Skip to content

expat 2.9.0 for CVE-2026-77214, with iana-etc 20260930, cmake 4.4.4 and openssh 10.6p1 #229

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DevomB merged 5 commits into from
Oct 7, 2026
Merged

expat 2.9.0 for CVE-2026-77214, with iana-etc 20260930, cmake 4.4.4 and openssh 10.6p1 #229

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e072083
expat 2.9.0: the release of 2026-10-05 that checks XML_ParseBuffer's …
DevomB Oct 7, 2026
157c872
iana-etc 20260930: /etc/services and /etc/protocols from IANA's regis…
DevomB Oct 7, 2026
2f37e3b
cmake 4.4.4: the patch release of 2026-10-02, which changes no docume…
DevomB Oct 7, 2026
22ad93e
iana-etc's review row goes: the pin is current, and the gate refuses …
DevomB Oct 7, 2026
53f4078
openssh 10.6p1: the release of 2026-10-06, whose one fix in ssh-keyge…
DevomB Oct 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions build/config/versions.env
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ V_SHADOW=4.16.0
# --- compression / core libs ---
V_BZIP2=1.0.8
V_ZSTD=1.5.6
V_EXPAT=2.8.5
V_EXPAT=2.9.0
V_LIBFFI=3.5.2
V_LIBXCRYPT=4.5.2

Expand All @@ -73,7 +73,7 @@ V_GPERF=3.1
# --- system utilities ---
V_ATTR=2.6.0
V_ACL=2.4.0
V_IANA_ETC=20240806
V_IANA_ETC=20260930
V_LESS=710
V_GROFF=1.23.0
V_PROCPS=4.0.7
Expand Down Expand Up @@ -106,15 +106,15 @@ V_PERL=5.40.5
# cmake only builds json-c and is not in the image. The chroot runs Kitware's
# binary (cmake-bin in sources.lock) to save a long source build; the source
# tarball is the fallback where that binary cannot run.
V_CMAKE=4.4.3
V_CMAKE=4.4.4
V_JSON_C=0.19-20260627
V_POPT=1.19
V_LIBAIO=0.3.113
# Only libdevmapper and dmsetup are built from LVM2 (make device-mapper).
V_LVM2=2.03.42

# --- release signatures: only ssh-keygen is built from OpenSSH ---
V_OPENSSH=10.5p1
V_OPENSSH=10.6p1

# --- the net zone: NAT, a resolver and DHCP (docs/design/net-zone.md) ---
V_LIBMNL=1.0.5
Expand Down
10 changes: 5 additions & 5 deletions sources.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,8 @@ ae470fec429775653e042015edc928d07c8c3b2fc59765172a330d3d87785f86 bc-1.08.2.tar.
9bba0214ccf7f1079c5d59210045227bcf619519840ebfa80cd3849cff5a5bf2 bison-3.8.2.tar.xz
ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269 bzip2-1.0.8.tar.gz
f66dff1bdf8f96060b8177976f8b7d9254bc89bc4db933d769f7384d28480bc9 cacert-2026-08-13.pem
d6c83076c575bc00b823522ac974bda66d0af05d6ddc30e739c12385cf32c6cc cmake-4.4.3-linux-x86_64.tar.gz
c46400618b4f1f2b43507f24fb22f3ae830c3416cf23b776e16e1d413aa892f0 cmake-4.4.3.tar.gz
e5bb807f7728cb60cd8b27ebc97a2edb469b68655f21e844a600c3575b76f5bb cmake-4.4.4-linux-x86_64.tar.gz
bd24c30d80a7744ae84b845ff080cc8453b06c622ef01066564108e9cefc44cf cmake-4.4.4.tar.gz
a480198559733e9b3da999e90543ac6f888a2caa544d8d664c5a1f17e528e210 coreutils-9.12.tar.xz
3acfa685f2dd7fcc832e0b77bc7093aa7da554a51ce8dafbb4138eaa854eee35 cryptsetup-2.8.8.tar.xz
fa9ca4d13871dd122f61258a80d01751d603b4d3ee14095d65453b4e846e17d7 dejavu-fonts-ttf-2.37.tar.bz2
Expand All @@ -23,7 +23,7 @@ ccc8bbb3fb66a7e6f0392693533ac9c8bd4e6283dd1f66992e68ec4d4a9cdee7 dwl-v0.8.tar.g
df76db71366d1d708365fc7a6c60ca48398f14367eb2b8954efc8897147ad871 elfutils-0.191.tar.bz2
eb69809fc0d1187f2463ab2149c53aa9f42a78e59f14ebea68eae6cb6b4fc1c3 eudev-3.2.15.tar.gz
908ed4db3a6b3a23a205d8fd4cf2a71089156f2aeae0f54656045aafad2dee32 execline-2.9.9.2.tar.gz
1e727b8933ec51a77a9a9d9afcf8e688bce45d907c13e36ab7393fe36e703182 expat-2.8.5.tar.xz
1e6371862cc31999b368c3b89b49994f0677e1bab5f1b2b85ae3741f5d803051 expat-2.9.0.tar.xz
fc97f51029bb0e2c9f4e3bffefdaf678f0e039ee872b9de5c002a6d09c784d82 file-5.45.tar.gz
bfd19cb06cc71f3352d567e90284d8cdac02ac89774bbeadf0b533b0c11432fd findutils-4.11.0.tar.xz
e87aae032bf07c26f85ac0ed3250998c37621d95f8bd748b31f15b33c45ee995 flex-2.6.4.tar.gz
Expand All @@ -40,7 +40,7 @@ a3c2b80201b89e68616f4ad30bc66aee4927c3ce50e33929ca819d5c43538898 gmp-6.3.0.tar.
9aa0cc780dec156b8282844833b342ab7cb08c25d2cd9a1869cdd0df31deff48 gzip-1.15.tar.xz
b4f819bfc3b0f8ea967018948dbf3a71f174a02886d00ee16121739fcd140d6f havoc-0.7.0.tar.gz
f0c64cd7e31d70a5fb3a52e53ab50a61e74c0421a6381eaa45114eec3bde5fe7 hwdata-0.412.tar.gz
672dbe1ba52b889a46dc07ee3876664ed601983239f82d729d02a002475a5b66 iana-etc-20240806.tar.gz
ead94c150ba26a30a33c36722b97624fd9ff24c80abcd6303a21af52b24f9e55 iana-etc-20260930.tar.gz
57b3cf4f77555992881e5ba2a09a63b05aa2c56342a60ed4305b5f45938390b5 inetutils-2.8.tar.gz
4c2fa124c2cf0afd7ca34d1eeacba6ba048a56f6374e2aab93dafbdbd4eea9c0 iproute2-7.2.0.tar.xz
6f213700dbf96b5cc4499ca70cb15ecd69c09f405b06785bb4a1a10b572b6276 iputils-20250605.tar.xz
Expand Down Expand Up @@ -79,7 +79,7 @@ a107adad2101fecac54ac7f9f0e0a0dd155d954193da55c2340c97f2ff1d814e mtdev-1.1.7.ta
355b4cbbed880b0381a04c46617b7656e362585d52e9cf84a67e2009b749ff11 ncurses-6.6.tar.gz
a6fbf060d8d4fff001517a2b94f356bb4366bfbf0ba366366f9d27cc38caa58f nftables-1.1.7.tar.xz
974d6b2f4eeefa25625d34da3cb36bdcebe7fbce40f4c16ac0835fd1c0cbae17 ninja-1.13.2.tar.gz
d44d28a839ea9daf969cc69150fde59910b2b39361dad81a3bd6cbd19218db11 openssh-10.5p1.tar.gz
a9dc9565dffe8640f64d863cd29a32bc4a3dbdec0566a7fc44c5d6ee767d5f39 openssh-10.6p1.tar.gz
603f5602e2eef00d77fbd429d34dcd5822bb301757a1bc9cdb24c670f1eb859a openssl-3.5.9.tar.gz
f87cee69eec2b4fcbf60a396b030ad6aa3415f192aa5f7ee84cad5e11f7f5ae3 patch-2.8.tar.xz
1fe6f825b487d26c35aa51a35f52fe494d4cfc77b8051f8b1ee3391bf0289bc6 perl-5.40.5.tar.xz
Expand Down
1 change: 0 additions & 1 deletion tools/pin-reviews.tsv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,6 @@ texinfo 7.1 7.3 fine 2026-09-19 NEWS 7.1.1 to 7.3: no security
libtool 2.4.7 2.6.2 fine 2026-09-19 NEWS 2.5.x and 2.6.x: no security fix.
gperf 3.1 3.3 fine 2026-09-19 NEWS 3.2 and 3.3: no security fix.
pkgconf 2.3.0 3.0.7 fine 2026-09-19 NEWS to 3.0.7: no security fix. 3.0 breaks the libpkgconf ABI, moves to meson and changed quoting and sysroot handling twice.
iana-etc 20240806 20260911 fine 2026-09-19 Data only: /etc/services and /etc/protocols.
intel-microcode 20260812 20260925 fine 2026-09-27 Release notes 20260925: one functional update, Meteor Lake C0 (06-aa-04, 0x28 to 0x2b), and no security advisory.
ca-bundle 2026-08-13 2026-09-25 fine 2026-09-27 The 2026-09-25 bundle holds the same 121 certificates, byte for byte; only its header's date and certdata.txt digest differ.
groff 1.23.0 1.24.2 fine 2026-09-29 NEWS 1.24.0 to 1.24.2: 1.24.2 fixes command injection (CWE-78) in mmroff, pdfmom and pre-grohtml, which the image does not install (build/recipes/groff.sh); man renders for a terminal, never HTML. 1.24.0 has incompatible request-syntax changes; never that one.
Expand Down
Loading