Weekly portage-stable package updates 2026-07-06

[github-actions]

CI: TODO

--

• app-admin/eselect: [DEV]

  • from 1.4.31 to 1.4.32
  • release notes: https://gitweb.gentoo.org/proj/eselect.git/plain/NEWS?id=1ff2aea90d6cd2bb93019deb40d3c7c7a0b5c36f

• app-arch/libarchive: [PROD] [DEV]

  • from 3.8.7 to 3.8.8
  • fixes CVE-2026-14164
    • update: libarchive Flatcar#2193
  • package became unstable on 'amd64' and 'arm64'
    • added accept keywords to overlay profiles
  • release notes: https://github.com/libarchive/libarchive/releases/tag/v3.8.8

• app-containers/aardvark-dns: [SYSEXT-PODMAN]

  • from 1.17.0 to 2.0.0
  • fixes CVE-2026-35406
    • no Flatcar issue filed
  • package became unstable on 'amd64' and 'arm64'
    • added accept keywords to overlay profiles
  • build dependencies:
    • changes for dev-lang/rust with USE conditionals '||':
      • changed version constraint from >=1.87.0 to >=1.88.0
    • changes for dev-lang/rust-bin with USE conditionals '||':
      • changed version constraint from >=1.87.0 to >=1.88.0
  • release notes: https://github.com/containers/aardvark-dns/releases/tag/v2.0.0 https://github.com/containers/aardvark-dns/releases/tag/v1.17.1

• app-containers/conmon: [SYSEXT-PODMAN]

  • from 2.1.13 to 2.2.1
  • package became unstable on 'amd64' and 'arm64'
    • added accept keywords to overlay profiles
  • added IUSE flag 'selinux'
  • runtime dependencies:
    • added a dependency 'sec-policy/selinux-podman' for USE 'selinux?'
  • release notes: https://github.com/containers/conmon/releases/tag/v2.2.1 https://github.com/containers/conmon/releases/tag/v2.2.0

• app-containers/crun: [SYSEXT-PODMAN]

  • from 1.21 to 1.28
  • fixes CVE-2026-30892
    • update: crun Flatcar#2061
  • package became unstable on 'amd64' and 'arm64'
    • added accept keywords to overlay profiles
  • dependencies and runtime dependencies:
    • dropped a dependency 'dev-libs/yajl:='
    • added a dependency 'dev-libs/json-c:='
    • added a dependency 'sys-libs/error-standalone' for USE 'elibc_musl?'
  • release notes: https://github.com/containers/crun/releases/tag/1.2{8..2}

• app-containers/docker: [SYSEXT-DOCKER]

  • from 28.2.2 to 29.1.3-r1
  • dependencies:
    • added a dependency 'net-firewall/nftables:='
  • runtime dependencies:
    • changes for app-containers/containerd:
      • changed version constraint from >=1.7.27 to >=2.2.0
    • changes for app-containers/docker-cli weak blocker:
      • changed version constraint from <28.2.2 to <29.1.3
    • dropped a dependency '>=net-firewall/iptables-1.4'
    • added a dependency 'net-firewall/nftables:='
  • dropped installation of udev rules
    • these were for devicemapper, which docker no longer supports
  • release notes: https://github.com/moby/moby/releases/tag/docker-v29.1.3 https://github.com/moby/moby/releases/tag/docker-v29.1.2 https://github.com/moby/moby/releases/tag/docker-v29.1.1 https://github.com/moby/moby/releases/tag/docker-v29.1.0 https://github.com/moby/moby/releases/tag/docker-v29.0.0

• app-containers/docker-cli: [SYSEXT-DOCKER]

  • still at 29.1.3
  • package became stable on 'amd64' and 'arm64'
    • dropped accept keywords from overlay profiles

• app-containers/incus: [SYSEXT-INCUS]

  • from 6.0.5-r1 to 7.2
  • fixes a boatload of CVEs
    • update: incus Flatcar#2063
  • package became unstable on 'amd64'
    • updated accept keywords in overlay profiles
  • added IUSE flag 'selinux'
  • build dependencies:
    • changes for dev-lang/go:
      • changed version constraint from >=1.21 to >=1.25.10
  • runtime dependencies:
    • changes for dev-libs/cowsql:
      • changed version constraint from >=1.15.9 to >=1.15.7
    • added a dependency 'net-firewall/nftables[json]'
    • dropped a dependency 'net-firewall/iptables' for USE '||'
    • dropped a dependency 'net-firewall/nftables[json]' for USE '||'
    • added a dependency 'sec-policy/selinux-incus' for USE 'selinux?'
  • release notes: https://discuss.linuxcontainers.org/t/incus-7-2-has-been-released/26879 https://discuss.linuxcontainers.org/t/incus-7-0-lts-has-been-released/26641

• app-containers/lxc: [SYSEXT-INCUS]

  • from 6.0.5 to 7.0.0
  • fixes CVE-2026-39402
    • update: lxc Flatcar#2122
  • added IUSE flag 'doc'
  • added IUSE flag 'landlock'
  • build dependencies:
    • added a dependency 'app-text/doxygen' for USE 'doc?'
  • release notes: https://discuss.linuxcontainers.org/t/lxc-7-0-lts-has-been-released/26612

• app-containers/netavark: [SYSEXT-PODMAN]

  • from 1.17.1 to 2.0.0
  • package became unstable on 'amd64' and 'arm64'
    • added accept keywords for this package in overlay profiles
  • build dependencies:
    • changes for dev-lang/rust with USE conditionals '||':
      • changed version constraint from >=1.86 to >=1.88.0
    • changes for dev-lang/rust-bin with USE conditionals '||':
      • changed version constraint from >=1.86 to >=1.88.0
  • release notes: https://github.com/containers/netavark/releases/tag/v2.0.0 https://github.com/containers/netavark/releases/tag/v1.17.2

• app-containers/podman: [SYSEXT-PODMAN]

  • from 5.7.1 to 6.0.0
  • fixes CVE-2026-33414, CVE-2026-44517, CVE-2026-57231
    • update: podman Flatcar#2083
  • package became unstable on 'amd64' and 'arm64'
    • added accept keywords to overlay profiles
  • build dependencies:
    • added a dependency '>=dev-lang/go-1.25.6'
  • dependencies and runtime dependencies:
    • changes for app-containers/conmon:
      • changed version constraint from >=2.1.10 to >=2.2.1
    • dropped a dependency '>=app-containers/containers-common-0.58.0-r1'
    • added a dependency '>=app-containers/container-libs-0.68.0'
  • release notes: https://github.com/podman-container-tools/podman/releases/tag/v6.0.0 https://github.com/podman-container-tools/podman/releases/tag/v5.8.0

• app-crypt/adcli: [PROD] [DEV]

  • still at 0.9.3.1
  • brings in cross-compilation fix, so we can drop our own

• app-crypt/gnupg: [PROD] [DEV]

  • from 2.5.18 to 2.5.20-r1
  • fixes gnupg-20260513 (CVE)
    • update: gnupg Flatcar#2154
  • release notes: https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000505.html (2.5.20), https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html (2.5.19)

• app-crypt/libmd: [PROD] [DEV]

  • from 1.1.0 to 1.2.0
  • release notes: https://git.hadrons.org/cgit/libmd.git/log/?h=1.2.0

• app-crypt/mit-krb5: [PROD] [DEV]

  • from 1.21.3-r1 to 1.22.2-r2
  • package became stable on 'arm64'
    • dropped accept keywords from overlay profiles
  • added cross-compilation fixes, so we can drop our own
  • release notes: https://web.mit.edu/kerberos/krb5-1.22/krb5-1.22.2.html

• app-crypt/rhash:

  • from 1.4.5 to 1.4.6-r1
  • added IUSE flag 'cpu_flags_x86_sha'
  • release notes: https://github.com/rhash/RHash/releases/tag/v1.4.6

• app-doc/eclass-manpages:

  • from 20260426 to 20260624
  • release notes: none

• app-emulation/qemu-guest-agent: [PROD] [DEV]

  • from 9.2.0 to 10.2.2
  • release notes: https://wiki.qemu.org/ChangeLog/10.2#Guest_agent

• app-emulation/virt-firmware:

  • from 26.2 to 26.2-r1
  • build dependencies:
    • changes for dev-python/setuptools:
      • dropped version constraint
  • runtime dependencies:
    • added a dependency 'dev-python/pkg-resources[python_targets_python3_12(-)?,python_targets_python3_13(-)?,python_targets_python3_14(-)?]'

• app-portage/getuto: [DEV]

  • from 1.18 to 2.0
  • release notes: https://github.com/projg2/getuto/commits/getuto-2.0/

• app-shells/bash: [PROD] [DEV]

  • from 5.3_p9-r1 to 5.3_p9-r2
  • added a patch fixing pid reuse
    • the issue sometimes appeared during flatcar builds
    • it is the same patch we used in user-patches, so dropping it

• dev-build/meson:

  • from 1.9.2 to 1.11.1
  • release notes: https://mesonbuild.com/Release-notes-for-1-11-0.html https://mesonbuild.com/Release-notes-for-1-10-0.html

• dev-db/sqlite: [PROD] [DEV]

  • from 3.51.3 to 3.53.1
  • release notes: https://sqlite.org/releaselog/3_53_1.html

• dev-debug/gdb: [DEV]

  • from 17.1 to 17.2
  • release notes: https://sourceware.org/pipermail/gdb-announce/2026/000148.html

• dev-debug/strace: [PROD] [DEV]

  • from 6.19 to 7.0-r1
  • added IUSE flag 'ncurses'
  • dependencies:
    • added a dependency 'sys-libs/ncurses[static-libs(+)]' for USE 'static?' -> 'ncurses?'
    • added a dependency 'dev-libs/elfutils' for USE '!static?' -> 'elfutils?'
    • added a dependency 'sys-libs/ncurses:=' for USE '!static?' -> 'ncurses?'
    • added a dependency 'sys-libs/libselinux' for USE '!static?' -> 'selinux?'
    • added a dependency 'sys-libs/libunwind:=' for USE '!static?' -> 'unwind?'
  • runtime dependencies:
    • added a dependency 'sys-libs/ncurses:=' for USE '!static?' -> 'ncurses?'
  • release notes: https://github.com/strace/strace/releases/tag/v7.0

• dev-go/go-md2man:

  • still at 2.0.7
  • fixed cross-compilation

• dev-lang/go:

  • still at 1.26.3
  • package became stable on 'amd64' and 'arm64'
    • dropped accept keywords for this package in overlay profiles

• dev-lang/perl:

  • from 5.42.0-r1 to 5.42.2
  • fixes CVE-2026-4176
    • update: perl Flatcar#2084
  • release notes: https://perldoc.perl.org/perl5422delta

• dev-lang/rust:

  • from 1.93.1 to 1.95.0
  • removed IUSE flag 'llvm_slot_21'
  • added IUSE flag 'llvm_slot_22'
  • default llvm version is 22
  • runtime dependencies:
    • added a dependency 'dev-db/sqlite:3'
  • release notes: https://blog.rust-lang.org/2026/04/16/Rust-1.95.0/ https://blog.rust-lang.org/2026/03/05/Rust-1.94.0/

• dev-lang/tcl:

  • from 8.6.16 to 8.6.17
  • release notes: https://sourceforge.net/p/tcl/mailman/message/59221153/

• dev-libs/expat: [PROD] [DEV]

  • from 2.8.1 to 2.8.2
  • fixes a bunch of CVEs
    • update: expat Flatcar#2174
  • release notes: https://blog.hartwork.org/posts/expat-2-8-2-released/

• dev-libs/glib: [PROD] [DEV]

  • from 2.84.4-r5 to 2.88.2
  • fixes a bunch of CVEs
    • update: glib Flatcar#2058
  • build dependencies:
    • changes for dev-util/gi-docgen with USE conditionals 'doc?':
      • changed version constraint from >=2023.1 to >=2026.1
  • dependencies and runtime dependencies:
    • changes for dev-libs/gobject-introspection weak blocker:
      • changed version constraint from <1.80.1 to <1.86.0
    • changes for dev-util/gdbus-codegen weak blocker:
      • changed version constraint from <2.84.4 to <2.88.2
  • release notes: https://gitlab.gnome.org/GNOME/glib/-/releases/2.88.2 https://gitlab.gnome.org/GNOME/glib/-/releases/2.88.1 https://gitlab.gnome.org/GNOME/glib/-/releases/2.88.0 https://gitlab.gnome.org/GNOME/glib/-/releases/2.86.0

• dev-libs/gobject-introspection-common:

  • from 1.84.0 to 1.86.0
  • runtime dependencies:
    • changes for dev-libs/gobject-introspection weak blocker:
      • changed version constraint from <1.84.0 to <1.86.0
  • release notes: https://gitlab.gnome.org/GNOME/gobject-introspection/-/releases/1.86.0

• dev-libs/libgpg-error: [PROD] [DEV]

  • from 1.59 to 1.60
  • release notes: https://dev.gnupg.org/T8112.html

• dev-libs/libksba: [PROD] [DEV]

  • from 1.6.8 to 1.8.0
  • release notes: https://dev.gnupg.org/T8253.html

• dev-libs/libunistring: [PROD] [DEV]

  • from 1.3 to 1.4.2
  • release notes: https://gitweb.git.savannah.gnu.org/gitweb/?p=libunistring.git;a=blob;f=NEWS;h=e97ee06e03d6fea559665306c82f02e09725893a;hb=7dee51196310a703972a94843ecaf92decce6f82

• dev-libs/libuv: [PROD] [DEV]

  • from 1.51.0-r1 to 1.52.1
  • build dependencies:
    • changes for sec-keys/openpgp-keys-libuv with USE conditionals 'verify-sig?':
      • added version constraint >=20260323
  • release notes: https://github.com/libuv/libuv/releases/tag/v1.52.1 https://github.com/libuv/libuv/releases/tag/v1.52.0

• dev-libs/libxml2: [PROD] [DEV]

  • still at 2.15.3
  • package became stable on 'amd64' and 'arm64'
    • dropped accept keywords from overlay profiles

• dev-libs/nspr:

  • from 4.38.2 to 4.39
  • release notes: https://hg-edge.mozilla.org/projects/nspr/log/54e7c1b0803d151e142e30dc0d05f12e1ec67a13

• dev-libs/xmlsec: [VMWARE]

  • from 1.3.10-r1 to 1.3.11-r1
  • build dependencies:
    • added a dependency 'app-text/doxygen' for USE 'doc?'
    • added a dependency 'virtual/pandoc' for USE 'doc?'
  • release notes: https://github.com/lsh123/xmlsec/releases/tag/1.3.11

• dev-python/cryptography:

  • from 46.0.7 to 48.0.0
  • build dependencies:
    • changes for dev-lang/rust with USE conditionals '||':
      • changed version constraint from >=1.74.1 to >=1.83.0
    • changes for dev-lang/rust-bin with USE conditionals '||':
      • changed version constraint from >=1.74.1 to >=1.83.0
  • release notes: https://raw.githubusercontent.com/pyca/cryptography/refs/tags/48.0.0/CHANGELOG.rst

• dev-python/distlib: [SYSEXT-PYTHON]

  • from 0.4.0 to 0.4.1
  • release notes: https://raw.githubusercontent.com/pypa/distlib/refs/tags/0.4.1/CHANGES.rst

• dev-python/docutils:

  • from 0.22.4 to 0.23
  • release notes: https://docutils.sourceforge.io/HISTORY.html#release-0-23-2026-05-27

• dev-python/editables:

  • from 0.5 to 0.6
  • release notes: https://raw.githubusercontent.com/pfmoore/editables/refs/tags/0.6/CHANGELOG.md

• dev-python/ensurepip-pip: [AZURE] [DEV] [GCE] [SYSEXT-PYTHON]

  • from 26.0.1 to 26.1.2
  • release notes: https://raw.githubusercontent.com/pypa/pip/refs/tags/26.1.2/NEWS.rst

• dev-python/hatchling:

  • from 1.29.0 to 1.30.1
  • release notes: https://github.com/pypa/hatch/releases/tag/hatchling-v1.30.1

• dev-python/idna: [SYSEXT-PYTHON]

  • from 3.14 to 3.18
  • release notes: https://github.com/kjd/idna/releases/tag/v3.18 https://github.com/kjd/idna/releases/tag/v3.17 https://github.com/kjd/idna/releases/tag/v3.16 https://github.com/kjd/idna/releases/tag/v3.15

• dev-python/installer:

  • from 0.7.0 to 1.0.1
  • added IUSE flag 'verify-provenance'
  • build dependencies:
    • added a dependency 'dev-python/pypi-attestations' for USE 'verify-provenance?'
  • release notes: https://github.com/pypa/installer/releases/tag/1.0.1 https://github.com/pypa/installer/releases/tag/1.0.0

• dev-python/jaraco-functools: [SYSEXT-PYTHON]

  • from 4.4.0 to 4.5.0
  • release notes: https://raw.githubusercontent.com/jaraco/jaraco.functools/refs/tags/v4.5.0/NEWS.rst

• dev-python/markdown-it-py: [SYSEXT-PYTHON]

  • from 4.0.0 to 4.2.0
  • release notes: https://github.com/executablebooks/markdown-it-py/releases/tag/v4.2.0

• dev-python/more-itertools: [SYSEXT-PYTHON]

  • from 11.0.2 to 11.1.0
  • release notes: https://github.com/more-itertools/more-itertools/releases/tag/v11.1.0

• dev-python/packaging: [SYSEXT-PYTHON]

  • from 26.1 to 26.2
  • release notes: https://github.com/pypa/packaging/releases/tag/26.2

• dev-python/pathspec:

  • from 1.0.4 to 1.1.1
  • release notes: https://raw.githubusercontent.com/cpburnz/python-pathspec/refs/tags/v1.1.1/CHANGES.rst

• dev-python/pip: [SYSEXT-PYTHON]

  • from 26.0.1 to 26.1.2
  • build dependencies and runtime dependencies:
    • changes for dev-python/packaging:
      • changed version constraint from >=25.0 to >=26.2
    • changes for dev-python/requests:
      • changed version constraint from >=2.32.4 to >=2.33.1
  • release notes: https://raw.githubusercontent.com/pypa/pip/refs/tags/26.1.2/NEWS.rst

• dev-python/platformdirs: [SYSEXT-PYTHON]

  • from 4.9.6 to 4.10.0
  • release notes: https://github.com/tox-dev/platformdirs/releases/tag/4.10.0

• dev-python/poetry-core:

  • from 2.3.2 to 2.4.1
  • build dependencies and runtime dependencies:
    • changes for dev-python/packaging:
      • changed version constraint from >=25.0 to >=26.2
  • release notes: https://github.com/python-poetry/poetry-core/releases/tag/2.4.1

• dev-python/requests: [SYSEXT-PYTHON]

  • from 2.33.1 to 2.34.2
  • release notes: https://github.com/psf/requests/releases/tag/v2.34.2 https://github.com/psf/requests/releases/tag/v2.34.1 https://github.com/psf/requests/releases/tag/v2.34.0

• dev-python/trove-classifiers: [SYSEXT-PYTHON]

  • from 2026.1.14.14 to 2026.6.1.19
  • release notes: https://github.com/pypa/trove-classifiers/releases/tag/2026.6.1.19

• dev-util/catalyst:

  • from 4.1.1 to 4.1.1-r1
  • dependencies and runtime dependencies:
    • added a dependency 'app-portage/gemato[python_targets_python3_12(-)?,python_targets_python3_13(-)?,python_targets_python3_14(-)?]'

• dev-util/gdbus-codegen:

  • from 2.84.4 to 2.88.2
  • dependencies and runtime dependencies:
    • changes for dev-libs/glib:
      • changed version constraint from >=2.84.4 to >=2.88.2
  • release notes: https://gitlab.gnome.org/GNOME/glib/-/releases/2.88.2

• dev-util/glib-utils:

  • from 2.84.4 to 2.88.2
  • release notes: https://gitlab.gnome.org/GNOME/glib/-/releases/2.88.2

• dev-util/maturin:

  • from 1.12.6 to 1.13.3
  • build dependencies:
    • changes for dev-lang/rust with USE conditionals '||':
      • changed version constraint from >=1.88.0 to >=1.89.0
    • changes for dev-lang/rust-bin with USE conditionals '||':
      • changed version constraint from >=1.88.0 to >=1.89.0
  • dependencies and runtime dependencies:
    • changes for dev-libs/openssl with USE conditionals 'ssl?':
      • dropped version constraint
  • licenses:
    • added license 'ISC'
    • added license 'MIT-0'
    • added license 'openssl'
  • release notes: https://github.com/PyO3/maturin/releases/tag/v1.13.3

• dev-util/patchutils:

  • from 0.4.2 to 0.4.5-r1
  • EAPI changed from '7' to '8'
  • dependencies and runtime dependencies:
    • added a weak blocker '!<app-shells/bash-completion-2.16.0-r3'
    • added a dependency '>=sys-libs/error-standalone-2.0' for USE 'elibc_musl?'
    • added a dependency 'dev-lang/python:3.12' for USE 'python_single_target_python3_12?'
  • licenses:
    • dropped license 'GPL-2'
    • added license 'GPL-2+'
  • release notes: https://github.com/twaugh/patchutils/releases/tag/0.4.5 https://github.com/twaugh/patchutils/releases/tag/0.4.4 https://github.com/twaugh/patchutils/releases/tag/0.4.3

• dev-util/perf:

  • from 6.14 to 6.19.12
  • removed IUSE flag 'doc'
    • docs are now built unconditionally
  • build dependencies:
    • changes for app-text/asciidoc with USE conditionals 'doc?':
      • dropped all USE conditionals
    • changes for app-text/sgml-common with USE conditionals 'doc?':
      • dropped all USE conditionals
    • changes for app-text/xmlto with USE conditionals 'doc?':
      • dropped all USE conditionals
    • changes for sys-process/time with USE conditionals 'doc?':
      • dropped all USE conditionals
  • runtime dependencies:
    • dropped a dependency 'sys-libs/binutils-libs:='
  • release notes: none

• dev-vcs/git: [PROD] [DEV]

  • from 2.53.0 to 2.54.0
  • release notes: https://raw.githubusercontent.com/git/git/refs/tags/v2.54.0/Documentation/RelNotes/2.54.0.adoc

• eclass/bash-completion-r1.eclass:

  • mostly replaced by shell-completion eclass

• eclass/linux-mod.eclass:

  • unused, dropped

• eclass/optfeature.eclass:

  • added support for EAPI 9

• eclass/python-utils-r1.eclass:

  • dropped pypy3 and python 3.11 from supported versions

• eclass/qmake-utils.eclass:

  • added support for EAPI 9

• eclass/qt-utils.eclass:

  • added from Gentoo

• eclass/secureboot.eclass:

  • added support for systemd-sbsign

• eclass/shell-completion.eclass:

  • added support for EAPI 7 and 9

• licenses:

  • added EUPL-1.2, GPL-2+-with-eCos-exception-2, MIT-0, NVIDIA-2025

• net-dns/bind: [PROD] [DEV]

  • from 9.18.42 to 9.20.23
  • fixes a bunch of CVEs
    • update: bind Flatcar#1999
  • package became unstable on 'arm64'
    • added accept keywords to overlay profiles
  • removed IUSE flag 'caps'
    • became unconditional
  • added IUSE flag 'verify-sig'
  • added IUSE flag 'systemtap'
  • build dependencies:
    • added a dependency 'dev-debug/systemtap' for USE 'systemtap?'
  • dependencies and runtime dependencies:
    • added a dependency 'dev-libs/userspace-rcu:='
    • added a dependency '>=sys-libs/libcap-2.1.0'
    • dropped a dependency '>=sys-libs/libcap-2.1.0' for USE 'caps?'
  • release notes: https://bind9.readthedocs.io/en/v9.20.23/notes.html#notes-for-bind-9-20-23

• net-fs/cifs-utils: [PROD] [DEV]

  • from 7.5 to 7.6
  • fixes CVE-2026-12505
    • update: cifs-utils Flatcar#2194
  • package became unstable on 'amd64' and 'arm64'
    • added accept keywords to overlay profiles
  • release notes: https://lists.samba.org/archive/samba-technical/2026-June/140908.html

• net-libs/gnutls: [PROD] [DEV]

  • still at 3.8.13
  • package became stable on 'amd64' and 'arm64'
    • dropped accept keywords from overlay profiles

• net-libs/libmicrohttpd: [PROD] [DEV]

  • from 1.0.1-r1 to 1.0.5
  • fixes CVE-2025-59777, CVE-2025-62689
    • update: libmicrohttpd Flatcar#1944
  • package became unstable on 'amd64' and 'arm64'
    • added accept keywords to overlay profiles
  • dependencies and runtime dependencies:
    • changes for net-libs/gnutls with USE conditionals 'ssl?':
      • changed version constraint from >2.12.20 to >2.12.20-r0
  • release notes: https://lists.gnu.org/archive/html/libmicrohttpd/2026-04/msg00003.html (1.0.5), https://lists.gnu.org/archive/html/libmicrohttpd/2026-04/msg00000.html (1.0.3)

• net-libs/nghttp2: [PROD] [DEV]

  • from 1.68.0 to 1.68.1
  • fixes CVE-2026-27135
    • update: nghttp2 Flatcar#2055
  • dropped USE jemalloc, dropped support for jemalloc
  • release notes: https://github.com/nghttp2/nghttp2/releases/tag/v1.68.1

• net-misc/curl: [PROD] [DEV]

  • from 8.19.0 to 8.21.0
  • fixes a bunch of CVEs
    • update: curl Flatcar#2188
  • became unstable, so added accept keywords to overlay profiles
  • removed IUSE flag 'rtmp'
    • dropped by upstream
  • removed IUSE flag 'samba'
    • weak security, rarely used
  • dependencies and runtime dependencies:
    • dropped a dependency 'media-video/rtmpdump[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_s390_32(-)?,abi_s390_64(-)?]' for USE 'rtmp?'
    • changes for dev-libs/openssl with USE conditionals 'ssl?' -> 'openssl?':
      • changed version constraint from >=1.0.2 to >=3.0.0
    • added a dependency '>=dev-libs/openssl-4.0.0_beta1:=[static-libs?,abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_s390_32(-)?,abi_s390_64(-)?]' for USE 'ssl?' -> 'openssl?' -> 'ech?'
  • release notes: https://curl.se/ch/8.21.0.html https://curl.se/ch/8.20.0.html

• net-misc/passt: [SYSEXT-PODMAN]

  • from 2025.12.15 to 2026.05.26
  • package became unstable on 'amd64' and 'arm64'
    • added accept keywords to overlay profiles
  • release notes: https://archives.passt.top/passt-user/20260527093624.6349111e@elisabeth/T/#u

• net-misc/rsync: [PROD] [DEV]

  • from 3.4.3 to 3.4.4
  • release notes: https://github.com/RsyncProject/rsync/releases/tag/v3.4.4

• net-nds/openldap: [PROD] [DEV]

  • from 2.6.8-r1 to 2.6.13
  • added IUSE flag 'verify-sig'
  • build dependencies:
    • dropped a dependency 'acct-group/ldap' for USE '!minimal?'
    • dropped a dependency 'acct-user/ldap' for USE '!minimal?'
  • dependencies:
    • changes for dev-db/lmdb with USE conditionals '!minimal?':
      • changed version constraint from >=0.9.33 to >=0.9.35
  • runtime dependencies:
    • added a dependency 'acct-group/ldap' for USE '!minimal?'
    • added a dependency 'acct-user/ldap' for USE '!minimal?'
    • changes for dev-db/lmdb with USE conditionals '!minimal?':
      • changed version constraint from >=0.9.33 to >=0.9.35
  • release notes: none

• profiles:

  • ech (encrypted client hello) masked in curl - dependency on openssl 4, which is also masked

• sec-policy/selinux-base: [PROD] [DEV]

  • from 2.20250618_p1 to 2.20260312_p1
  • user patches are now applied inside the refpolicy directory, making it inconsistent with packages using selinux-policy-2 eclass
    • created a separate set of patches for it
    • https://bugs.gentoo.org/979024
  • release notes: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260312 https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250923

• sec-policy/selinux-base-policy: [PROD] [DEV]

  • from 2.20250618_p1-r1 to 2.20260312_p1
  • user patches are now applied inside the refpolicy directory, making it inconsistent with packages using selinux-policy-2 eclass
    • created a separate set of patches for it
    • https://bugs.gentoo.org/979024
  • dependencies and runtime dependencies:
    • changes for sec-policy/selinux-base:
      • changed version constraint from ~2.20250618_p1 to ~2.20260312_p1
  • release notes: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260312 https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250923

• sec-policy/selinux-container: [PROD] [DEV]

  • from 2.20250618_p1 to 2.20260312_p1
  • regenerated the user patches
  • dependencies and runtime dependencies:
    • changes for sec-policy/selinux-base-policy:
      • changed version constraint from >=2.20250618-r1 to >=2.20260312_p1
  • release notes: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260312 https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250923

• sec-policy/selinux-dbus: [PROD] [DEV]

  • from 2.20250618_p1 to 2.20260312_p1
  • regenerated the user patches
  • dependencies and runtime dependencies:
    • changes for sec-policy/selinux-base-policy:
      • changed version constraint from >=2.20250618-r1 to >=2.20260312_p1
  • release notes: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260312 https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250923

• sec-policy/selinux-policykit: [PROD] [DEV]

  • from 2.20250618_p1 to 2.20260312_p1
  • regenerated the user patches
  • dependencies and runtime dependencies:
    • changes for sec-policy/selinux-base-policy:
      • changed version constraint from >=2.20250618-r1 to >=2.20260312_p1
  • release notes: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260312 https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250923

• sec-policy/selinux-sssd: [PROD] [DEV]

  • from 2.20250618_p1 to 2.20260312_p1
  • regenerated the user patches
  • dependencies and runtime dependencies:
    • changes for sec-policy/selinux-base-policy:
      • changed version constraint from >=2.20250618-r1 to >=2.20260312_p1
  • release notes: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260312 https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250923

• sec-policy/selinux-unconfined: [PROD] [DEV]

  • from 2.20250618_p1 to 2.20260312_p1
  • regenerated the user patches
  • dependencies and runtime dependencies:
    • changes for sec-policy/selinux-base-policy:
      • changed version constraint from >=2.20250618-r1 to >=2.20260312_p1
  • release notes: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260312 https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250923

• sys-apps/checkpolicy: [PROD] [DEV]

  • from 3.9 to 3.10
  • dependencies and runtime dependencies:
    • changes for sys-libs/libsepol:
      • changed version constraint from >=3.9 to >=3.10
  • release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.10

• sys-apps/ethtool: [PROD] [DEV]

  • from 6.19 to 7.0
  • release notes: https://git.kernel.org/pub/scm/network/ethtool/ethtool.git/plain/NEWS?h=v7.0

• sys-apps/gentoo-functions: [PROD] [DEV]

  • from 1.7.6 to 1.7.7
  • release notes: https://gitweb.gentoo.org/proj/gentoo-functions.git/log/?h=gentoo-functions-1.7.7

• sys-apps/i2c-tools: [DEV]

  • from 4.3-r2 to 4.4
  • release notes: https://git.kernel.org/pub/scm/utils/i2c-tools/i2c-tools.git/tree/CHANGES?h=v4.4

• sys-apps/iproute2: [PROD] [DEV]

  • from 6.19.0 to 7.0.0
  • release notes: https://lwn.net/Articles/1067497/

• sys-apps/kbd: [PROD] [DEV]

  • from 2.9.0-r2 to 2.10.0
  • added IUSE flag 'xkb'
    • allow to generate kernel keymaps based on xkb database from x11-libs/libxkbcommon
    • disabled in Flatcar
  • dependencies and runtime dependencies:
    • added a dependency 'x11-libs/libxkbcommon' for USE 'xkb?'
  • release notes: https://github.com/legionus/kbd/releases/tag/v2.10.0

• sys-apps/portage: [DEV]

  • from 3.0.81 to 3.0.81.1
  • package became stable on 'amd64' and ''arm64'
    • dropped accept keywords from overlay profiles
  • release notes: https://gitweb.gentoo.org/proj/portage.git/plain/NEWS?h=portage-3.0.81.1

• sys-apps/sed: [PROD] [DEV]

  • from 4.9-r1 to 4.10
  • fixes CVE-2026-5958
    • update: sed Flatcar#2123
  • release notes: https://lists.gnu.org/archive/html/info-gnu/2026-04/msg00009.html

• sys-apps/semodule-utils: [PROD] [DEV]

  • from 3.9 to 3.10
  • release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.10

• sys-apps/shadow: [PROD] [DEV]

  • still at 4.19.4
  • build dependencies:
    • dropped a dependency 'acct-group/shadow'
  • dependencies:
    • added a dependency 'acct-group/shadow'

• sys-apps/systemd: [PROD] [DEV]

  • from 260.1-r1 to 260.1-r2
  • creates autovt symlinks pointing to getty
    • https://bugs.gentoo.org/974688
    • https://bugs.gentoo.org/971385

• sys-apps/util-linux: [PROD] [DEV]

  • still at 2.41.4-r1
  • runtime dependencies:
    • added a dependency 'sec-policy/selinux-uuidd' for USE 'uuidd?' -> 'selinux?'
  • licenses:
    • added license 'BSD'
    • added license 'BSD-2'
    • added license 'EUPL-1.2'
    • added license 'GPL-1+'
    • dropped license 'GPL-3'
    • dropped license 'LGPL-2.1'
    • added license 'GPL-2+'
    • added license 'GPL-3+'
    • added license 'LGPL-2.1+'

• sys-devel/crossdev:

  • from 20260326 to 20260501-r1
  • prints a warning about requiring another repository called crossdev
    • TODO: I think we use x-crossdev, actually, so we need to check if nothing breaks
  • release notes: https://gitweb.gentoo.org/proj/crossdev.git/log/?h=20260501

• sys-devel/gcc: [PROD] [DEV]

  • from 15.2.1_p20260214 to 15.3.0
  • bumped patchset to 8
    • https://gitweb.gentoo.org/proj/gcc-patches.git/tree/15.2.0/gentoo/README.history?id=2b488bf0f2c283c927f95a06671937d0649eeb72
  • release notes: none

• sys-fs/btrfs-progs: [PROD] [DEV]

  • from 6.19.1 to 7.0
  • release notes: https://github.com/kdave/btrfs-progs/releases/tag/v7.0

• sys-fs/lxcfs: [SYSEXT-INCUS]

  • from 6.0.5 to 7.0.0
  • release notes: https://discuss.linuxcontainers.org/t/lxcfs-7-0-lts-has-been-released/26607

• sys-fs/xfsprogs: [PROD] [DEV]

  • from 6.19.0 to 7.0.1
  • dependencies:
    • changes for sys-kernel/linux-headers:
      • changed version constraint from >=6.11 to >=6.18
  • release notes: https://web.git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/plain/doc/CHANGES?h=v7.0.1 https://web.git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/plain/doc/CHANGES?h=v7.0.0

• sys-kernel/coreos-sources:

  • still at 6.12.95
  • added IUSE flag 'vanilla'
    • came through kernel-2 eclass - enabling it removes Gentoo patches
    • not really relevant to Flatcar

• sys-kernel/dracut: [PROD] [DEV]

  • from 110-r5 to 111-r1
  • release notes: https://github.com/dracut-ng/dracut/releases/tag/111

• sys-libs/glibc: [PROD] [DEV]

  • from 2.42-r7 to 2.43-r2
  • added IUSE flag 'clang'
    • build with clang
  • release notes: https://sourceware.org/pipermail/libc-announce/2026/000052.html

• sys-libs/libselinux: [PROD] [DEV]

  • from 3.9 to 3.10-r2
  • build dependencies:
    • dropped a dependency 'dev-python/pip[python_targets_python3_11(-)?,python_targets_python3_12(-)?,python_targets_python3_13(-)?,python_targets_python3_14(-)?]' for USE 'python?'
  • release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.10

• sys-libs/libsepol: [PROD] [DEV]

  • from 3.9 to 3.10
  • build dependencies:
    • added a dependency 'sys-devel/flex'
  • TODO: review ebuild.diff
  • TODO: review occurrences
  • release notes: TODO

• sys-libs/libunwind: [PROD] [DEV]

  • from 1.8.2-r1 to 1.8.3
  • package became unstable on 'arm64'
    • TODO: add/update accept keywords for this package in overlay profiles
  • build dependencies:
    • added a dependency '>=dev-build/libtool-2.4.7-r3'
    • added a dependency 'sys-devel/gnuconfig'
    • added a dependency '>=dev-build/automake-1.18.1:1.18' for USE '||'
    • added a dependency '>=dev-build/autoconf-2.73:2.73' for USE '||'
    • added a dependency '>=dev-build/autoconf-2.72-r1:2.72' for USE '||'
  • TODO: review ebuild.diff
  • TODO: review occurrences
  • release notes: TODO

• sys-libs/liburing: [PROD] [DEV]

  • still at 2.9
  • TODO: review ebuild.diff
  • TODO: review occurrences

• sys-libs/libxcrypt: [PROD] [DEV]

  • still at 4.4.38-r1
  • TODO: review ebuild.diff
  • TODO: review occurrences

• sys-libs/talloc: [PROD] [DEV]

  • from 2.4.3 to 2.4.4
  • TODO: review ebuild.diff
  • TODO: review occurrences
  • release notes: TODO

• sys-libs/tdb: [PROD] [DEV]

  • from 1.4.14 to 1.4.15
  • TODO: review occurrences
  • release notes: TODO

• sys-libs/timezone-data: [PROD] [DEV]

  • from 2026a to 2026b
  • TODO: review occurrences
  • release notes: TODO

• sys-process/audit: [PROD] [DEV]

  • from 4.1.4-r1 to 4.1.4-r4
  • added IUSE flag 'build'
    • TODO: describe added IUSE flag
  • build dependencies:
    • changes for dev-python/setuptools with USE conditionals 'python?' -> 'python_targets_python3_12?':
      • USE conditionals changed to 'python?'
  • install dependencies:
    • added a dependency 'virtual/tmpfiles' for USE '!build?'
  • runtime dependencies:
    • dropped a dependency 'virtual/tmpfiles'
  • TODO: review ebuild.diff
  • TODO: review other.diff
  • TODO: review occurrences

• virtual/ldb: [PROD] [DEV]

  • still at 2.11.0
  • TODO: review ebuild.diff
  • TODO: review occurrences

• virtual/libudev: [PROD] [DEV]

  • from 251-r2 to 257
  • runtime dependencies:
    • changes for sys-apps/systemd with USE conditionals 'systemd?':
      • changed version constraint from >=251 to >=257
    • changes for sys-apps/systemd-utils with USE conditionals '!systemd?':
      • changed version constraint from >=251 to >=257
  • TODO: review ebuild.diff
  • TODO: review occurrences

• virtual/perl-Carp:

  • from 1.540.0-r2 to 1.540.0-r3
  • runtime dependencies:
    • added a dependency '=dev-lang/perl-5.44*' for USE '||'
  • TODO: review ebuild.diff
  • TODO: review occurrences

• virtual/perl-Exporter:

  • from 5.790.0 to 5.790.0-r1
  • runtime dependencies:
    • added a dependency '=dev-lang/perl-5.44*' for USE '||'
  • TODO: review ebuild.diff
  • TODO: review occurrences

• x11-drivers/nvidia-drivers: [SYSEXT-NVIDIA-DRIVERS-535] [SYSEXT-NVIDIA-DRIVERS-535-OPEN]

  • still at 535.309.01
  • TODO: review ebuild.diff
  • TODO: review other.diff
  • TODO: review occurrences

--

• changelog
• image diff

[Copilot]

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.