Weekly portage-stable package updates 2026-05-25

[github-actions]

CI: https://jenkins.flatcar.org/job/container/job/sdk/44/cldsv/

Closes flatcar/Flatcar#2051
Closes flatcar/Flatcar#2053
Closes flatcar/Flatcar#2062
Closes flatcar/Flatcar#2066
Closes flatcar/Flatcar#2069
Closes flatcar/Flatcar#2073
Closes flatcar/Flatcar#2074
Closes flatcar/Flatcar#2082
Closes flatcar/Flatcar#2087
Closes flatcar/Flatcar#2088
Closes flatcar/Flatcar#2120
Closes flatcar/Flatcar#2153

Partially addresses flatcar/Flatcar#2050
Partially addresses flatcar/Flatcar#2049
Partially addresses flatcar/Flatcar#2155
Partially addresses flatcar/Flatcar#2157

Security issue for nvidia-drivers is addressed partially as only 535 line adressed that. Other lines we have (550 and 570) are EOL and are moved to coreos-overlay as x11-drivers/old-nvidia-drivers. Dropping of the old nvidia drivers and adding newer versions should be done in different PR.

--

• app-arch/libarchive: [PROD] [DEV]

  • from 3.8.5 to 3.8.7
  • fixes CVE-2026-4426
    • update: libarchive Flatcar#2053
  • package became stable on 'amd64' and 'arm64'
    • dropped accept keywords from overlay profiles
  • dependencies:
    • added a dependency 'virtual/os-headers'
    • added a dependency 'sys-fs/e2fsprogs[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_s390_32(-)?,abi_s390_64(-)?]' for USE 'e2fsprogs?'
    • dropped a dependency 'virtual/os-headers' for USE 'kernel_linux?'
    • dropped a dependency 'sys-fs/e2fsprogs[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_s390_32(-)?,abi_s390_64(-)?]' for USE 'kernel_linux?' -> 'e2fsprogs?'
  • release notes: https://github.com/libarchive/libarchive/releases/tag/v3.8.7 https://github.com/libarchive/libarchive/releases/tag/v3.8.6

• app-arch/xz-utils: [PROD] [DEV]

  • from 5.8.2 to 5.8.3
  • fixes CVE-2026-34743
    • update: app-arch/xz-utils Flatcar#2066
  • release notes: https://github.com/tukaani-project/xz/releases/tag/v5.8.3

• app-containers/containerd: [SYSEXT-CONTAINERD]

  • from 2.2.1 to 2.2.2
  • dropped our patches, they are in the update
  • release notes: https://github.com/containerd/containerd/releases/tag/v2.2.2

• app-containers/cri-tools: [PROD] [DEV]

  • still at 1.33.0
  • drop our patch - it's being brought through FILESDIR now
  • build dependencies:
    • changes for dev-lang/go:
      • changed version constraint from >=1.20 to >=1.24.1
      • dropped slot constraint
    • added a dependency '>=dev-lang/go-1.24.11:='

• app-containers/docker-cli: [SYSEXT-DOCKER]

  • still at 29.1.3
  • dropped unnecessary cross-compilation fix

• app-crypt/adcli: [PROD] [DEV]

  • from 0.9.2 to 0.9.3.1
  • added IUSE flag 'netapi'
    • for Samba's offline join feature, disabled
  • added IUSE flag 'selinux'
  • dependencies:
    • added a dependency 'net-fs/samba' for USE 'netapi?'
  • runtime dependencies:
    • added a dependency 'net-fs/samba' for USE 'netapi?'
    • added a dependency 'sec-policy/selinux-kerberos' for USE 'selinux?'
  • release notes: https://gitlab.freedesktop.org/realmd/adcli/-/releases/0.9.3.1 https://gitlab.freedesktop.org/realmd/adcli/-/releases/0.9.3a

• app-crypt/gnupg: [PROD] [DEV]

  • from 2.5.17-r2 to 2.5.18
  • release notes: https://lists.gnupg.org/pipermail/gnupg-announce/2017q1/000401.html

• app-doc/eclass-manpages:

  • from 20260124 to 20260426
  • release notes: none

• app-editors/nano:

  • from 8.7.1 to 9.0
  • release notes: https://lists.gnu.org/archive/html/info-nano/2026-04/msg00001.html

• app-emulation/qemu:

  • from 10.2.0-r1 to 10.2.2
  • release notes: https://lists.nongnu.org/archive/html/qemu-devel/2026-03/msg05601.html

• app-emulation/virt-firmware:

  • from 24.11 to 26.2
  • release notes: none

• app-portage/gentoolkit: [DEV]

  • from 0.7.1 to 0.7.2
  • release notes: https://codeberg.org/gentoo/gentoolkit/commits/tag/gentoolkit-0.7.2

• app-portage/getuto: [DEV]

  • from 1.15-r1 to 1.18
  • release notes: https://github.com/projg2/getuto/commits/getuto-1.18/

• app-portage/portage-utils:

  • from 0.97 to 0.97.1
  • release notes: https://gitweb.gentoo.org/proj/portage-utils.git/log/?h=v0.97.1

• dev-build/autoconf-wrapper:

  • from 20231224 to 20260320
  • release notes: https://gitweb.gentoo.org/proj/autotools-wrappers.git/log/?h=at-20260320

• dev-build/cmake:

  • from 4.1.4 to 4.3.3
  • release notes: https://cmake.org/cmake/help/v4.3/release/4.3.html https://cmake.org/cmake/help/v4.2/release/4.2.html

• dev-cpp/azure-core:

  • from 1.16.2 to 1.16.3
  • release notes: https://github.com/Azure/azure-sdk-for-cpp/releases/tag/azure-core_1.16.3

• dev-db/sqlite: [PROD] [DEV]

  • from 3.51.2 to 3.51.3
  • release notes: https://sqlite.org/releaselog/3_51_3.html

• dev-lang/go:

  • from 1.25.8 to 1.26.3
  • fixes CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501
    • update: go Flatcar#2157 (partially)
  • EAPI changed from '8' to '9'
  • package became unstable on 'amd64' and 'arm64'
    • added accept keywords to overlay profiles
  • build dependencies:
    • changes for dev-lang/go with USE conditionals '||':
      • changed version constraint from >=1.22.12 to >=1.24.6
    • changes for dev-lang/go-bootstrap with USE conditionals '||':
      • changed version constraint from >=1.22.12 to >=1.24.6
  • release notes: https://go.dev/doc/go1.26

• dev-lang/go-bootstrap:

  • from 1.22.12 to 1.24.6
  • release notes: https://go.dev/doc/go1.24

• dev-lang/python: [AZURE] [DEV] [GCE] [SYSEXT-PYTHON]

  • from 3.12.12 to 3.12.13_p1
  • release notes: https://www.python.org/downloads/release/python-31213/

• dev-lang/rust:

  • from 1.92.0_p1-r1 to 1.93.1
  • IUSE flag 'doc' became enabled by default
    • disabled in Flatcar profiles
  • IUSE flag 'rustfmt' became enabled by default
    • disabled in Flatcar profiles
  • IUSE flag 'clippy' became enabled by default
    • disabled in Flatcar profiles
  • build dependencies:
    • added a dependency 'dev-lang/rust:1.93.1' for USE '||'
    • added a dependency 'dev-lang/rust-bin:1.93.1' for USE '||'
  • release notes: https://blog.rust-lang.org/2026/02/12/Rust-1.93.1/ https://blog.rust-lang.org/2026/01/22/Rust-1.93.0/

• dev-libs/elfutils: [PROD] [DEV]

  • from 0.194-r1 to 0.195
  • release notes: https://inbox.sourceware.org/elfutils-devel/CAJDtP-Qok4ViNzvrr28WgkCCqrFH0iAZStiD8C7nbpDhrPzLWA@mail.gmail.com/T/

• dev-libs/expat: [PROD] [DEV]

  • from 2.7.5 to 2.8.1
  • fixes CVE-2026-41080 CVE-2026-45186
    • update: expat Flatcar#2153
  • release notes: https://blog.hartwork.org/posts/expat-2-8-1-released/ https://blog.hartwork.org/posts/expat-2-8-0-released/

• dev-libs/glib: [PROD] [DEV]

  • from 2.84.4-r2 to 2.84.4-r5
  • package became stable on 'amd64' and 'arm64'
    • dropped accept keywords from overlay profiles

• dev-libs/jose: [PROD] [DEV]

  • still at 14
  • package became stable on 'amd64' and received a keyword for 'arm64'
    • updated accept keywords in overlay profiles

• dev-libs/libgcrypt: [PROD] [DEV]

  • from 1.11.2-r1 to 1.12.2
  • fixes CVE-2026-41989
    • update: libgcrypt Flatcar#2088
  • dependencies:
    • changes for dev-libs/libgpg-error:
      • changed version constraint from >=1.49 to >=1.56
  • runtime dependencies:
    • changes for dev-libs/libgpg-error:
      • changed version constraint from >=1.49 to >=1.56
  • release notes: https://dev.gnupg.org/T8114.html https://dev.gnupg.org/T8067.html https://lists.gnupg.org/pipermail/gnupg-announce/2026q1/000502.html

• dev-libs/libgpg-error: [PROD] [DEV]

  • from 1.58 to 1.59
  • release notes: https://dev.gnupg.org/T7974.html

• dev-libs/libksba: [PROD] [DEV]

  • from 1.6.7 to 1.6.8
  • release notes: https://dev.gnupg.org/T7174.html

• dev-libs/libsodium: [PROD] [DEV]

  • from 1.0.21_p20260122 to 1.0.22
  • release notes: https://github.com/jedisct1/libsodium/releases/tag/1.0.22-RELEASE

• dev-libs/libtraceevent:

  • from 1.8.4 to 1.9.0
  • package became unstable on 'arm64'
    • added accept keywords to overlay profiles
  • release notes: https://lwn.net/Articles/1057413/

• dev-libs/libtracefs:

  • from 1.8.2 to 1.8.3
  • release notes: none

• dev-libs/libxml2: [PROD] [DEV]

  • from 2.15.1 to 2.15.3
  • dropped unnecessary user patches
  • fixes CVE-2026-0989, CVE-2026-0990, CVE-2026-0992, CVE-2026-1757, libxml2-20260415
    • update: libxml2 Flatcar#2049 (partially)
  • package became unstable on 'amd64' and 'arm64'
    • added accept keywords to overlay profiles
  • release notes: https://gitlab.gnome.org/GNOME/libxml2/-/raw/v2.15.3/NEWS https://gitlab.gnome.org/GNOME/libxml2/-/raw/v2.15.2/NEWS

• dev-libs/mpc: [DEV]

  • from 1.3.1 to 1.4.1
  • release notes: https://gitlab.inria.fr/mpc/mpc/-/raw/1.4.1/NEWS https://gitlab.inria.fr/mpc/mpc/-/raw/1.4.0/NEWS

• dev-libs/openssl: [PROD] [DEV]

  • from 3.5.5-r2 to 3.5.6
  • fixes CVE-2026-2673, CVE-2026-28386, CVE-2026-28387, CVE-2026-28388, CVE-2026-28389, CVE-2026-28390, CVE-2026-31790
    • update: openssl Flatcar#2051
  • release notes: https://openssl-library.org/post/2026-04-07-release-announcement/

• dev-libs/tree-sitter:

  • from 0.25.10 to 0.26.8
  • build dependencies:
    • added a dependency 'app-alternatives/ninja'
    • added a dependency '>=dev-build/cmake-3.28.5'
  • release notes: https://github.com/tree-sitter/tree-sitter/releases/tag/v0.26.8

• dev-python/chardet:

  • from 5.2.0 to 6.0.0_p1
  • build dependencies:
    • dropped a dependency '>=dev-python/setuptools-78.1.0[python_targets_pypy3_11(-)?,python_targets_python3_11(-)?,python_targets_python3_12(-)?,python_targets_python3_13(-)?,python_targets_python3_14(-)?]'
    • added a dependency 'dev-python/hatch-vcs[python_targets_pypy3_11(-)?,python_targets_python3_11(-)?,python_targets_python3_12(-)?,python_targets_python3_13(-)?,python_targets_python3_14(-)?]'
    • added a dependency '>=dev-python/hatchling-1.27.0[python_targets_pypy3_11(-)?,python_targets_python3_11(-)?,python_targets_python3_12(-)?,python_targets_python3_13(-)?,python_targets_python3_14(-)?]'
  • release notes: https://github.com/chardet/chardet/releases/tag/6.0.0

• dev-python/charset-normalizer: [SYSEXT-PYTHON]

  • from 3.4.4 to 3.4.7
  • added IUSE flag 'native-extensions'
    • disabled in Flatcar, otherwise pulls in a bunch of dependencies
  • added IUSE flag 'debug'
  • build dependencies:
    • added a dependency 'dev-python/mypy[python_targets_python3_11(-)?,python_targets_python3_12(-)?,python_targets_python3_13(-)?,python_targets_python3_14(-)?]' for USE 'native-extensions?' -> 'python_targets_python3_12?'
  • dependencies:
    • added a dependency 'dev-lang/python:3.12' for USE 'python_targets_python3_12?'
  • release notes: https://github.com/jawah/charset_normalizer/releases/tag/3.4.{7..5}

• dev-python/cryptography:

  • from 46.0.5 to 46.0.7
  • release notes: https://github.com/pyca/cryptography/blob/46.0.7/CHANGELOG.rst

• dev-python/cython:

  • from 3.1.7 to 3.2.4
  • release notes: https://github.com/cython/cython/releases/tag/3.2.4

• dev-python/ensurepip-pip: [AZURE] [DEV] [GCE] [SYSEXT-PYTHON]

  • from 25.3 to 26.0.1
  • release notes: https://raw.githubusercontent.com/pypa/pip/refs/tags/26.0.1/NEWS.rst

• dev-python/hatchling:

  • from 1.27.0 to 1.29.0
  • release notes: https://github.com/pypa/hatch/releases/tag/hatchling-v1.29.0

• dev-python/idna: [SYSEXT-PYTHON]

  • from 3.11 to 3.14
  • added IUSE flag 'verify-provenance'
  • build dependencies:
    • added a dependency 'dev-python/pypi-attestations' for USE 'verify-provenance?'
  • release notes: https://github.com/kjd/idna/releases/tag/v3.14 https://github.com/kjd/idna/releases/tag/v3.13 https://github.com/kjd/idna/releases/tag/v3.12

• dev-python/jaraco-context: [SYSEXT-PYTHON]

  • from 6.1.0 to 6.1.2
  • release notes: https://raw.githubusercontent.com/jaraco/jaraco.context/refs/tags/v6.1.2/NEWS.rst

• dev-python/jaraco-text: [SYSEXT-PYTHON]

  • from 4.0.0 to 4.2.0
  • release notes: https://raw.githubusercontent.com/jaraco/jaraco.text/refs/tags/v4.2.0/NEWS.rst

• dev-python/linkify-it-py: [SYSEXT-PYTHON]

  • from 2.0.3 to 2.1.0
  • added IUSE flag 'verify-provenance'
  • build dependencies:
    • added a dependency 'dev-python/pypi-attestations' for USE 'verify-provenance?'
  • release notes: https://github.com/tsutsu3/linkify-it-py/releases/tag/v2.1.0

• dev-python/lxml:

  • from 6.0.2 to 6.1.1
  • release notes: https://lxml.de/6.1/changes-6.1.1.html

• dev-python/more-itertools: [SYSEXT-PYTHON]

  • from 10.8.0 to 11.0.2
  • release notes: https://github.com/more-itertools/more-itertools/releases/tag/v11.0.2 https://github.com/more-itertools/more-itertools/releases/tag/v11.0.1 https://github.com/more-itertools/more-itertools/releases/tag/v11.0.0

• dev-python/packaging: [SYSEXT-PYTHON]

  • from 26.0 to 26.1
  • release notes: https://github.com/pypa/packaging/releases/tag/26.1

• dev-python/pip: [SYSEXT-PYTHON]

  • from 25.3 to 26.0.1
  • release notes: https://raw.githubusercontent.com/pypa/pip/refs/tags/26.0.1/NEWS.rst

• dev-python/platformdirs: [SYSEXT-PYTHON]

  • from 4.5.0 to 4.9.6
  • added IUSE flag 'verify-provenance'
  • build dependencies:
    • added a dependency 'dev-python/pypi-attestations' for USE 'verify-provenance?'
  • release notes: https://github.com/tox-dev/platformdirs/releases/tag/4.9.6 https://github.com/tox-dev/platformdirs/releases/tag/4.9.0 https://github.com/tox-dev/platformdirs/releases/tag/4.8.0 https://github.com/tox-dev/platformdirs/releases/tag/4.7.0 https://github.com/tox-dev/platformdirs/releases/tag/4.6.0

• dev-python/poetry-core:

  • from 2.3.0 to 2.3.2
  • release notes: https://github.com/python-poetry/poetry-core/releases/tag/2.3.2

• dev-python/pycparser:

  • from 2.23 to 3.0
  • release notes: https://github.com/eliben/pycparser/releases/tag/release_v3.00

• dev-python/requests: [SYSEXT-PYTHON]

  • from 2.32.5 to 2.33.1
  • added IUSE flag 'verify-provenance'
  • build dependencies:
    • added a dependency 'dev-python/pypi-attestations' for USE 'verify-provenance?'
  • release notes: https://github.com/psf/requests/releases/tag/v2.33.1 https://github.com/psf/requests/releases/tag/v2.33.0

• dev-python/rich: [SYSEXT-PYTHON]

  • from 14.2.0 to 15.0.0
  • release notes: https://github.com/Textualize/rich/releases/tag/v15.0.0 https://github.com/Textualize/rich/releases/tag/v14.3.0

• dev-python/setuptools: [SYSEXT-PYTHON]

  • from 80.9.0-r1 to 82.0.1
  • build dependencies:
    • dropped a dependency 'dev-python/jaraco-collections[python_targets_pypy3_11(-)?,python_targets_python3_13t(-)?,python_targets_python3_14t(-)?,python_targets_python3_11(-)?,python_targets_python3_12(-)?,python_targets_python3_13(-)?,python_targets_python3_14(-)?]'
    • changes for dev-python/jaraco-functools:
      • changed version constraint from >=4 to >=4.4.0
    • changes for dev-python/jaraco-text:
      • changed version constraint from >=3.7.0-r1 to >=4.0.0
    • changes for dev-python/more-itertools:
      • changed version constraint from >=8.12.0-r1 to >=10.8.0
    • changes for dev-python/packaging:
      • changed version constraint from >=24.2 to >=25.0
    • changes for dev-python/platformdirs:
      • changed version constraint from >=4.2.2 to >=4.4.0
    • changes for dev-python/wheel:
      • changed version constraint from >=0.44.0 to >=0.45.1
  • runtime dependencies:
    • dropped a dependency 'dev-python/jaraco-collections[python_targets_pypy3_11(-)?,python_targets_python3_13t(-)?,python_targets_python3_14t(-)?,python_targets_python3_11(-)?,python_targets_python3_12(-)?,python_targets_python3_13(-)?,python_targets_python3_14(-)?]'
    • changes for dev-python/jaraco-functools:
      • changed version constraint from >=4 to >=4.4.0
    • changes for dev-python/jaraco-text:
      • changed version constraint from >=3.7.0-r1 to >=4.0.0
    • changes for dev-python/more-itertools:
      • changed version constraint from >=8.12.0-r1 to >=10.8.0
    • changes for dev-python/packaging:
      • changed version constraint from >=24.2 to >=25.0
    • changes for dev-python/platformdirs:
      • changed version constraint from >=4.2.2 to >=4.4.0
    • changes for dev-python/wheel:
      • changed version constraint from >=0.44.0 to >=0.45.1
  • release notes: https://raw.githubusercontent.com/pypa/setuptools/refs/tags/v82.0.1/NEWS.rst

• dev-python/setuptools-scm: [SYSEXT-PYTHON]

  • from 9.2.2 to 10.0.5
  • build dependencies:
    • changes for dev-python/setuptools:
      • added version constraint >=78.1.0
    • added a dependency '>=dev-python/vcs-versioning-1.0.0[python_targets_pypy3_11(-)?,python_targets_python3_13t(-)?,python_targets_python3_14t(-)?,python_targets_python3_15t(-)?,python_targets_python3_11(-)?,python_targets_python3_12(-)?,python_targets_python3_13(-)?,python_targets_python3_14(-)?,python_targets_python3_15(-)?]'
  • runtime dependencies:
    • added a dependency '>=dev-python/vcs-versioning-1.0.0[python_targets_pypy3_11(-)?,python_targets_python3_13t(-)?,python_targets_python3_14t(-)?,python_targets_python3_15t(-)?,python_targets_python3_11(-)?,python_targets_python3_12(-)?,python_targets_python3_13(-)?,python_targets_python3_14(-)?,python_targets_python3_15(-)?]'
  • release notes: https://github.com/pypa/setuptools-scm/releases/tag/setuptools-scm-v10.0.5 https://github.com/pypa/setuptools-scm/releases/tag/setuptools-scm-v10.0.0

• dev-python/tomli:

  • from 2.3.0 to 2.4.1
  • release notes: https://raw.githubusercontent.com/hukkin/tomli/refs/tags/2.4.1/CHANGELOG.md

• dev-python/uc-micro-py: [SYSEXT-PYTHON]

  • from 1.0.3 to 2.0.0
  • added IUSE flag 'verify-provenance'
  • build dependencies:
    • added a dependency 'dev-python/pypi-attestations' for USE 'verify-provenance?'
  • release notes: https://raw.githubusercontent.com/tsutsu3/uc.micro-py/refs/tags/v2.0.0/CHANGELOG.md

• dev-python/urllib3: [AZURE] [DEV] [SYSEXT-PYTHON]

  • from 2.6.3 to 2.7.0
  • release notes: https://github.com/urllib3/urllib3/releases/tag/2.7.0

• dev-python/wheel: [SYSEXT-PYTHON]

  • from 0.46.2 to 0.47.0
  • release notes: https://github.com/pypa/wheel/releases/tag/0.47.0

• dev-util/bpftool: [PROD] [DEV]

  • from 7.6.0 to 7.7.0-r1
  • release notes: https://github.com/libbpf/bpftool/releases/tag/v7.7.0

• dev-util/debugedit: [DEV]

  • from 5.2-r1 to 5.3
  • build dependencies:
    • changes for sec-keys/openpgp-keys-debugedit with USE conditionals 'verify-sig?':
      • added version constraint >=20260311
  • release notes: https://sourceware.org/cgit/debugedit/log/?h=debugedit-5.3

• dev-util/maturin:

  • from 1.11.5 to 1.12.6
  • build dependencies:
    • changes for dev-lang/rust with USE conditionals '||':
      • changed version constraint from >=1.85.0 to >=1.88.0
    • changes for dev-lang/rust-bin with USE conditionals '||':
      • changed version constraint from >=1.85.0 to >=1.88.0
  • dependencies:
    • changes for dev-libs/openssl with USE conditionals 'ssl?':
      • added version constraint <4
  • runtime dependencies:
    • changes for dev-libs/openssl with USE conditionals 'ssl?':
      • added version constraint <4
  • licenses:
    • added license 'CDLA-Permissive-2.0'
  • release notes: https://github.com/PyO3/maturin/releases/tag/v1.12.6

• dev-vcs/git: [PROD] [DEV]

  • from 2.52.0 to 2.53.0
  • release notes: https://raw.githubusercontent.com/git/git/refs/tags/v2.53.0/Documentation/RelNotes/2.53.0.adoc

• eclass/go-env.eclass:

  • Create named go run wrapper rather than using -exec
  • Add support for EAPI 9
  • Enable CGO by default for EAPI 9

• eclass/go-module.eclass:

  • Add support for EAPI 9
  • Bump minimal go version from 1.20 to 1.24.11
  • Call go-env_set_compile_environment in src_configure for EAPI 9

• eclass/llvm-r2.eclass:

  • added from Gentoo

• eclass/meson.eclass:

  • fix boost detection w/ cross-compile

• eclass/multiprocessing.eclass:

  • add support for EAPI 9

• eclass/rust.eclass:

  • added rust 1.94.1

• eclass/vala.eclass:

  • added from Gentoo

• licenses:

  • dropped GPL-2+-with-eCos-exception-2, NVIDIA-2025, metapackage
  • added CDLA-Permissive-2.0

• media-libs/libpng:

  • from 1.6.55 to 1.6.58
  • release notes: https://www.libpng.org/pub/png/src/libpng-1.6.58-README.txt

• net-analyzer/netperf: [DEV]

  • still at 2.7.0_p20210121-r1
  • package became stable on 'amd64' and 'arm64'
    • dropped accept keywords from overlay profiles

• net-dialup/minicom: [DEV]

  • from 2.10-r1 to 2.11.1
  • release notes: https://salsa.debian.org/minicom-team/minicom/-/releases/2.11.1 https://salsa.debian.org/minicom-team/minicom/-/releases/2.11

• net-dns/dnsmasq: [SYSEXT-INCUS]

  • from 2.91 to 2.92_p2
  • added IUSE flag 'verify-sig'
  • build dependencies:
    • added a dependency '>=app-portage/gemato-20' for USE 'verify-sig?'
    • added a dependency 'sec-keys/openpgp-keys-simonkelley' for USE 'verify-sig?'
    • added a dependency 'app-alternatives/gpg' for USE 'verify-sig?' -> '||'
    • added a dependency 'app-crypt/gnupg[-alternatives(-)]' for USE 'verify-sig?' -> '||'
  • release notes: https://dnsmasq.org/CHANGELOG

• net-firewall/conntrack-tools: [PROD] [DEV]

  • from 1.4.8-r1 to 1.4.9
  • dependencies:
    • changes for net-libs/libnetfilter_conntrack:
      • changed version constraint from >=1.0.9 to >=1.1.1
  • runtime dependencies:
    • changes for net-libs/libnetfilter_conntrack:
      • changed version constraint from >=1.0.9 to >=1.1.1
  • release notes: https://www.mail-archive.com/netfilter-announce@lists.netfilter.org/msg00285.html

• net-firewall/iptables: [PROD] [DEV]

  • from 1.8.11-r1 to 1.8.13
  • added IUSE flag 'verify-sig'
  • release notes: https://www.mail-archive.com/netfilter-announce@lists.netfilter.org/msg00287.html https://www.mail-archive.com/netfilter-announce@lists.netfilter.org/msg00286.html

• net-fs/cifs-utils: [PROD] [DEV]

  • from 7.4 to 7.5
  • release notes: https://git.samba.org/cifs-utils.git/?p=cifs-utils.git;a=log;h=25ba696a213f9a6d7b4fcdd157757695710c8886

• net-libs/gnutls: [PROD] [DEV]

  • from 3.8.12 to 3.8.13
  • package became unstable on 'amd64' and 'arm64'
    • added accept keywords to overlay profiles
  • added IUSE flag 'post-quantum'
    • enable post-quantum algos
  • dependencies and runtime dependencies:
    • added a dependency '>=dev-libs/leancrypto-1.2.0:=[…]' for USE 'post-quantum?'
  • release notes: https://gitlab.com/gnutls/gnutls/-/raw/3.8.13/NEWS

• net-libs/libnetfilter_conntrack: [PROD] [DEV]

  • from 1.1.0 to 1.1.1
  • release notes: https://www.mail-archive.com/netfilter-announce@lists.netfilter.org/msg00284.html

• net-libs/libnetfilter_queue: [PROD] [DEV]

  • from 1.0.5 to 1.0.5-r1
  • EAPI changed from '7' to '8'
  • build dependencies:
    • changes for app-text/doxygen with USE conditionals 'doc?':
      • added dot use enabled requirement (must exist, no pretending if missing)

• net-libs/ngtcp2: [PROD] [DEV]

  • from 1.12.0 to 1.22.1
  • package became unstable on 'amd64' and 'arm64'
    • added accept keywords to overlay profiles
  • added IUSE flag 'verify-sig'
  • IUSE flag 'gnutls' became disabled by default
  • IUSE flag 'openssl' became enabled by default
  • dependencies and runtime dependencies:
    • changes for dev-libs/openssl with USE conditionals 'ssl?' -> 'openssl?':
      • changed version constraint from >=1.1.1 to >=3.5
  • release notes: https://github.com/ngtcp2/ngtcp2/releases/tag/v1.22.1

• net-misc/curl: [PROD] [DEV]

  • from 8.18.0 to 8.19.0
  • fixes CVE-2026-1965, CVE-2026-3783, CVE-2026-3784, CVE-2026-3805
    • update: curl Flatcar#2050 (partially)
  • mostly changes related to QUIC, which is disabled in Flatcar
  • release notes: https://curl.se/ch/8.19.0.html

• net-misc/iperf: [DEV]

  • from 3.20 to 3.21
  • the dropped dependencies are a bug in Gentoo, filed a PR
    • https://codeberg.org/gentoo/gentoo/pulls/1030
  • dependencies:
    • dropped a dependency '>=dev-libs/cJSON-1.7.15'
    • dropped a dependency 'dev-libs/openssl:='
    • dropped a dependency 'net-misc/lksctp-tools' for USE 'sctp?'
    • added a dependency 'virtual/os-headers'
  • release notes: https://github.com/esnet/iperf/releases/tag/3.21

• net-misc/openssh: [PROD] [DEV]

  • from 10.2_p1 to 10.3_p1
  • fixes CVE-2026-35385, CVE-2026-35386, CVE-2026-35387, CVE-2026-35388, CVE-2026-35414
    • update: net-misc/openssh Flatcar#2069
  • release notes: https://www.openssh.org/txt/release-10.3

• net-misc/rsync: [PROD] [DEV]

  • from 3.4.1-r2 to 3.4.3
  • fixes CVE-2026-41035, CVE-2026-29518, CVE-2026-43617, CVE-2026-43618, CVE-2026-43619, CVE-2026-43620, CVE-2026-45232
    • update: rsync Flatcar#2087
  • release notes: https://download.samba.org/pub/rsync/NEWS#3.4.3 https://download.samba.org/pub/rsync/NEWS#3.4.2

• net-misc/whois: [PROD] [DEV]

  • from 5.5.23 to 5.6.6
  • removed IUSE flag 'xcrypt'
    • used to pick between libxcrypt or virtual libcrypt, now only virtual libcrypt is used
  • build dependencies:
    • dropped a dependency 'app-arch/xz-utils'
  • dependencies:
    • added a dependency 'virtual/libcrypt:='
    • dropped a dependency '>=sys-libs/libxcrypt-4.1:=' for USE 'xcrypt?'
    • dropped a dependency 'virtual/libcrypt:=' for USE '!xcrypt?'
  • runtime dependencies:
    • added a dependency 'virtual/libcrypt:='
    • dropped a dependency '>=sys-libs/libxcrypt-4.1:=' for USE 'xcrypt?'
    • dropped a dependency 'virtual/libcrypt:=' for USE '!xcrypt?'
  • release notes: https://github.com/rfc1036/whois/blob/v5.6.6/debian/changelog

• profiles:

  • added support for python 3.15, blacklisted in overlay profiles
  • dev-libs/openssl 4 is masked
  • sys-libs/ncurses >=6.6_p20260411 masked (tmux issues)

• sec-policy/selinux-base: [PROD] [DEV]

  • from 2.20250618-r1 to 2.20250618_p1
  • EAPI changed from '7' to '8'
  • added IUSE flag 'selinux_policy_types_strict'
    • this one is disabled
  • added IUSE flag 'selinux_policy_types_mcs'
  • added IUSE flag 'selinux_policy_types_mls'
  • added IUSE flag 'selinux_policy_types_targeted'
  • similar changes are made in other sec-policy packages, dropped from the report

• sys-apps/bubblewrap:

  • from 0.11.0 to 0.11.2-r1
  • fixes CVE-2026-41163
    • update: bubblewrap Flatcar#2120
  • runtime dependencies:
    • added a dependency 'sec-policy/selinux-bubblewrap' for USE 'selinux?'
  • release notes: https://github.com/containers/bubblewrap/releases/tag/v0.11.2

• sys-apps/checkpolicy: [PROD] [DEV]

  • from 3.8.1 to 3.9
  • dependencies:
    • changes for sys-libs/libsepol:
      • changed version constraint from >=3.8.1 to >=3.9
  • runtime dependencies:
    • changes for sys-libs/libsepol:
      • changed version constraint from >=3.8.1 to >=3.9
  • release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.9

• sys-apps/coreutils: [PROD] [DEV]

  • from 9.9-r12 to 9.11
  • release notes: https://lists.gnu.org/archive/html/coreutils-announce/2026-04/msg00000.html https://lists.gnu.org/archive/html/coreutils-announce/2026-02/msg00000.html

• sys-apps/debianutils:

  • from 5.14-r1 to 5.23.2
  • release notes: https://salsa.debian.org/debian/debianutils/-/raw/debian/5.23.2/debian/changelog?ref_type=tags

• sys-apps/ethtool: [PROD] [DEV]

  • from 6.15 to 6.19
  • release notes: https://git.kernel.org/pub/scm/network/ethtool/ethtool.git/plain/NEWS?h=v6.19

• sys-apps/file: [DEV]

  • from 5.46-r3 to 5.47-r3
  • release notes: https://raw.githubusercontent.com/file/file/refs/tags/FILE5_47/ChangeLog

• sys-apps/hwdata: [PROD] [DEV]

  • from 0.400 to 0.401
  • release notes: https://github.com/vcrhonek/hwdata/releases/tag/v0.401

• sys-apps/iproute2: [PROD] [DEV]

  • from 6.18.0 to 6.19.0
  • release notes: https://www.spinics.net/lists/netdev/msg1158895.html

• sys-apps/man-pages: [DEV]

  • from 6.16-r2 to 6.17-r1
  • release notes: https://lwn.net/ml/all/aYy41v6tYda2Qc_1@devuan/

• sys-apps/pciutils: [PROD] [DEV]

  • from 3.14.0 to 3.15.0
  • release notes: https://git.kernel.org/pub/scm/utils/pciutils/pciutils.git/plain/ChangeLog?h=v3.15.0

• sys-apps/portage: [DEV]

  • from 3.0.77-r3 to 3.0.77-r4
  • added patches:
    • Revert "depgraph: earlier slot operator backtracking"
      • caused unnecessary rebuilds
    • estrip: Don't break the debuglink CRC with the salted build

• sys-apps/pv:

  • from 1.10.3 to 1.10.4
  • release notes: https://codeberg.org/ivarch/pv/releases/tag/v1.10.4

• sys-apps/semodule-utils: [PROD] [DEV]

  • from 3.8.1 to 3.9
  • dependencies:
    • changes for sys-libs/libsepol:
      • changed version constraint from >=3.8.1 to >=3.9
  • runtime dependencies:
    • changes for sys-libs/libsepol:
      • changed version constraint from >=3.8.1 to >=3.9
  • release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.9

• sys-apps/shadow: [PROD] [DEV]

  • from 4.19.3 to 4.19.4
  • release notes: https://github.com/shadow-maint/shadow/releases/tag/4.19.4

• sys-apps/systemd: [PROD] [DEV]

  • from 259.4-r1 to 260.1-r1
  • removed IUSE flag 'split-usr'
    • support for /usr mounting after switching root is removed
  • removed IUSE flag 'cgroup-hybrid'
    • support for cgroupv1 is removed
  • renamed IUSE flag 'http' to 'remote'
  • some deps lost the MULTILIB_USEDEP requirement and slot constraints
    • since this was quite verbose I dropped them from the report
  • regenerated the user patches
    • some patches could be dropped
  • dependencies and runtime dependencies:
    • changes for sys-apps/util-linux:
      • changed version constraint from >=2.32 to >=2.37
    • changes for sys-kernel/linux-headers:
      • changed version constraint from >=4.15 to >=5.10
    • dropped a dependency 'sys-libs/libcap'
    • dropped a dependency 'virtual/libcrypt'
    • changes for sys-fs/cryptsetup with USE conditionals 'cryptsetup?':
      • changed version constraint from >=2.0.1 to >=2.4.0
    • changes for dev-libs/elfutils with USE conditionals 'elfutils?':
      • changed version constraint from >=0.158 to >=0.177
    • added a dependency '>=sys-libs/glibc-2.34' for USE 'elibc_glibc?'
    • added a dependency '>=sys-libs/libxcrypt-4.4.0' for USE 'elibc_glibc?'
    • changes for dev-libs/openssl with USE conditionals 'openssl?':
      • changed version constraint from >=1.1.0 to >=3.0.0
    • changes for sys-libs/libseccomp with USE conditionals 'seccomp?':
      • changed version constraint from >=2.3.3 to >=2.4.0
  • release notes: https://github.com/systemd/systemd/releases/tag/v260

• sys-apps/texinfo:

  • from 7.2-r4 to 7.3
  • release notes: https://lists.gnu.org/archive/html/info-gnu/2026-03/msg00000.html

• sys-apps/util-linux: [PROD] [DEV]

  • from 2.41.3-r1 to 2.41.4-r1
  • fixes CVE-2026-27456
    • update: util-linux Flatcar#2073
  • release notes: https://github.com/util-linux/util-linux/blob/v2.41.4/Documentation/releases/v2.41.4-ReleaseNotes

• sys-auth/sssd: [PROD] [DEV]

  • from 2.9.8 to 2.13.0
  • fixes CVE-2026-6245
    • update: sssd Flatcar#2082
  • removed IUSE flag 'acl'
    • support for access control lists is unconditional
  • added IUSE flag 'filecaps'
    • use file capabilities instead of setuid for some helper binaries
  • added IUSE flag 'openid'
    • support for login via OpenID Connect (like Keycloak), disabled in Flatcar
  • build dependencies:
    • added a dependency 'acct-group/sssd'
    • added a dependency 'acct-user/sssd'
    • added a dependency 'sys-libs/libcap'
    • added a dependency 'virtual/pkgconfig'
  • dependencies:
    • added a dependency 'net-fs/cifs-utils[acl]'
    • added a dependency 'sys-libs/libcap'
    • dropped a dependency 'net-fs/cifs-utils[acl]' for USE 'acl?'
    • added a dependency 'dev-libs/jose' for USE 'openid?'
    • added a dependency 'net-misc/curl' for USE 'openid?'
  • install dependencies:
    • added a dependency 'sys-libs/libcap' for USE 'filecaps?'
  • runtime dependencies:
    • added a dependency 'acct-group/sssd'
    • added a dependency 'acct-user/sssd'
    • added a dependency 'net-fs/cifs-utils[acl]'
    • added a dependency 'sys-libs/libcap'
    • dropped a dependency 'net-fs/cifs-utils[acl]' for USE 'acl?'
    • added a dependency 'virtual/tmpfiles'
    • added a dependency 'dev-libs/jose' for USE 'openid?'
    • added a dependency 'net-misc/curl' for USE 'openid?'
    • dropped a dependency 'sys-apps/pcsc-lite[policykit]' for USE 'passkey?'
  • release notes: https://sssd.io/release-notes/sssd-2.13.0.html https://sssd.io/release-notes/sssd-2.12.0.html https://sssd.io/release-notes/sssd-2.11.0.html https://sssd.io/release-notes/sssd-2.10.0.html

• sys-block/parted: [PROD] [DEV]

  • from 3.6-r2 to 3.7
  • EAPI changed from '7' to '8'
  • added IUSE flag 'static-libs'
  • build dependencies:
    • dropped a dependency '>=app-portage/elt-patches-20250306'
    • dropped a dependency '>=dev-build/libtool-2.4.7-r3'
    • dropped a dependency 'sys-devel/gnuconfig'
    • changes for sec-keys/openpgp-keys-bcl with USE conditionals 'verify-sig?':
      • changed version constraint from >=20230315 to >=20260418
    • dropped a dependency '>=dev-build/automake-1.18.1:1.18' for USE '||'
    • dropped a dependency '>=dev-build/autoconf-2.73:2.73' for USE '||'
    • dropped a dependency '>=dev-build/autoconf-2.72-r1:2.72' for USE '||'
  • release notes: https://savannah.gnu.org/news/?id=10879

• sys-devel/crossdev:

  • from 20260318 to 20260326
  • release notes: https://gitweb.gentoo.org/proj/crossdev.git/log/?h=20260326

• sys-firmware/intel-microcode: [PROD] [DEV]

  • from 20260227_p20260227 to 20260512_p20260513
  • release notes: https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20260512

• sys-fs/btrfs-progs: [PROD] [DEV]

  • from 6.17.1 to 6.19.1
  • release notes: https://github.com/kdave/btrfs-progs/releases/tag/v6.19.1 https://github.com/kdave/btrfs-progs/releases/tag/v6.19

• sys-fs/cryptsetup: [PROD] [DEV]

  • from 2.8.4 to 2.8.6-r1
  • release notes: https://gitlab.com/cryptsetup/cryptsetup/-/raw/v2.8.6/docs/v2.8.6-ReleaseNotes

• sys-fs/e2fsprogs: [PROD] [DEV]

  • from 1.47.3-r1 to 1.47.4
  • release notes: https://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.47.4

• sys-fs/fuse: [SYSEXT-INCUS] [SYSEXT-PODMAN] [VMWARE]

  • from 3.18.1 to 3.18.2
  • release notes: https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2

• sys-fs/lvm2: [PROD] [DEV]

  • from 2.03.37 to 2.03.39
  • added IUSE flag 'xfs'
    • support for xfs?, disabled
  • added IUSE flag 'vdo'
    • support for virtual disk optimizer, disabled
  • dependencies:
    • added a dependency '>=sys-block/vdo-8.3.2.1' for USE 'lvm?' -> 'vdo?'
    • added a dependency 'sys-fs/xfsprogs' for USE 'xfs?'
  • runtime dependencies:
    • added a dependency '>=sys-block/vdo-8.3.2.1' for USE 'lvm?' -> 'vdo?'
  • release notes: https://gitlab.com/lvmteam/lvm2/-/tags/v2_03_39 https://gitlab.com/lvmteam/lvm2/-/tags/v2_03_38

• sys-fs/mdadm: [PROD] [DEV]

  • from 4.5-r1 to 4.6-r1
  • release notes: https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/tree/CHANGELOG.md?h=mdadm-4.6

• sys-fs/squashfs-tools: [DEV] [SYSEXT-INCUS]

  • from 4.7.4 to 4.7.5
  • release notes: https://github.com/plougher/squashfs-tools/releases?q=4.7.5

• sys-fs/xfsprogs: [PROD] [DEV]

  • from 6.18.0 to 6.19.0
  • release notes: https://web.git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/plain/doc/CHANGES?h=v6.19.0

• sys-kernel/dracut: [PROD] [DEV]

  • from 109-r2 to 110-r5
  • package became stable on 'amd64' and 'arm64'
    • dropped accept keywords from overlay profiles
  • release notes: https://github.com/dracut-ng/dracut/releases/tag/110

• sys-libs/libcap: [PROD] [DEV]

  • from 2.77 to 2.78
  • fixes CVE-2026-4878
    • update: libcap Flatcar#2074
  • release notes: https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.x4zn8j3lss6r

• sys-libs/libcap-ng: [PROD] [DEV]

  • from 0.8.5 to 0.9.3
  • added IUSE flag 'bpf'
    • build cap-audit tool, disabled
  • added IUSE flag 'deprecated'
    • build deprecated captest, disabled
  • build dependencies:
    • added a dependency 'llvm-core/clang[llvm_targets_BPF(-)]' for USE 'bpf?'
    • added a dependency 'virtual/pkgconfig' for USE 'bpf?'
  • dependencies:
    • added a dependency 'dev-libs/libbpf:=' for USE 'bpf?'
    • added a dependency 'dev-util/bpftool' for USE 'bpf?'
    • added a dependency 'sys-process/audit' for USE 'bpf?'
  • runtime dependencies:
    • added a dependency 'dev-libs/libbpf:=' for USE 'bpf?'
    • added a dependency 'sys-process/audit' for USE 'bpf?'
  • release notes: https://github.com/stevegrubb/libcap-ng/releases/tag/v0.9.3 https://github.com/stevegrubb/libcap-ng/releases/tag/v0.9.2 https://github.com/stevegrubb/libcap-ng/releases/tag/v0.9.1 https://github.com/stevegrubb/libcap-ng/releases/tag/v0.9

• sys-libs/libselinux: [PROD] [DEV]

  • from 3.8.1-r3 to 3.9
  • modified the ebuild in place to make python optional again
    • same change happened in Gentoo, but for 3.10-r1 ebuild
    • not reporting it to Gentoo, as 3.10-r1 became stable at the time of writing, so we will pick it up next time we do weekly updates
  • package became stable on 'amd64' and 'arm64'
    • dropped accept keywords from overlay profiles
  • dependencies and runtime dependencies:
    • changes for sys-libs/libsepol:
      • changed version constraint from >=3.8.1 to >=3.9
  • release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.9

• sys-libs/libsepol: [PROD] [DEV]

  • from 3.8.1 to 3.9
  • release notes: https://github.com/SELinuxProject/selinux/releases/tag/3.9

• sys-libs/ncurses: [PROD] [DEV]

  • from 6.5_p20250802 to 6.5_p20251220
  • release notes: https://invisible-island.net/ncurses/NEWS.html#t20251220

• sys-libs/timezone-data: [PROD] [DEV]

  • from 2025c to 2026a
  • release notes: https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/ASPLBE3A4BAEXIOQ3KZ6EJSJWBU6L53G/

• sys-libs/zlib: [PROD] [DEV]

  • from 1.3.1-r1 to 1.3.2-r1
  • fixes CVE-2026-27171
    • update: zlib Flatcar#2062
  • release notes: https://github.com/madler/zlib/releases?q=1.3.2

• sys-process/audit: [PROD] [DEV]

  • from 4.0.2-r1 to 4.1.4-r1
  • runtime dependencies:
    • added a dependency 'virtual/tmpfiles'
  • release notes: https://github.com/linux-audit/audit-userspace/releases/tag/v4.1.{4..0}

• sys-process/lsof: [PROD] [DEV]

  • from 4.99.5 to 4.99.6
  • release notes: https://github.com/lsof-org/lsof/releases/tag/4.99.6

• sys-process/procps: [PROD] [DEV]

  • from 4.0.5-r4 to 4.0.6
  • added IUSE flag 'verify-sig'
  • release notes: https://gitlab.com/procps-ng/procps/-/releases/v4.0.6

• x11-drivers/nvidia-drivers: [SYSEXT-NVIDIA-DRIVERS-535] [SYSEXT-NVIDIA-DRIVERS-535-OPEN]

  • from 535.288.01 to 535.309.01
  • fixes CVE-2025-33221, CVE-2026-24182, CVE-2026-24187, CVE-2026-24190, CVE-2026-24192, CVE-2026-24193, CVE-2026-24194, CVE-2026-24195, CVE-2026-24196, CVE-2026-24197, CVE-2026-24198, CVE-2026-24199
    • update: nvidia-drivers Flatcar#2155 (partially - not sure about other versions we distribute)
  • runtime dependencies:
    • dropped a dependency 'dev-libs/openssl:0/3'
    • added a dependency 'dev-libs/openssl:0/3' for USE '||'
    • added a dependency 'dev-libs/openssl-compat:3' for USE '||'
  • release notes: https://docs.nvidia.com/datacenter/tesla/tesla-release-notes-535-309-01/index.html

--

• changelog
• image diff