Weekly portage-stable package updates 2026-08-03 by github-actions[bot] · Pull Request #4173 · flatcar/scripts

github-actions · 2026-08-03T08:23:07Z

CI: https://jenkins.flatcar.org/job/container/job/sdk/133/cldsv/

Partially addresses flatcar/Flatcar#2169
Partially addresses flatcar/Flatcar#2142

--

app-admin/etcd-wrapper: [PROD] [DEV]
- from 3.5.16 to 3.6.11
- bumped to match dev-db/etcd
- release notes: https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.6.md#v3611-2026-05-01
app-admin/logrotate: [PROD] [DEV]
- from 3.22.0 to 3.22.0-r1
- package became unstable on 'arm64'
  - added accept keywords to overlay profiles
- added a patch fixing some selinux issue
app-arch/bzip2: [TODO]
- version TODO
- fixes CVE-2026-42250 through a backported patch
  - update: bzip2 Flatcar#2173
app-arch/gzip: [PROD] [DEV]
- from 1.14 to 1.14_p20260502
- fixes CVE-2026-41991
  - update: app-arch/gzip Flatcar#2224
- package became unknown on 'amd64' and 'arm64'
app-arch/libarchive: [PROD] [DEV]
- from 3.8.8 to 3.8.9
- package became stable on 'amd64' and 'arm64'
  - dropped accept keywords from overlay profiles
- release notes: https://github.com/libarchive/libarchive/releases/tag/v3.8.9
app-arch/tar: [PROD] [DEV]
- from 1.35 to 1.35-r1
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- fixes build with acl 2.4.0
app-containers/container-libs: [SYSEXT-PODMAN]
- from 0.68.0 to 0.69.0
- added IUSE flag 'extra'
  - adds extra dependencies for podman
- build dependencies:
  - changes for dev-go/go-md2man:
    - changed version constraint from >=2.0.2 to >=2.0.7
- runtime dependencies:
  - dropped a dependency '>=app-containers/aardvark-dns-2.0.0'
  - changes for app-containers/containers-shortnames:
    - changed to no block
  - changes for app-containers/crun:
    - USE conditionals changed to 'extra?'
  - changes for app-containers/netavark:
    - USE conditionals changed to 'extra?'
  - changes for net-misc/passt:
    - USE conditionals changed to 'extra?'
- release notes: https://github.com/podman-container-tools/container-libs/releases/tag/common%2Fv0.69.0
app-containers/containerd: [SYSEXT-CONTAINERD]
- from 2.2.5 to 2.3.3
- fixes CVE-2026-24051, CVE-2026-33186, CVE-2026-34986, CVE-2026-35469, CVE-2026-39883
  - update: containerd Flatcar#2182
- build dependencies:
  - added a dependency '>=dev-lang/go-1.26.3'
  - dropped a dependency 'sec-policy/selinux-docker' for USE 'selinux?'
- runtime dependencies:
  - changes for app-containers/runc:
    - changed version constraint from >=1.3.6 to >=1.4.3
  - added a dependency 'sec-policy/selinux-docker' for USE 'selinux?'
- release notes: https://github.com/containerd/containerd/releases/tag/v2.3.{3..0}
app-containers/cri-tools: [PROD] [DEV]
- from 1.33.0 to 1.36.0
- fixes CVE-2026-32285, CVE-2026-24051, CVE-2026-33186
  - update: cri-tools/crictl Flatcar#2169 (partially)
- package became unstable on 'amd64'
  - added accept keywords to overlay profiles
- build dependencies:
  - changes for dev-lang/go:
    - changed version constraint from >=1.24.1 to >=1.26.2
- release notes: https://github.com/kubernetes-sigs/cri-tools/releases/tag/v1.3{6..4}.0
app-containers/docker: [SYSEXT-DOCKER]
- from 29.1.3-r1 to 29.5.2
- fixes CVE-2026-24051, CVE-2026-33186, CVE-2026-33997, CVE-2026-34040, CVE-2026-39883, CVE-2026-41567, CVE-2026-42306, CVE-2026-33747, CVE-2026-33748
  - update: docker Flatcar#2142 (partially)
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- build dependencies:
  - added a dependency '>=dev-lang/go-1.25.5'
- runtime dependencies:
  - changes for app-containers/docker-cli weak blocker:
    - changed version constraint from <29.1.3 to <29.5.2
- release notes: https://github.com/moby/moby/releases/tag/docker-v29.5.{2..0} https://github.com/moby/moby/releases/tag/docker-v29.{4..2}.0
app-containers/docker-buildx: [SYSEXT-DOCKER]
- from 0.21.2 to 0.35.0
- fixes CVE-2025-0495
  - update: app-containers/docker-buildx Flatcar#1693
- EAPI changed from '8' to '9'
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- build dependencies:
  - added a dependency '>=dev-lang/go-1.25.9'
- licenses:
  - added license 'Unicode-DFS-2016'
- release notes: https://github.com/docker/buildx/releases/tag/v0.36.0
app-containers/docker-cli: [SYSEXT-DOCKER]
- from 29.1.3 to 29.5.2
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- build dependencies:
  - added a dependency '>=dev-lang/go-1.25.0'
- release notes: https://github.com/moby/moby/releases/tag/docker-v29.5.{2..0} https://github.com/moby/moby/releases/tag/docker-v29.{4..2}.0
app-containers/netavark: [SYSEXT-PODMAN]
- still at 2.0.0
- runtime dependencies:
  - added a dependency '>=app-containers/aardvark-dns-2.0.0'
  - added a weak blocker '!<app-containers/buildah-1.44.0'
  - added a weak blocker '!<app-containers/podman-6.0.0'
  - added a dependency 'net-firewall/nftables[json]'
app-containers/podman: [SYSEXT-PODMAN]
- still at 6.0.0
- added IUSE flag 'cron'
  - installs a cron daily file, disabled in Flatcar, used to be under a part of !systemd
- dependencies and runtime dependencies:
  - changes for app-containers/conmon:
    - changed version constraint from >=2.2.1 to >=2.1.10
  - changes for app-containers/container-libs:
    - added extra use enabled requirement (will pretend as disabled if missing)
app-crypt/mit-krb5: [PROD] [DEV]
- still at 1.22.2-r2
- fixes CVE-2026-40355, CVE-2026-40356 through backported patches
  - update: mit-krb5 Flatcar#2124
app-crypt/p11-kit: [PROD] [DEV]
- from 0.26.2 to 0.26.4
- fixes CVE-2026-13757
  - update: p11-kit Flatcar#2212
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords in overlay profiles
- release notes: https://github.com/p11-glue/p11-kit/releases/tag/0.26.{4,3}
app-crypt/tpm2-tools: [PROD] [DEV]
- from 5.7 to 5.8
- fixes GHSA-v7w4-4gc9-qcgv, GHSA-gwfg-w3jr-xh66, GHSA-qp88-8f4j-wv7q
  - update: tpm2-tools Flatcar#2210
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- release notes: https://github.com/tpm2-software/tpm2-tools/releases/tag/5.8
app-crypt/tpm2-tss: [PROD] [DEV]
- from 4.1.3-r2 to 4.2.0
- fixes GHSA-q759-vqg7-8rc5, GHSA-7638-f8gq-c475, GHSA-p3px-r4mm-jpw5, GHSA-x5j2-26fc-hhc3, GHSA-gf8g-2r5c-74c7, GHSA-mj78-pj5v-wvjx, GHSA-v2qp-xh5m-44mf, GHSA-2q5v-c7hv-fvpf, GHSA-pcpw-8625-jqcp, GHSA-6grq-c24j-xcjr
  - update: tpm2-tss Flatcar#2209
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- dependencies and runtime dependencies:
  - changes for net-libs/mbedtls with USE conditionals 'mbedtls?':
    - changed slot constraint from 0= to 3=
- release notes: https://github.com/tpm2-software/tpm2-tss/releases/tag/4.2.0
app-editors/nano:
- from 9.0 to 9.1
- release notes: https://lists.gnu.org/archive/html/info-gnu/2026-06/msg00008.html
app-emulation/qemu:
- from 10.2.2 to 10.2.3
- fixes CVE-2026-3886
  - update: app-emulation/qemu Flatcar#2225
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- added IUSE flag 'verify-sig'
- dependencies and runtime dependencies:
  - changes for app-emulation/spice-protocol with USE conditionals 'spice?':
    - changed version constraint from >=0.14.0 to >=0.14.5
- release notes: https://lists.gnu.org/archive/html/qemu-stable/2026-05/msg00654.html
app-misc/jq: [PROD] [DEV]
- from 1.8.1 to 1.8.2
- fixes CVE-2026-32316, CVE-2026-33947, CVE-2026-33948, CVE-2026-39956, CVE-2026-39979, CVE-2026-40164, CVE-2026-41256, CVE-2026-41257, CVE-2026-43894, CVE-2026-43895, CVE-2026-43896, CVE-2026-44777, CVE-2026-47770, CVE-2026-49839, CVE-2026-54679
  - update: jq Flatcar#2079
- release notes: https://github.com/jqlang/jq/releases/tag/jq-1.8.2
app-portage/gentoolkit: [DEV]
- from 0.7.2 to 0.7.6
- release notes: https://gitweb.gentoo.org/proj/gentoolkit.git/log/?h=gentoolkit-0.7.6
dev-build/cmake:
- from 4.3.3-r1 to 4.3.4
- release notes: https://cmake.org/cmake/help/v4.3/release/4.3.html#id4
dev-db/etcd: [PROD] [DEV]
- from 3.5.18 to 3.6.11
- fixes CVE-2025-22869, CVE-2025-30204, CVE-2026-33186
  - update: etcdctl Flatcar#2127
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- build dependencies:
  - added a dependency '>=dev-lang/go-1.25.9'
- release notes: https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.6.md#v3611-2026-05-01
dev-debug/strace: [PROD] [DEV]
- from 7.0-r1 to 7.1
- release notes: https://github.com/strace/strace/releases/tag/v7.1
dev-lang/go:
- from 1.26.3 to 1.26.5
- fixes CVE-2026-27145, CVE-2026-39822, CVE-2026-42504, CVE-2026-42505, CVE-2026-42507
  - update: go Flatcar#2197
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- release notes: https://go.dev/doc/devel/release#go1.26.{5,4}
dev-lang/nasm:
- from 3.01 to 3.02
- release notes: https://www.nasm.us/docs/3.02/nasmac.html
dev-libs/json-c: [PROD] [DEV]
- from 0.18 to 0.19-r2
- fixes CVE-2026-9146
  - update: json-c Flatcar#2211
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- removed IUSE flag 'doc'
- build dependencies:
  - dropped a dependency '>=dev-build/cmake-3.28.5'
  - dropped a dependency '>=app-text/doxygen-1.8.13' for USE 'doc?'
  - added a dependency '>=dev-build/meson-1.2.3'
  - added a dependency 'dev-build/meson-format-array'
- release notes: https://raw.githubusercontent.com/json-c/json-c/refs/heads/json-c-0.19/ChangeLog
dev-libs/jsoncpp:
- from 1.9.6-r2 to 1.9.8
- release notes: https://github.com/open-source-parsers/jsoncpp/releases/tag/1.9.{8,7}
dev-libs/libgpg-error: [PROD] [DEV]
- from 1.60 to 1.61
- release notes: https://dev.gnupg.org/T8239.html
dev-libs/libxml2: [PROD] [DEV]
- still at 2.15.3
- fixes CVE-2026-11979 through a backported patch
  - update: libxml2 Flatcar#2196
dev-libs/opensc:
- from 0.26.1 to 0.27.1
- fixes CVE-2025-13763, CVE-2025-49010, CVE-2025-66037, CVE-2025-66038, CVE-2025-66215
  - update: dev-libs/opensc Flatcar#2068
- release notes: https://github.com/OpenSC/OpenSC/releases/tag/0.27.1
dev-python/cryptography:
- from 48.0.0 to 49.0.0
- release notes: https://raw.githubusercontent.com/pyca/cryptography/e300bbe2f1bec75e5ee7e0ab7b196958831b3db6/CHANGELOG.rst
dev-python/cython:
- from 3.2.4 to 3.2.8
- release notes: https://github.com/cython/cython/releases/tag/3.2.{8..5}
dev-python/distlib: [SYSEXT-PYTHON]
- from 0.4.1 to 0.4.3
- release notes: https://raw.githubusercontent.com/pypa/distlib/refs/tags/0.4.3/CHANGES.rst
dev-python/msgpack: [SYSEXT-PYTHON]
- from 1.1.2 to 1.2.1
- release notes: https://github.com/msgpack/msgpack-python/releases/tag/v1.2.{1,0}
dev-python/setuptools-scm: [SYSEXT-PYTHON]
- from 10.0.5 to 10.1.2
- build dependencies:
  - changes for dev-python/vcs-versioning:
    - changed version constraint from >=1.0.0 to =2*
- runtime dependencies:
  - changes for dev-python/vcs-versioning:
    - changed version constraint from >=1.0.0 to =2*
- release notes: https://github.com/pypa/setuptools-scm/releases/tag/setuptools-scm-v10.1.{2..0}
dev-python/snakeoil:
- from 0.11.0 to 0.11.1
- release notes: https://github.com/pkgcore/snakeoil/releases/tag/v0.11.1
dev-python/typing-extensions: [SYSEXT-PYTHON]
- from 4.15.0 to 4.16.0
- release notes: https://raw.githubusercontent.com/python/typing_extensions/refs/tags/4.16.0/CHANGELOG.md
dev-python/vcs-versioning: [SYSEXT-PYTHON]
- from 1.1.1 to 2.2.2
- release notes: https://github.com/pypa/setuptools-scm/releases/tag/vcs-versioning-v2.2.{2..0} https://github.com/pypa/setuptools-scm/releases/tag/vcs-versioning-v2.{1,0}.0
dev-util/maturin:
- from 1.13.3 to 1.14.1
- release notes: https://github.com/PyO3/maturin/releases/tag/v1.14.1
dev-util/pkgcheck:
- from 0.10.39-r1 to 0.10.40-r1
- build dependencies and runtime dependencies:
  - dropped a dependency 'dev-python/chardet'
  - added a dependency 'dev-python/charset-normalizer'
  - changes for dev-python/snakeoil:
    - changed version constraint from >=0.11.0 to >=0.11.1
  - changes for sys-apps/pkgcore:
    - changed version constraint from >=0.12.31 to >=0.12.34
  - dropped a dependency '<sys-apps/pkgcore-0.12.35'
- release notes: https://github.com/pkgcore/pkgcheck/releases/tag/v0.10.40
dev-util/xdelta: [SYSEXT-INCUS]
- from 3.0.11-r1 to 3.2.0
- build dependencies:
  - added a dependency 'app-alternatives/ninja'
  - added a dependency '>=dev-build/cmake-3.28.5'
- dependencies and runtime dependencies:
  - added a dependency 'dev-libs/blake3:='
- release notes: https://github.com/jmacd/xdelta/releases/tag/v3.2.0
eclass/kernel-2.eclass:
- apply patches defined in ebuild too
eclass/selinux-policy-2.eclass:
- fixed application of user patches, now they are applied inside the refpolicy directory
  - we can drop our duplicated selinux policy patch
net-dns/bind: [PROD] [DEV]
- still at 9.20.23
- replaced a user patch for cross-compilation issue with a different one
  - patching Makefile.in instead of Makefile.am, maybe this won't require modifying the ebuild
net-dns/c-ares: [PROD] [DEV]
- from 1.34.6 to 1.34.8
- fixes CVE-2026-33630, GHSA-pjmc-gx33-gc76, GHSA-jv8r-gqr9-68wj
  - update: c-ares Flatcar#2199
- release notes: https://github.com/c-ares/c-ares/releases/tag/v1.34.{8,7}
net-fs/samba: [PROD] [DEV]
- from 4.23.6 to 4.24.4
- dependencies and runtime dependencies:
  - changes for sys-libs/talloc:
    - changed version constraint from >=2.4.3 to >=2.4.4
  - changes for sys-libs/tdb:
    - changed version constraint from >=1.4.14 to >=1.4.15
- release notes: https://www.samba.org/samba/history/samba-4.24.{4..0}.html
net-libs/nghttp2: [PROD] [DEV]
- from 1.68.1 to 1.69.0
- package became stable on 'amd64' and 'arm64'
  - dropped accept keywords from overlay profiles
- release notes: https://github.com/nghttp2/nghttp2/releases/tag/v1.69.0
net-libs/ngtcp2: [PROD] [DEV]
- from 1.22.1 to 1.24.0
- package became stable on 'amd64' and 'arm64'
  - dropped accept keywords from overlay profiles
- release notes: https://github.com/ngtcp2/ngtcp2/releases/tag/v1.2{4,3}.0
net-misc/curl: [PROD] [DEV]
- from 8.21.0 to 8.21.0-r1
- package became stable on 'amd64' and 'arm64'
  - dropped accept keywords from overlay profiles
net-misc/socat: [PROD] [DEV]
- from 1.8.1.1 to 1.8.1.3
- fixes CVE-2026-56123
  - update: net-misc/socat Flatcar#2190
- release notes: https://repo.or.cz/socat.git/blob/refs/tags/tag-1.8.1.3:/CHANGES
net-misc/wget: [PROD] [DEV]
- still at 1.25.0-r2
- fixes CVE-2026-15146, CVE-2026-58469, CVE-2026-58470, CVE-2026-58471, CVE-2026-58472 through backported patches
  - update: net-misc/wget Flatcar#2222
sec-policy/selinux-base-policy: [PROD] [DEV]
- from 2.20260312_p1 to 2.20260312_p1-r1
- added some patches for authlogin and su modules
sys-apps/acl: [PROD] [DEV]
- from 2.3.2-r3 to 2.4.0-r2
- fixes CVE-2026-54369, CVE-2026-54370
  - update: sys-apps/acl Flatcar#2189
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- added IUSE flag 'verify-sig'
- dependencies:
  - changes for sys-apps/attr:
    - dropped version constraint
- runtime dependencies:
  - dropped a dependency '>=sys-apps/attr-2.4.47-r1'
- release notes: https://cgit.git.savannah.nongnu.org/cgit/acl.git/plain/doc/CHANGES?h=v2.4.0
sys-apps/attr: [PROD] [DEV]
- from 2.5.2-r1 to 2.6.0
- fixes CVE-2026-54371
  - update: sys-apps/attr Flatcar#2191
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- added IUSE flag 'verify-sig'
- release notes: https://cgit.git.savannah.nongnu.org/cgit/attr.git/plain/doc/CHANGES?h=v2.6.0
sys-apps/diffutils: [PROD] [DEV]
- still at 3.12
- fixes CVE-2026-53910 through a backported patch
  - update: sys-apps/diffutils Flatcar#2258
sys-apps/coreutils: [PROD] [DEV]
- still at 9.11-r1
- fixes CVE-2026-56391, CVE-2026-56392 through backported patches
  - update: sys-apps/coreutils Flatcar#2242
sys-apps/file: [DEV]
- from 5.47-r3 to 5.48
- release notes: https://raw.githubusercontent.com/file/file/refs/tags/FILE5_48/ChangeLog
sys-apps/less: [PROD] [DEV]
- from 692 to 704
- fixes less-20260606
  - update: less Flatcar#2175
- release notes: https://greenwoodsoftware.com/less/news.70{4,2}.html
sys-apps/pkgcore:
- from 0.12.32 to 0.12.35
- build dependencies and runtime dependencies:
  - changes for dev-python/snakeoil:
    - changed version constraint from >=0.11.0 to >=0.11.1
- release notes: https://github.com/pkgcore/pkgcore/releases/tag/v0.12.35
sys-apps/policycoreutils: [PROD] [DEV]
- from 3.8.1 to 3.11
- fixes CVE-2026-59676, CVE-2026-59677
  - update: sys-apps/policycoreutils Flatcar#2220
- dependencies and runtime dependencies:
  - changes for sys-libs/libsepol:
    - changed version constraint from >=3.8.1 to >=3.11
  - changes for sys-libs/libselinux:
    - changed version constraint from >=3.8.1 to >=3.11
  - changes for sys-libs/libsemanage:
    - changed version constraint from >=3.8.1 to >=3.11
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.{11..9}
sys-apps/portage: [DEV]
- from 3.0.81.1 to 3.0.81.2
- release notes: https://gitweb.gentoo.org/proj/portage.git/plain/NEWS?h=portage-3.0.81.2
sys-apps/sandbox: [DEV]
- from 2.46 to 2.49
- release notes: https://gitweb.gentoo.org/proj/sandbox.git/log/?h=v2.49
sys-apps/sed: [PROD] [DEV]
- from 4.10 to 4.10-r1
- fixed automagic dep on sys-apps/attr
- added IUSE flag 'xattr'
  - enable support for extended attributes
- dependencies:
  - added a dependency 'sys-apps/attr[static-libs(+)]' for USE 'static?' -> 'xattr?'
  - added a dependency 'sys-apps/attr' for USE '!static?' -> 'xattr?'
- runtime dependencies:
  - added a dependency 'sys-apps/attr' for USE '!static?' -> 'xattr?'
sys-apps/semodule-utils: [PROD] [DEV]
- from 3.10 to 3.11
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- dependencies and runtime dependencies:
  - changes for sys-libs/libsepol:
    - changed version constraint from >=3.10 to >=3.11
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.11
sys-apps/util-linux: [PROD] [DEV]
- from 2.41.4-r1 to 2.42.2
- fixes CVE-2026-13595, CVE-2026-53612, CVE-2026-53613, CVE-2026-53614
  - update: util-linux Flatcar#2179
- release notes: https://github.com/util-linux/util-linux/blob/v2.42.2/Documentation/releases/v2.42.2-ReleaseNotes https://github.com/util-linux/util-linux/blob/v2.42.1/Documentation/releases/v2.42.1-ReleaseNotes https://github.com/util-linux/util-linux/blob/v2.42/Documentation/releases/v2.42-ReleaseNotes
sys-auth/sssd: [PROD] [DEV]
- from 2.13.0 to 2.13.1
- fixes CVE-2026-12610, CVE-2026-14474, CVE-2026-14476 through backported patches
  - update: sssd Flatcar#2192
- release notes: https://sssd.io/release-notes/sssd-2.13.1.html
sys-block/thin-provisioning-tools: [PROD] [DEV]
- still at 1.3.1
- moved the ebuild modification to env overrides
sys-fs/cryptsetup: [PROD] [DEV]
- from 2.8.6-r1 to 2.8.6-r2
- apply some patch bundle from Gentoo
  - these mostly relate to handling of null bytes by jq in testsuite, nothing interesting for us
sys-fs/zfs: [SYSEXT-ZFS]
- from 2.3.6 to 2.4.3
- this version of the package replaces sys-fs/zfs-kmod
  - dropped any stuff related to zfs-kmod from overlay profiles, adapted zfs stuff
- release notes: https://github.com/openzfs/zfs/releases/tag/zfs-2.4.{3..0}
sys-libs/libnvme: [PROD] [DEV]
- from 1.16.1 to 1.16.2
- release notes: https://github.com/linux-nvme/libnvme/releases/tag/v1.16.2
sys-libs/libseccomp: [PROD] [DEV]
- from 2.6.0-r3 to 2.6.1
- fixes GHSA-2hqh-5c36-grrm, GHSA-46fr-jh49-xvhx, GHSA-4q85-33p6-j5g6
  - update: sys-libs/libseccomp Flatcar#2207
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- release notes: https://github.com/seccomp/libseccomp/releases/tag/v2.6.1
sys-libs/libselinux: [PROD] [DEV]
- from 3.10-r2 to 3.11
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- dependencies and runtime dependencies:
  - changes for sys-libs/libsepol:
    - changed version constraint from >=3.10 to >=3.11
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.11
sys-libs/libsemanage: [PROD] [DEV]
- from 3.8.1 to 3.11
- dependencies and runtime dependencies:
  - changes for sys-libs/libselinux:
    - changed version constraint from >=3.8.1 to >=3.11
  - changes for sys-libs/libsepol:
    - changed version constraint from >=3.8.1 to >=3.11
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.{11..9}
sys-libs/libsepol: [PROD] [DEV]
- from 3.10 to 3.11
- package became unstable on 'amd64' and 'arm64'
  - added accept keywords to overlay profiles
- release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.11
sys-libs/pam: [PROD] [DEV]
- still at 1.7.2
- fixes CVE-2026-54411 through a backported patch
  - update: pam Flatcar#2195
sys-process/time:
- from 1.9-r1 to 1.10
- release notes: https://lists.gnu.org/archive/html/info-gnu/2026-04/msg00005.html

--

changelog
image diff

It's from Gentoo commit 26eea6f0bd95ba783f861e590012f0f0abb77117. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 8861c37e3fe818881fc80a944bb0da1fe2817b42. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 849115cb6a00b3cd2c29a11990728f39cc009633. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 2bc085bd16ce55b6b6d739181524efcba10e43ae. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit a934a8ca9c04f1d5cb108d3b8868a83d8c72bd8a. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 7aa35664605c2c323f160612fd3b2f392d2d6cf8. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit e54427313be85e660df7678ad4dcd38292c94c3a. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 5865bd45d8349212a216950c5fb090f7804e0d49. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 0833c9fed35b418972af787666741cf67a6818df. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 97c0ae5651db0f9e21202e43afe67c55143bfcab. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit a1f53fdc3dfad3e635a5315d608ead207f739df0. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 20b551b506a120a825dbdc8ec59f666dfbb1031f. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 77c41003631bbba0337b580c67ba456ba36e3d26. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 28d5d4f4063e979264df423f0ae7645b59b5b7bb. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit c95402428a66081d54db5c1b24ca746c1be7a089. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 70f57f449120ad9e753012c227b7a69159da8289. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 9d10ab4b36aeb0799d33de9ab8fe31d8ffb79944. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit c00037fc49f3a4713c27ebaa00723d7d3631fcec. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 7148be37d12953a53176d5cbc96cf8763937c6a2. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 078af3a216810923a2b43fbf7b6f286dfb170592. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 7b57b72b52b2f592873e207f40b374763545fd07. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

It's from Gentoo commit 1a7ea9d501b1fd9673bff8f28c7b089db2e2f288. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Prepare the changes for upstreaming: - Hide python dependencies behind the python USE flag. - Allow using original sources, without Gentoo modifications with the vanilla USE flag. - This also hides app-admin/setools dependency behind this USE flag. I'm not sure if anything in policycoreutils requires anything from that package - I assumed that Gentoo-provided rlpkg maybe does. - Keep using /var/lib/selinux as a SELinux policy directory. We will use INSTALL_MASK to skip installation of the directory and will add a tmpfiles config file to coreos-base/misc-files instead. - Stabilize the package. Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com> Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

It's from Gentoo commit 66a5f848251234112d42dbdc8fe6f94b926cadc0. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Prepare the ebuild to be in an upstreamable state: - hide python dependencies behind the IUSE flag - move the semanage.conf additions to a patch - that way, we can add a user patch that changes compression setting that was added by Gentoo - stabilize the package Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com> Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

And fix a tag - currently all the tags have arch as the suffix. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

…cies With the fixes in selinux-policy-2.eclass, we can go back to the single patch for all the selinux policy packages. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

… to env overrides Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

…erently Instead of patching Makefile.am and modifying ebuild to regenerate the build system, try patching Makefile.in. That way we don't need to remember to readd eautoreconf on every weekly update (which clobbers our modifications to ebuilds in portage-stable). Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

github-actions Bot added the main label Aug 3, 2026

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-08-03 branch from 683249d to 6f5965e Compare August 7, 2026 18:39

krnowak had a problem deploying to development August 7, 2026 18:39 — with GitHub Actions Error

krnowak added this to Flatcar tactical, release planning, and roadmap Aug 7, 2026

krnowak moved this to ⚒️ In Progress in Flatcar tactical, release planning, and roadmap Aug 7, 2026

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-08-03 branch from 6f5965e to c3c2756 Compare August 7, 2026 18:47

krnowak had a problem deploying to development August 7, 2026 18:47 — with GitHub Actions Error

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-08-03 branch from c3c2756 to c81c02f Compare August 7, 2026 18:48

krnowak had a problem deploying to development August 7, 2026 18:49 — with GitHub Actions Error

Flatcar Buildbot added 21 commits August 10, 2026 16:39

app-admin/logrotate: Sync with Gentoo

1881de3

It's from Gentoo commit 26eea6f0bd95ba783f861e590012f0f0abb77117. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-admin/perl-cleaner: Sync with Gentoo

4fceed4

It's from Gentoo commit 8861c37e3fe818881fc80a944bb0da1fe2817b42. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-arch/libarchive: Sync with Gentoo

7fa2742

It's from Gentoo commit 849115cb6a00b3cd2c29a11990728f39cc009633. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/aardvark-dns: Sync with Gentoo

a2d99e4

It's from Gentoo commit 2bc085bd16ce55b6b6d739181524efcba10e43ae. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/conmon: Sync with Gentoo

cd78f56

It's from Gentoo commit a934a8ca9c04f1d5cb108d3b8868a83d8c72bd8a. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/containerd: Sync with Gentoo

a48de12

It's from Gentoo commit 7aa35664605c2c323f160612fd3b2f392d2d6cf8. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/incus: Sync with Gentoo

f8e2ff3

It's from Gentoo commit e54427313be85e660df7678ad4dcd38292c94c3a. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/lxc: Sync with Gentoo

8181987

It's from Gentoo commit 5865bd45d8349212a216950c5fb090f7804e0d49. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/netavark: Sync with Gentoo

159a6ac

It's from Gentoo commit 0833c9fed35b418972af787666741cf67a6818df. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/podman: Sync with Gentoo

d9330ae

It's from Gentoo commit 97c0ae5651db0f9e21202e43afe67c55143bfcab. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-containers/runc: Sync with Gentoo

3d756f6

It's from Gentoo commit a1f53fdc3dfad3e635a5315d608ead207f739df0. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-crypt/gpgme: Sync with Gentoo

d79d5f2

It's from Gentoo commit 20b551b506a120a825dbdc8ec59f666dfbb1031f. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-crypt/p11-kit: Sync with Gentoo

f37d125

It's from Gentoo commit 77c41003631bbba0337b580c67ba456ba36e3d26. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-crypt/pinentry: Sync with Gentoo

e22c4d7

It's from Gentoo commit 28d5d4f4063e979264df423f0ae7645b59b5b7bb. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-crypt/tpm2-tools: Sync with Gentoo

55bbc31

It's from Gentoo commit c95402428a66081d54db5c1b24ca746c1be7a089. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-crypt/tpm2-tss: Sync with Gentoo

9f85365

It's from Gentoo commit 70f57f449120ad9e753012c227b7a69159da8289. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-editors/nano: Sync with Gentoo

d811c8e

It's from Gentoo commit 9d10ab4b36aeb0799d33de9ab8fe31d8ffb79944. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-emulation/qemu: Sync with Gentoo

c00ccc9

It's from Gentoo commit c00037fc49f3a4713c27ebaa00723d7d3631fcec. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-emulation/virt-firmware: Sync with Gentoo

45b3244

It's from Gentoo commit 7148be37d12953a53176d5cbc96cf8763937c6a2. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-misc/jq: Sync with Gentoo

8da3b6f

It's from Gentoo commit 078af3a216810923a2b43fbf7b6f286dfb170592. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

app-misc/pax-utils: Sync with Gentoo

0ba6a28

It's from Gentoo commit 7b57b72b52b2f592873e207f40b374763545fd07. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>

krnowak and others added 25 commits August 10, 2026 16:39

sys-apps/policycoreutils: Sync with Gentoo

38f633d

It's from Gentoo commit 1a7ea9d501b1fd9673bff8f28c7b089db2e2f288. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

sys-libs/libsemanage: Sync with Gentoo

541b878

It's from Gentoo commit 66a5f848251234112d42dbdc8fe6f94b926cadc0. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Add accept keywords for sys-apps/policycoreutils deps

ee15127

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Add a patch for dev-libs/libxml2

e9de245

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Add a patch for sys-libs/pam

d978ffb

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Add patches for sys-auth/sssd

6e152c7

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Add a patch for app-arch/bzip2

8fbf284

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay app-admin/etcd-wrapper: Bump to 3.6.11 to match dev-db/etcd

101e9b8

And fix a tag - currently all the tags have arch as the suffix. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay user-patches: Add a patch for app-crypt/mit-krb5

2e54410

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Add/update accept keywords for security issues

b677e2f

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay user-patches: Add a patch for sys-apps/diffutils

01afa9d

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for app-arch/libarchive

2c0bb9f

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Add patches for sys-apps/coreutils

243868c

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Update some READMEs

945b05b

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for net-libs/nghttp2

1bf9af0

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for net-libs/ngtcp2

037108a

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop accept keywords for net-misc/curl

929fa08

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/user-patches: Drop duplicated patches for selinux poli…

d5f2274

…cies With the fixes in selinux-policy-2.eclass, we can go back to the single patch for all the selinux policy packages. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

sys-block/thin-provisioning-tool: Move LLVM_COMPAT change from ebuild…

cbfd5b6

… to env overrides Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay profiles: Drop settings for sys-fs/zfs-kmod

d6963da

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

overlay coreos/config: Move overrides from sys-fs/zfs-kmod to sys-fs/zfs

c122068

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

changelog: Add entries

d2a5e3c

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>

krnowak force-pushed the buildbot/weekly-portage-stable-package-updates-2026-08-03 branch from c81c02f to d2a5e3c Compare August 10, 2026 14:41

krnowak requested a deployment to development August 10, 2026 14:41 — with GitHub Actions Waiting

This was referenced Aug 10, 2026

Weekly portage-stable package updates 2026-08-10 #4204

Closed

Weekly portage-stable package updates 2026-07-27 #4157

Closed

Weekly portage-stable package updates 2026-07-20 #4148

Closed

Navigation Menu

Uh oh!

Weekly portage-stable package updates 2026-08-03 - #4173

Weekly portage-stable package updates 2026-08-03#4173
github-actions[bot] wants to merge 193 commits into
mainfrom
buildbot/weekly-portage-stable-package-updates-2026-08-03

github-actions Bot commented Aug 3, 2026 •

edited by krnowak

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

github-actions Bot commented Aug 3, 2026 • edited by krnowak Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Aug 3, 2026 •

edited by krnowak

Loading