firewall/nftables[json]'
  - dropped a dependency 'net-firewall/iptables' for USE '||'
  - dropped a dependency 'net-firewall/nftables[json]' for USE '||'
  - added a dependency 'sec-policy/selinux-incus' for USE 'selinux?'
- release notes: https://discuss.linuxcontainers.org/t/incus-7-2-has-been-released/26879 https://discuss.linuxcontainers.org/t/incus-7-0-lts-has-been-released/26641
app-containers/lxc: [SYSEXT-INCUS]
- from 6.0.5 to 7.0.0
- fixes CVE-2026-39402
  - update: lxc Flatcar#2122
- added IUSE flag 'doc'
- added IUSE flag 'landlock'
- build dependencies:
  - added a dependency 'app-text/doxygen' for USE 'doc?'
- release notes: https://discuss.linuxcontainers.org/t/lxc-7-0-lts-has-been-released/26612
app-containers/netavark: [SYSEXT-PODMAN]
- from 1.17.1 to 2.0.0
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords for this package in overlay profiles
- build dependencies:
  - changes for dev-lang/rust with USE conditionals '||':
    - changed version constraint from >=1.86 to >=1.88.0
  - changes for dev-lang/rust-bin with USE conditionals '||':
    - changed version constraint from >=1.86 to >=1.88.0
- release notes: https://github.com/containers/netavark/releases/tag/v2.0.0 https://github.com/containers/netavark/releases/tag/v1.17.2
app-containers/podman: [SYSEXT-PODMAN]
- from 5.7.1 to 6.0.0
- fixes CVE-2026-33414, CVE-2026-44517, CVE-2026-57231
  - update: podman Flatcar#2083
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- build dependencies:
  - added a dependency '>=dev-lang/go-1.25.6'
- dependencies and runtime dependencies:
  - changes for app-containers/conmon:
    - changed version constraint from >=2.1.10 to >=2.2.1
  - dropped a dependency '>=app-containers/containers-common-0.58.0-r1'
  - added a dependency '>=app-containers/container-libs-0.68.0'
- release notes: https://github.com/podman-container-tools/podman/releases/tag/v6.0.0 https://github.com/podman-container-tools/podman/releases/tag/v5.8.0
app-crypt/adcli: [PROD] [DEV]
- still at 0.9.3.1
- brings in cross-compilation fix, so we can drop our own
app-crypt/gnupg: [PROD] [DEV]
- from 2.5.18 to 2.5.20-r1
- fixes gnupg-20260513 (CVE)
  - update: gnupg Flatcar#2154
- release notes: https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000505.html (2.5.20), https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html (2.5.19)
app-crypt/libmd: [PROD] [DEV]
- from 1.1.0 to 1.2.0
- release notes: https://git.hadrons.org/cgit/libmd.git/log/?h=1.2.0
app-crypt/mit-krb5: [PROD] [DEV]
- from 1.21.3-r1 to 1.22.2-r2
- package became stable on 'arm64'
  - dropped accept keywords from overlay profiles
- added cross-compilation fixes, so we can drop our own
- dropped a security fix patch (now part of the release)
- release notes: https://web.mit.edu/kerberos/krb5-1.22/krb5-1.22.2.html
app-crypt/rhash:
- from 1.4.5 to 1.4.6-r1
- added IUSE flag 'cpu_flags_x86_sha'
- release notes: https://github.com/rhash/RHash/releases/tag/v1.4.6
app-doc/eclass-manpages:
- from 20260426 to 20260624
- release notes: none
app-emulation/qemu-guest-agent: [PROD] [DEV]
- from 9.2.0 to 10.2.2
- release notes: https://wiki.qemu.org/ChangeLog/10.2#Guest_agent
app-emulation/virt-firmware:
- from 26.2 to 26.2-r1
- build dependencies:
  - changes for dev-python/setuptools:
    - dropped version constraint
- runtime dependencies:
  - added a dependency 'dev-python/pkg-resources[python_targets_python3_12(-)?,python_targets_python3_13(-)?,python_targets_python3_14(-)?]'
app-portage/getuto: [DEV]
- from 1.18 to 2.0
- release notes: https://github.com/projg2/getuto/commits/getuto-2.0/
app-shells/bash: [PROD] [DEV]
- from 5.3_p9-r1 to 5.3_p9-r2
- added a patch fixing pid reuse
  - the issue sometimes appeared during flatcar builds
  - it is the same patch we used in user-patches, so dropping it
dev-build/meson:
- from 1.9.2 to 1.11.1
- release notes: https://mesonbuild.com/Release-notes-for-1-11-0.html https://mesonbuild.com/Release-notes-for-1-10-0.html
dev-db/sqlite: [PROD] [DEV]
- from 3.51.3 to 3.53.1
- release notes: https://sqlite.org/releaselog/3_53_1.html
dev-debug/gdb: [DEV]
- from 17.1 to 17.2
- release notes: https://sourceware.org/pipermail/gdb-announce/2026/000148.html
dev-debug/strace: [PROD] [DEV]
- from 6.19 to 7.0-r1
- added IUSE flag 'ncurses'
- dependencies:
  - added a dependency 'sys-libs/ncurses[static-libs(+)]' for USE 'static?' -> 'ncurses?'
  - added a dependency 'dev-libs/elfutils' for USE '!static?' -> 'elfutils?'
  - added a dependency 'sys-libs/ncurses:=' for USE '!static?' -> 'ncurses?'
  - added a dependency 'sys-libs/libselinux' for USE '!static?' -> 'selinux?'
  - added a dependency 'sys-libs/libunwind:=' for USE '!static?' -> 'unwind?'
- runtime dependencies:
  - added a dependency 'sys-libs/ncurses:=' for USE '!static?' -> 'ncurses?'
- release notes: https://github.com/strace/strace/releases/tag/v7.0
dev-go/go-md2man:
- still at 2.0.7
- fixed cross-compilation
dev-lang/go:
- still at 1.26.3
- package became stable on 'amd64' and 'arm64'
  - dropped accept keywords for this package in overlay profiles
dev-lang/perl:
- from 5.42.0-r1 to 5.42.2
- fixes CVE-2026-4176
  - update: perl Flatcar#2084
- release notes: https://perldoc.perl.org/perl5422delta
dev-lang/rust:
- from 1.93.1 to 1.95.0
- removed IUSE flag 'llvm_slot_21'
- added IUSE flag 'llvm_slot_22'
- default llvm version is 22
- runtime dependencies:
  - added a dependency 'dev-db/sqlite:3'
- release notes: https://blog.rust-lang.org/2026/04/16/Rust-1.95.0/ https://blog.rust-lang.org/2026/03/05/Rust-1.94.0/
dev-lang/tcl:
- from 8.6.16 to 8.6.17
- release notes: https://sourceforge.net/p/tcl/mailman/message/59221153/
dev-libs/expat: [PROD] [DEV]
- from 2.8.1 to 2.8.2
- fixes a bunch of CVEs
  - update: expat Flatcar#2174
- release notes: https://blog.hartwork.org/posts/expat-2-8-2-released/
dev-libs/glib: [PROD] [DEV]
- from 2.84.4-r5 to 2.88.2
- fixes a bunch of CVEs
  - update: glib Flatcar#2058
- build dependencies:
  - changes for dev-util/gi-docgen with USE conditionals 'doc?':
    - changed version constraint from >=2023.1 to >=2026.1
- dependencies and runtime dependencies:
  - changes for dev-libs/gobject-introspection weak blocker:
    - changed version constraint from <1.80.1 to <1.86.0
  - changes for dev-util/gdbus-codegen weak blocker:
    - changed version constraint from <2.84.4 to <2.88.2
- release notes: https://gitlab.gnome.org/GNOME/glib/-/releases/2.88.2 https://gitlab.gnome.org/GNOME/glib/-/releases/2.88.1 https://gitlab.gnome.org/GNOME/glib/-/releases/2.88.0 https://gitlab.gnome.org/GNOME/glib/-/releases/2.86.0
dev-libs/gobject-introspection-common:
- from 1.84.0 to 1.86.0
- runtime dependencies:
  - changes for dev-libs/gobject-introspection weak blocker:
    - changed version constraint from <1.84.0 to <1.86.0
- release notes: https://gitlab.gnome.org/GNOME/gobject-introspection/-/releases/1.86.0
dev-libs/libgpg-error: [PROD] [DEV]
- from 1.59 to 1.60
- release notes: https://dev.gnupg.org/T8112.html
dev-libs/libksba: [PROD] [DEV]
- from 1.6.8 to 1.8.0
- release notes: https://dev.gnupg.org/T8253.html
dev-libs/libunistring: [PROD] [DEV]
- from 1.3 to 1.4.2
- release notes: https://gitweb.git.savannah.gnu.org/gitweb/?p=libunistring.git;a=blob;f=NEWS;h=e97ee06e03d6fea559665306c82f02e09725893a;hb=7dee51196310a703972a94843ecaf92decce6f82
dev-libs/libuv: [PROD] [DEV]
- from 1.51.0-r1 to 1.52.1
- build dependencies:
  - changes for sec-keys/openpgp-keys-libuv with USE conditionals 'verify-sig?':
    - added version constraint >=20260323
- release notes: https://github.com/libuv/libuv/releases/tag/v1.52.1 https://github.com/libuv/libuv/releases/tag/v1.52.0
dev-libs/libxml2: [PROD] [DEV]
- still at 2.15.3
- package became stable on 'amd64' and 'arm64'
  - dropped accept keywords from overlay profiles
dev-libs/nspr:
- from 4.38.2 to 4.39
- release notes: https://hg-edge.mozilla.org/projects/nspr/log/54e7c1b0803d151e142e30dc0d05f12e1ec67a13
dev-libs/xmlsec: [VMWARE]
- from 1.3.10-r1 to 1.3.11-r1
- build dependencies:
  - added a dependency 'app-text/doxygen' for USE 'doc?'
  - added a dependency 'virtual/pandoc' for USE 'doc?'
- release notes: https://github.com/lsh123/xmlsec/releases/tag/1.3.11
dev-python/cryptography:
- from 46.0.7 to 48.0.0
- build dependencies:
  - changes for dev-lang/rust with USE conditionals '||':
    - changed version constraint from >=1.74.1 to >=1.83.0
  - changes for dev-lang/rust-bin with USE conditionals '||':
    - changed version constraint from >=1.74.1 to >=1.83.0
- release notes: https://raw.githubusercontent.com/pyca/cryptography/refs/tags/48.0.0/CHANGELOG.rst
dev-python/distlib: [SYSEXT-PYTHON]
- from 0.4.0 to 0.4.1
- release notes: https://raw.githubusercontent.com/pypa/distlib/refs/tags/0.4.1/CHANGES.rst
dev-python/docutils:
- from 0.22.4 to 0.23
- release notes: https://docutils.sourceforge.io/HISTORY.html#release-0-23-2026-05-27
dev-python/editables:
- from 0.5 to 0.6
- release notes: https://raw.githubusercontent.com/pfmoore/editables/refs/tags/0.6/CHANGELOG.md
dev-python/ensurepip-pip: [AZURE] [DEV] [GCE] [SYSEXT-PYTHON]
- from 26.0.1 to 26.1.2
- release notes: https://raw.githubusercontent.com/pypa/pip/refs/tags/26.1.2/NEWS.rst
dev-python/hatchling:
- from 1.29.0 to 1.30.1
- release notes: https://github.com/pypa/hatch/releases/tag/hatchling-v1.30.1
dev-python/idna: [SYSEXT-PYTHON]
- from 3.14 to 3.18
- release notes: https://github.com/kjd/idna/releases/tag/v3.18 https://github.com/kjd/idna/releases/tag/v3.17 https://github.com/kjd/idna/releases/tag/v3.16 https://github.com/kjd/idna/releases/tag/v3.15
dev-python/installer:
- from 0.7.0 to 1.0.1
- added IUSE flag 'verify-provenance'
- build dependencies:
  - added a dependency 'dev-python/pypi-attestations' for USE 'verify-provenance?'
- release notes: https://github.com/pypa/installer/releases/tag/1.0.1 https://github.com/pypa/installer/releases/tag/1.0.0
dev-python/jaraco-functools: [SYSEXT-PYTHON]
- from 4.4.0 to 4.5.0
- release notes: https://raw.githubusercontent.com/jaraco/jaraco.functools/refs/tags/v4.5.0/NEWS.rst
dev-python/markdown-it-py: [SYSEXT-PYTHON]
- from 4.0.0 to 4.2.0
- release notes: https://github.com/executablebooks/markdown-it-py/releases/tag/v4.2.0
dev-python/more-itertools: [SYSEXT-PYTHON]
- from 11.0.2 to 11.1.0
- release notes: https://github.com/more-itertools/more-itertools/releases/tag/v11.1.0
dev-python/packaging: [SYSEXT-PYTHON]
- from 26.1 to 26.2
- release notes: https://github.com/pypa/packaging/releases/tag/26.2
dev-python/pathspec:
- from 1.0.4 to 1.1.1
- release notes: https://raw.githubusercontent.com/cpburnz/python-pathspec/refs/tags/v1.1.1/CHANGES.rst
dev-python/pip: [SYSEXT-PYTHON]
- from 26.0.1 to 26.1.2
- build dependencies and runtime dependencies:
  - changes for dev-python/packaging:
    - changed version constraint from >=25.0 to >=26.2
  - changes for dev-python/requests:
    - changed version constraint from >=2.32.4 to >=2.33.1
- release notes: https://raw.githubusercontent.com/pypa/pip/refs/tags/26.1.2/NEWS.rst
dev-python/platformdirs: [SYSEXT-PYTHON]
- from 4.9.6 to 4.10.0
- release notes: https://github.com/tox-dev/platformdirs/releases/tag/4.10.0
dev-python/poetry-core:
- from 2.3.2 to 2.4.1
- build dependencies and runtime dependencies:
  - changes for dev-python/packaging:
    - changed version constraint from >=25.0 to >=26.2
- release notes: https://github.com/python-poetry/poetry-core/releases/tag/2.4.1
dev-python/requests: [SYSEXT-PYTHON]
- from 2.33.1 to 2.34.2
- release notes: https://github.com/psf/requests/releases/tag/v2.34.2 https://github.com/psf/requests/releases/tag/v2.34.1 https://github.com/psf/requests/releases/tag/v2.34.0
dev-python/trove-classifiers: [SYSEXT-PYTHON]
- from 2026.1.14.14 to 2026.6.1.19
- release notes: https://github.com/pypa/trove-classifiers/releases/tag/2026.6.1.19
dev-util/catalyst:
- from 4.1.1 to 4.1.1-r1
- dependencies and runtime dependencies:
  - added a dependency 'app-portage/gemato[python_targets_python3_12(-)?,python_targets_python3_13(-)?,python_targets_python3_14(-)?]'
dev-util/gdbus-codegen:
- from 2.84.4 to 2.88.2
- dependencies and runtime dependencies:
  - changes for dev-libs/glib:
    - changed version constraint from >=2.84.4 to >=2.88.2
- release notes: https://gitlab.gnome.org/GNOME/glib/-/releases/2.88.2
dev-util/glib-utils:
- from 2.84.4 to 2.88.2
- release notes: https://gitlab.gnome.org/GNOME/glib/-/releases/2.88.2
dev-util/maturin:
- from 1.12.6 to 1.13.3
- build dependencies:
  - changes for dev-lang/rust with USE conditionals '||':
    - changed version constraint from >=1.88.0 to >=1.89.0
  - changes for dev-lang/rust-bin with USE conditionals '||':
    - changed version constraint from >=1.88.0 to >=1.89.0
- dependencies and runtime dependencies:
  - changes for dev-libs/openssl with USE conditionals 'ssl?':
    - dropped version constraint
- licenses:
  - added license 'ISC'
  - added license 'MIT-0'
  - added license 'openssl'
- release notes: https://github.com/PyO3/maturin/releases/tag/v1.13.3
dev-util/patchutils:
- from 0.4.2 to 0.4.5-r1
- EAPI changed from '7' to '8'
- dependencies and runtime dependencies:
  - added a weak blocker '!<app-shells/bash-completion-2.16.0-r3'
  - added a dependency '>=sys-libs/error-standalone-2.0' for USE 'elibc_musl?'
  - added a dependency 'dev-lang/python:3.12' for USE 'python_single_target_python3_12?'
- licenses:
  - dropped license 'GPL-2'
  - added license 'GPL-2+'
- release notes: https://github.com/twaugh/patchutils/releases/tag/0.4.5 https://github.com/twaugh/patchutils/releases/tag/0.4.4 https://github.com/twaugh/patchutils/releases/tag/0.4.3
dev-util/perf:
- from 6.14 to 6.19.12
- removed IUSE flag 'doc'
  - docs are now built unconditionally
- build dependencies:
  - changes for app-text/asciidoc with USE conditionals 'doc?':
    - dropped all USE conditionals
  - changes for app-text/sgml-common with USE conditionals 'doc?':
    - dropped all USE conditionals
  - changes for app-text/xmlto with USE conditionals 'doc?':
    - dropped all USE conditionals
  - changes for sys-process/time with USE conditionals 'doc?':
    - dropped all USE conditionals
- runtime dependencies:
  - dropped a dependency 'sys-libs/binutils-libs:='
- release notes: none
dev-vcs/git: [PROD] [DEV]
- from 2.53.0 to 2.54.0
- release notes: https://raw.githubusercontent.com/git/git/refs/tags/v2.54.0/Documentation/RelNotes/2.54.0.adoc
eclass/bash-completion-r1.eclass:
- mostly replaced by shell-completion eclass
eclass/linux-mod.eclass:
- unused, dropped
eclass/optfeature.eclass:
- added support for EAPI 9
eclass/python-utils-r1.eclass:
- dropped pypy3 and python 3.11 from supported versions
eclass/qmake-utils.eclass:
- added support for EAPI 9
eclass/qt-utils.eclass:
- added from Gentoo
eclass/secureboot.eclass:
- added support for systemd-sbsign
eclass/shell-completion.eclass:
- added support for EAPI 7 and 9
licenses:
- added EUPL-1.2, GPL-2+-with-eCos-exception-2, MIT-0, NVIDIA-2025
net-dns/bind: [PROD] [DEV]
- from 9.18.42 to 9.20.23
- fixes a bunch of CVEs
  - update: bind Flatcar#1999
- package became unstable on 'arm64'
  - added accept keywords to overlay profiles
- removed IUSE flag 'caps'
  - became unconditional
- added IUSE flag 'verify-sig'
- added IUSE flag 'systemtap'
- build dependencies:
  - added a dependency 'dev-debug/systemtap' for USE 'systemtap?'
- dependencies and runtime dependencies:
  - added a dependency 'dev-libs/userspace-rcu:='
  - added a dependency '>=sys-libs/libcap-2.1.0'
  - dropped a dependency '>=sys-libs/libcap-2.1.0' for USE 'caps?'
- release notes: https://bind9.readthedocs.io/en/v9.20.23/notes.html#notes-for-bind-9-20-23
net-fs/cifs-utils: [PROD] [DEV]
- from 7.5 to 7.6
- fixes CVE-2026-12505
  - update: cifs-utils Flatcar#2194
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- release notes: https://lists.samba.org/archive/samba-technical/2026-June/140908.html
net-libs/gnutls: [PROD] [DEV]
- still at 3.8.13
- package became stable on 'amd64' and 'arm64'
  - dropped accept keywords from overlay profiles
net-libs/libmicrohttpd: [PROD] [DEV]
- from 1.0.1-r1 to 1.0.5
- fixes CVE-2025-59777, CVE-2025-62689
  - update: libmicrohttpd Flatcar#1944
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- dependencies and runtime dependencies:
  - changes for net-libs/gnutls with USE conditionals 'ssl?':
    - changed version constraint from >2.12.20 to >2.12.20-r0
- release notes: https://lists.gnu.org/archive/html/libmicrohttpd/2026-04/msg00003.html (1.0.5), https://lists.gnu.org/archive/html/libmicrohttpd/2026-04/msg00000.html (1.0.3)
net-libs/nghttp2: [PROD] [DEV]
- from 1.68.0 to 1.68.1
- fixes CVE-2026-27135
  - update: nghttp2 Flatcar#2055
- dropped USE jemalloc, dropped support for jemalloc
- release notes: https://github.com/nghttp2/nghttp2/releases/tag/v1.68.1
net-misc/curl: [PROD] [DEV]
- from 8.19.0 to 8.21.0
- fixes a bunch of CVEs
  - update: curl Flatcar#2188
- became unstable, so added accept keywords to overlay profiles
- removed IUSE flag 'rtmp'
  - dropped by upstream
- removed IUSE flag 'samba'
  - weak security, rarely used
- dependencies and runtime dependencies:
  - dropped a dependency 'media-video/rtmpdump[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_s390_32(-)?,abi_s390_64(-)?]' for USE 'rtmp?'
  - changes for dev-libs/openssl with USE conditionals 'ssl?' -> 'openssl?':
    - changed version constraint from >=1.0.2 to >=3.0.0
  - added a dependency '>=dev-libs/openssl-4.0.0_beta1:=[static-libs?,abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_s390_32(-)?,abi_s390_64(-)?]' for USE 'ssl?' -> 'openssl?' -> 'ech?'
- release notes: https://curl.se/ch/8.21.0.html https://curl.se/ch/8.20.0.html
net-misc/passt: [SYSEXT-PODMAN]
- from 2025.12.15 to 2026.05.26
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- release notes: https://archives.passt.top/passt-user/20260527093624.6349111e@elisabeth/T/#u
net-misc/rsync: [PROD] [DEV]
- from 3.4.3 to 3.4.4
- release notes: https://github.com/RsyncProject/rsync/releases/tag/v3.4.4
net-nds/openldap: [PROD] [DEV]
- from 2.6.8-r1 to 2.6.13
- added IUSE flag 'verify-sig'
- build dependencies:
  - dropped a dependency 'acct-group/ldap' for USE '!minimal?'
  - dropped a dependency 'acct-user/ldap' for USE '!minimal?'
- dependencies:
  - changes for dev-db/lmdb with USE conditionals '!minimal?':
    - changed version constraint from >=0.9.33 to >=0.9.35
- runtime dependencies:
  - added a dependency 'acct-group/ldap' for USE '!minimal?'
  - added a dependency 'acct-user/ldap' for USE '!minimal?'
  - changes for dev-db/lmdb with USE conditionals '!minimal?':
    - changed version constraint from >=0.9.33 to >=0.9.35
- release notes: none
profiles:
- ech (encrypted client hello) masked in curl - dependency on openssl 4, which is also masked
sec-policy/selinux-base: [PROD] [DEV]
- from 2.20250618_p1 to 2.20260312_p1
- user patches are now applied inside the refpolicy directory, making it inconsistent with packages using selinux-policy-2 eclass
  - created a separate set of patches for it
  - https://bugs.gentoo.org/979024
- release notes: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260312 https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250923
sec-policy/selinux-base-policy: [PROD] [DEV]
- from 2.20250618_p1-r1 to 2.20260312_p1
- user patches are now applied inside the refpolicy directory, making it inconsistent with packages using selinux-policy-2 eclass
  - created a separate set of patches for it
  - https://bugs.gentoo.org/979024
- dependencies and runtime dependencies:
  - changes for sec-policy/selinux-base:
    - changed version constraint from ~2.20250618_p1 to ~2.20260312_p1
- release notes: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260312 https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250923
sec-policy/selinux-container: [PROD] [DEV]
- from 2.20250618_p1 to 2.20260312_p1
- regenerated the user patches
- dependencies and runtime dependencies:
  - changes for sec-policy/selinux-base-policy:
    - changed version constraint from >=2.20250618-r1 to >=2.20260312_p1
- release notes: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260312 https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250923
sec-policy/selinux-dbus: [PROD] [DEV]
- from 2.20250618_p1 to 2.20260312_p1
- regenerated the user patches
- dependencies and runtime dependencies:
  - changes for sec-policy/selinux-base-policy:
    - changed version constraint from >=2.20250618-r1 to >=2.20260312_p1
- release notes: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260312 https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250923
sec-policy/selinux-policykit: [PROD] [DEV]
- from 2.20250618_p1 to 2.20260312_p1
- regenerated the user patches
- dependencies and runtime dependencies:
  - changes for sec-policy/selinux-base-policy:
    - changed version constraint from >=2.20250618-r1 to >=2.20260312_p1
- release notes: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260312 https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250923
sec-policy/selinux-sssd: [PROD] [DEV]
- from 2.20250618_p1 to 2.20260312_p1
- regenerated the user patches
- dependencies and runtime dependencies:
  - changes for sec-policy/selinux-base-policy:
    - changed version constraint from >=2.20250618-r1 to >=2.20260312_p1
- release notes: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260312 https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250923
sec-policy/selinux-unconfined: [PROD] [DEV]
- from 2.20250618_p1 to 2.20260312_p1
- regenerated the user patches
- dependencies and runtime dependencies:
  - changes for sec-policy/selinux-base-policy:
    - changed version constraint from >=2.20250618-r1 to >=2.20260312_p1
- release notes: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260312 https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250923
sys-apps/checkpolicy: [PROD] [DEV]
- from 3.9 to 3.10
- dependencies and runtime dependencies:
  - changes for sys-libs/libsepol:
    - changed version constraint from >=3.9 to >=3.10
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.10
sys-apps/ethtool: [PROD] [DEV]
- from 6.19 to 7.0
- release notes: https://git.kernel.org/pub/scm/network/ethtool/ethtool.git/plain/NEWS?h=v7.0
sys-apps/gentoo-functions: [PROD] [DEV]
- from 1.7.6 to 1.7.7
- release notes: https://gitweb.gentoo.org/proj/gentoo-functions.git/log/?h=gentoo-functions-1.7.7
sys-apps/i2c-tools: [DEV]
- from 4.3-r2 to 4.4
- release notes: https://git.kernel.org/pub/scm/utils/i2c-tools/i2c-tools.git/tree/CHANGES?h=v4.4
sys-apps/iproute2: [PROD] [DEV]
- from 6.19.0 to 7.0.0
- release notes: https://lwn.net/Articles/1067497/
sys-apps/kbd: [PROD] [DEV]
- from 2.9.0-r2 to 2.10.0
- added IUSE flag 'xkb'
  - allow to generate kernel keymaps based on xkb database from x11-libs/libxkbcommon
  - disabled in Flatcar
- dependencies and runtime dependencies:
  - added a dependency 'x11-libs/libxkbcommon' for USE 'xkb?'
- release notes: https://github.com/legionus/kbd/releases/tag/v2.10.0
sys-apps/portage: [DEV]
- from 3.0.81 to 3.0.81.1
- package became stable on 'amd64' and ''arm64'
  - dropped accept keywords from overlay profiles
- release notes: https://gitweb.gentoo.org/proj/portage.git/plain/NEWS?h=portage-3.0.81.1
sys-apps/sed: [PROD] [DEV]
- from 4.9-r1 to 4.10
- fixes CVE-2026-5958
  - update: sed Flatcar#2123
- release notes: https://lists.gnu.org/archive/html/info-gnu/2026-04/msg00009.html
sys-apps/semodule-utils: [PROD] [DEV]
- from 3.9 to 3.10
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.10
sys-apps/shadow: [PROD] [DEV]
- still at 4.19.4
- build dependencies:
  - dropped a dependency 'acct-group/shadow'
- dependencies:
  - added a dependency 'acct-group/shadow'
sys-apps/systemd: [PROD] [DEV]
- from 260.1-r1 to 260.1-r2
- creates autovt symlinks pointing to getty
  - https://bugs.gentoo.org/974688
  - https://bugs.gentoo.org/971385
sys-apps/util-linux: [PROD] [DEV]
- still at 2.41.4-r1
- runtime dependencies:
  - added a dependency 'sec-policy/selinux-uuidd' for USE 'uuidd?' -> 'selinux?'
- licenses:
  - added license 'BSD'
  - added license 'BSD-2'
  - added license 'EUPL-1.2'
  - added license 'GPL-1+'
  - dropped license 'GPL-3'
  - dropped license 'LGPL-2.1'
  - added license 'GPL-2+'
  - added license 'GPL-3+'
  - added license 'LGPL-2.1+'
sys-devel/crossdev:
- from 20260326 to 20260501-r1
- prints a warning about requiring another repository called crossdev
  - TODO: I think we use x-crossdev, actually, so we need to check if nothing breaks
- release notes: https://gitweb.gentoo.org/proj/crossdev.git/log/?h=20260501
sys-devel/gcc: [PROD] [DEV]
- from 15.2.1_p20260214 to 15.3.0
- bumped patchset to 8
  - https://gitweb.gentoo.org/proj/gcc-patches.git/tree/15.2.0/gentoo/README.history?id=2b488bf0f2c283c927f95a06671937d0649eeb72
- release notes: none
sys-fs/btrfs-progs: [PROD] [DEV]
- from 6.19.1 to 7.0
- release notes: https://github.com/kdave/btrfs-progs/releases/tag/v7.0
sys-fs/lxcfs: [SYSEXT-INCUS]
- from 6.0.5 to 7.0.0
- release notes: https://discuss.linuxcontainers.org/t/lxcfs-7-0-lts-has-been-released/26607
sys-fs/xfsprogs: [PROD] [DEV]
- from 6.19.0 to 7.0.1
- dependencies:
  - changes for sys-kernel/linux-headers:
    - changed version constraint from >=6.11 to >=6.18
- release notes: https://web.git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/plain/doc/CHANGES?h=v7.0.1 https://web.git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/plain/doc/CHANGES?h=v7.0.0
sys-kernel/coreos-sources:
- still at 6.12.95
- added IUSE flag 'vanilla'
  - came through kernel-2 eclass - enabling it removes Gentoo patches
  - not really relevant to Flatcar
sys-kernel/dracut: [PROD] [DEV]
- from 110-r5 to 111-r1
- release notes: https://github.com/dracut-ng/dracut/releases/tag/111
sys-libs/glibc: [PROD] [DEV]
- from 2.42-r7 to 2.43-r2
- added IUSE flag 'clang'
  - build with clang
- release notes: https://sourceware.org/pipermail/libc-announce/2026/000052.html
sys-libs/libselinux: [PROD] [DEV]
- from 3.9 to 3.10-r2
- build dependencies:
  - dropped a dependency 'dev-python/pip[python_targets_python3_11(-)?,python_targets_python3_12(-)?,python_targets_python3_13(-)?,python_targets_python3_14(-)?]' for USE 'python?'
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.10
sys-libs/libsepol: [PROD] [DEV]
- from 3.9 to 3.10
- build dependencies:
  - added a dependency 'sys-devel/flex'
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.10
sys-libs/libunwind: [PROD] [DEV]
- still at 1.8.3
- package became unstable on 'arm64'
  - We already accept unstable for both archs - this can be dropped when arm64 will be stabilized
- build dependencies:
  - added a dependency '>=dev-build/libtool-2.4.7-r3'
  - added a dependency 'sys-devel/gnuconfig'
  - added a dependency '>=dev-build/automake-1.18.1:1.18' for USE '||'
  - added a dependency '>=dev-build/autoconf-2.73:2.73' for USE '||'
  - added a dependency '>=dev-build/autoconf-2.72-r1:2.72' for USE '||'
sys-libs/liburing: [PROD] [DEV]
- still at 2.9
sys-libs/libxcrypt: [PROD] [DEV]
- still at 4.4.38-r1
sys-libs/talloc: [PROD] [DEV]
- from 2.4.3 to 2.4.4
- release notes: https://gitlab.com/samba-team/samba/-/commit/51d05da70e8461834396d361eead807127751b76
sys-libs/tdb: [PROD] [DEV]
- from 1.4.14 to 1.4.15
- release notes: https://gitlab.com/samba-team/samba/-/commit/c05d12c4fefa0272fb06a040ff8ba2b03ab42fb3
sys-libs/timezone-data: [PROD] [DEV]
- from 2026a to 2026b
- release notes: https://lists.iana.org/hyperkitty/list/tz@iana.org/thread/VX2Z3CBO6KHTYZNBBKFFWM7ZCI6TVCXP/
sys-process/audit: [PROD] [DEV]
- from 4.1.4-r1 to 4.1.4-r4
- added IUSE flag 'build'
  - 'build': !!internal use only!! DO NOT SET THIS FLAG YOURSELF!, used for creating build images and the first half of bootstrapping [make stage1]
- build dependencies:
  - changes for dev-python/setuptools with USE conditionals 'python?' -> 'python_targets_python3_12?':
    - USE conditionals changed to 'python?'
- install dependencies:
  - added a dependency 'virtual/tmpfiles' for USE '!build?'
- runtime dependencies:
  - dropped a dependency 'virtual/tmpfiles'
virtual/ldb: [PROD] [DEV]
- still at 2.11.0
virtual/libudev: [PROD] [DEV]
- from 251-r2 to 257
- runtime dependencies:
  - changes for sys-apps/systemd with USE conditionals 'systemd?':
    - changed version constraint from >=251 to >=257
  - changes for sys-apps/systemd-utils with USE conditionals '!systemd?':
    - changed version constraint from >=251 to >=257
virtual/perl-Carp:
- from 1.540.0-r2 to 1.540.0-r3
- runtime dependencies:
  - added a dependency '=dev-lang/perl-5.44*' for USE '||'
virtual/perl-Exporter:
- from 5.790.0 to 5.790.0-r1
- runtime dependencies:
  - added a dependency '=dev-lang/perl-5.44*' for USE '||'
x11-drivers/nvidia-drivers: [SYSEXT-NVIDIA-DRIVERS-535] [SYSEXT-NVIDIA-DRIVERS-535-OPEN]
- still at 535.309.01
  --
changelog
image diff

Copilot

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

…sc/curl Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

…x-* packages Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

This reverts commit 43b5ea1. Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>

Our dev-lang/rust build is configured for cross-compiling, while dev-lang/rust-bin is not. The latter will be pulled in because of RUST_NEEDS_LLVM=1, but we don't need LLVM for our build. The env change avoids using rust-bin, but it cannot avoid pulling it in. The ebuild change does that. It might get undone by the next resync, but we might as well avoid it for a little while. Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>

This has to be upstreamed. Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

dongsupark

Looks good, see below:

dongsupark · 2026-07-23T14:05:37Z

CVE-2026-4176

+- nghttp2 ([CVE-2026-27135](https://www.cve.org/CVERecord?id=CVE-2026-27135))
+- curl ([CVE-2026-4873](https://www.cve.org/CVERecord?id=CVE-2026-4873), [CVE-2026-5545](https://www.cve.org/CVERecord?id=CVE-2026-5545), [CVE-2026-5773](https://www.cve.org/CVERecord?id=CVE-2026-5773), [CVE-2026-6253](https://www.cve.org/CVERecord?id=CVE-2026-6253), [CVE-2026-6276](https://www.cve.org/CVERecord?id=CVE-2026-6276), [CVE-2026-6429](https://www.cve.org/CVERecord?id=CVE-2026-6429), [CVE-2026-7009](https://www.cve.org/CVERecord?id=CVE-2026-7009), [CVE-2026-7168](https://www.cve.org/CVERecord?id=CVE-2026-7168), [CVE-2026-8286](https://www.cve.org/CVERecord?id=CVE-2026-8286), [CVE-2026-8458](https://www.cve.org/CVERecord?id=CVE-2026-8458), [CVE-2026-8924](https://www.cve.org/CVERecord?id=CVE-2026-8924), [CVE-2026-8925](https://www.cve.org/CVERecord?id=CVE-2026-8925), [CVE-2026-8926](https://www.cve.org/CVERecord?id=CVE-2026-8926), [CVE-2026-8927](https://www.cve.org/CVERecord?id=CVE-2026-8927), [CVE-2026-8932](https://www.cve.org/CVERecord?id=CVE-2026-8932), [CVE-2026-9079](https://www.cve.org/CVERecord?id=CVE-2026-9079), [CVE-2026-9080](https://www.cve.org/CVERecord?id=CVE-2026-9080), [CVE-2026-9545](https://www.cve.org/CVERecord?id=CVE-2026-9545), [CVE-2026-9546](https://www.cve.org/CVERecord?id=CVE-2026-9546), [CVE-2026-9547](https://www.cve.org/CVERecord?id=CVE-2026-9547), [CVE-2026-10536](https://www.cve.org/CVERecord?id=CVE-2026-10536), [CVE-2026-11352](https://www.cve.org/CVERecord?id=CVE-2026-11352), [CVE-2026-11564](https://www.cve.org/CVERecord?id=CVE-2026-11564), [CVE-2026-11586](https://www.cve.org/CVERecord?id=CVE-2026-11586), [CVE-2026-11856](https://www.cve.org/CVERecord?id=CVE-2026-11856), [CVE-2026-12064](https://www.cve.org/CVERecord?id=CVE-2026-12064))
+- sed ([CVE-2026-5958](https://www.cve.org/CVERecord?id=CVE-2026-5958))
+- perl ([CVE-2026-4176](https://www.cve.org/CVERecord?id=CVE-2026-4176), [CVE-2026-13221](https://www.cve.org/CVERecord?id=CVE-2026-13221), [CVE-2026-57432](https://www.cve.org/CVERecord?id=CVE-2026-57432))


While perl 5.42.2 fixes CVE-2026-4176, it does not fix CVE-2026-13221, CVE-2026-57432.
I have also fixed flatcar/Flatcar#2084.

dongsupark · 2026-07-23T14:21:38Z

+- base, dev: dracut ([111](https://github.com/dracut-ng/dracut/releases/tag/111))
+- base, dev: ethtool ([7.0](https://git.kernel.org/pub/scm/network/ethtool/ethtool.git/plain/NEWS?h=v7.0))
+- base, dev: expat ([2.8.2](https://blog.hartwork.org/posts/expat-2-8-2-released/))
+- base, dev: gcc (15.3.0)


- base, dev: gcc ([15.3.0](https://gcc.gnu.org/gcc-15/changes.html))

dongsupark · 2026-07-23T14:23:21Z

+([1.52.1](https://github.com/libuv/libuv/releases/tag/v1.52.1) (includes
+[1.52.0](https://github.com/libuv/libuv/releases/tag/v1.52.0)))
+- base, dev: mit-krb5 ([1.22.2](https://web.mit.edu/kerberos/krb5-1.22/krb5-1.22.2.html))
+- base, dev: openldap (2.6.13)


- base, dev: openldap ([2.6.13](https://www.openldap.org/software/release/changes_lts.html))

dongsupark · 2026-07-23T14:47:47Z

+- nghttp2 ([CVE-2026-27135](https://www.cve.org/CVERecord?id=CVE-2026-27135))
+- curl ([CVE-2026-4873](https://www.cve.org/CVERecord?id=CVE-2026-4873), [CVE-2026-5545](https://www.cve.org/CVERecord?id=CVE-2026-5545), [CVE-2026-5773](https://www.cve.org/CVERecord?id=CVE-2026-5773), [CVE-2026-6253](https://www.cve.org/CVERecord?id=CVE-2026-6253), [CVE-2026-6276](https://www.cve.org/CVERecord?id=CVE-2026-6276), [CVE-2026-6429](https://www.cve.org/CVERecord?id=CVE-2026-6429), [CVE-2026-7009](https://www.cve.org/CVERecord?id=CVE-2026-7009), [CVE-2026-7168](https://www.cve.org/CVERecord?id=CVE-2026-7168), [CVE-2026-8286](https://www.cve.org/CVERecord?id=CVE-2026-8286), [CVE-2026-8458](https://www.cve.org/CVERecord?id=CVE-2026-8458), [CVE-2026-8924](https://www.cve.org/CVERecord?id=CVE-2026-8924), [CVE-2026-8925](https://www.cve.org/CVERecord?id=CVE-2026-8925), [CVE-2026-8926](https://www.cve.org/CVERecord?id=CVE-2026-8926), [CVE-2026-8927](https://www.cve.org/CVERecord?id=CVE-2026-8927), [CVE-2026-8932](https://www.cve.org/CVERecord?id=CVE-2026-8932), [CVE-2026-9079](https://www.cve.org/CVERecord?id=CVE-2026-9079), [CVE-2026-9080](https://www.cve.org/CVERecord?id=CVE-2026-9080), [CVE-2026-9545](https://www.cve.org/CVERecord?id=CVE-2026-9545), [CVE-2026-9546](https://www.cve.org/CVERecord?id=CVE-2026-9546), [CVE-2026-9547](https://www.cve.org/CVERecord?id=CVE-2026-9547), [CVE-2026-10536](https://www.cve.org/CVERecord?id=CVE-2026-10536), [CVE-2026-11352](https://www.cve.org/CVERecord?id=CVE-2026-11352), [CVE-2026-11564](https://www.cve.org/CVERecord?id=CVE-2026-11564), [CVE-2026-11586](https://www.cve.org/CVERecord?id=CVE-2026-11586), [CVE-2026-11856](https://www.cve.org/CVERecord?id=CVE-2026-11856), [CVE-2026-12064](https://www.cve.org/CVERecord?id=CVE-2026-12064))
+- sed ([CVE-2026-5958](https://www.cve.org/CVERecord?id=CVE-2026-5958))
+- perl ([CVE-2026-4176](https://www.cve.org/CVERecord?id=CVE-2026-4176), [CVE-2026-13221](https://www.cve.org/CVERecord?id=CVE-2026-13221), [CVE-2026-57432](https://www.cve.org/CVERecord?id=CVE-2026-57432))


Another missing entry:

- docker ([CVE-2024-25621](https://www.cve.org/CVERecord?id=CVE-2024-25621), [CVE-2025-52881](https://www.cve.org/CVERecord?id=CVE-2025-52881))

Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>

It has to be upstreamed Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>

tormath1 · 2026-07-23T15:03:25Z

Looks good, see below:

Thanks - force pushed here: https://github.com/flatcar/scripts/compare/a73bfd722bfe532c82c60ebca243680fde8a72ed..64690d949ee51f1bc06857df2f9da075047c4a4f

Copilot AI review requested due to automatic review settings July 6, 2026 08:43

github-actions Bot added the main label Jul 6, 2026

Copilot AI reviewed Jul 6, 2026

Copilot AI review requested due to automatic review settings July 7, 2026 14:15

tormath1 force-pushed the buildbot/weekly-portage-stable-package-updates-2026-07-06 branch from 5bf9093 to e5d4a79 Compare July 7, 2026 14:15

tormath1 had a problem deploying to development July 7, 2026 14:15 — with GitHub Actions Error

Copilot started reviewing on behalf of tormath1 July 7, 2026 14:16 View session

Copilot AI reviewed Jul 7, 2026

Copilot AI review requested due to automatic review settings July 8, 2026 18:20

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-07-06 branch from e5d4a79 to d7f3ff9 Compare July 8, 2026 18:20

krnowak had a problem deploying to development July 8, 2026 18:20 — with GitHub Actions Error

Copilot started reviewing on behalf of krnowak July 8, 2026 18:20 View session

Copilot AI reviewed Jul 8, 2026

Copilot AI review requested due to automatic review settings July 10, 2026 09:01

krnowak had a problem deploying to development July 10, 2026 09:01 — with GitHub Actions Error

Copilot started reviewing on behalf of krnowak July 10, 2026 09:01 View session

Copilot AI reviewed Jul 10, 2026

Copilot AI review requested due to automatic review settings July 10, 2026 09:39

krnowak had a problem deploying to development July 10, 2026 09:39 — with GitHub Actions Error

Copilot started reviewing on behalf of krnowak July 10, 2026 09:40 View session

krnowak had a problem deploying to development July 10, 2026 09:43 — with GitHub Actions Error

Copilot AI reviewed Jul 10, 2026

Copilot AI review requested due to automatic review settings July 10, 2026 10:24

krnowak had a problem deploying to development July 10, 2026 10:24 — with GitHub Actions Error

Copilot started reviewing on behalf of krnowak July 10, 2026 10:25 View session

Copilot AI reviewed Jul 10, 2026

Copilot AI review requested due to automatic review settings July 10, 2026 16:23

krnowak had a problem deploying to development July 10, 2026 16:23 — with GitHub Actions Error

Copilot started reviewing on behalf of krnowak July 10, 2026 16:24 View session

Copilot AI reviewed Jul 10, 2026

krnowak and others added 13 commits July 23, 2026 15:26

overlay coreos/user-patches: Drop a patch for net-dns/bind

88e8008

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/config: Fix a typo

6183a88

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for net-libs/gnutls

ac47652

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Add accept keywords for net-libs/nghttp2 and net-mi…

03cefa3

…sc/curl Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Add some security-related accept keywords

a934ca7

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

portage-stable: Drop unused packages

f199c16

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

.github: Remove dropped packages

6046231

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Fix accept keywords for net-misc/curl

d93074a

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Regenerate patches for sec-policy/selinu…

a4747b5

…x-* packages Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for sys-apps/portage

bd090be

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Revert "overlay profiles: Mask dev-python/setuptools-82"

5a96b66

This reverts commit 43b5ea1. Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>

net-dns/bind: fix cross compilation issue

e4770f6

This has to be upstreamed. Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>

tormath1 force-pushed the buildbot/weekly-portage-stable-package-updates-2026-07-06 branch from e6155d5 to a73bfd7 Compare July 23, 2026 13:26

tormath1 had a problem deploying to development July 23, 2026 13:26 — with GitHub Actions Error

tormath1 marked this pull request as ready for review July 23, 2026 13:27

tormath1 requested a review from a team as a code owner July 23, 2026 13:27

Copilot AI review requested due to automatic review settings July 23, 2026 13:27

Copilot AI reviewed Jul 23, 2026

dongsupark approved these changes Jul 23, 2026

View reviewed changes

dongsupark reviewed Jul 23, 2026

View reviewed changes

tormath1 added 2 commits July 23, 2026 17:01

changelog: add entries

36549e5

Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>

app-emulation/open-vm-tools: fix glib compilation

64690d9

It has to be upstreamed Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>

tormath1 force-pushed the buildbot/weekly-portage-stable-package-updates-2026-07-06 branch from a73bfd7 to 64690d9 Compare July 23, 2026 15:02

tormath1 requested a deployment to development July 23, 2026 15:02 — with GitHub Actions Waiting

tormath1 merged commit 26eabab into main Jul 23, 2026
4 of 5 checks passed

tormath1 deleted the buildbot/weekly-portage-stable-package-updates-2026-07-06 branch July 23, 2026 15:08

github-project-automation Bot moved this from ✅ Testing / in Review to Implemented in Flatcar tactical, release planning, and roadmap Jul 23, 2026

dongsupark mentioned this pull request Jul 23, 2026

update: app-containers/aardvark-dns flatcar/Flatcar#2221

Closed

Uh oh!

Conversation

github-actions Bot commented Jul 6, 2026 • edited by dongsupark Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

dongsupark left a comment

Choose a reason for hiding this comment

Uh oh!

dongsupark Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

dongsupark Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

dongsupark Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

dongsupark Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

tormath1 commented Jul 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions Bot commented Jul 6, 2026 •

edited by dongsupark

Loading