Weekly portage-stable package updates 2026-09-14

[github-actions]

CI: https://jenkins.flatcar.org/job/container/job/sdk/211/cldsv/

Closes flatcar/Flatcar#2347
Closes flatcar/Flatcar#2407
Closes flatcar/Flatcar#2408
Closes flatcar/Flatcar#2409
Closes flatcar/Flatcar#2410
Closes flatcar/Flatcar#2411
Closes flatcar/Flatcar#2414
Closes flatcar/Flatcar#2415
Closes flatcar/Flatcar#2416
Closes flatcar/Flatcar#2418
Closes flatcar/Flatcar#2419
Closes flatcar/Flatcar#2420

--

• app-arch/cpio: [PROD] [DEV]

  • still at 2.15
  • fixes CVE-2026-66485, CVE-2026-66486 through backported patches
    • update: app-arch/cpio Flatcar#2410

• app-arch/xz-utils: [PROD] [DEV]

  • from 5.8.3 to 5.8.4
  • fixes GHSA-5qpq-xqfv-j9pg
    • update: app-arch/xz-utils Flatcar#2416
  • package became unstable on 'amd64'
  • package became unstable on 'arm64'
  • release notes: https://github.com/tukaani-project/xz/releases/tag/v5.8.4

• app-containers/containerd: [SYSEXT-CONTAINERD]

  • from 2.3.4 to 2.3.5
  • fixes CVE-2026-53495, GHSA-rp3h-jf77-q9p4
    • update: containerd Flatcar#2420
  • release notes: https://github.com/containerd/containerd/releases/tag/v2.3.5

• app-containers/cri-tools: [PROD] [DEV]

  • from 1.36.0 to 1.37.0
  • fixes CVE-2026-34040, CVE-2026-41567, CVE-2026-42306, CVE-2026-39883
    • update: cri-tools Flatcar#2347
  • build dependencies:
    • changes for dev-lang/go:
      • changed version constraint from >=1.26.2 to >=1.26.6
  • release notes: https://github.com/kubernetes-sigs/cri-tools/releases/tag/v1.37.0

• app-containers/crun: [SYSEXT-PODMAN]

  • from 1.28 to 1.29.1-r1
  • fixes CVE-2026-88264, CVE-2026-88265 through backported patches
    • update: app-containers/crun Flatcar#2418
  • package became unstable on 'amd64'
  • package became unstable on 'arm64'
  • dependencies and runtime dependencies:
    • added a dependency 'dev-libs/blake3'
  • release notes: https://github.com/containers/crun/releases/tag/1.29.1 https://github.com/containers/crun/releases/tag/1.29

• app-containers/incus: [SYSEXT-INCUS]

  • from 7.4 to 7.4-r1
  • runtime dependencies:
    • changes for sys-fs/squashfs-tools:
      • added zstd use enabled requirement (must exist, no pretending if missing)

• app-crypt/p11-kit: [PROD] [DEV]

  • still at 0.26.4
  • package became stable on 'amd64'
  • package became stable on 'arm64'

• dev-lang/python: [AZURE] [DEV] [GCE] [SYSEXT-PYTHON]

  • still at 3.13.15
  • fixes CVE-2026-19672 through backported patches
    • update: dev-lang/python Flatcar#2414

• dev-libs/libgcrypt: [PROD] [DEV]

  • from 1.12.3-r1 to 1.12.4
  • package became stable on 'amd64'
  • package became stable on 'arm64'
  • release notes: https://lists.gnu.org/archive/html/info-gnu/2026-09/msg00002.html

• dev-libs/libpcre2: [PROD] [DEV]

  • from 10.47 to 10.48
  • fixes CVE-2026-86145, CVE-2026-89156, CVE-2026-89161, GHSA-9qww-pwc4-77qq, GHSA-q7rw-r7qq-2hx6
    • update: dev-libs/libpcre2 Flatcar#2409
  • package became unstable on 'amd64'
  • package became unstable on 'arm64'
  • release notes: https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48

• dev-libs/libxml2: [PROD] [DEV]

  • from 2.15.3 to 2.15.4
  • fixes CVE-2026-86137, CVE-2026-86138, CVE-2026-86139, CVE-2026-86140, CVE-2026-86141, CVE-2026-86142, CVE-2026-86143, CVE-2026-86144
    • update: dev-libs/libxml2 Flatcar#2408
  • package became unstable on 'amd64'
  • package became unstable on 'arm64'
  • dropped our user patches
  • release notes: https://gitlab.gnome.org/GNOME/libxml2/-/raw/v2.15.4/NEWS

• dev-python/hatchling:

  • from 1.31.0 to 1.32.0
  • build dependencies and runtime dependencies:
    • added a dependency '>=dev-python/tomlkit-0.11.1[python_targets_python3_13(-)?]'
  • release notes: https://github.com/pypa/hatch/releases/tag/hatchling-v1.32.0

• dev-python/platformdirs: [SYSEXT-PYTHON]

  • from 4.10.1 to 4.11.3
  • release notes: https://github.com/tox-dev/platformdirs/releases/tag/4.11.{3..0}

• dev-python/setuptools: [SYSEXT-PYTHON]

  • from 83.0.0 to 84.0.0
  • release notes: https://raw.githubusercontent.com/pypa/setuptools/refs/tags/v84.0.0/NEWS.rst

• dev-python/snakeoil:

  • from 0.11.5 to 0.11.6
  • release notes: https://github.com/pkgcore/snakeoil/releases/tag/v0.11.6

• dev-python/wheel: [SYSEXT-PYTHON]

  • from 0.47.0 to 0.48.0
  • release notes: https://github.com/pypa/wheel/releases/tag/0.48.0

• dev-util/pkgcheck:

  • from 0.10.42 to 0.10.43
  • build dependencies and runtime dependencies:
    • changes for dev-python/snakeoil:
      • changed version constraint from >=0.11.3 to >=0.11.6
    • changes for sys-apps/pkgcore:
      • changed version constraint from >=0.12.37 to >=0.12.42
  • release notes: https://github.com/pkgcore/pkgcheck/releases/tag/v0.10.43

• dev-util/pkgconf: [PROD] [DEV]

  • from 2.5.1 to 3.0.7
  • release notes: https://raw.githubusercontent.com/pkgconf/pkgconf/refs/tags/pkgconf-3.0.7/NEWS

• dev-vcs/git: [PROD] [DEV]

  • still at 2.55.0
  • dropped our user patch in favor of Gentoo's

• net-libs/libpcap: [PROD] [DEV]

  • from 1.10.6 to 1.10.7
  • fixes CVE-2026-0799, CVE-2026-18238, CVE-2026-18313, CVE-2026-31911, CVE-2026-31912, CVE-2026-6244, CVE-2026-6554
    • update: net-libs/libpcap Flatcar#2415
  • build dependencies:
    • changes for sec-keys/openpgp-keys-tcpdump with USE conditionals 'verify-sig?':
      • changed version constraint from >=20260104 to >=20260908
  • release notes: https://raw.githubusercontent.com/the-tcpdump-group/libpcap/refs/tags/libpcap-1.10.7/CHANGES

• net-libs/nghttp2: [PROD] [DEV]

  • from 1.69.0 to 1.70.0
  • fixes CVE-2026-58055
    • update: net-libs/nghttp2 Flatcar#2412
  • package became unstable on 'amd64'
  • package became unstable on 'arm64'
  • release notes: https://github.com/nghttp2/nghttp2/releases/tag/v1.70.0

• net-misc/curl: [PROD] [DEV]

  • from 8.21.0-r1 to 8.22.0
  • fixes CVE-2026-13608, CVE-2026-18924, CVE-2026-19931, CVE-2026-80229, CVE-2026-80230, CVE-2026-80231, CVE-2026-80255, CVE-2026-80256
    • update: net-misc/curl Flatcar#2407
  • package became unstable on 'amd64'
  • package became unstable on 'arm64'
  • dependencies and runtime dependencies:
    • changes for app-arch/brotli with USE conditionals 'brotli?':
      • added version constraint >=1.0.0
    • changes for net-libs/libpsl with USE conditionals 'psl?':
      • added version constraint >=0.16.0
    • changes for net-libs/libssh2 with USE conditionals 'ssh?':
      • changed version constraint from >=1.2.8 to >=1.9.0
    • changes for dev-libs/nettle with USE conditionals 'ssl?' -> 'gnutls?':
      • added version constraint >=3.4.1
    • changes for net-libs/gnutls with USE conditionals 'ssl?' -> 'gnutls?':
      • changed version constraint from >=3.1.10 to >=3.6.5
    • changes for app-arch/zstd with USE conditionals 'zstd?':
      • added version constraint >=1.0
  • release notes: https://curl.se/ch/8.22.0.html

• sys-apps/checkpolicy: [PROD] [DEV]

  • from 3.10 to 3.11
  • dependencies and runtime dependencies:
    • changes for sys-libs/libsepol:
      • changed version constraint from >=3.10 to >=3.11
  • release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.11

• sys-apps/gawk: [PROD] [DEV]

  • from 5.3.2 to 5.4.1-r1
  • fixes CVE-2026-40553, CVE-2026-40467, CVE-2026-40468
    • update: sys-apps/gawk Flatcar#2411
  • package became unstable on 'amd64'
  • package became unstable on 'arm64'
  • release notes: (5.4.1: https://lists.gnu.org/archive/html/info-gnu/2026-07/msg00001.html) (5.4.0: https://lists.gnu.org/archive/html/info-gnu/2026-02/msg00011.html)

• sys-apps/pkgcore:

  • from 0.12.41 to 0.12.42
  • build dependencies and runtime dependencies:
    • changes for dev-python/snakeoil:
      • changed version constraint from >=0.11.5 to >=0.11.6
    • added a dependency 'dev-python/py-landlock[python_targets_python3_13(-)?]' for USE 'amd64?'
  • release notes: https://github.com/pkgcore/pkgcore/releases/tag/v0.12.42

• sys-apps/semodule-utils: [PROD] [DEV]

  • still at 3.11
  • package became stable on 'amd64'
  • package became stable on 'arm64'

• sys-auth/sssd: [PROD] [DEV]

  • still at 2.13.1
  • fixes CVE-2026-87853 through backported patches
    • update: sys-auth/sssd Flatcar#2419

• sys-devel/gnuconfig: [DEV]

  • from 20250710 to 20260517
  • release notes: none

• sys-kernel/dracut: [PROD] [DEV]

  • from 111-r2 to 112
  • release notes: https://github.com/dracut-ng/dracut/releases/tag/112

• sys-libs/libseccomp: [PROD] [DEV]

  • still at 2.6.1
  • package became stable on 'amd64'
  • package became stable on 'arm64'

• sys-libs/libselinux: [PROD] [DEV]

  • still at 3.11-r1
  • package became stable on 'amd64'
  • package became stable on 'arm64'

• sys-libs/libsepol: [PROD] [DEV]

  • still at 3.11
  • package became stable on 'amd64'
  • package became stable on 'arm64'

• virtual/libpcre2-internals: [PROD] [DEV]

  • from 10.47 to 10.48
  • package became unstable on 'amd64'
  • package became unstable on 'arm64'
  • runtime dependencies:
    • changes for dev-libs/libpcre2:
      • changed version constraint from ~10.47 to ~10.48

--

• changelog
• image diff

[krnowak]

CI passed.

[Copilot]

🟡 Changes recommended

One or more issues must be addressed before approval.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates the vendored Gentoo portage tree and Flatcar-specific patches with weekly package versions, security fixes, keyword changes, and build-system adjustments.

Changes:

• Adds and refreshes package versions, manifests, dependencies, and architecture keywords.
• Updates cross-compilation, testing, and build-system patches.
• Refreshes Flatcar security patches, profile masks, and package metadata.

File summaries

File	Description
sdk_container/src/third_party/portage-stable/sys-libs/timezone-data/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-9999.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.4_alpha_pre20251007.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_p3.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.2_p13-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-3.11.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.11-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-2.6.1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/glibc/files/glibc-2.43-hurd-link-helpers.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-libs/glibc/files/glibc-2.43-hurd-ldconfig.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-112.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-fs/fuse/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-fs/fuse/fuse-3.18.3.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-fs/fuse/fuse-3.18.2.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20260517.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-17.0.0_p20260913.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-17.0.0_p20260906.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-17.0.0_p20260823.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-17.0.0_p20260816.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.2.1_p20260912.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.2.1_p20260829.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.2.1_p20260822.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.2.1_p20260815.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.3.1_p20260911.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.3.1_p20260828.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.3.1_p20260821.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.3.1_p20260814.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.4.1_p20260827.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.4.1_p20260820.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.4.1_p20260813.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.4.1_p20260806.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.5.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20260902.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20260826.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20260819.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20260812.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20260805.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/systemd/systemd-261.2.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/semodule-utils/semodule-utils-3.11.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.51.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/pkgcore-0.12.43.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/pkgcore-0.12.42.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.11-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.11.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/bubblewrap/files/bubblewrap-0.12.0-tests-run.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/bubblewrap/files/bubblewrap-0.12.0-musl.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sys-apps/bubblewrap/bubblewrap-0.12.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sec-policy/selinux-unconfined/selinux-unconfined-2.20260616_p1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sec-policy/selinux-sssd/selinux-sssd-2.20260616_p1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sec-policy/selinux-policykit/selinux-policykit-2.20260616_p1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sec-policy/selinux-dbus/selinux-dbus-2.20260616_p1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sec-policy/selinux-container/selinux-container-2.20260616_p1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sec-policy/selinux-base/selinux-base-2.20260616_p1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/sec-policy/selinux-base-policy/selinux-base-policy-2.20260616_p1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2026	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/package.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/arch/ppc/package.use.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.stable.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/net-misc/curl/metadata.xml	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.20.0-cpu-use.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/net-misc/curl/curl-9999.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/net-misc/chrony/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/net-libs/libpcap/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/net-libs/libpcap/libpcap-9999.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/metadata.xml	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-1.0.1-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/eclass/cmake.eclass	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.55.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-vcs/git/files/git-2.55.0-cargo-meson-cross.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-3.0.7.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.43.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.88.3.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.88.3.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-9999.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.7.0-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.48.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/vcs-versioning/vcs-versioning-2.4.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/vcs-versioning/vcs-versioning-2.2.3.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.26.0_p20260816.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/tomlkit/tomlkit-0.15.1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/tomlkit/tomlkit-0.15.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/tomlkit/metadata.xml	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/tomlkit/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.11.6.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-84.0.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-10.3.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/py-landlock/py-landlock-0.1.1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/py-landlock/metadata.xml	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/py-landlock/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.11.8.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.11.3.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/pip/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.32.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-84.0.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.27.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.26.13.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-3.0.1-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-3.0.0-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/libassuan/files/libassuan-3.0.0-remove-putc.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.88.3.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/elfutils/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.193-perf.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.25.13.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-build/gtk-doc-am/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-build/gtk-doc-am/gtk-doc-am-1.36.1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-9999.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-portage/gemato/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-portage/gemato/gemato-20.14.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-misc/jq/files/jq-1.7.1-runpath.patch	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/p11-kit-0.26.4.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/incus/incus-9999.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/incus/incus-7.4-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/docker/docker-29.7.2.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-29.8.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-29.7.2.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/crun/crun-1.29.1-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/crun/crun-1.28-r1.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/cri-tools/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/cri-tools/cri-tools-1.37.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/cri-tools/cri-tools-1.36.0.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/containers-shortnames/containers-shortnames-2025.03.19_p20260615.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/containerd/metadata.xml	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/containerd/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.3.5.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.3.3.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild	Updated as part of this pull request.
sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-auth/sssd/README.md	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-auth/sssd/0004-IDP-fix-user-matching-in-eval_access_token_buf.patch	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/README.md	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-vcs/git/README.md	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-vcs/git/0001-fix-cross.patch	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-python/gpep517/get-config-vars-args.patch	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-libs/libxml2/README.md	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/python/README.md	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/app-containers/crun/README.md	Updated as part of this pull request.
sdk_container/src/third_party/coreos-overlay/coreos/user-patches/app-arch/cpio/README.md	Updated as part of this pull request.
.github/workflows/portage-stable-packages-list	Updated as part of this pull request.

Review details

Suppressed comments (5)

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/app-containers/crun/README.md:2

• The sentence should use the simple present (“fix”), not “are fixing”, because the patches fix the issue.

are fixing some symlink-related security issues. At the time of

sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.3.5.ebuild:14

• Because this ebuild inherits go-module and produces a statically linked Go program, LICENSE="Apache-2.0" is incomplete: containerd v2.3.5 directly uses golang.org/x/sys, whose bundled license is BSD-style. go-module.eclass requires all statically linked dependency licenses; please audit the vendor tree and add the missing licenses, as the cri-tools ebuild does.

LICENSE="Apache-2.0"

sdk_container/src/third_party/portage-stable/app-containers/crun/crun-1.28-r1.ebuild:26

• Because --enable-embedded-blake3=no makes crun link against the system library, this dependency should carry its ABI subslot. With the plain atom, a future blake3 subslot bump will not trigger a crun rebuild; use the same := form used by the repository's other consumer (dev-util/xdelta-3.2.0.ebuild:21).
  sdk_container/src/third_party/portage-stable/app-containers/crun/crun-1.29.1-r1.ebuild:26
• Because --enable-embedded-blake3=no makes crun link against the system library, this dependency should carry its ABI subslot. With the plain atom, a future blake3 subslot bump will not trigger a crun rebuild; use the same := form used by the repository's other consumer (dev-util/xdelta-3.2.0.ebuild:21).
  sdk_container/src/third_party/portage-stable/dev-libs/libassuan/files/libassuan-3.0.0-remove-putc.patch:9
• This patch description uses “was remove”; please change it to “was removed”.

• Files reviewed: 213/217 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chewi]

Last one of these ever? 😉

What happened with the SELinux issues? Was this snapshot before those changes?

[krnowak]

Last one of these ever? 😉

Ah, of this kind maybe. But still, with Gentoo as a submodule, PRs with manual cleanups in profiles and with updates/security changelogs will still be needed.

What happened with the SELinux issues? Was this snapshot before those changes?

I masked the SELinux policy versions that introduced the issues. It's something to look into next week.

[krnowak]

Rebased to add a missing signoff.