Weekly portage-stable package updates 2026-08-03 by github-actions[bot] · Pull Request #4173 · flatcar/scripts

github-actions · 2026-08-03T08:23:07Z

CI: https://jenkins.flatcar.org/job/container/job/sdk/133/cldsv/

Partially addresses flatcar/Flatcar#2142
Partially addresses flatcar/Flatcar#2169

--

app-admin/logrotate: [PROD] [DEV]
- from 3.22.0 to 3.22.0-r1
- package became unstable on 'arm64'
  - added accept keywords to overlay profiles
- added a patch fixing some selinux issue
app-arch/bzip2: [TODO]
- version TODO
- fixes CVE-2026-42250 through a backported patch
  - update: bzip2 Flatcar#2173
app-arch/gzip: [PROD] [DEV]
- from 1.14 to 1.14_p20260502
- fixes CVE-2026-41991
  - update: app-arch/gzip Flatcar#2224
- package became unknown on 'amd64' and 'arm64'
app-arch/libarchive: [PROD] [DEV]
- from 3.8.8 to 3.8.9
- package became stable on 'amd64' and 'arm64'
  - dropped accept keywords from overlay profiles
- release notes: https://github.com/libarchive/libarchive/releases/tag/v3.8.9
app-arch/tar: [PROD] [DEV]
- from 1.35 to 1.35-r1
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- fixes build with acl 2.4.0
app-containers/container-libs: [SYSEXT-PODMAN]
- from 0.68.0 to 0.69.0
- added IUSE flag 'extra'
  - adds extra dependencies for podman
- build dependencies:
  - changes for dev-go/go-md2man:
    - changed version constraint from >=2.0.2 to >=2.0.7
- runtime dependencies:
  - dropped a dependency '>=app-containers/aardvark-dns-2.0.0'
  - changes for app-containers/containers-shortnames:
    - changed to no block
  - changes for app-containers/crun:
    - USE conditionals changed to 'extra?'
  - changes for app-containers/netavark:
    - USE conditionals changed to 'extra?'
  - changes for net-misc/passt:
    - USE conditionals changed to 'extra?'
- release notes: https://github.com/podman-container-tools/container-libs/releases/tag/common%2Fv0.69.0
app-containers/containerd: [SYSEXT-CONTAINERD]
- from 2.2.5 to 2.3.3
- fixes CVE-2026-24051, CVE-2026-33186, CVE-2026-34986, CVE-2026-35469, CVE-2026-39883
  - update: containerd Flatcar#2182
- build dependencies:
  - added a dependency '>=dev-lang/go-1.26.3'
  - dropped a dependency 'sec-policy/selinux-docker' for USE 'selinux?'
- runtime dependencies:
  - changes for app-containers/runc:
    - changed version constraint from >=1.3.6 to >=1.4.3
  - added a dependency 'sec-policy/selinux-docker' for USE 'selinux?'
- release notes: https://github.com/containerd/containerd/releases/tag/v2.3.{3..0}
app-containers/cri-tools: [PROD] [DEV]
- from 1.33.0 to 1.36.0
- fixes CVE-2026-32285, CVE-2026-24051, CVE-2026-33186
  - update: cri-tools/crictl Flatcar#2169 (partially)
- package became unstable on 'amd64'
  - added accept keywords to overlay profiles
- build dependencies:
  - changes for dev-lang/go:
    - changed version constraint from >=1.24.1 to >=1.26.2
- release notes: https://github.com/kubernetes-sigs/cri-tools/releases/tag/v1.3{6..4}.0
app-containers/docker: [SYSEXT-DOCKER]
- from 29.1.3-r1 to 29.5.2
- fixes CVE-2026-24051, CVE-2026-33186, CVE-2026-33997, CVE-2026-34040, CVE-2026-39883, CVE-2026-41567, CVE-2026-42306, CVE-2026-33747, CVE-2026-33748
  - update: docker Flatcar#2142 (partially)
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- build dependencies:
  - added a dependency '>=dev-lang/go-1.25.5'
- runtime dependencies:
  - changes for app-containers/docker-cli weak blocker:
    - changed version constraint from <29.1.3 to <29.5.2
- release notes: https://github.com/moby/moby/releases/tag/docker-v29.5.{2..0} https://github.com/moby/moby/releases/tag/docker-v29.{4..2}.0
app-containers/docker-buildx: [SYSEXT-DOCKER]
- from 0.21.2 to 0.35.0
- fixes CVE-2025-0495
  - update: app-containers/docker-buildx Flatcar#1693
- EAPI changed from '8' to '9'
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- build dependencies:
  - added a dependency '>=dev-lang/go-1.25.9'
- licenses:
  - added license 'Unicode-DFS-2016'
- release notes: https://github.com/docker/buildx/releases/tag/v0.36.0
app-containers/docker-cli: [SYSEXT-DOCKER]
- from 29.1.3 to 29.5.2
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- build dependencies:
  - added a dependency '>=dev-lang/go-1.25.0'
- release notes: https://github.com/moby/moby/releases/tag/docker-v29.5.{2..0} https://github.com/moby/moby/releases/tag/docker-v29.{4..2}.0
app-containers/netavark: [SYSEXT-PODMAN]
- still at 2.0.0
- runtime dependencies:
  - added a dependency '>=app-containers/aardvark-dns-2.0.0'
  - added a weak blocker '!<app-containers/buildah-1.44.0'
  - added a weak blocker '!<app-containers/podman-6.0.0'
  - added a dependency 'net-firewall/nftables[json]'
app-containers/podman: [SYSEXT-PODMAN]
- still at 6.0.0
- added IUSE flag 'cron'
  - installs a cron daily file, disabled in Flatcar, used to be under a part of !systemd
- dependencies and runtime dependencies:
  - changes for app-containers/conmon:
    - changed version constraint from >=2.2.1 to >=2.1.10
  - changes for app-containers/container-libs:
    - added extra use enabled requirement (will pretend as disabled if missing)
app-crypt/mit-krb5: [PROD] [DEV]
- still at 1.22.2-r2
- fixes CVE-2026-40355, CVE-2026-40356 through backported patches
  - update: mit-krb5 Flatcar#2124
app-crypt/p11-kit: [PROD] [DEV]
- from 0.26.2 to 0.26.4
- fixes CVE-2026-13757
  - update: p11-kit Flatcar#2212
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords in overlay profiles
- release notes: https://github.com/p11-glue/p11-kit/releases/tag/0.26.{4,3}
app-crypt/tpm2-tools: [PROD] [DEV]
- from 5.7 to 5.8
- fixes GHSA-v7w4-4gc9-qcgv, GHSA-gwfg-w3jr-xh66, GHSA-qp88-8f4j-wv7q
  - update: tpm2-tools Flatcar#2210
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- release notes: https://github.com/tpm2-software/tpm2-tools/releases/tag/5.8
app-crypt/tpm2-tss: [PROD] [DEV]
- from 4.1.3-r2 to 4.2.0
- fixes GHSA-q759-vqg7-8rc5, GHSA-7638-f8gq-c475, GHSA-p3px-r4mm-jpw5, GHSA-x5j2-26fc-hhc3, GHSA-gf8g-2r5c-74c7, GHSA-mj78-pj5v-wvjx, GHSA-v2qp-xh5m-44mf, GHSA-2q5v-c7hv-fvpf, GHSA-pcpw-8625-jqcp, GHSA-6grq-c24j-xcjr
  - update: tpm2-tss Flatcar#2209
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- dependencies and runtime dependencies:
  - changes for net-libs/mbedtls with USE conditionals 'mbedtls?':
    - changed slot constraint from 0= to 3=
- release notes: https://github.com/tpm2-software/tpm2-tss/releases/tag/4.2.0
app-editors/nano:
- from 9.0 to 9.1
- release notes: https://lists.gnu.org/archive/html/info-gnu/2026-06/msg00008.html
app-emulation/qemu:
- from 10.2.2 to 10.2.3
- fixes CVE-2026-3886
  - update: app-emulation/qemu Flatcar#2225
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- added IUSE flag 'verify-sig'
- dependencies and runtime dependencies:
  - changes for app-emulation/spice-protocol with USE conditionals 'spice?':
    - changed version constraint from >=0.14.0 to >=0.14.5
- release notes: https://lists.gnu.org/archive/html/qemu-stable/2026-05/msg00654.html
app-misc/jq: [PROD] [DEV]
- from 1.8.1 to 1.8.2
- fixes CVE-2026-32316, CVE-2026-33947, CVE-2026-33948, CVE-2026-39956, CVE-2026-39979, CVE-2026-40164, CVE-2026-41256, CVE-2026-41257, CVE-2026-43894, CVE-2026-43895, CVE-2026-43896, CVE-2026-44777, CVE-2026-47770, CVE-2026-49839, CVE-2026-54679
  - update: jq Flatcar#2079
- release notes: https://github.com/jqlang/jq/releases/tag/jq-1.8.2
app-portage/gentoolkit: [DEV]
- from 0.7.2 to 0.7.6
- release notes: https://gitweb.gentoo.org/proj/gentoolkit.git/log/?h=gentoolkit-0.7.6
dev-build/cmake:
- from 4.3.3-r1 to 4.3.4
- release notes: https://cmake.org/cmake/help/v4.3/release/4.3.html#id4
dev-debug/strace: [PROD] [DEV]
- from 7.0-r1 to 7.1
- release notes: https://github.com/strace/strace/releases/tag/v7.1
dev-lang/go:
- from 1.26.3 to 1.26.5
- fixes CVE-2026-27145, CVE-2026-39822, CVE-2026-42504, CVE-2026-42505, CVE-2026-42507
  - update: go Flatcar#2197
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- release notes: https://go.dev/doc/devel/release#go1.26.{5,4}
dev-lang/nasm:
- from 3.01 to 3.02
- release notes: https://www.nasm.us/docs/3.02/nasmac.html
dev-libs/json-c: [PROD] [DEV]
- from 0.18 to 0.19-r2
- fixes CVE-2026-9146
  - update: json-c Flatcar#2211
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- removed IUSE flag 'doc'
- build dependencies:
  - dropped a dependency '>=dev-build/cmake-3.28.5'
  - dropped a dependency '>=app-text/doxygen-1.8.13' for USE 'doc?'
  - added a dependency '>=dev-build/meson-1.2.3'
  - added a dependency 'dev-build/meson-format-array'
- release notes: https://raw.githubusercontent.com/json-c/json-c/refs/heads/json-c-0.19/ChangeLog
dev-libs/jsoncpp:
- from 1.9.6-r2 to 1.9.8
- release notes: https://github.com/open-source-parsers/jsoncpp/releases/tag/1.9.{8,7}
dev-libs/libgpg-error: [PROD] [DEV]
- from 1.60 to 1.61
- release notes: https://dev.gnupg.org/T8239.html
dev-libs/libxml2: [PROD] [DEV]
- still at 2.15.3
- fixes CVE-2026-11979 through a backported patch
  - update: libxml2 Flatcar#2196
dev-libs/opensc:
- from 0.26.1 to 0.27.1
- fixes CVE-2025-13763, CVE-2025-49010, CVE-2025-66037, CVE-2025-66038, CVE-2025-66215
  - update: dev-libs/opensc Flatcar#2068
- release notes: https://github.com/OpenSC/OpenSC/releases/tag/0.27.1
dev-python/cryptography:
- from 48.0.0 to 49.0.0
- release notes: https://raw.githubusercontent.com/pyca/cryptography/e300bbe2f1bec75e5ee7e0ab7b196958831b3db6/CHANGELOG.rst
dev-python/cython:
- from 3.2.4 to 3.2.8
- release notes: https://github.com/cython/cython/releases/tag/3.2.{8..5}
dev-python/distlib: [SYSEXT-PYTHON]
- from 0.4.1 to 0.4.3
- release notes: https://raw.githubusercontent.com/pypa/distlib/refs/tags/0.4.3/CHANGES.rst
dev-python/msgpack: [SYSEXT-PYTHON]
- from 1.1.2 to 1.2.1
- release notes: https://github.com/msgpack/msgpack-python/releases/tag/v1.2.{1,0}
dev-python/setuptools-scm: [SYSEXT-PYTHON]
- from 10.0.5 to 10.1.2
- build dependencies:
  - changes for dev-python/vcs-versioning:
    - changed version constraint from >=1.0.0 to =2*
- runtime dependencies:
  - changes for dev-python/vcs-versioning:
    - changed version constraint from >=1.0.0 to =2*
- release notes: https://github.com/pypa/setuptools-scm/releases/tag/setuptools-scm-v10.1.{2..0}
dev-python/snakeoil:
- from 0.11.0 to 0.11.1
- release notes: https://github.com/pkgcore/snakeoil/releases/tag/v0.11.1
dev-python/typing-extensions: [SYSEXT-PYTHON]
- from 4.15.0 to 4.16.0
- release notes: https://raw.githubusercontent.com/python/typing_extensions/refs/tags/4.16.0/CHANGELOG.md
dev-python/vcs-versioning: [SYSEXT-PYTHON]
- from 1.1.1 to 2.2.2
- release notes: https://github.com/pypa/setuptools-scm/releases/tag/vcs-versioning-v2.2.{2..0} https://github.com/pypa/setuptools-scm/releases/tag/vcs-versioning-v2.{1,0}.0
dev-util/maturin:
- from 1.13.3 to 1.14.1
- release notes: https://github.com/PyO3/maturin/releases/tag/v1.14.1
dev-util/pkgcheck:
- from 0.10.39-r1 to 0.10.40-r1
- build dependencies and runtime dependencies:
  - dropped a dependency 'dev-python/chardet'
  - added a dependency 'dev-python/charset-normalizer'
  - changes for dev-python/snakeoil:
    - changed version constraint from >=0.11.0 to >=0.11.1
  - changes for sys-apps/pkgcore:
    - changed version constraint from >=0.12.31 to >=0.12.34
  - dropped a dependency '<sys-apps/pkgcore-0.12.35'
- release notes: https://github.com/pkgcore/pkgcheck/releases/tag/v0.10.40
dev-util/xdelta: [SYSEXT-INCUS]
- from 3.0.11-r1 to 3.2.0
- build dependencies:
  - added a dependency 'app-alternatives/ninja'
  - added a dependency '>=dev-build/cmake-3.28.5'
- dependencies and runtime dependencies:
  - added a dependency 'dev-libs/blake3:='
- release notes: https://github.com/jmacd/xdelta/releases/tag/v3.2.0
eclass/kernel-2.eclass:
- apply patches defined in ebuild too
eclass/selinux-policy-2.eclass:
- fixed application of user patches, now they are applied inside the refpolicy directory
  - we can drop our duplicated selinux policy patch
net-dns/bind: [PROD] [DEV]
- still at 9.20.23
- dropped the user patch, regenerating the build system is enough
- yell loudly about the rare modification of the portage-stable ebuild
net-dns/c-ares: [PROD] [DEV]
- from 1.34.6 to 1.34.8
- fixes CVE-2026-33630, GHSA-pjmc-gx33-gc76, GHSA-jv8r-gqr9-68wj
  - update: c-ares Flatcar#2199
- release notes: https://github.com/c-ares/c-ares/releases/tag/v1.34.{8,7}
net-fs/samba: [PROD] [DEV]
- from 4.23.6 to 4.24.4
- dependencies and runtime dependencies:
  - changes for sys-libs/talloc:
    - changed version constraint from >=2.4.3 to >=2.4.4
  - changes for sys-libs/tdb:
    - changed version constraint from >=1.4.14 to >=1.4.15
- release notes: https://www.samba.org/samba/history/samba-4.24.{4..0}.html
net-libs/nghttp2: [PROD] [DEV]
- from 1.68.1 to 1.69.0
- package became stable on 'amd64' and 'arm64'
  - dropped accept keywords from overlay profiles
- release notes: https://github.com/nghttp2/nghttp2/releases/tag/v1.69.0
net-libs/ngtcp2: [PROD] [DEV]
- from 1.22.1 to 1.24.0
- package became stable on 'amd64' and 'arm64'
  - dropped accept keywords from overlay profiles
- release notes: https://github.com/ngtcp2/ngtcp2/releases/tag/v1.2{4,3}.0
net-misc/curl: [PROD] [DEV]
- from 8.21.0 to 8.21.0-r1
- package became stable on 'amd64' and 'arm64'
  - dropped accept keywords from overlay profiles
net-misc/socat: [PROD] [DEV]
- from 1.8.1.1 to 1.8.1.3
- fixes CVE-2026-56123
  - update: net-misc/socat Flatcar#2190
- release notes: https://repo.or.cz/socat.git/blob/refs/tags/tag-1.8.1.3:/CHANGES
net-misc/wget: [PROD] [DEV]
- still at 1.25.0-r2
- fixes CVE-2026-15146, CVE-2026-58469, CVE-2026-58470, CVE-2026-58471, CVE-2026-58472 through backported patches
  - update: net-misc/wget Flatcar#2222
sec-policy/selinux-base-policy: [PROD] [DEV]
- from 2.20260312_p1 to 2.20260312_p1-r1
- added some patches for authlogin and su modules
sys-apps/acl: [PROD] [DEV]
- from 2.3.2-r3 to 2.4.0-r2
- fixes CVE-2026-54369, CVE-2026-54370
  - update: sys-apps/acl Flatcar#2189
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- added IUSE flag 'verify-sig'
- dependencies:
  - changes for sys-apps/attr:
    - dropped version constraint
- runtime dependencies:
  - dropped a dependency '>=sys-apps/attr-2.4.47-r1'
- release notes: https://cgit.git.savannah.nongnu.org/cgit/acl.git/plain/doc/CHANGES?h=v2.4.0
sys-apps/attr: [PROD] [DEV]
- from 2.5.2-r1 to 2.6.0
- fixes CVE-2026-54371
  - update: sys-apps/attr Flatcar#2191
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- added IUSE flag 'verify-sig'
- release notes: https://cgit.git.savannah.nongnu.org/cgit/attr.git/plain/doc/CHANGES?h=v2.6.0
sys-apps/diffutils: [PROD] [DEV]
- still at 3.12
- fixes CVE-2026-53910 through a backported patch
  - update: sys-apps/diffutils Flatcar#2258
- added a workaround for cross-compilation issue
  - help2man invokes the built binary
  - since this is for generating man pages that are later discarded, I patched the Makefile to skip this entirely
sys-apps/coreutils: [PROD] [DEV]
- still at 9.11-r1
- fixes CVE-2026-56391, CVE-2026-56392 through backported patches
  - update: sys-apps/coreutils Flatcar#2242
sys-apps/file: [DEV]
- from 5.47-r3 to 5.48
- release notes: https://raw.githubusercontent.com/file/file/refs/tags/FILE5_48/ChangeLog
sys-apps/less: [PROD] [DEV]
- from 692 to 704
- fixes less-20260606
  - update: less Flatcar#2175
- release notes: https://greenwoodsoftware.com/less/news.70{4,2}.html
sys-apps/pkgcore:
- from 0.12.32 to 0.12.35
- build dependencies and runtime dependencies:
  - changes for dev-python/snakeoil:
    - changed version constraint from >=0.11.0 to >=0.11.1
- release notes: https://github.com/pkgcore/pkgcore/releases/tag/v0.12.35
sys-apps/policycoreutils: [PROD] [DEV]
- from 3.8.1 to 3.11
- fixes CVE-2026-59676, CVE-2026-59677
  - update: sys-apps/policycoreutils Flatcar#2220
- dependencies and runtime dependencies:
  - changes for sys-libs/libsepol:
    - changed version constraint from >=3.8.1 to >=3.11
  - changes for sys-libs/libselinux:
    - changed version constraint from >=3.8.1 to >=3.11
  - changes for sys-libs/libsemanage:
    - changed version constraint from >=3.8.1 to >=3.11
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.{11..9}
sys-apps/portage: [DEV]
- from 3.0.81.1 to 3.0.81.2
- release notes: https://gitweb.gentoo.org/proj/portage.git/plain/NEWS?h=portage-3.0.81.2
sys-apps/sandbox: [DEV]
- from 2.46 to 2.49
- release notes: https://gitweb.gentoo.org/proj/sandbox.git/log/?h=v2.49
sys-apps/sed: [PROD] [DEV]
- from 4.10 to 4.10-r1
- fixed automagic dep on sys-apps/attr
- added IUSE flag 'xattr'
  - enable support for extended attributes
- dependencies:
  - added a dependency 'sys-apps/attr[static-libs(+)]' for USE 'static?' -> 'xattr?'
  - added a dependency 'sys-apps/attr' for USE '!static?' -> 'xattr?'
- runtime dependencies:
  - added a dependency 'sys-apps/attr' for USE '!static?' -> 'xattr?'
sys-apps/semodule-utils: [PROD] [DEV]
- from 3.10 to 3.11
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- dependencies and runtime dependencies:
  - changes for sys-libs/libsepol:
    - changed version constraint from >=3.10 to >=3.11
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.11
sys-apps/util-linux: [PROD] [DEV]
- from 2.41.4-r1 to 2.42.2
- fixes CVE-2026-13595, CVE-2026-53612, CVE-2026-53613, CVE-2026-53614
  - update: util-linux Flatcar#2179
- release notes: https://github.com/util-linux/util-linux/blob/v2.42.2/Documentation/releases/v2.42.2-ReleaseNotes https://github.com/util-linux/util-linux/blob/v2.42.1/Documentation/releases/v2.42.1-ReleaseNotes https://github.com/util-linux/util-linux/blob/v2.42/Documentation/releases/v2.42-ReleaseNotes
sys-auth/sssd: [PROD] [DEV]
- from 2.13.0 to 2.13.1
- fixes CVE-2026-12610, CVE-2026-14474, CVE-2026-14476 through backported patches
  - update: sssd Flatcar#2192
- release notes: https://sssd.io/release-notes/sssd-2.13.1.html
sys-block/thin-provisioning-tools: [PROD] [DEV]
- still at 1.3.1
- moved the ebuild modification to env overrides
sys-fs/cryptsetup: [PROD] [DEV]
- from 2.8.6-r1 to 2.8.6-r2
- apply some patch bundle from Gentoo
  - these mostly relate to handling of null bytes by jq in testsuite, nothing interesting for us
sys-fs/lvm2: [PROD] [DEV]
- still at 2.03.39
- relaxed permissions of installed tmpfiles config file from 0444 to 0644
  - didn't break anything, just noticed it when dealing with a similar case in sys-process/audit
sys-fs/zfs: [SYSEXT-ZFS]
- from 2.3.6 to 2.4.3
- this version of the package replaces sys-fs/zfs-kmod
  - dropped any stuff related to zfs-kmod from overlay profiles, adapted zfs stuff
- release notes: https://github.com/openzfs/zfs/releases/tag/zfs-2.4.{3..0}
sys-libs/libnvme: [PROD] [DEV]
- from 1.16.1 to 1.16.2
- release notes: https://github.com/linux-nvme/libnvme/releases/tag/v1.16.2
sys-libs/libseccomp: [PROD] [DEV]
- from 2.6.0-r3 to 2.6.1
- fixes GHSA-2hqh-5c36-grrm, GHSA-46fr-jh49-xvhx, GHSA-4q85-33p6-j5g6
  - update: sys-libs/libseccomp Flatcar#2207
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- release notes: https://github.com/seccomp/libseccomp/releases/tag/v2.6.1
sys-libs/libselinux: [PROD] [DEV]
- from 3.10-r2 to 3.11
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- dependencies and runtime dependencies:
  - changes for sys-libs/libsepol:
    - changed version constraint from >=3.10 to >=3.11
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.11
sys-libs/libsemanage: [PROD] [DEV]
- from 3.8.1 to 3.11
- dependencies and runtime dependencies:
  - changes for sys-libs/libselinux:
    - changed version constraint from >=3.8.1 to >=3.11
  - changes for sys-libs/libsepol:
    - changed version constraint from >=3.8.1 to >=3.11
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.{11..9}
sys-libs/libsepol: [PROD] [DEV]
- from 3.10 to 3.11
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.11
sys-libs/pam: [PROD] [DEV]
- still at 1.7.2
- fixes CVE-2026-54411 through a backported patch
  - update: pam Flatcar#2195
sys-process/audit: [PROD] [DEV]
- still at 4.1.4-r4
- relaxed permissions of installed tmpfiles config file from 0640 to 0644
  - this broke our tmpfiles post-processing step
sys-process/time:
- from 1.9-r1 to 1.10
- release notes: https://lists.gnu.org/archive/html/info-gnu/2026-04/msg00005.html

--

changelog
image diff

krnowak · 2026-08-19T16:57:24Z

CI finally passed.

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

It's from Gentoo commit 26eea6f0bd95ba783f861e590012f0f0abb77117. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 8861c37e3fe818881fc80a944bb0da1fe2817b42. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

…cies With the fixes in selinux-policy-2.eclass, we can go back to the single patch for all the selinux policy packages. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

… to env overrides Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

But this time yell quite loud about it, so it will be visible in the occurences file. And I will remember to reinstate it next time instead of spending more time to investigate it. But at least the investigation resulted in dropping the patch - it is enough to just regenerate the build system. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

This is a workaround for a cross-compilation issue. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

…s/lvm2 Did not break anything, because the post-processing of tmpfiles does not modify this one. Noticed when dealing with audit's config file. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

…es 3.11 The issue we are working around is SELinuxProject/selinux#540. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

krnowak · 2026-08-19T17:15:23Z

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

chewi · 2026-08-19T17:27:17Z

app-arch/gzip: [PROD] [DEV]

from 1.14 to 1.14_p20260502
fixes GHSA-67v8-88jf-4x6q
flatcar/Flatcar#2224
package became unknown on 'amd64' and 'arm64'

That seems broken. 1.14_p20260502 is unkeyworded, so we haven't taken that version.

chewi · 2026-08-19T17:29:09Z

Oh okay, I see you've overridden that. I wonder why Gentoo didn't keyword it.

krnowak · 2026-08-19T18:11:10Z

Oh okay, I see you've overridden that. I wonder why Gentoo didn't keyword it.

Yeah, I sometimes override stuff for security fixes. Dunno about missing keywords, though.

dongsupark

Huge thanks, see below:

dongsupark · 2026-08-20T08:43:20Z

+- base, dev: libsemanage ([3.11](https://github.com/SELinuxProject/selinux/releases/tag/3.11) (includes [3.10](https://github.com/SELinuxProject/selinux/releases/tag/3.10), [3.9](https://github.com/SELinuxProject/selinux/releases/tag/3.9)))
+- base, dev: libsepol ([3.11](https://github.com/SELinuxProject/selinux/releases/tag/3.11))
+- base, dev: nghttp2 ([1.69.0](https://github.com/nghttp2/nghttp2/releases/tag/v1.69.0))
+- base, dev: ngtcp2 ([1.24.0](https://github.com/ngtcp2/ngtcp2/releases/tag/v1.2{4,3}.0) (includes [1.23.0](https://github.com/ngtcp2/ngtcp2/releases/tag/v1.23.0)))


Broken link. Should be:

- base, dev: ngtcp2 ([1.24.0](https://github.com/ngtcp2/ngtcp2/releases/tag/v1.24.0) (includes [1.23.0](https://github.com/ngtcp2/ngtcp2/releases/tag/v1.23.0)))

dongsupark · 2026-08-20T08:49:19Z

+- dev: sandbox ([2.49](https://gitweb.gentoo.org/proj/sandbox.git/log/?h=v2.49))
+- sysext-containerd: containerd ([2.3.3](https://github.com/containerd/containerd/releases/tag/v2.3.3) (includes [2.3.2](https://github.com/containerd/containerd/releases/tag/v2.3.2), [2.3.1](https://github.com/containerd/containerd/releases/tag/v2.3.1), [2.3.0](https://github.com/containerd/containerd/releases/tag/v2.3.0)))
+- sysext-docker: docker ([29.5.2](https://github.com/moby/moby/releases/tag/docker-v29.5.2) (includes [29.5.1](https://github.com/moby/moby/releases/tag/docker-v29.5.1), [29.5.0](https://github.com/moby/moby/releases/tag/docker-v29.5.0), [29.4.0](https://github.com/moby/moby/releases/tag/docker-v29.4.0), [29.3.0](https://github.com/moby/moby/releases/tag/docker-v29.3.0), [29.2.0](https://github.com/moby/moby/releases/tag/docker-v29.2.0)))
+- sysext-docker: docker-buildx ([0.35.0](https://github.com/docker/buildx/releases/tag/v0.36.0))


Typo, should be:

- sysext-docker: docker-buildx ([0.35.0](https://github.com/docker/buildx/releases/tag/v0.35.0))

dongsupark · 2026-08-20T09:09:55Z

+## THIS IS A RARE FLATCAR MODIFICATION IN PORTAGE-STABLE EBUILD.
+## REINSTATE IT AFTER WEEKLY UPDATES AUTOMATION CLOBBERS IT AGAIN.  WE
+## NEED TO KEEP IT UNTIL WE UPDATE TO BIND 9.21 (USES MESON) OR GENTOO
+## UPDATES THE EBUILD TO DO THE SAME THING.


If I understand the comment correctly, we need to repeat remembering adding Flatcar-specific inherit autotools on every upcoming weekly updates, until Gentoo at some point is able to have bind 9.21, right? Isn't it too error-prone?
Because AFAIK Gentoo still has bind 9.20.26 as stable, not 9.21.

Why don't we simply move bind to coreos-overlay, until bind 9.21 could be available?
Or is there some discussion upstream going on that I am not aware of?

github-actions Bot added the main label Aug 3, 2026

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-08-03 branch from 683249d to 6f5965e Compare August 7, 2026 18:39

krnowak had a problem deploying to development August 7, 2026 18:39 — with GitHub Actions Error

krnowak added this to Flatcar tactical, release planning, and roadmap Aug 7, 2026

krnowak moved this to ⚒️ In Progress in Flatcar tactical, release planning, and roadmap Aug 7, 2026

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-08-03 branch from 6f5965e to c3c2756 Compare August 7, 2026 18:47

krnowak had a problem deploying to development August 7, 2026 18:47 — with GitHub Actions Error

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-08-03 branch from c3c2756 to c81c02f Compare August 7, 2026 18:48

krnowak had a problem deploying to development August 7, 2026 18:49 — with GitHub Actions Error

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-08-03 branch from c81c02f to d2a5e3c Compare August 10, 2026 14:41

krnowak had a problem deploying to development August 10, 2026 14:41 — with GitHub Actions Error

This was referenced Aug 10, 2026

Weekly portage-stable package updates 2026-08-10 #4204

Closed

Weekly portage-stable package updates 2026-07-27 #4157

Closed

Weekly portage-stable package updates 2026-07-20 #4148

Closed

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-08-03 branch from d2a5e3c to 2f8968f Compare August 11, 2026 10:02

krnowak had a problem deploying to development August 11, 2026 10:02 — with GitHub Actions Error

krnowak had a problem deploying to development August 12, 2026 11:19 — with GitHub Actions Error

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-08-03 branch from 85c5ba0 to 084df81 Compare August 14, 2026 11:09

krnowak had a problem deploying to development August 14, 2026 11:09 — with GitHub Actions Error

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-08-03 branch from 084df81 to ef55a48 Compare August 14, 2026 15:09

krnowak had a problem deploying to development August 14, 2026 15:09 — with GitHub Actions Error

krnowak mentioned this pull request Aug 18, 2026

Weekly portage-stable package updates 2026-08-17 #4220

Closed

2 tasks

krnowak marked this pull request as ready for review August 19, 2026 16:57

krnowak requested a review from a team as a code owner August 19, 2026 16:57

Copilot AI lite review requested due to automatic review settings August 19, 2026 16:57

Copilot AI reviewed Aug 19, 2026

krnowak moved this from ⚒️ In Progress to ✅ Testing / in Review in Flatcar tactical, release planning, and roadmap Aug 19, 2026

Flatcar Buildbot added 2 commits August 19, 2026 18:57

app-admin/logrotate: Sync with Gentoo

d3a42cd

It's from Gentoo commit 26eea6f0bd95ba783f861e590012f0f0abb77117. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-admin/perl-cleaner: Sync with Gentoo

88be634

It's from Gentoo commit 8861c37e3fe818881fc80a944bb0da1fe2817b42. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

krnowak added 23 commits August 19, 2026 18:57

overlay coreos/user-patches: Add a patch for sys-libs/pam

4a5b05c

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Add patches for sys-auth/sssd

0b6ae17

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Add a patch for app-arch/bzip2

34fddcc

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay user-patches: Add a patch for app-crypt/mit-krb5

c6ca705

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Add/update accept keywords for security issues

c082d9e

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay user-patches: Add a patch for sys-apps/diffutils

9969057

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for app-arch/libarchive

cc9465a

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Add patches for sys-apps/coreutils

8702e28

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Update some READMEs

6cb4f44

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for net-libs/nghttp2

156fb73

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for net-libs/ngtcp2

b09e5aa

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for net-misc/curl

5961ad1

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Drop duplicated patches for selinux poli…

fbcc6b4

…cies With the fixes in selinux-policy-2.eclass, we can go back to the single patch for all the selinux policy packages. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

sys-block/thin-provisioning-tool: Move LLVM_COMPAT change from ebuild…

d6b3322

… to env overrides Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop settings for sys-fs/zfs-kmod

d32b929

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/config: Move overrides from sys-fs/zfs-kmod to sys-fs/zfs

d7e1655

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/config: Minor cleanups in net-dns/bind modifications

4c618e7

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Drop unnecessary patch

3c8e2f7

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/config: Do not build tests and docs in sys-apps/diffutils

26afca7

This is a workaround for a cross-compilation issue. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/config: Relax perms to tmpfiles config file from sys-f…

48163de

…s/lvm2 Did not break anything, because the post-processing of tmpfiles does not modify this one. Noticed when dealing with audit's config file. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

build_library/build_image_util: Workaround for a regression in setfil…

3fc5424

…es 3.11 The issue we are working around is SELinuxProject/selinux#540. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

changelog: Add entries

8cceb92

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-08-03 branch from ef55a48 to 8cceb92 Compare August 19, 2026 16:58

krnowak requested a deployment to development August 19, 2026 16:58 — with GitHub Actions Waiting

dongsupark reviewed Aug 20, 2026

View reviewed changes

Navigation Menu

Uh oh!

Weekly portage-stable package updates 2026-08-03 - #4173

Weekly portage-stable package updates 2026-08-03#4173
github-actions[bot] wants to merge 197 commits into
mainfrom
buildbot/weekly-portage-stable-package-updates-2026-08-03

github-actions Bot commented Aug 3, 2026 •

edited by krnowak

Loading

Uh oh!

krnowak commented Aug 19, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

krnowak commented Aug 19, 2026

Uh oh!

chewi commented Aug 19, 2026

Uh oh!

chewi commented Aug 19, 2026

Uh oh!

krnowak commented Aug 19, 2026

Uh oh!

dongsupark left a comment

Uh oh!

dongsupark Aug 20, 2026

Uh oh!

dongsupark Aug 20, 2026

Uh oh!

dongsupark Aug 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

github-actions Bot commented Aug 3, 2026 • edited by krnowak Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

krnowak commented Aug 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

krnowak commented Aug 19, 2026

Uh oh!

chewi commented Aug 19, 2026

Uh oh!

chewi commented Aug 19, 2026

Uh oh!

krnowak commented Aug 19, 2026

Uh oh!

dongsupark left a comment

Choose a reason for hiding this comment

Uh oh!

dongsupark Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

dongsupark Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

dongsupark Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions Bot commented Aug 3, 2026 •

edited by krnowak

Loading