Merge pull request #3092 from flatcar/buildbot/weekly-portage-stable-package-updates-2025-07-07

Weekly portage-stable package updates 2025-07-07

Author: krnowak

changelog/updates/2025-07-07-weekly-updates.md

@@ -0,0 +1,5 @@
+- base, dev: glibc ([2.41](https://lists.gnu.org/archive/html/info-gnu/2025-01/msg00014.html))
+- base, dev: jq ([1.8.1](https://github.com/jqlang/jq/releases/tag/jq-1.8.1))
+- base, dev: sssd ([2.9.7](https://sssd.io/release-notes/sssd-2.9.7.html))
+- dev: pahole ([1.30](https://git.kernel.org/pub/scm/devel/pahole/pahole.git/tag/?h=v1.30))
+- sysext-python: urllib3 ([2.5.0](https://github.com/urllib3/urllib3/releases/tag/2.5.0))

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-auth/sssd/0001-Assume-that-callbacks-are-not-broken-in-OpenLDAP-whe.patch

@@ -7,22 +7,10 @@
 # Gentoo upstream package stabilisation
 # (the following packages are "unstable" upstream; we're stabilising these)
 
-# Needed to address CVE-2024-40635, CVE-2025-47291
-=app-containers/containerd-2.0.5 ~arm64
-
 # Keep versions on both arches in sync.
-=app-containers/containers-common-0.63.0 ~arm64
 =app-containers/cri-tools-1.32.0 ~arm64
-
-# Needed to address CVE-2025-24965.
-=app-containers/crun-1.20 ~arm64
-
-# Keep versions on both arches in sync.
-=app-containers/docker-28.0.4 ~arm64
-=app-containers/docker-cli-28.0.4 ~arm64
 =app-containers/incus-6.0.4-r1 ~arm64
 =app-containers/lxc-6.0.4-r1 ~arm64
-=app-containers/runc-1.2.6 ~arm64
 
 # No stable keywords.
 =app-containers/syft-1.18.1 ~amd64 ~arm64
@@ -41,9 +29,6 @@ app-crypt/azure-keyvault-pkcs11
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =app-crypt/clevis-19-r1 **
 
-# Keep versions on both arches in sync.
-=app-crypt/gnupg-2.4.8 ~arm64
-
 # Needed to address CVE-2025-1215, CVE-2025-22134, CVE-2025-24014, GHSA-63p5-mwg2-787v, CVE-2025-27423, CVE-2025-29768
 =app-editors/vim-9.1.1436 ~amd64 ~arm64
 =app-editors/vim-core-9.1.1436 ~amd64 ~arm64
@@ -53,11 +38,6 @@ app-crypt/azure-keyvault-pkcs11
 
 # Keep versions on both arches in sync.
 =app-emulation/qemu-guest-agent-9.2.0 ~arm64
-
-# Needed to address CVE-2024-23337, CVE-2024-53427, CVE-2025-48060
-=app-misc/jq-1.8.0 ~amd64 ~arm64
-
-# Keep versions on both arches in sync.
 =dev-build/meson-1.7.2 ~arm64
 
 # Packages are in Gentoo but not expected to be used outside Flatcar, so they
@@ -71,45 +51,23 @@ dev-cpp/azure-security-keyvault-keys
 # Keep versions on both arches in sync.
 =dev-db/sqlite-3.49.2 ~arm64
 =dev-lang/go-1.24.4 ~arm64
-=dev-lang/python-3.11.13 ~arm64
 =dev-lang/yasm-1.3.0-r1 ~arm64
 =dev-libs/cowsql-1.15.8 ~arm64
 =dev-libs/ding-libs-0.6.2-r1 ~arm64
 
-# Needed to address CVE-2025-4373
-=dev-libs/glib-2.84.3 ~arm64
-=dev-libs/gobject-introspection-common-1.84.0 ~arm64
-
-# Keep versions on both arches in sync.
-=dev-libs/jansson-2.14.1 ~arm64
-
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =dev-libs/jose-12 **
-
-# Keep versions on both arches in sync.
-=dev-libs/libgcrypt-1.11.1 ~arm64
-=dev-libs/libtracefs-1.8.2 ~arm64
-=dev-libs/libunistring-1.3 ~arm64
-
-# The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =dev-libs/luksmeta-9-r1 **
 
 # Keep versions on both arches in sync.
 =dev-libs/raft-0.22.1 ~arm64
-=dev-python/cryptography-45.0.4 ~arm64
-=dev-python/cython-3.1.2 ~arm64
-=dev-python/msgpack-1.1.1 ~arm64
 
 # No arm64 keyword in package.
 =dev-util/bsdiff-4.3-r4 **
 
 # Catalyst 4 is not stable yet, but earlier versions are masked now.
 =dev-util/catalyst-4.0.0 ~amd64 ~arm64
 
-# Needed to address CVE-2025-4373
-=dev-util/gdbus-codegen-2.84.3 ~arm64
-=dev-util/glib-utils-2.84.3 ~arm64
-
 # Keep versions on both arches in sync.
 =dev-util/xdelta-3.0.11-r1 ~arm64
 
@@ -118,44 +76,30 @@ dev-cpp/azure-security-keyvault-keys
 
 # Keep versions on both arches in sync.
 =net-firewall/conntrack-tools-1.4.8-r1 ~arm64
-=net-firewall/ipset-7.24 ~arm64
 
 # Needed to address CVE-2025-2312.
 =net-fs/cifs-utils-7.3 ~amd64 ~arm64
 
 # Keep versions on both arches in sync.
 =net-libs/libnetfilter_cthelper-1.0.1-r1 ~arm64
 =net-libs/libnetfilter_cttimeout-1.0.1 ~arm64
-=net-libs/libnftnl-1.2.9 ~arm64
 
 # Needed for addressing CVE-2025-47268 and CVE-2025-48964
 =net-misc/iputils-20250605 ~amd64 ~arm64
 
-# Keep versions on both arches in sync.
-=net-misc/passt-2025.04.15 ~arm64
-
 # Packages are in Gentoo but not expected to be used outside Flatcar, so they
 # are generally never stabilised. Thus an unusual form is used to pick up the
 # latest version of the package with the unstable keywords.
 sys-apps/azure-vm-utils
 
 # Keep versions on both arches in sync.
-=sys-apps/dtc-1.7.2-r2 ~arm64
 =sys-apps/portage-3.0.68 ~arm64
 =sys-apps/zram-generator-1.2.1 ~arm64
-
-# Needed to avoid pulling python into production images.
-=sys-auth/sssd-2.9.6-r3 ~arm64
-
-# Keep versions on both arches in sync.
-=sys-boot/gnu-efi-4.0.1 ~arm64
+=sys-auth/sssd-2.9.7 ~arm64
 =sys-boot/mokutil-0.7.2 **
 
 # Enable ipvsadm for arm64.
 =sys-cluster/ipvsadm-1.31-r1 ~arm64
 
 # Keep versions on both arches in sync.
 =sys-fs/lxcfs-6.0.4 ~arm64
-=sys-libs/libcap-2.76 ~arm64
-=sys-libs/libunwind-1.8.2 ~arm64
-=sys-process/audit-4.0.2-r1 ~arm64

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-auth/sssd/README.md

@@ -1,6 +1,2 @@
-DIST sudo-1.9.16p2.tar.gz 5398419 BLAKE2B ef9f1c2cd4044454a808d1dff5f865355e1bd061d1b5c93a005207e28e9b9df7c267cf01358ce60dd2c98f6844b51dab00eac4e7a08bade1d621235c3a4774bf SHA512 1e2ea762671890a03b0ea4b95b3849f2d3a4c301432db8767433e9d80c517efd8b7a68e0bbce1b178aff5857907600f1f5e0d889779cb27e38c2f602395f6f06
-DIST sudo-1.9.16p2.tar.gz.sig 566 BLAKE2B 90f90658a7d6ec3b32f6a726a2cd28e156826a65749a88a2a29d970e97804d2d75de856bc85c9a459233b59e35564c5fbf93aff53ffe42d17d0e94dd23724acd SHA512 7f0e3269c9befada535590b2cfc36f96cd70831b5c030df5b3bf8c7cb3eff296d22193429f940db4a0df849b4d8080e4006086c49869b4bbae663836b2632b49
-DIST sudo-1.9.17.tar.gz 5447899 BLAKE2B d9f2e0d8bca5d5dba5f78a9c064454032038fa60dae022ce72dd0d262bc4bd756fcc5a8e5b0ab4e179c3786fc86a401f7f1ba6d45ca4fe02e43d5cacb1e7f022 SHA512 e94df174ca63a828d953d8400d7e68f8cb86119ca1cd845567b7b452d09bef806a6bd0a6cfc232acfdf7c85aa915f2897b29990c7df89b36c92c62aa469cd7a7
-DIST sudo-1.9.17.tar.gz.sig 566 BLAKE2B c7543ab8f3a20a27eb2df6b4b6f0aa69d657cbc5d88ea4377ec28b5ef77ec137b7a88a9f28d7051a0ce95493e4c860a01a1cb7e081563183850f4d704805336e SHA512 c03534cf696f300c4434ad2053267b586d3a01459269206632c3c8f348469d3b40d7b4ace30373203c539e2f69b94402d6d2b96da1427d7e872509e4e8029812
 DIST sudo-1.9.17p1.tar.gz 5449076 BLAKE2B 21771348a8de392767c366bb938951327dcc64a4cedee716a802435899e5135c218468271833a9e3ab9d90bda29e36c0870e27dd333d3a5c64fb8e3a5ebbff58 SHA512 1a9fb27a117b54adf5c99443b3375f7e0eaaf3a2d5a3d409f7c7b10c43432eb301d721df93fb1a8a2e45bf4a4957288d4f153359fc018af00973be57f62a1ebc
 DIST sudo-1.9.17p1.tar.gz.sig 566 BLAKE2B b6380c84b82740455a28388925d27bdf9296ddef943653c1883af3c7684ab53571053ef333ac9747ee11330b06fd23adf477856f70bd5fcaa6dbda1c9e432675 SHA512 714ce7c613683689e9d166171b04c03220e21d06f2e66d800f2d075927830014447611933d7293d9c763beeea66fc02255d8175c9ac8cba6d62166750aab50a6