Weekly portage-stable package updates 2026-09-14 by github-actions[bot] · Pull Request #4273 · flatcar/scripts

github-actions · 2026-09-14T07:28:38Z

CI: https://jenkins.flatcar.org/job/container/job/sdk/211/cldsv/

Closes flatcar/Flatcar#2347
Closes flatcar/Flatcar#2407
Closes flatcar/Flatcar#2408
Closes flatcar/Flatcar#2409
Closes flatcar/Flatcar#2410
Closes flatcar/Flatcar#2411
Closes flatcar/Flatcar#2414
Closes flatcar/Flatcar#2415
Closes flatcar/Flatcar#2416
Closes flatcar/Flatcar#2418
Closes flatcar/Flatcar#2419
Closes flatcar/Flatcar#2420

--

app-arch/cpio: [PROD] [DEV]
- still at 2.15
- fixes CVE-2026-66485, CVE-2026-66486 through backported patches
  - update: app-arch/cpio Flatcar#2410
app-arch/xz-utils: [PROD] [DEV]
- from 5.8.3 to 5.8.4
- fixes GHSA-5qpq-xqfv-j9pg
  - update: app-arch/xz-utils Flatcar#2416
- package became unstable on 'amd64'
- package became unstable on 'arm64'
- release notes: https://github.com/tukaani-project/xz/releases/tag/v5.8.4
app-containers/containerd: [SYSEXT-CONTAINERD]
- from 2.3.4 to 2.3.5
- fixes CVE-2026-53495, GHSA-rp3h-jf77-q9p4
  - update: containerd Flatcar#2420
- release notes: https://github.com/containerd/containerd/releases/tag/v2.3.5
app-containers/cri-tools: [PROD] [DEV]
- from 1.36.0 to 1.37.0
- fixes CVE-2026-34040, CVE-2026-41567, CVE-2026-42306, CVE-2026-39883
  - update: cri-tools Flatcar#2347
- build dependencies:
  - changes for dev-lang/go:
    - changed version constraint from >=1.26.2 to >=1.26.6
- release notes: https://github.com/kubernetes-sigs/cri-tools/releases/tag/v1.37.0
app-containers/crun: [SYSEXT-PODMAN]
- from 1.28 to 1.29.1-r1
- fixes CVE-2026-88264, CVE-2026-88265 through backported patches
  - update: app-containers/crun Flatcar#2418
- package became unstable on 'amd64'
- package became unstable on 'arm64'
- dependencies and runtime dependencies:
  - added a dependency 'dev-libs/blake3'
- release notes: https://github.com/containers/crun/releases/tag/1.29.1 https://github.com/containers/crun/releases/tag/1.29
app-containers/incus: [SYSEXT-INCUS]
- from 7.4 to 7.4-r1
- runtime dependencies:
  - changes for sys-fs/squashfs-tools:
    - added zstd use enabled requirement (must exist, no pretending if missing)
app-crypt/p11-kit: [PROD] [DEV]
- still at 0.26.4
- package became stable on 'amd64'
- package became stable on 'arm64'
dev-lang/python: [AZURE] [DEV] [GCE] [SYSEXT-PYTHON]
- still at 3.13.15
- fixes CVE-2026-19672 through backported patches
  - update: dev-lang/python Flatcar#2414
dev-libs/libgcrypt: [PROD] [DEV]
- from 1.12.3-r1 to 1.12.4
- package became stable on 'amd64'
- package became stable on 'arm64'
- release notes: https://lists.gnu.org/archive/html/info-gnu/2026-09/msg00002.html
dev-libs/libpcre2: [PROD] [DEV]
- from 10.47 to 10.48
- fixes CVE-2026-86145, CVE-2026-89156, CVE-2026-89161, GHSA-9qww-pwc4-77qq, GHSA-q7rw-r7qq-2hx6
  - update: dev-libs/libpcre2 Flatcar#2409
- package became unstable on 'amd64'
- package became unstable on 'arm64'
- release notes: https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
dev-libs/libxml2: [PROD] [DEV]
- from 2.15.3 to 2.15.4
- fixes CVE-2026-86137, CVE-2026-86138, CVE-2026-86139, CVE-2026-86140, CVE-2026-86141, CVE-2026-86142, CVE-2026-86143, CVE-2026-86144
  - update: dev-libs/libxml2 Flatcar#2408
- package became unstable on 'amd64'
- package became unstable on 'arm64'
- dropped our user patches
- release notes: https://gitlab.gnome.org/GNOME/libxml2/-/raw/v2.15.4/NEWS
dev-python/hatchling:
- from 1.31.0 to 1.32.0
- build dependencies and runtime dependencies:
  - added a dependency '>=dev-python/tomlkit-0.11.1[python_targets_python3_13(-)?]'
- release notes: https://github.com/pypa/hatch/releases/tag/hatchling-v1.32.0
dev-python/platformdirs: [SYSEXT-PYTHON]
- from 4.10.1 to 4.11.3
- release notes: https://github.com/tox-dev/platformdirs/releases/tag/4.11.{3..0}
dev-python/setuptools: [SYSEXT-PYTHON]
- from 83.0.0 to 84.0.0
- release notes: https://raw.githubusercontent.com/pypa/setuptools/refs/tags/v84.0.0/NEWS.rst
dev-python/snakeoil:
- from 0.11.5 to 0.11.6
- release notes: https://github.com/pkgcore/snakeoil/releases/tag/v0.11.6
dev-python/wheel: [SYSEXT-PYTHON]
- from 0.47.0 to 0.48.0
- release notes: https://github.com/pypa/wheel/releases/tag/0.48.0
dev-util/pkgcheck:
- from 0.10.42 to 0.10.43
- build dependencies and runtime dependencies:
  - changes for dev-python/snakeoil:
    - changed version constraint from >=0.11.3 to >=0.11.6
  - changes for sys-apps/pkgcore:
    - changed version constraint from >=0.12.37 to >=0.12.42
- release notes: https://github.com/pkgcore/pkgcheck/releases/tag/v0.10.43
dev-util/pkgconf: [PROD] [DEV]
- from 2.5.1 to 3.0.7
- release notes: https://raw.githubusercontent.com/pkgconf/pkgconf/refs/tags/pkgconf-3.0.7/NEWS
dev-vcs/git: [PROD] [DEV]
- still at 2.55.0
- dropped our user patch in favor of Gentoo's
net-libs/libpcap: [PROD] [DEV]
- from 1.10.6 to 1.10.7
- fixes CVE-2026-0799, CVE-2026-18238, CVE-2026-18313, CVE-2026-31911, CVE-2026-31912, CVE-2026-6244, CVE-2026-6554
  - update: net-libs/libpcap Flatcar#2415
- build dependencies:
  - changes for sec-keys/openpgp-keys-tcpdump with USE conditionals 'verify-sig?':
    - changed version constraint from >=20260104 to >=20260908
- release notes: https://raw.githubusercontent.com/the-tcpdump-group/libpcap/refs/tags/libpcap-1.10.7/CHANGES
net-libs/nghttp2: [PROD] [DEV]
- from 1.69.0 to 1.70.0
- fixes CVE-2026-58055
  - update: net-libs/nghttp2 Flatcar#2412
- package became unstable on 'amd64'
- package became unstable on 'arm64'
- release notes: https://github.com/nghttp2/nghttp2/releases/tag/v1.70.0
net-misc/curl: [PROD] [DEV]
- from 8.21.0-r1 to 8.22.0
- fixes CVE-2026-13608, CVE-2026-18924, CVE-2026-19931, CVE-2026-80229, CVE-2026-80230, CVE-2026-80231, CVE-2026-80255, CVE-2026-80256
  - update: net-misc/curl Flatcar#2407
- package became unstable on 'amd64'
- package became unstable on 'arm64'
- dependencies and runtime dependencies:
  - changes for app-arch/brotli with USE conditionals 'brotli?':
    - added version constraint >=1.0.0
  - changes for net-libs/libpsl with USE conditionals 'psl?':
    - added version constraint >=0.16.0
  - changes for net-libs/libssh2 with USE conditionals 'ssh?':
    - changed version constraint from >=1.2.8 to >=1.9.0
  - changes for dev-libs/nettle with USE conditionals 'ssl?' -> 'gnutls?':
    - added version constraint >=3.4.1
  - changes for net-libs/gnutls with USE conditionals 'ssl?' -> 'gnutls?':
    - changed version constraint from >=3.1.10 to >=3.6.5
  - changes for app-arch/zstd with USE conditionals 'zstd?':
    - added version constraint >=1.0
- release notes: https://curl.se/ch/8.22.0.html
sys-apps/checkpolicy: [PROD] [DEV]
- from 3.10 to 3.11
- dependencies and runtime dependencies:
  - changes for sys-libs/libsepol:
    - changed version constraint from >=3.10 to >=3.11
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.11
sys-apps/gawk: [PROD] [DEV]
- from 5.3.2 to 5.4.1-r1
- fixes CVE-2026-40553, CVE-2026-40467, CVE-2026-40468
  - update: sys-apps/gawk Flatcar#2411
- package became unstable on 'amd64'
- package became unstable on 'arm64'
- release notes: (5.4.1: https://lists.gnu.org/archive/html/info-gnu/2026-07/msg00001.html) (5.4.0: https://lists.gnu.org/archive/html/info-gnu/2026-02/msg00011.html)
sys-apps/pkgcore:
- from 0.12.41 to 0.12.42
- build dependencies and runtime dependencies:
  - changes for dev-python/snakeoil:
    - changed version constraint from >=0.11.5 to >=0.11.6
  - added a dependency 'dev-python/py-landlock[python_targets_python3_13(-)?]' for USE 'amd64?'
- release notes: https://github.com/pkgcore/pkgcore/releases/tag/v0.12.42
sys-apps/semodule-utils: [PROD] [DEV]
- still at 3.11
- package became stable on 'amd64'
- package became stable on 'arm64'
sys-auth/sssd: [PROD] [DEV]
- still at 2.13.1
- fixes CVE-2026-87853 through backported patches
  - update: sys-auth/sssd Flatcar#2419
sys-devel/gnuconfig: [DEV]
- from 20250710 to 20260517
- release notes: none
sys-kernel/dracut: [PROD] [DEV]
- from 111-r2 to 112
- release notes: https://github.com/dracut-ng/dracut/releases/tag/112
sys-libs/libseccomp: [PROD] [DEV]
- still at 2.6.1
- package became stable on 'amd64'
- package became stable on 'arm64'
sys-libs/libselinux: [PROD] [DEV]
- still at 3.11-r1
- package became stable on 'amd64'
- package became stable on 'arm64'
sys-libs/libsepol: [PROD] [DEV]
- still at 3.11
- package became stable on 'amd64'
- package became stable on 'arm64'
virtual/libpcre2-internals: [PROD] [DEV]
- from 10.47 to 10.48
- package became unstable on 'amd64'
- package became unstable on 'arm64'
- runtime dependencies:
  - changes for dev-libs/libpcre2:
    - changed version constraint from ~10.47 to ~10.48

--

changelog
image diff

krnowak · 2026-09-18T07:10:38Z

CI passed.

Copilot

🟡 Changes recommended

One or more issues must be addressed before approval.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates the vendored Gentoo portage tree and Flatcar-specific patches with weekly package versions, security fixes, keyword changes, and build-system adjustments.

Changes:

Adds and refreshes package versions, manifests, dependencies, and architecture keywords.
Updates cross-compilation, testing, and build-system patches.
Refreshes Flatcar security patches, profile masks, and package metadata.

File summaries

File	Description
sdk_container/src/third_party/portage-stable/sys-libs/timezone-data/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-9999.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.4_alpha_pre20251007.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_p3.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.2_p13-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-3.11.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.11-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-2.6.1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/glibc/files/glibc-2.43-hurd-link-helpers.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/glibc/files/glibc-2.43-hurd-ldconfig.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-112.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-fs/fuse/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-fs/fuse/fuse-3.18.3.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-fs/fuse/fuse-3.18.2.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20260517.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-17.0.0_p20260913.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-17.0.0_p20260906.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-17.0.0_p20260823.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-17.0.0_p20260816.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.2.1_p20260912.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.2.1_p20260829.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.2.1_p20260822.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.2.1_p20260815.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.3.1_p20260911.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.3.1_p20260828.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.3.1_p20260821.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.3.1_p20260814.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.4.1_p20260827.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.4.1_p20260820.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.4.1_p20260813.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.4.1_p20260806.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.5.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20260902.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20260826.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20260819.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20260812.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20260805.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/systemd/systemd-261.2.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/semodule-utils/semodule-utils-3.11.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.51.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/pkgcore-0.12.43.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/pkgcore-0.12.42.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.11-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.11.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/bubblewrap/files/bubblewrap-0.12.0-tests-run.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/bubblewrap/files/bubblewrap-0.12.0-musl.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/bubblewrap/bubblewrap-0.12.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sec-policy/selinux-unconfined/selinux-unconfined-2.20260616_p1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sec-policy/selinux-sssd/selinux-sssd-2.20260616_p1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sec-policy/selinux-policykit/selinux-policykit-2.20260616_p1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sec-policy/selinux-dbus/selinux-dbus-2.20260616_p1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sec-policy/selinux-container/selinux-container-2.20260616_p1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sec-policy/selinux-base/selinux-base-2.20260616_p1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sec-policy/selinux-base-policy/selinux-base-policy-2.20260616_p1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2026	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/package.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/arch/ppc/package.use.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.stable.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/net-misc/curl/metadata.xml	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.20.0-cpu-use.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/net-misc/curl/curl-9999.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/net-misc/chrony/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/net-libs/libpcap/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/net-libs/libpcap/libpcap-9999.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/metadata.xml	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-1.0.1-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/eclass/cmake.eclass	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.55.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-vcs/git/files/git-2.55.0-cargo-meson-cross.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-3.0.7.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.43.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.88.3.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.88.3.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-9999.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.7.0-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.48.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/vcs-versioning/vcs-versioning-2.4.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/vcs-versioning/vcs-versioning-2.2.3.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.26.0_p20260816.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/tomlkit/tomlkit-0.15.1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/tomlkit/tomlkit-0.15.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/tomlkit/metadata.xml	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/tomlkit/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.11.6.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-84.0.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-10.3.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/py-landlock/py-landlock-0.1.1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/py-landlock/metadata.xml	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/py-landlock/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.11.8.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.11.3.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/pip/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.32.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-84.0.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.27.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.26.13.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-3.0.1-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-3.0.0-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/libassuan/files/libassuan-3.0.0-remove-putc.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.88.3.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/elfutils/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.193-perf.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.25.13.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-build/gtk-doc-am/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-build/gtk-doc-am/gtk-doc-am-1.36.1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-9999.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-portage/gemato/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-portage/gemato/gemato-20.14.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-misc/jq/files/jq-1.7.1-runpath.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/p11-kit-0.26.4.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/incus/incus-9999.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/incus/incus-7.4-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/docker/docker-29.7.2.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-29.8.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-29.7.2.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/crun/crun-1.29.1-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/crun/crun-1.28-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/cri-tools/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/cri-tools/cri-tools-1.37.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/cri-tools/cri-tools-1.36.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/containers-shortnames/containers-shortnames-2025.03.19_p20260615.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/containerd/metadata.xml	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/containerd/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.3.5.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.3.3.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-auth/sssd/README.md	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-auth/sssd/0004-IDP-fix-user-matching-in-eval_access_token_buf.patch	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/README.md	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-vcs/git/README.md	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-vcs/git/0001-fix-cross.patch	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-python/gpep517/get-config-vars-args.patch	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-libs/libxml2/README.md	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/python/README.md	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/app-containers/crun/README.md	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/app-arch/cpio/README.md	Updated as part of this pull request.
.github/workflows/portage-stable-packages-list	Updated as part of this pull request.

Review details

Suppressed comments (5)

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/app-containers/crun/README.md:2

The sentence should use the simple present (“fix”), not “are fixing”, because the patches fix the issue.

are fixing some symlink-related security issues. At the time of

sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.3.5.ebuild:14

Because this ebuild inherits go-module and produces a statically linked Go program, LICENSE="Apache-2.0" is incomplete: containerd v2.3.5 directly uses golang.org/x/sys, whose bundled license is BSD-style. go-module.eclass requires all statically linked dependency licenses; please audit the vendor tree and add the missing licenses, as the cri-tools ebuild does.

LICENSE="Apache-2.0"

sdk_container/src/third_party/portage-stable/app-containers/crun/crun-1.28-r1.ebuild:26

Because --enable-embedded-blake3=no makes crun link against the system library, this dependency should carry its ABI subslot. With the plain atom, a future blake3 subslot bump will not trigger a crun rebuild; use the same := form used by the repository's other consumer (dev-util/xdelta-3.2.0.ebuild:21).
sdk_container/src/third_party/portage-stable/app-containers/crun/crun-1.29.1-r1.ebuild:26
Because --enable-embedded-blake3=no makes crun link against the system library, this dependency should carry its ABI subslot. With the plain atom, a future blake3 subslot bump will not trigger a crun rebuild; use the same := form used by the repository's other consumer (dev-util/xdelta-3.2.0.ebuild:21).
sdk_container/src/third_party/portage-stable/dev-libs/libassuan/files/libassuan-3.0.0-remove-putc.patch:9
This patch description uses “was remove”; please change it to “was removed”.

Files reviewed: 213/217 changed files
Comments generated: 2
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+From 69069bc63e6b1152e34e39bc322132fd4fd7284d Mon Sep 17 00:00:00 2001
+From: Werner Koch <wk@gnupg.org>
+Date: Tue, 25 Jun 2024 09:06:04 +0200
+Subject: [PATCH] Remove an declaration for an unused function


+KEYWORDS="amd64"
+
+EPYTEST_DESELECT=(
+	# tries to load an executable, with rule not aloowing libgcc.so.1


chewi

Last one of these ever? 😉

What happened with the SELinux issues? Was this snapshot before those changes?

krnowak · 2026-09-18T13:12:35Z

Last one of these ever? 😉

Ah, of this kind maybe. But still, with Gentoo as a submodule, PRs with manual cleanups in profiles and with updates/security changelogs will still be needed.

What happened with the SELinux issues? Was this snapshot before those changes?

I masked the SELinux policy versions that introduced the issues. It's something to look into next week.

It's from Gentoo commit 4a06540bf638f10a35b7fa35207d16a5cc214250. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 75d4677a078104658e54c96392d53e8c613a2704. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit e6b96b17537dc3eea5f2af6de6c149beec30fdc6. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit e170aa871d5410d13d587c2ace54c3a9db012423. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit b92343ea94c3fa49bbd0f3a14e9c36bf733fad7c. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit a49e7120e9bae41631dcd954589c4bd79f58a68e. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit f7ee63a1a5fcf016442babc5a2c55055c0c00008. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 3496e5ae4b2c14afe92401d831388234b6d261cd. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit ac25fe848f8ff9c88cf37e4886e60af710326a5b. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 45d1c9d3258cfe085aa1100fffec5210a5c357f9. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit fa27784de8a5ab1d8b089837d2a0a88a49e11d90. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit d7a3a139206e7ffe379ecb49b1e1ac9756f40a12. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 762b44d057bf3705ce7fe3e27c0e60b554fed412. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

It's from Gentoo commit 4ece7c6c4f115411b5b1e3bf5f17e271ee89ca6b. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

It's from Gentoo commit 620ce00e540281401a39cc3447d908b32afb9d5a. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>

krnowak · 2026-09-18T13:15:51Z

Rebased to add a missing signoff.

github-actions Bot added the main label Sep 14, 2026

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-09-14 branch from e7bc4bc to 42d603c Compare September 14, 2026 14:36

krnowak had a problem deploying to development September 14, 2026 14:36 — with GitHub Actions Error

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-09-14 branch from 42d603c to 35aad4d Compare September 15, 2026 16:15

krnowak had a problem deploying to development September 15, 2026 16:15 — with GitHub Actions Error

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-09-14 branch from 35aad4d to 3435f38 Compare September 17, 2026 11:08

krnowak had a problem deploying to development September 17, 2026 11:08 — with GitHub Actions Error

krnowak marked this pull request as ready for review September 18, 2026 07:10

krnowak requested a review from a team as a code owner September 18, 2026 07:10

Copilot AI lite review requested due to automatic review settings September 18, 2026 07:10

Copilot started reviewing on behalf of krnowak September 18, 2026 07:11 View session

Copilot AI reviewed Sep 18, 2026

View reviewed changes

krnowak added this to Flatcar tactical, release planning, and roadmap Sep 18, 2026

krnowak moved this to ✅ Testing / in Review in Flatcar tactical, release planning, and roadmap Sep 18, 2026

chewi approved these changes Sep 18, 2026

View reviewed changes

Flatcar Buildbot added 13 commits September 18, 2026 15:14

app-arch/xz-utils: Sync with Gentoo

2ed8030

It's from Gentoo commit 4a06540bf638f10a35b7fa35207d16a5cc214250. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/containerd: Sync with Gentoo

61c649f

It's from Gentoo commit 75d4677a078104658e54c96392d53e8c613a2704. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/containers-shortnames: Sync with Gentoo

0b37ad4

It's from Gentoo commit e6b96b17537dc3eea5f2af6de6c149beec30fdc6. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/cri-tools: Sync with Gentoo

9dde62a

It's from Gentoo commit e170aa871d5410d13d587c2ace54c3a9db012423. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/crun: Sync with Gentoo

b6807b2

It's from Gentoo commit b92343ea94c3fa49bbd0f3a14e9c36bf733fad7c. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/docker: Sync with Gentoo

1fb4ba3

It's from Gentoo commit a49e7120e9bae41631dcd954589c4bd79f58a68e. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/docker-cli: Sync with Gentoo

9fcd87b

It's from Gentoo commit f7ee63a1a5fcf016442babc5a2c55055c0c00008. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/incus: Sync with Gentoo

32ce9fd

It's from Gentoo commit 3496e5ae4b2c14afe92401d831388234b6d261cd. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/lxc: Sync with Gentoo

33e8803

It's from Gentoo commit ac25fe848f8ff9c88cf37e4886e60af710326a5b. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-crypt/gpgme: Sync with Gentoo

81ca330

It's from Gentoo commit 45d1c9d3258cfe085aa1100fffec5210a5c357f9. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-crypt/p11-kit: Sync with Gentoo

cf66ada

It's from Gentoo commit fa27784de8a5ab1d8b089837d2a0a88a49e11d90. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-misc/jq: Sync with Gentoo

8b92d13

It's from Gentoo commit d7a3a139206e7ffe379ecb49b1e1ac9756f40a12. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-portage/gemato: Sync with Gentoo

953bc46

It's from Gentoo commit 762b44d057bf3705ce7fe3e27c0e60b554fed412. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

krnowak and others added 24 commits September 18, 2026 15:14

overlay coreos/user-patches: Add a patch for dev-lang/python

07e0521

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Add accept keywords for app-arch/xz-utils

03003b2

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Add accept keywords for net-libs/nghttp2

beedc81

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Add patches for app-arch/cpio

b4ba92f

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Add accept keywords for sys-apps/gawk

edc652e

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Add accept keywords for pcre2

eff22df

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Add accept keywords for dev-libs/libxml2

89a19e6

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Add accept keywords for net-misc/curl

dbc9f9f

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Update accept keywords for app-containers/cri-tools

19b9ee2

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

dev-python/tomlkit: Add from Gentoo

37de5e1

It's from Gentoo commit 4ece7c6c4f115411b5b1e3bf5f17e271ee89ca6b. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

dev-python/py-landlock: Add from Gentoo

c05128e

It's from Gentoo commit 620ce00e540281401a39cc3447d908b32afb9d5a. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

.github: Add new packages to automation

837eefb

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Add accept keywords for app-containers/crun

845a54e

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for app-crypt/p11-kit

a02e8f7

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for dev-libs/libgcrypt

76f01ec

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Drop patches for dev-libs/libxml2

cbb017d

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Drop patches for dev-vcs/git

6570874

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Regenerate SELinux policy patch

3ceb326

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for sys-apps/semodule-utils

6065904

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for sys-libs/libseccomp

dcbb933

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for sys-libs/libse{linux,pol}

097d01f

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

changelog: Add entries

b7cd989

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Mask the selinux policy update for now

1502abd

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

dev-python/gpep517: Patch to fix cross-compiling with setuptools 84.0.0

43fc336

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-09-14 branch from 3435f38 to 43fc336 Compare September 18, 2026 13:15

krnowak requested a deployment to development September 18, 2026 13:15 — with GitHub Actions Waiting

krnowak merged commit d813dc4 into main Sep 18, 2026
1 of 3 checks passed

krnowak deleted the buildbot/weekly-portage-stable-package-updates-2026-09-14 branch September 18, 2026 13:16

github-project-automation Bot moved this from ✅ Testing / in Review to Implemented in Flatcar tactical, release planning, and roadmap Sep 18, 2026

Navigation Menu

Weekly portage-stable package updates 2026-09-14 - #4273

Weekly portage-stable package updates 2026-09-14#4273
krnowak merged 103 commits into
mainfrom
buildbot/weekly-portage-stable-package-updates-2026-09-14

github-actions Bot commented Sep 14, 2026 •

edited by krnowak

Loading

Uh oh!

krnowak commented Sep 18, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

chewi left a comment

Uh oh!

krnowak commented Sep 18, 2026

Uh oh!

krnowak commented Sep 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

github-actions Bot commented Sep 14, 2026 • edited by krnowak Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

krnowak commented Sep 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Suppressed comments (5)

Uh oh!

chewi left a comment

Choose a reason for hiding this comment

Uh oh!

krnowak commented Sep 18, 2026

Uh oh!

krnowak commented Sep 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Sep 14, 2026 •

edited by krnowak

Loading