Weekly portage-stable package updates 2026-08-03 by github-actions[bot] · Pull Request #4173 · flatcar/scripts

github-actions · 2026-08-03T08:23:07Z

CI: https://jenkins.flatcar.org/job/container/job/sdk/133/cldsv/

Partially addresses flatcar/Flatcar#2169
Partially addresses flatcar/Flatcar#2142

--

app-admin/etcd-wrapper: [PROD] [DEV]
- from 3.5.16 to 3.6.11
- bumped to match dev-db/etcd
- release notes: https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.6.md#v3611-2026-05-01
app-admin/logrotate: [PROD] [DEV]
- from 3.22.0 to 3.22.0-r1
- package became unstable on 'arm64'
  - added accept keywords to overlay profiles
- added a patch fixing some selinux issue
app-arch/bzip2: [TODO]
- version TODO
- fixes CVE-2026-42250 through a backported patch
  - update: bzip2 Flatcar#2173
app-arch/gzip: [PROD] [DEV]
- from 1.14 to 1.14_p20260502
- fixes CVE-2026-41991
  - update: app-arch/gzip Flatcar#2224
- package became unknown on 'amd64' and 'arm64'
app-arch/libarchive: [PROD] [DEV]
- from 3.8.8 to 3.8.9
- package became stable on 'amd64' and 'arm64'
  - dropped accept keywords from overlay profiles
- release notes: https://github.com/libarchive/libarchive/releases/tag/v3.8.9
app-arch/tar: [PROD] [DEV]
- from 1.35 to 1.35-r1
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- fixes build with acl 2.4.0
app-containers/container-libs: [SYSEXT-PODMAN]
- from 0.68.0 to 0.69.0
- added IUSE flag 'extra'
  - adds extra dependencies for podman
- build dependencies:
  - changes for dev-go/go-md2man:
    - changed version constraint from >=2.0.2 to >=2.0.7
- runtime dependencies:
  - dropped a dependency '>=app-containers/aardvark-dns-2.0.0'
  - changes for app-containers/containers-shortnames:
    - changed to no block
  - changes for app-containers/crun:
    - USE conditionals changed to 'extra?'
  - changes for app-containers/netavark:
    - USE conditionals changed to 'extra?'
  - changes for net-misc/passt:
    - USE conditionals changed to 'extra?'
- release notes: https://github.com/podman-container-tools/container-libs/releases/tag/common%2Fv0.69.0
app-containers/containerd: [SYSEXT-CONTAINERD]
- from 2.2.5 to 2.3.3
- fixes CVE-2026-24051, CVE-2026-33186, CVE-2026-34986, CVE-2026-35469, CVE-2026-39883
  - update: containerd Flatcar#2182
- build dependencies:
  - added a dependency '>=dev-lang/go-1.26.3'
  - dropped a dependency 'sec-policy/selinux-docker' for USE 'selinux?'
- runtime dependencies:
  - changes for app-containers/runc:
    - changed version constraint from >=1.3.6 to >=1.4.3
  - added a dependency 'sec-policy/selinux-docker' for USE 'selinux?'
- release notes: https://github.com/containerd/containerd/releases/tag/v2.3.{3..0}
app-containers/cri-tools: [PROD] [DEV]
- from 1.33.0 to 1.36.0
- fixes CVE-2026-32285, CVE-2026-24051, CVE-2026-33186
  - update: cri-tools/crictl Flatcar#2169 (partially)
- package became unstable on 'amd64'
  - added accept keywords to overlay profiles
- build dependencies:
  - changes for dev-lang/go:
    - changed version constraint from >=1.24.1 to >=1.26.2
- release notes: https://github.com/kubernetes-sigs/cri-tools/releases/tag/v1.3{6..4}.0
app-containers/docker: [SYSEXT-DOCKER]
- from 29.1.3-r1 to 29.5.2
- fixes CVE-2026-24051, CVE-2026-33186, CVE-2026-33997, CVE-2026-34040, CVE-2026-39883, CVE-2026-41567, CVE-2026-42306, CVE-2026-33747, CVE-2026-33748
  - update: docker Flatcar#2142 (partially)
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- build dependencies:
  - added a dependency '>=dev-lang/go-1.25.5'
- runtime dependencies:
  - changes for app-containers/docker-cli weak blocker:
    - changed version constraint from <29.1.3 to <29.5.2
- release notes: https://github.com/moby/moby/releases/tag/docker-v29.5.{2..0} https://github.com/moby/moby/releases/tag/docker-v29.{4..2}.0
app-containers/docker-buildx: [SYSEXT-DOCKER]
- from 0.21.2 to 0.35.0
- fixes CVE-2025-0495
  - update: app-containers/docker-buildx Flatcar#1693
- EAPI changed from '8' to '9'
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- build dependencies:
  - added a dependency '>=dev-lang/go-1.25.9'
- licenses:
  - added license 'Unicode-DFS-2016'
- release notes: https://github.com/docker/buildx/releases/tag/v0.36.0
app-containers/docker-cli: [SYSEXT-DOCKER]
- from 29.1.3 to 29.5.2
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- build dependencies:
  - added a dependency '>=dev-lang/go-1.25.0'
- release notes: https://github.com/moby/moby/releases/tag/docker-v29.5.{2..0} https://github.com/moby/moby/releases/tag/docker-v29.{4..2}.0
app-containers/netavark: [SYSEXT-PODMAN]
- still at 2.0.0
- runtime dependencies:
  - added a dependency '>=app-containers/aardvark-dns-2.0.0'
  - added a weak blocker '!<app-containers/buildah-1.44.0'
  - added a weak blocker '!<app-containers/podman-6.0.0'
  - added a dependency 'net-firewall/nftables[json]'
app-containers/podman: [SYSEXT-PODMAN]
- still at 6.0.0
- added IUSE flag 'cron'
  - installs a cron daily file, disabled in Flatcar, used to be under a part of !systemd
- dependencies and runtime dependencies:
  - changes for app-containers/conmon:
    - changed version constraint from >=2.2.1 to >=2.1.10
  - changes for app-containers/container-libs:
    - added extra use enabled requirement (will pretend as disabled if missing)
app-crypt/mit-krb5: [PROD] [DEV]
- still at 1.22.2-r2
- fixes CVE-2026-40355, CVE-2026-40356 through backported patches
  - update: mit-krb5 Flatcar#2124
app-crypt/p11-kit: [PROD] [DEV]
- from 0.26.2 to 0.26.4
- fixes CVE-2026-13757
  - update: p11-kit Flatcar#2212
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords in overlay profiles
- release notes: https://github.com/p11-glue/p11-kit/releases/tag/0.26.{4,3}
app-crypt/tpm2-tools: [PROD] [DEV]
- from 5.7 to 5.8
- fixes GHSA-v7w4-4gc9-qcgv, GHSA-gwfg-w3jr-xh66, GHSA-qp88-8f4j-wv7q
  - update: tpm2-tools Flatcar#2210
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- release notes: https://github.com/tpm2-software/tpm2-tools/releases/tag/5.8
app-crypt/tpm2-tss: [PROD] [DEV]
- from 4.1.3-r2 to 4.2.0
- fixes GHSA-q759-vqg7-8rc5, GHSA-7638-f8gq-c475, GHSA-p3px-r4mm-jpw5, GHSA-x5j2-26fc-hhc3, GHSA-gf8g-2r5c-74c7, GHSA-mj78-pj5v-wvjx, GHSA-v2qp-xh5m-44mf, GHSA-2q5v-c7hv-fvpf, GHSA-pcpw-8625-jqcp, GHSA-6grq-c24j-xcjr
  - update: tpm2-tss Flatcar#2209
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- dependencies and runtime dependencies:
  - changes for net-libs/mbedtls with USE conditionals 'mbedtls?':
    - changed slot constraint from 0= to 3=
- release notes: https://github.com/tpm2-software/tpm2-tss/releases/tag/4.2.0
app-editors/nano:
- from 9.0 to 9.1
- release notes: https://lists.gnu.org/archive/html/info-gnu/2026-06/msg00008.html
app-emulation/qemu:
- from 10.2.2 to 10.2.3
- fixes CVE-2026-3886
  - update: app-emulation/qemu Flatcar#2225
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- added IUSE flag 'verify-sig'
- dependencies and runtime dependencies:
  - changes for app-emulation/spice-protocol with USE conditionals 'spice?':
    - changed version constraint from >=0.14.0 to >=0.14.5
- release notes: https://lists.gnu.org/archive/html/qemu-stable/2026-05/msg00654.html
app-misc/jq: [PROD] [DEV]
- from 1.8.1 to 1.8.2
- fixes CVE-2026-32316, CVE-2026-33947, CVE-2026-33948, CVE-2026-39956, CVE-2026-39979, CVE-2026-40164, CVE-2026-41256, CVE-2026-41257, CVE-2026-43894, CVE-2026-43895, CVE-2026-43896, CVE-2026-44777, CVE-2026-47770, CVE-2026-49839, CVE-2026-54679
  - update: jq Flatcar#2079
- release notes: https://github.com/jqlang/jq/releases/tag/jq-1.8.2
app-portage/gentoolkit: [DEV]
- from 0.7.2 to 0.7.6
- release notes: https://gitweb.gentoo.org/proj/gentoolkit.git/log/?h=gentoolkit-0.7.6
dev-build/cmake:
- from 4.3.3-r1 to 4.3.4
- release notes: https://cmake.org/cmake/help/v4.3/release/4.3.html#id4
dev-db/etcd: [PROD] [DEV]
- from 3.5.18 to 3.6.11
- fixes CVE-2025-22869, CVE-2025-30204, CVE-2026-33186
  - update: etcdctl Flatcar#2127
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- build dependencies:
  - added a dependency '>=dev-lang/go-1.25.9'
- release notes: https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.6.md#v3611-2026-05-01
dev-debug/strace: [PROD] [DEV]
- from 7.0-r1 to 7.1
- release notes: https://github.com/strace/strace/releases/tag/v7.1
dev-lang/go:
- from 1.26.3 to 1.26.5
- fixes CVE-2026-27145, CVE-2026-39822, CVE-2026-42504, CVE-2026-42505, CVE-2026-42507
  - update: go Flatcar#2197
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- release notes: https://go.dev/doc/devel/release#go1.26.{5,4}
dev-lang/nasm:
- from 3.01 to 3.02
- release notes: https://www.nasm.us/docs/3.02/nasmac.html
dev-libs/json-c: [PROD] [DEV]
- from 0.18 to 0.19-r2
- fixes CVE-2026-9146
  - update: json-c Flatcar#2211
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- removed IUSE flag 'doc'
- build dependencies:
  - dropped a dependency '>=dev-build/cmake-3.28.5'
  - dropped a dependency '>=app-text/doxygen-1.8.13' for USE 'doc?'
  - added a dependency '>=dev-build/meson-1.2.3'
  - added a dependency 'dev-build/meson-format-array'
- release notes: https://raw.githubusercontent.com/json-c/json-c/refs/heads/json-c-0.19/ChangeLog
dev-libs/jsoncpp:
- from 1.9.6-r2 to 1.9.8
- release notes: https://github.com/open-source-parsers/jsoncpp/releases/tag/1.9.{8,7}
dev-libs/libgpg-error: [PROD] [DEV]
- from 1.60 to 1.61
- release notes: https://dev.gnupg.org/T8239.html
dev-libs/libxml2: [PROD] [DEV]
- still at 2.15.3
- fixes CVE-2026-11979 through a backported patch
  - update: libxml2 Flatcar#2196
dev-libs/opensc:
- from 0.26.1 to 0.27.1
- fixes CVE-2025-13763, CVE-2025-49010, CVE-2025-66037, CVE-2025-66038, CVE-2025-66215
  - update: dev-libs/opensc Flatcar#2068
- release notes: https://github.com/OpenSC/OpenSC/releases/tag/0.27.1
dev-python/cryptography:
- from 48.0.0 to 49.0.0
- release notes: https://raw.githubusercontent.com/pyca/cryptography/e300bbe2f1bec75e5ee7e0ab7b196958831b3db6/CHANGELOG.rst
dev-python/cython:
- from 3.2.4 to 3.2.8
- release notes: https://github.com/cython/cython/releases/tag/3.2.{8..5}
dev-python/distlib: [SYSEXT-PYTHON]
- from 0.4.1 to 0.4.3
- release notes: https://raw.githubusercontent.com/pypa/distlib/refs/tags/0.4.3/CHANGES.rst
dev-python/msgpack: [SYSEXT-PYTHON]
- from 1.1.2 to 1.2.1
- release notes: https://github.com/msgpack/msgpack-python/releases/tag/v1.2.{1,0}
dev-python/setuptools-scm: [SYSEXT-PYTHON]
- from 10.0.5 to 10.1.2
- build dependencies:
  - changes for dev-python/vcs-versioning:
    - changed version constraint from >=1.0.0 to =2*
- runtime dependencies:
  - changes for dev-python/vcs-versioning:
    - changed version constraint from >=1.0.0 to =2*
- release notes: https://github.com/pypa/setuptools-scm/releases/tag/setuptools-scm-v10.1.{2..0}
dev-python/snakeoil:
- from 0.11.0 to 0.11.1
- release notes: https://github.com/pkgcore/snakeoil/releases/tag/v0.11.1
dev-python/typing-extensions: [SYSEXT-PYTHON]
- from 4.15.0 to 4.16.0
- release notes: https://raw.githubusercontent.com/python/typing_extensions/refs/tags/4.16.0/CHANGELOG.md
dev-python/vcs-versioning: [SYSEXT-PYTHON]
- from 1.1.1 to 2.2.2
- release notes: https://github.com/pypa/setuptools-scm/releases/tag/vcs-versioning-v2.2.{2..0} https://github.com/pypa/setuptools-scm/releases/tag/vcs-versioning-v2.{1,0}.0
dev-util/maturin:
- from 1.13.3 to 1.14.1
- release notes: https://github.com/PyO3/maturin/releases/tag/v1.14.1
dev-util/pkgcheck:
- from 0.10.39-r1 to 0.10.40-r1
- build dependencies and runtime dependencies:
  - dropped a dependency 'dev-python/chardet'
  - added a dependency 'dev-python/charset-normalizer'
  - changes for dev-python/snakeoil:
    - changed version constraint from >=0.11.0 to >=0.11.1
  - changes for sys-apps/pkgcore:
    - changed version constraint from >=0.12.31 to >=0.12.34
  - dropped a dependency '<sys-apps/pkgcore-0.12.35'
- release notes: https://github.com/pkgcore/pkgcheck/releases/tag/v0.10.40
dev-util/xdelta: [SYSEXT-INCUS]
- from 3.0.11-r1 to 3.2.0
- build dependencies:
  - added a dependency 'app-alternatives/ninja'
  - added a dependency '>=dev-build/cmake-3.28.5'
- dependencies and runtime dependencies:
  - added a dependency 'dev-libs/blake3:='
- release notes: https://github.com/jmacd/xdelta/releases/tag/v3.2.0
eclass/kernel-2.eclass:
- apply patches defined in ebuild too
eclass/selinux-policy-2.eclass:
- fixed application of user patches, now they are applied inside the refpolicy directory
  - we can drop our duplicated selinux policy patch
net-dns/c-ares: [PROD] [DEV]
- from 1.34.6 to 1.34.8
- fixes CVE-2026-33630, GHSA-pjmc-gx33-gc76, GHSA-jv8r-gqr9-68wj
  - update: c-ares Flatcar#2199
- release notes: https://github.com/c-ares/c-ares/releases/tag/v1.34.{8,7}
net-fs/samba: [PROD] [DEV]
- from 4.23.6 to 4.24.4
- dependencies and runtime dependencies:
  - changes for sys-libs/talloc:
    - changed version constraint from >=2.4.3 to >=2.4.4
  - changes for sys-libs/tdb:
    - changed version constraint from >=1.4.14 to >=1.4.15
- release notes: https://www.samba.org/samba/history/samba-4.24.{4..0}.html
net-libs/nghttp2: [PROD] [DEV]
- from 1.68.1 to 1.69.0
- package became stable on 'amd64' and 'arm64'
  - dropped accept keywords from overlay profiles
- release notes: https://github.com/nghttp2/nghttp2/releases/tag/v1.69.0
net-libs/ngtcp2: [PROD] [DEV]
- from 1.22.1 to 1.24.0
- package became stable on 'amd64' and 'arm64'
  - dropped accept keywords from overlay profiles
- release notes: https://github.com/ngtcp2/ngtcp2/releases/tag/v1.2{4,3}.0
net-misc/curl: [PROD] [DEV]
- from 8.21.0 to 8.21.0-r1
- package became stable on 'amd64' and 'arm64'
  - dropped accept keywords from overlay profiles
net-misc/socat: [PROD] [DEV]
- from 1.8.1.1 to 1.8.1.3
- fixes CVE-2026-56123
  - update: net-misc/socat Flatcar#2190
- release notes: https://repo.or.cz/socat.git/blob/refs/tags/tag-1.8.1.3:/CHANGES
net-misc/wget: [PROD] [DEV]
- still at 1.25.0-r2
- fixes CVE-2026-15146, CVE-2026-58469, CVE-2026-58470, CVE-2026-58471, CVE-2026-58472 through backported patches
  - update: net-misc/wget Flatcar#2222
sec-policy/selinux-base-policy: [PROD] [DEV]
- from 2.20260312_p1 to 2.20260312_p1-r1
- added some patches for authlogin and su modules
sys-apps/acl: [PROD] [DEV]
- from 2.3.2-r3 to 2.4.0-r2
- fixes CVE-2026-54369, CVE-2026-54370
  - update: sys-apps/acl Flatcar#2189
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- added IUSE flag 'verify-sig'
- dependencies:
  - changes for sys-apps/attr:
    - dropped version constraint
- runtime dependencies:
  - dropped a dependency '>=sys-apps/attr-2.4.47-r1'
- release notes: https://cgit.git.savannah.nongnu.org/cgit/acl.git/plain/doc/CHANGES?h=v2.4.0
sys-apps/attr: [PROD] [DEV]
- from 2.5.2-r1 to 2.6.0
- fixes CVE-2026-54371
  - update: sys-apps/attr Flatcar#2191
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- added IUSE flag 'verify-sig'
- release notes: https://cgit.git.savannah.nongnu.org/cgit/attr.git/plain/doc/CHANGES?h=v2.6.0
sys-apps/diffutils: [PROD] [DEV]
- still at 3.12
- fixes CVE-2026-53910 through a backported patch
  - update: sys-apps/diffutils Flatcar#2258
sys-apps/coreutils: [PROD] [DEV]
- still at 9.11-r1
- fixes CVE-2026-56391, CVE-2026-56392 through backported patches
  - update: sys-apps/coreutils Flatcar#2242
sys-apps/file: [DEV]
- from 5.47-r3 to 5.48
- release notes: https://raw.githubusercontent.com/file/file/refs/tags/FILE5_48/ChangeLog
sys-apps/less: [PROD] [DEV]
- from 692 to 704
- fixes less-20260606
  - update: less Flatcar#2175
- release notes: https://greenwoodsoftware.com/less/news.70{4,2}.html
sys-apps/pkgcore:
- from 0.12.32 to 0.12.35
- build dependencies and runtime dependencies:
  - changes for dev-python/snakeoil:
    - changed version constraint from >=0.11.0 to >=0.11.1
- release notes: https://github.com/pkgcore/pkgcore/releases/tag/v0.12.35
sys-apps/policycoreutils: [PROD] [DEV]
- from 3.8.1 to 3.11
- fixes CVE-2026-59676, CVE-2026-59677
  - update: sys-apps/policycoreutils Flatcar#2220
- dependencies and runtime dependencies:
  - changes for sys-libs/libsepol:
    - changed version constraint from >=3.8.1 to >=3.11
  - changes for sys-libs/libselinux:
    - changed version constraint from >=3.8.1 to >=3.11
  - changes for sys-libs/libsemanage:
    - changed version constraint from >=3.8.1 to >=3.11
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.{11..9}
sys-apps/portage: [DEV]
- from 3.0.81.1 to 3.0.81.2
- release notes: https://gitweb.gentoo.org/proj/portage.git/plain/NEWS?h=portage-3.0.81.2
sys-apps/sandbox: [DEV]
- from 2.46 to 2.49
- release notes: https://gitweb.gentoo.org/proj/sandbox.git/log/?h=v2.49
sys-apps/sed: [PROD] [DEV]
- from 4.10 to 4.10-r1
- fixed automagic dep on sys-apps/attr
- added IUSE flag 'xattr'
  - enable support for extended attributes
- dependencies:
  - added a dependency 'sys-apps/attr[static-libs(+)]' for USE 'static?' -> 'xattr?'
  - added a dependency 'sys-apps/attr' for USE '!static?' -> 'xattr?'
- runtime dependencies:
  - added a dependency 'sys-apps/attr' for USE '!static?' -> 'xattr?'
sys-apps/semodule-utils: [PROD] [DEV]
- from 3.10 to 3.11
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- dependencies and runtime dependencies:
  - changes for sys-libs/libsepol:
    - changed version constraint from >=3.10 to >=3.11
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.11
sys-apps/util-linux: [PROD] [DEV]
- from 2.41.4-r1 to 2.42.2
- fixes CVE-2026-13595, CVE-2026-53612, CVE-2026-53613, CVE-2026-53614
  - update: util-linux Flatcar#2179
- release notes: https://github.com/util-linux/util-linux/blob/v2.42.2/Documentation/releases/v2.42.2-ReleaseNotes https://github.com/util-linux/util-linux/blob/v2.42.1/Documentation/releases/v2.42.1-ReleaseNotes https://github.com/util-linux/util-linux/blob/v2.42/Documentation/releases/v2.42-ReleaseNotes
sys-auth/sssd: [PROD] [DEV]
- from 2.13.0 to 2.13.1
- fixes CVE-2026-12610, CVE-2026-14474, CVE-2026-14476 through backported patches
  - update: sssd Flatcar#2192
- release notes: https://sssd.io/release-notes/sssd-2.13.1.html
sys-block/thin-provisioning-tools: [PROD] [DEV]
- still at 1.3.1
- moved the ebuild modification to env overrides
sys-fs/cryptsetup: [PROD] [DEV]
- from 2.8.6-r1 to 2.8.6-r2
- apply some patch bundle from Gentoo
  - these mostly relate to handling of null bytes by jq in testsuite, nothing interesting for us
sys-fs/zfs: [SYSEXT-ZFS]
- from 2.3.6 to 2.4.3
- this version of the package replaces sys-fs/zfs-kmod
  - dropped any stuff related to zfs-kmod from overlay profiles, adapted zfs stuff
- release notes: https://github.com/openzfs/zfs/releases/tag/zfs-2.4.{3..0}
sys-libs/libnvme: [PROD] [DEV]
- from 1.16.1 to 1.16.2
- release notes: https://github.com/linux-nvme/libnvme/releases/tag/v1.16.2
sys-libs/libseccomp: [PROD] [DEV]
- from 2.6.0-r3 to 2.6.1
- fixes GHSA-2hqh-5c36-grrm, GHSA-46fr-jh49-xvhx, GHSA-4q85-33p6-j5g6
  - update: sys-libs/libseccomp Flatcar#2207
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- release notes: https://github.com/seccomp/libseccomp/releases/tag/v2.6.1
sys-libs/libselinux: [PROD] [DEV]
- from 3.10-r2 to 3.11
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- dependencies and runtime dependencies:
  - changes for sys-libs/libsepol:
    - changed version constraint from >=3.10 to >=3.11
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.11
sys-libs/libsemanage: [PROD] [DEV]
- from 3.8.1 to 3.11
- dependencies and runtime dependencies:
  - changes for sys-libs/libselinux:
    - changed version constraint from >=3.8.1 to >=3.11
  - changes for sys-libs/libsepol:
    - changed version constraint from >=3.8.1 to >=3.11
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.{11..9}
sys-libs/libsepol: [PROD] [DEV]
- from 3.10 to 3.11
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.11
sys-libs/pam: [PROD] [DEV]
- still at 1.7.2
- fixes CVE-2026-54411 through a backported patch
  - update: pam Flatcar#2195
sys-process/time:
- from 1.9-r1 to 1.10
- release notes: https://lists.gnu.org/archive/html/info-gnu/2026-04/msg00005.html

--

changelog
image diff

It's from Gentoo commit 143af5e9e3abde855ee4153d2e020ea6ed2357f6. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

Pull in openssh 10.4_p1 for CVE-2026-60002 etc. Signed-off-by: Dongsu Park <dongsu@dpark.io>

Signed-off-by: Dongsu Park <dongsu@dpark.io>

It's from Gentoo commit 26eea6f0bd95ba783f861e590012f0f0abb77117. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 8861c37e3fe818881fc80a944bb0da1fe2817b42. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 849115cb6a00b3cd2c29a11990728f39cc009633. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 2bc085bd16ce55b6b6d739181524efcba10e43ae. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit a934a8ca9c04f1d5cb108d3b8868a83d8c72bd8a. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 7aa35664605c2c323f160612fd3b2f392d2d6cf8. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit e54427313be85e660df7678ad4dcd38292c94c3a. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 5865bd45d8349212a216950c5fb090f7804e0d49. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 0833c9fed35b418972af787666741cf67a6818df. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 97c0ae5651db0f9e21202e43afe67c55143bfcab. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit a1f53fdc3dfad3e635a5315d608ead207f739df0. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 20b551b506a120a825dbdc8ec59f666dfbb1031f. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 77c41003631bbba0337b580c67ba456ba36e3d26. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 28d5d4f4063e979264df423f0ae7645b59b5b7bb. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit c95402428a66081d54db5c1b24ca746c1be7a089. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 70f57f449120ad9e753012c227b7a69159da8289. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 9d10ab4b36aeb0799d33de9ab8fe31d8ffb79944. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit c00037fc49f3a4713c27ebaa00723d7d3631fcec. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 7148be37d12953a53176d5cbc96cf8763937c6a2. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 078af3a216810923a2b43fbf7b6f286dfb170592. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 7b57b72b52b2f592873e207f40b374763545fd07. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 4d9489be539c7fafccdeb703df18fc932a3f352b. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 7f6aedaf508a7ffd652a68cb0827dda7ad99da5b. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 6dffa449ff101bd2b1c349b3064039811ca34493. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 8452019bf7d65b3cd18c6e24717e056a2bb41a52. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 46b7608ff25ae1bf0d3a5b2259c89de29818f922. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 66a5f848251234112d42dbdc8fe6f94b926cadc0. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Prepare the ebuild to be in an upstreamable state: - hide python dependencies behind the IUSE flag - move the semanage.conf additions to a patch - that way, we can add a user patch that changes compression setting that was added by Gentoo - stabilize the package Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com> Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

And fix a tag - currently all the tags have arch as the suffix. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

…cies With the fixes in selinux-policy-2.eclass, we can go back to the single patch for all the selinux policy packages. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

… to env overrides Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

github-actions Bot added the main label Aug 3, 2026

Flatcar Buildbot and others added 29 commits August 7, 2026 20:37

net-misc/openssh: Sync with Gentoo

230b8e7

It's from Gentoo commit 143af5e9e3abde855ee4153d2e020ea6ed2357f6. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

overlay profiles: Add accept keywords for net-misc/openssh

6229487

Pull in openssh 10.4_p1 for CVE-2026-60002 etc. Signed-off-by: Dongsu Park <dongsu@dpark.io>

changelog: Add changelog for openssh 10.4_p1-r1

155f217

Signed-off-by: Dongsu Park <dongsu@dpark.io>

app-admin/logrotate: Sync with Gentoo

14d9077

It's from Gentoo commit 26eea6f0bd95ba783f861e590012f0f0abb77117. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-admin/perl-cleaner: Sync with Gentoo

25583b2

It's from Gentoo commit 8861c37e3fe818881fc80a944bb0da1fe2817b42. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-arch/libarchive: Sync with Gentoo

e75c4f7

It's from Gentoo commit 849115cb6a00b3cd2c29a11990728f39cc009633. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/aardvark-dns: Sync with Gentoo

902ccfa

It's from Gentoo commit 2bc085bd16ce55b6b6d739181524efcba10e43ae. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/conmon: Sync with Gentoo

2582afa

It's from Gentoo commit a934a8ca9c04f1d5cb108d3b8868a83d8c72bd8a. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/containerd: Sync with Gentoo

7172eda

It's from Gentoo commit 7aa35664605c2c323f160612fd3b2f392d2d6cf8. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/incus: Sync with Gentoo

8454831

It's from Gentoo commit e54427313be85e660df7678ad4dcd38292c94c3a. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/lxc: Sync with Gentoo

0b3a30c

It's from Gentoo commit 5865bd45d8349212a216950c5fb090f7804e0d49. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/netavark: Sync with Gentoo

0c56362

It's from Gentoo commit 0833c9fed35b418972af787666741cf67a6818df. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/podman: Sync with Gentoo

ba15023

It's from Gentoo commit 97c0ae5651db0f9e21202e43afe67c55143bfcab. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/runc: Sync with Gentoo

17b6f35

It's from Gentoo commit a1f53fdc3dfad3e635a5315d608ead207f739df0. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-crypt/gpgme: Sync with Gentoo

3d3b2ac

It's from Gentoo commit 20b551b506a120a825dbdc8ec59f666dfbb1031f. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-crypt/p11-kit: Sync with Gentoo

9f78836

It's from Gentoo commit 77c41003631bbba0337b580c67ba456ba36e3d26. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-crypt/pinentry: Sync with Gentoo

c596954

It's from Gentoo commit 28d5d4f4063e979264df423f0ae7645b59b5b7bb. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-crypt/tpm2-tools: Sync with Gentoo

566ad5c

It's from Gentoo commit c95402428a66081d54db5c1b24ca746c1be7a089. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-crypt/tpm2-tss: Sync with Gentoo

77b05a8

It's from Gentoo commit 70f57f449120ad9e753012c227b7a69159da8289. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-editors/nano: Sync with Gentoo

58472bf

It's from Gentoo commit 9d10ab4b36aeb0799d33de9ab8fe31d8ffb79944. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-emulation/qemu: Sync with Gentoo

f8872ae

It's from Gentoo commit c00037fc49f3a4713c27ebaa00723d7d3631fcec. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-emulation/virt-firmware: Sync with Gentoo

9bfb252

It's from Gentoo commit 7148be37d12953a53176d5cbc96cf8763937c6a2. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-misc/jq: Sync with Gentoo

96301e7

It's from Gentoo commit 078af3a216810923a2b43fbf7b6f286dfb170592. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-misc/pax-utils: Sync with Gentoo

e08ecc6

It's from Gentoo commit 7b57b72b52b2f592873e207f40b374763545fd07. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-portage/gemato: Sync with Gentoo

5f75458

It's from Gentoo commit 4d9489be539c7fafccdeb703df18fc932a3f352b. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-portage/gentoolkit: Sync with Gentoo

e61d422

It's from Gentoo commit 7f6aedaf508a7ffd652a68cb0827dda7ad99da5b. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-shells/bash-completion: Sync with Gentoo

3123384

It's from Gentoo commit 6dffa449ff101bd2b1c349b3064039811ca34493. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-text/asciidoc: Sync with Gentoo

20f64ac

It's from Gentoo commit 8452019bf7d65b3cd18c6e24717e056a2bb41a52. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-text/scdoc: Sync with Gentoo

2c7ed97

It's from Gentoo commit 46b7608ff25ae1bf0d3a5b2259c89de29818f922. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

krnowak and others added 7 commits August 7, 2026 20:37

sys-libs/libsemanage: Sync with Gentoo

2b11b9e

It's from Gentoo commit 66a5f848251234112d42dbdc8fe6f94b926cadc0. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Add accept keywords for sys-apps/policycoreutils deps

eea38cc

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Add a patch for dev-libs/libxml2

2fe39fc

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Add a patch for sys-libs/pam

6e3a9bc

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Add patches for sys-auth/sssd

a737998

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Add a patch for app-arch/bzip2

c962926

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-08-03 branch from 683249d to 6f5965e Compare August 7, 2026 18:39

krnowak had a problem deploying to development August 7, 2026 18:39 — with GitHub Actions Error

krnowak added this to Flatcar tactical, release planning, and roadmap Aug 7, 2026

krnowak moved this to ⚒️ In Progress in Flatcar tactical, release planning, and roadmap Aug 7, 2026

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-08-03 branch from 6f5965e to c3c2756 Compare August 7, 2026 18:47

krnowak had a problem deploying to development August 7, 2026 18:47 — with GitHub Actions Error

krnowak added 15 commits August 7, 2026 20:48

overlay app-admin/etcd-wrapper: Bump to 3.6.11 to match dev-db/etcd

2e6dc01

And fix a tag - currently all the tags have arch as the suffix. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay user-patches: Add a patch for app-crypt/mit-krb5

25fdb86

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Add/update accept keywords for security issues

133a056

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay user-patches: Add a patch for sys-apps/diffutils

559bd84

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for app-arch/libarchive

6f97c67

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Add patches for sys-apps/coreutils

474a524

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Update some READMEs

53b5d60

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for net-libs/nghttp2

a67f685

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for net-libs/ngtcp2

680f24c

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for net-misc/curl

7298220

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Drop duplicated patches for selinux poli…

28d0834

…cies With the fixes in selinux-policy-2.eclass, we can go back to the single patch for all the selinux policy packages. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

sys-block/thin-provisioning-tool: Move LLVM_COMPAT change from ebuild…

54edb02

… to env overrides Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop settings for sys-fs/zfs-kmod

db14e24

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/config: Move overrides from sys-fs/zfs-kmod to sys-fs/zfs

617c049

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

changelog: Add entries

c81c02f

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-08-03 branch from c3c2756 to c81c02f Compare August 7, 2026 18:48

krnowak requested a deployment to development August 7, 2026 18:49 — with GitHub Actions Waiting

Navigation Menu

Uh oh!

Weekly portage-stable package updates 2026-08-03 - #4173

Weekly portage-stable package updates 2026-08-03#4173
github-actions[bot] wants to merge 195 commits into
mainfrom
buildbot/weekly-portage-stable-package-updates-2026-08-03

github-actions Bot commented Aug 3, 2026 •

edited by krnowak

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

github-actions Bot commented Aug 3, 2026 • edited by krnowak Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Aug 3, 2026 •

edited by krnowak

Loading