Merge pull request #3131 from flatcar/buildbot/weekly-portage-stable-package-updates-2025-07-21

Weekly portage-stable package updates 2025-07-21

Author: tormath1

changelog/security/2025-07-21-weekly-updates.md

@@ -0,0 +1,4 @@
+- git ([CVE-2025-48384](https://www.cve.org/CVERecord?id=CVE-2025-48384), [CVE-2025-48385](https://www.cve.org/CVERecord?id=CVE-2025-48385), [CVE-2025-48386](https://www.cve.org/CVERecord?id=CVE-2025-48386))
+- go ([CVE-2025-4674](https://www.cve.org/CVERecord?id=CVE-2025-4674))
+- libxml2 ([CVE-2025-49794](https://www.cve.org/CVERecord?id=CVE-2025-49794), [CVE-2025-49795](https://www.cve.org/CVERecord?id=CVE-2025-49795), [CVE-2025-49796](https://www.cve.org/CVERecord?id=CVE-2025-49796))
+- podman ([CVE-2025-6032](https://www.cve.org/CVERecord?id=CVE-2025-6032))

changelog/updates/2025-07-21-weekly-updates.md

@@ -0,0 +1,45 @@
+- btrfs-progs ([6.14](https://github.com/kdave/btrfs-progs/releases/tag/v6.14))
+- chrony ([4.7](https://listengine.tuxfamily.org/chrony.tuxfamily.org/chrony-announce/2025/06/msg00000.html))
+- curl ([8.14.1](https://curl.se/ch/8.14.1.html))
+- dbus-glib ([0.114](https://gitlab.freedesktop.org/dbus/dbus-glib/-/blob/master/NEWS?ref_type=heads#L8))
+- ethtool ([6.14](https://git.kernel.org/pub/scm/network/ethtool/ethtool.git/commit/?id=fba608c5a8ac943ebff046f387ade9dd364eb5a7))
+- fuse-overlayfs ([1.15](https://github.com/containers/fuse-overlayfs/releases/tag/v1.15))
+- git ([2.49.1](https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.49.1.adoc))
+- inih ([60](https://github.com/benhoyt/inih/releases/tag/r60))
+- iproute2 ([6.15.0](https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=401816cc9c7cde7b666d4befb06a10d6359c9688))
+- iputils ([20250605-r1](https://github.com/iputils/iputils/releases/tag/20250605))
+- kbd ([2.8.0](https://lore.kernel.org/kbd/[email protected]/T/#u))
+- less ([679](https://greenwoodsoftware.com/less/news.679.html))
+- libffi ([3.5.1](https://github.com/libffi/libffi/releases/tag/v3.5.1))
+- libgpg-error ([1.55](https://github.com/gpg/libgpg-error/releases/tag/libgpg-error-1.55))
+- libnvme ([1.14](https://github.com/linux-nvme/libnvme/releases/tag/v1.14))
+- libxml2 ([2.14.5](https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.14.5))
+- ncurses ([6.5_p20250329](https://invisible-island.net/ncurses/announce.html))
+- nftables ([1.1.3](https://www.netfilter.org/projects/nftables/files/changes-nftables-1.1.3.txt))
+- nvidia: nvidia-drivers ([570.169](https://www.nvidia.com/en-us/drivers/details/247720/))
+- nvme-cli ([2.14](https://github.com/linux-nvme/nvme-cli/releases/tag/v2.14))
+- passt ([2025.6.11](https://passt.top/passt/commit/?id=0293c6f4a316baa561a9b43388906707f8cf7e81))
+- podman: podman ([5.5.2](https://github.com/containers/podman/releases/tag/v5.5.2))
+- procps ([4.0.5](https://gitlab.com/procps-ng/procps/-/blob/master/NEWS?ref_type=heads#L30))
+- python: ensurepip-pip ([25.1.1](https://pip.pypa.io/en/stable/news/#v25-1-1))
+- python: jaraco-collections ([5.2.1](https://github.com/jaraco/jaraco.collections/releases/tag/v5.2.1))
+- python: jaraco-functools ([4.2.1](https://github.com/jaraco/jaraco.functools/releases/tag/v4.2.1))
+- python: pygments ([2.19.2](https://pygments.org/docs/changelog/#version-2-19-2))
+- python: resolvelib ([1.2.0](https://github.com/sarugaku/resolvelib/blob/main/CHANGELOG.rst#120-2025-06-26))
+- python: typing-extensions ([4.14.1](https://github.com/python/typing_extensions/releases/tag/4.14.1))
+- samba ([4.20.8](https://www.samba.org/samba/history/samba-4.20.8.html))
+- SDK: gdb ([16.3](https://lists.gnu.org/archive/html/info-gnu/2025-04/msg00014.html))
+- SDK: gentoo-syntax ([16](https://github.com/gentoo/gentoo-syntax/releases/tag/v16))
+- SDK: go ([1.24.5](https://go.dev/doc/devel/release#go1.24.minor)
+- SDK: iperf ([3.19](https://github.com/esnet/iperf/releases/tag/3.19))
+- SDK: maturin ([1.9.1](https://github.com/PyO3/maturin/blob/main/Changelog.md#191))
+- SDK: mtools ([4.0.49](https://www.gnu.org/software/mtools/manual/mtools.html))
+- SDK: m4 ([1.4.20](https://lists.gnu.org/archive/html/m4-discuss/2025-05/msg00002.html))
+- SDK: nano ([8.5](https://lists.gnu.org/archive/html/info-gnu/2025-06/msg00003.html))
+- SDK: python-cryptography ([45.0.4](https://cryptography.io/en/latest/changelog/#v45-0-5))
+- sqlite ([3.50.2](https://sqlite.org/releaselog/3_50_2.html))
+- strace ([6.15](https://github.com/strace/strace/releases/tag/v6.15))
+- userspace-rcu ([0.15.3](https://lkml.org/lkml/2025/5/14/1580))
+- util-linux ([2.41.1](https://github.com/util-linux/util-linux/blob/master/Documentation/releases/v2.41-ReleaseNotes))
+- xfsprogs ([6.14.0](https://lkml.org/lkml/2025/4/14/1443))
+- zfs ([2.3.3](https://github.com/openzfs/zfs/releases/tag/zfs-2.3.3))

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults

@@ -58,8 +58,9 @@ USE="${USE} bindist"
 # freedist - license for sys-kernel/coreos-kernel
 # intel-ucode - license for sys-firmware/intel-microcode
 # NVIDIA-2023 - license for x11-drivers/nvidia-drivers
+# NVIDIA-2025 - license for x11-drivers/nvidia-drivers (>= 570)
 ACCEPT_LICENSE="${ACCEPT_LICENSE} no-source-code
-    linux-fw-redistributable freedist intel-ucode NVIDIA-2023"
+    linux-fw-redistributable freedist intel-ucode NVIDIA-2023 NVIDIA-2025"
 
 # Favor our own mirrors over Gentoo's
 GENTOO_MIRRORS="

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords

@@ -12,6 +12,9 @@
 =app-containers/incus-6.0.4-r1 ~arm64
 =app-containers/lxc-6.0.4-r1 ~arm64
 
+# CVE-2025-6032
+=app-containers/podman-5.5.2 ~amd64 ~arm64
+
 # No stable keywords.
 =app-containers/syft-1.18.1 ~amd64 ~arm64
 
@@ -48,9 +51,10 @@ dev-cpp/azure-identity
 dev-cpp/azure-security-keyvault-certificates
 dev-cpp/azure-security-keyvault-keys
 
+# CVE-2025-4674
+=dev-lang/go-1.24.5-r1 ~arm64 ~amd64
+
 # Keep versions on both arches in sync.
-=dev-db/sqlite-3.49.2 ~arm64
-=dev-lang/go-1.24.4 ~arm64
 =dev-lang/yasm-1.3.0-r1 ~arm64
 =dev-libs/cowsql-1.15.8 ~arm64
 =dev-libs/ding-libs-0.6.2-r1 ~arm64
@@ -59,6 +63,9 @@ dev-cpp/azure-security-keyvault-keys
 =dev-libs/jose-12 **
 =dev-libs/luksmeta-9-r1 **
 
+# CVE-2025-49794, CVE-2025-49795, CVE-2025-49796
+=dev-libs/libxml2-2.13.8-r2 ~amd64 ~arm64
+
 # Keep versions on both arches in sync.
 =dev-libs/raft-0.22.1 ~arm64
 
@@ -84,9 +91,6 @@ dev-cpp/azure-security-keyvault-keys
 =net-libs/libnetfilter_cthelper-1.0.1-r1 ~arm64
 =net-libs/libnetfilter_cttimeout-1.0.1 ~arm64
 
-# Needed for addressing CVE-2025-47268 and CVE-2025-48964
-=net-misc/iputils-20250605 ~amd64 ~arm64
-
 # Packages are in Gentoo but not expected to be used outside Flatcar, so they
 # are generally never stabilised. Thus an unusual form is used to pick up the
 # latest version of the package with the unstable keywords.
@@ -99,6 +103,8 @@ sys-apps/azure-vm-utils
 =sys-boot/mokutil-0.7.2 **
 
 # Enable ipvsadm for arm64.
+=sys-fs/zfs-2.3.3 ~arm64
+=sys-fs/zfs-kmod-2.3.3 ~arm64
 =sys-cluster/ipvsadm-1.31-r1 ~arm64
 
 # Keep versions on both arches in sync.

sdk_container/src/third_party/portage-stable/app-admin/eselect/eselect-1.4.30.ebuild

@@ -16,7 +16,7 @@ SRC_URI="https://dev.gentoo.org/~ulm/eselect/${P}.tar.xz"
 
 LICENSE="GPL-2+ || ( GPL-2+ CC-BY-SA-4.0 )"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="doc emacs vim-syntax"
 
 # coreutils for realpath

sdk_container/src/third_party/portage-stable/app-alternatives/sh/sh-0.ebuild

@@ -1,4 +1,4 @@
-# Copyright 2022-2024 Gentoo Authors
+# Copyright 2022-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -15,7 +15,7 @@ ALTERNATIVES=(
 inherit app-alternatives
 
 DESCRIPTION="/bin/sh (POSIX shell) symlink"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	!app-eselect/eselect-sh

sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.14.ebuild

@@ -31,7 +31,7 @@ fi
 LICENSE="GPL-3+"
 SLOT="0"
 if [[ ${PV} != *_p* ]] ; then
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 IUSE="pic static"
 

sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest

@@ -1,6 +1,2 @@
-DIST libarchive-3.7.9.tar.xz 5494688 BLAKE2B 7bcfb3fe8ffd9452f3d71cdc738144069594030278572ebba0bb247ad74fd68ec19822f281364878228ee311976e216614d4764e56c5fb7f98801695ab7aa7f4 SHA512 d8918445e2536eb29c2d6a6c8cd3671a8525be1619009a2e7c3a9c2a821b51939172dfccc25bfd62fec2a17fb01796b4f522b0ba72b31e3de9b9658c44c46345
-DIST libarchive-3.7.9.tar.xz.asc 659 BLAKE2B 1de2d5af2422c8220983d7e5aa76fae1fcf12c008e7a99ec193b82145a03506fddabc7d5b89efce609e3b807511ebf719fce2f81f2150ccc0a57b4248ad3c5cb SHA512 e60bf9b6c8c58a6fd8977df0ccdd375e42db03f99623412897711dfcbfa4fb4a5b8707e8643c30e25e8b2946df58d1367f67c6ef99223a2739dabbce387f83c5
-DIST libarchive-3.8.0.tar.xz 5950876 BLAKE2B 7cdccd6b4cbb180dbd40fba3461fa98b53aaf05c0b4b71776d9bb26d1ed5329b8aff9cb534667334a4069bb6e1e629522b048ce859c408d48ba96cec9c41bddf SHA512 b0dcee8cb586ce2061987589067bbc063e326471fe36de64cc9c3e8b5eaaaedb85ef2b320be1671e008a32f39bdfc07db4e8abbde58328ab2655c2af0f0984f9
-DIST libarchive-3.8.0.tar.xz.asc 659 BLAKE2B 47893aa0770487b7f3902ae9950baec3cecf7d514ead57d83e2d0cd6feb2e96c55fe1a42020a70260d6958eee654633f01b1dd200b2ef718248d2c559905ad37 SHA512 62896d1995b9d05dc0d01829062fa954c1319764a7b7d1dc34cde456b303c115725921dbcfa3dd82384aa8f81df9c9b04abcf9fafa1457d31e581da7b7b2f642
 DIST libarchive-3.8.1.tar.xz 5950428 BLAKE2B 92ce11758ea050c7f5b3b2440566b71d29d4fe3ee90ee3455117585ef629eb7cfbe6f3c67bfb309c38d02118ef8f71c1c30ffe14466bfef7929c6d6134b11fc8 SHA512 c794d1c6e6a6dcf4072438dc4e8ce5b1530bbe9ad40afad18f4e6a444aa5d85e48c58cfbd8af41d4d25e93844956de3ce262cb1d68097d2e5f95bd87b5a982b7
 DIST libarchive-3.8.1.tar.xz.asc 659 BLAKE2B 0965437c5087b29c356280613fba546c0f08cbe3996c885957e1424304f3ea1cb4651168b34c3389ec6119bd5ab99160dc530dced31490cd2f6e8c3850e77223 SHA512 540ea8203920c1e8e6934f20c0f6b592a309c82f82561960d9adff3a3a09cf28c7a3d92070682b6b420ef82c6e30d6e9741d8c3e5473a78390da5137e61c05bd