flatcar · github-actions · Sep 7, 2026 · Sep 7, 2026 · Sep 7, 2026 · Sep 7, 2026
@@ -750,6 +750,7 @@ virtual/libcrypt
 virtual/libelf
 virtual/libiconv
 virtual/libintl
+virtual/libpcre2-internals
 virtual/libudev
 virtual/libusb
 virtual/man

@@ -0,0 +1,9 @@
+- docker ([CVE-2026-46680](https://www.cve.org/CVERecord?id=CVE-2026-46680))
+- etcd ([CVE-2025-22869](https://www.cve.org/CVERecord?id=CVE-2025-22869), [CVE-2025-30204](https://www.cve.org/CVERecord?id=CVE-2025-30204), [CVE-2026-33186](https://www.cve.org/CVERecord?id=CVE-2026-33186), [CVE-2026-73500](https://www.cve.org/CVERecord?id=CVE-2026-73500))
+- expat ([CVE-2026-66046](https://www.cve.org/CVERecord?id=CVE-2026-66046), [CVE-2026-76641](https://www.cve.org/CVERecord?id=CVE-2026-76641), [CVE-2026-76956](https://www.cve.org/CVERecord?id=CVE-2026-76956), [CVE-2026-76957](https://www.cve.org/CVERecord?id=CVE-2026-76957))
+- incus ([CVE-2026-81500](https://www.cve.org/CVERecord?id=CVE-2026-81500), [CVE-2026-81501](https://www.cve.org/CVERecord?id=CVE-2026-81501))
+- libgcrypt ([libgcrypt-20260826](https://www.openwall.com/lists/oss-security/2026/08/31/8))
+- libksba ([libksba-20260824](https://dev.gnupg.org/T8253.html))
+- python ([CVE-2026-15308](https://www.cve.org/CVERecord?id=CVE-2026-15308))
+- util-linux ([CVE-2026-76642](https://www.cve.org/CVERecord?id=CVE-2026-76642), [CVE-2026-78408](https://www.cve.org/CVERecord?id=CVE-2026-78408), [CVE-2026-78409](https://www.cve.org/CVERecord?id=CVE-2026-78409), [CVE-2026-78410](https://www.cve.org/CVERecord?id=CVE-2026-78410))
+- zfs ([CVE-2026-79619](https://www.cve.org/CVERecord?id=CVE-2026-79619))
@@ -0,0 +1,23 @@
+- SDK: rust ([1.97.1](https://blog.rust-lang.org/2026/07/16/Rust-1.97.1/) (includes [1.97.0](https://blog.rust-lang.org/2026/07/09/Rust-1.97.0/)))
+- azure, dev, gce, sysext-python: python ([3.13.15](https://docs.python.org/release/3.13.15/whatsnew/changelog.html#python-3-13-15-final))
+- base, dev: btrfs-progs ([7.1](https://github.com/kdave/btrfs-progs/releases/tag/v7.1))
+- base, dev: cryptsetup ([2.8.7](https://gitlab.com/cryptsetup/cryptsetup/-/raw/v2.8.7/docs/v2.8.7-ReleaseNotes))
+- base, dev: etcd ([3.5.33](https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.5.md#v3533-2026-07-23))
+- base, dev: expat ([2.8.4](https://github.com/libexpat/libexpat/blob/R_2_8_4/expat/Changes))
+- base, dev: git ([2.55.0](https://raw.githubusercontent.com/git/git/refs/tags/v2.55.0/Documentation/RelNotes/2.55.0.adoc))
+- base, dev: jansson ([2.15.1](https://jansson.readthedocs.io/en/latest/changes.html#version-2-15-1))
+- base, dev: libgcrypt ([1.12.3](https://lists.gnu.org/archive/html/info-gnu/2026-08/msg00007.html))
+- base, dev: libksba ([1.8.1](https://dev.gnupg.org/T8253.html))
+- base, dev: liburing ([2.12](https://github.com/axboe/liburing/releases/tag/liburing-2.12) (includes [2.11](https://github.com/axboe/liburing/releases/tag/liburing-2.11), [2.10](https://github.com/axboe/liburing/releases/tag/liburing-2.10)))
+- base, dev: lsof ([4.99.7](https://github.com/lsof-org/lsof/releases/tag/4.99.7))
+- base, dev: pinentry ([1.3.3](https://raw.githubusercontent.com/gpg/pinentry/refs/tags/pinentry-1.3.3/NEWS))
+- base, dev: shadow ([4.20.0](https://github.com/shadow-maint/shadow/releases/tag/4.20.0))
+- base, dev: systemd ([261.2](https://github.com/systemd/systemd/releases/tag/v261))
+- base, dev: util-linux ([2.42.3](https://github.com/util-linux/util-linux/blob/v2.42.3/Documentation/releases/v2.42.3-ReleaseNotes))
+- sysext-docker: docker ([29.8.0](https://github.com/moby/moby/releases/tag/docker-v29.8.0) (includes [29.7.0](https://github.com/moby/moby/releases/tag/docker-v29.7.0), [29.6.0](https://github.com/moby/moby/releases/tag/docker-v29.6.0)))
+- sysext-incus: incus ([7.4](https://discuss.linuxcontainers.org/t/incus-7-4-has-been-released/27169))
+- sysext-python: packaging ([26.3](https://github.com/pypa/packaging/releases/tag/26.3))
+- sysext-python: pygments ([2.20.0](https://github.com/pygments/pygments/releases/tag/2.20.0))
+- sysext-python: setuptools-scm ([10.2.1](https://github.com/pypa/setuptools-scm/releases/tag/setuptools-scm-v10.2.1))
+- sysext-python: vcs-versioning ([2.2.4](https://github.com/pypa/setuptools-scm/releases/tag/vcs-versioning-v2.2.4))
+- sysext-zfs: zfs ([2.4.4](https://github.com/openzfs/zfs/releases/tag/zfs-2.4.4))
@@ -15,10 +15,7 @@ KEYWORDS="amd64 arm64"
 RDEPEND=">=app-admin/sdnotify-proxy-0.1.0"
 
 src_install() {
-	local tag="v${PV}"
-	if [[ "${ARCH}" != "amd64" ]]; then
-		tag+="-${ARCH}"
-	fi
+	local tag="v${PV}-${ARCH}"
 
 	exeinto /usr/lib/flatcar
 	doexe "${FILESDIR}"/etcd-wrapper

@@ -0,0 +1,19 @@
+diff '--color=auto' -r -u git-2.55.0/src/cargo-meson.sh git-2.55.0-mod/src/cargo-meson.sh
+--- git-2.55.0/src/cargo-meson.sh	2026-09-08 09:35:45.445569075 -0000
++++ git-2.55.0-mod/src/cargo-meson.sh	2026-09-08 09:36:40.445141695 -0000
+@@ -38,7 +38,12 @@
+ 	exit $RET
+ fi
+
+-if ! cmp "$BUILD_DIR/$BUILD_TYPE/$LIBNAME" "$BUILD_DIR/libgitcore.a" >/dev/null 2>&1
++if test "$CBUILD" != "$CHOST" && test -n "$CARGO_BUILD_TARGET"
+ then
+-	cp "$BUILD_DIR/$BUILD_TYPE/$LIBNAME" "$BUILD_DIR/libgitcore.a"
++	BUILD_DIR_EXTRA="$CARGO_BUILD_TARGET/"
++fi
++
++if ! cmp "$BUILD_DIR/$BUILD_DIR_EXTRA$BUILD_TYPE/$LIBNAME" "$BUILD_DIR/libgitcore.a" >/dev/null 2>&1
++then
++	cp "$BUILD_DIR/$BUILD_DIR_EXTRA$BUILD_TYPE/$LIBNAME" "$BUILD_DIR/libgitcore.a"
+ fi
+Only in git-2.55.0-mod/src: cargo-meson.sh.orig
@@ -0,0 +1,3 @@
+The patch `0001-fix-cross.patch` is a temporary fix for
+cross-compiling issue that pops up when building the libgitcore.a rust
+library.
@@ -1,4 +1,4 @@
-From c16ef94786281a7a75c498f33995191f7e1cc93d Mon Sep 17 00:00:00 2001
+From 1b44d9a28eca8b9790b54cdfeef112c61da38880 Mon Sep 17 00:00:00 2001
 From: David Michael <dm0@redhat.com>
 Date: Tue, 16 Apr 2019 02:44:51 +0000
 Subject: [PATCH 1/8] wait-online: set --any by default
@@ -15,10 +15,10 @@ earlier) for the original implementation.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/network/wait-online/wait-online.c b/src/network/wait-online/wait-online.c
-index b1d0b9cde2..e07c11d807 100644
+index e566f89d02..323041be40 100644
 --- a/src/network/wait-online/wait-online.c
 +++ b/src/network/wait-online/wait-online.c
-@@ -24,7 +24,7 @@ static Hashmap *arg_interfaces = NULL;
+@@ -25,7 +25,7 @@ static Hashmap *arg_interfaces = NULL;
  static char **arg_ignore = NULL;
  static LinkOperationalStateRange arg_required_operstate = LINK_OPERSTATE_RANGE_INVALID;
  static AddressFamily arg_required_family = ADDRESS_FAMILY_NO;
@@ -28,5 +28,5 @@ index b1d0b9cde2..e07c11d807 100644
 
  STATIC_DESTRUCTOR_REGISTER(arg_interfaces, hashmap_freep);
 -- 
-2.53.0
+2.55.0
 
@@ -1,4 +1,4 @@
-From ec321c3a3888014f94d782c8f6454745a96bfaab Mon Sep 17 00:00:00 2001
+From 738a8b0776b76f80670b05e05465e7598547ef21 Mon Sep 17 00:00:00 2001
 From: Alex Crawford <alex.crawford@coreos.com>
 Date: Wed, 2 Mar 2016 10:46:33 -0800
 Subject: [PATCH 2/8] needs-update: don't require strictly newer usr
@@ -10,7 +10,7 @@ Updates should be triggered whenever usr changes, not only when it is newer.
  2 files changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/man/systemd-update-done.service.xml b/man/systemd-update-done.service.xml
-index d9d78262a1..761bbdecca 100644
+index 8bb92ca5b5..8b65659b69 100644
 --- a/man/systemd-update-done.service.xml
 +++ b/man/systemd-update-done.service.xml
 @@ -49,7 +49,7 @@
@@ -23,10 +23,10 @@ index d9d78262a1..761bbdecca 100644
      This requires that updates to <filename>/usr/</filename> are always
      followed by an update of the modification time of
 diff --git a/src/shared/condition.c b/src/shared/condition.c
-index 903662edf1..9157b53e2f 100644
+index 2b4a29ed5c..a479ea11ab 100644
 --- a/src/shared/condition.c
 +++ b/src/shared/condition.c
-@@ -817,7 +817,7 @@ static int condition_test_needs_update(Condition *c, char **env) {
+@@ -926,7 +926,7 @@ static int condition_test_needs_update(Condition *c, char **env) {
           * First, compare seconds as they are always accurate...
           */
          if (usr.st_mtim.tv_sec != other.st_mtim.tv_sec)
@@ -35,7 +35,7 @@ index 903662edf1..9157b53e2f 100644
 
          /*
           * ...then compare nanoseconds.
-@@ -828,7 +828,7 @@ static int condition_test_needs_update(Condition *c, char **env) {
+@@ -937,7 +937,7 @@ static int condition_test_needs_update(Condition *c, char **env) {
           * (otherwise the filesystem supports nsec timestamps, see stat(2)).
           */
          if (usr.st_mtim.tv_nsec == 0 || other.st_mtim.tv_nsec > 0)
@@ -44,7 +44,7 @@ index 903662edf1..9157b53e2f 100644
 
          _cleanup_free_ char *timestamp_str = NULL;
          r = parse_env_file(NULL, p, "TIMESTAMP_NSEC", &timestamp_str);
-@@ -848,7 +848,7 @@ static int condition_test_needs_update(Condition *c, char **env) {
+@@ -957,7 +957,7 @@ static int condition_test_needs_update(Condition *c, char **env) {
                  return true;
          }
 
@@ -54,5 +54,5 @@ index 903662edf1..9157b53e2f 100644
 
  static bool in_first_boot(void) {
 -- 
-2.53.0
+2.55.0
 
@@ -1,4 +1,4 @@
-From 5e8b4b38473018964ac462a0c0aa9ec994945828 Mon Sep 17 00:00:00 2001
+From 20f887e7aa926a18b5c74045bf5620d265186f7c Mon Sep 17 00:00:00 2001
 From: Adrian Vladu <avladu@cloudbasesolutions.com>
 Date: Fri, 16 Feb 2024 11:22:08 +0000
 Subject: [PATCH 3/8] core: use max for DefaultTasksMax
@@ -21,7 +21,7 @@ Signed-off-by: Adrian Vladu <avladu@cloudbasesolutions.com>
  3 files changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/man/systemd-system.conf.xml b/man/systemd-system.conf.xml
-index b7fe53dc9c..175fe67139 100644
+index e33267409b..d37bd8c456 100644
 --- a/man/systemd-system.conf.xml
 +++ b/man/systemd-system.conf.xml
 @@ -227,7 +227,7 @@
@@ -34,10 +34,10 @@ index b7fe53dc9c..175fe67139 100644
          Kernel has a default value for <varname>kernel.pid_max=</varname> and an algorithm of counting in case of more than 32 cores.
          For example, with the default <varname>kernel.pid_max=</varname>, <varname>DefaultTasksMax=</varname> defaults to 4915,
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 79fa19d976..d83b5b38b0 100644
+index 74c9d3e7aa..7a46141a5f 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -113,7 +113,7 @@
+@@ -117,7 +117,7 @@
  /* How many units and jobs to process of the bus queue before returning to the event loop. */
  #define MANAGER_BUS_MESSAGE_BUDGET 100U
 
@@ -47,10 +47,10 @@ index 79fa19d976..d83b5b38b0 100644
  static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata);
  static int manager_dispatch_signal_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata);
 diff --git a/src/core/system.conf.in b/src/core/system.conf.in
-index 54196e8489..b0b5c78b56 100644
+index aa8208ca1d..fbfef9ec37 100644
 --- a/src/core/system.conf.in
 +++ b/src/core/system.conf.in
-@@ -58,7 +58,7 @@
+@@ -60,7 +60,7 @@
  #DefaultIPAccounting=no
  #DefaultMemoryAccounting={{ 'yes' if MEMORY_ACCOUNTING_DEFAULT else 'no' }}
  #DefaultTasksAccounting=yes
@@ -60,5 +60,5 @@ index 54196e8489..b0b5c78b56 100644
  #DefaultLimitFSIZE=
  #DefaultLimitDATA=
 -- 
-2.53.0
+2.55.0
 
@@ -1,4 +1,4 @@
-From 5c6b08088fe16e40e0aaaf501950d711a421fb99 Mon Sep 17 00:00:00 2001
+From fe5953a640cd30242a8bdf462838dc608e0b25bc Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <mjg59@coreos.com>
 Date: Tue, 20 Dec 2016 16:43:22 +0000
 Subject: [PATCH 4/8] systemd: Disable SELinux permissions checks
@@ -25,5 +25,5 @@ index 7457b3d456..82afe343dd 100644
  #include <unistd.h>
 
 -- 
-2.53.0
+2.55.0
 
@@ -1,4 +1,4 @@
-From 6c97801bdec3730f49f68683b141909145826f2f Mon Sep 17 00:00:00 2001
+From 3dfaa28aca094f4986450ad9df01c68276f0f935 Mon Sep 17 00:00:00 2001
 From: Sayan Chowdhury <schowdhury@microsoft.com>
 Date: Fri, 16 Dec 2022 16:28:26 +0530
 Subject: [PATCH 5/8] Revert "getty: Pass tty to use by agetty via stdin"
@@ -99,5 +99,5 @@ index d89805a0ef..73d88541fe 100644
  TTYReset=yes
  TTYVHangup=yes
 -- 
-2.53.0
+2.55.0
 
@@ -1,4 +1,4 @@
-From c05273535a1d96e187c7837929f0c88bfbf0ae68 Mon Sep 17 00:00:00 2001
+From 1916bda083e4f25fae1af9f156e058f57e172429 Mon Sep 17 00:00:00 2001
 From: Adrian Vladu <avladu@cloudbasesolutions.com>
 Date: Fri, 16 Feb 2024 11:29:04 +0000
 Subject: [PATCH 6/8] units: Keep using old journal file format
@@ -38,5 +38,5 @@ index b705ce08ff..874701dac4 100644
  FileDescriptorStoreMax=4224
  Group=systemd-journal
 -- 
-2.53.0
+2.55.0
 
@@ -1,4 +1,4 @@
-From e8de255a0141ab8d169488338dc24f391299d653 Mon Sep 17 00:00:00 2001
+From 39d334ff6a3932f8f3b46ba909d998b59f4e41f5 Mon Sep 17 00:00:00 2001
 From: Krzesimir Nowak <knowak@microsoft.com>
 Date: Wed, 22 Oct 2025 10:39:42 +0200
 Subject: [PATCH 7/8] tmpfiles.d: Fix DNS issues with default k8s configuration
@@ -32,5 +32,5 @@ index be5edc98e0..bea686682a 100644
 -L! /etc/resolv.conf - - - - ../run/systemd/resolve/stub-resolv.conf
 +L! /etc/resolv.conf - - - - ../run/systemd/resolve/resolv.conf
 -- 
-2.53.0
+2.55.0
 
@@ -1,4 +1,4 @@
-From 450c8acb76f851bb594f725f834c04b041c2859e Mon Sep 17 00:00:00 2001
+From 88f2b978a19289e978bd5d023f41dbb1b517e3f3 Mon Sep 17 00:00:00 2001
 From: Krzesimir Nowak <knowak@microsoft.com>
 Date: Fri, 24 Oct 2025 11:06:57 +0200
 Subject: [PATCH 8/8] units: Make multi-user.target the default target
@@ -9,7 +9,7 @@ Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/units/meson.build b/units/meson.build
-index b2cf9bd8f3..74d7f61519 100644
+index 27d8ef2f72..282d178c4a 100644
 --- a/units/meson.build
 +++ b/units/meson.build
 @@ -48,7 +48,7 @@ units = [
@@ -31,5 +31,5 @@ index b2cf9bd8f3..74d7f61519 100644
          {
            'file' : 'systemd-mute-console.socket',
 -- 
-2.53.0
+2.55.0
 
@@ -16,10 +16,6 @@
 # Needed to fix build with acl 2.4.0
 =app-arch/tar-1.35-r1
 
-# Needed to address security issues.
-=app-arch/unzip-6.0_p31
-=app-arch/zip-3.0_p16
-
 # For podman 6.0.0
 =app-containers/aardvark-dns-2.0.0
 
@@ -33,8 +29,12 @@
 # To address some CVEs.
 =app-containers/cri-tools-1.36.0
 
+# We always want the latest version available.
+=app-containers/docker-29*
+=app-containers/docker-cli-29*
+
 # To address security issues
-=app-containers/incus-7.3-r1
+=app-containers/incus-7.4
 
 # Keep versions on both arches in sync.
 =app-containers/lxc-7.0.0
@@ -90,15 +90,22 @@ dev-cpp/azure-security-keyvault-keys
 =dev-lang/go-1.26.7
 
 # Keep versions on both arches in sync.
+=dev-lang/swig-4.3.1
 =dev-libs/cowsql-1.15.9 ~arm64
 =dev-libs/ding-libs-0.6.2-r1 ~arm64
 
 # To address security issues.
 =dev-libs/glib-2.88.3
-=dev-libs/json-c-0.19-r2
 
 # Keep versions on both arches in sync.
 =dev-libs/jose-14
+
+# To address security issues.
+=dev-libs/json-c-0.19-r2
+=dev-libs/libgcrypt-1.12.3-r1
+=dev-libs/libksba-1.8.1
+
+# Keep versions on both arches in sync.
 =dev-libs/libtraceevent-1.9.0
 
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
@@ -152,9 +159,15 @@ dev-cpp/azure-security-keyvault-keys
 # latest version of the package with the unstable keywords.
 sys-apps/azure-vm-utils
 
+# Keep versions on both arches in sync.
+=sys-apps/bubblewrap-0.12.0
+
 # To address CVE-2026-59676, CVE-2026-59677 in policycoreutils.
 =sys-apps/semodule-utils-3.11
 
+# To address CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410
+=sys-apps/util-linux-2.42.3
+
 # Keep versions on both arches in sync.
 =sys-apps/zram-generator-1.2.1 ~arm64
 =sys-auth/sssd-2.13.1
@@ -180,14 +193,12 @@ sys-firmware/edk2-bin
 =sys-libs/libseccomp-2.6.1
 
 # To address CVE-2026-59676, CVE-2026-59677 in policycoreutils.
-=sys-libs/libselinux-3.11
+=sys-libs/libselinux-3.11-r1
 =sys-libs/libsepol-3.11
 
 # Keep versions on both arches in sync.
 =sys-libs/libunwind-1.8.3
+=sys-libs/liburing-2.12
 
 # rsync 3.5.0 needs it
 =virtual/acl-2.4.0
-
-# Pull some fixes (nested mount issue with sysext)
-=sys-apps/systemd-260.4
@@ -2,3 +2,5 @@ DIST gzip-1.14.tar.xz 885748 BLAKE2B 32f7241bd9f3b7f73a59905a5bc9abf4e360e787f69
 DIST gzip-1.14.tar.xz.sig 833 BLAKE2B a13ade68035fe32d69c24a1b5791ae6d7163cbbbebda396b4c773f2dc82ea6c619a44c39adc53dcd8fff094962a1c2dddfabfc7ec2cf54561202ef9a2be325ae SHA512 a5abd09e3b7bda8d87e5af7d2bd943e6021272cb0b6aa05625ddfeae45838aede1ffd91d7e0cb4e170f7f3078035f735f8441bc15cc115c51d302e0a11be44cf
 DIST gzip-1.14_p20260502.tar.xz 829092 BLAKE2B fc98853530b4c0e52f1276cf07969acaa42434773d62375d4048fe17b5984ae316ffb8d0ffa949bb5e772adbcab477a79890fc79f1ac4387dd9b2d5e29c337be SHA512 5507ea6ac68ed7c0f4eaf17e6016800a6df597aa9015f91b5c1ca1422f9edd0a8b714c29e7678bfa57a2f45f220ae2ca4e94f1d3dff2b2a7a2cd602e93b364ef
 DIST gzip-1.14_p20260502.tar.xz.sig 833 BLAKE2B 13c0c9f39f8ff3e210a772c0ce83bfb2f9f2fabf73ea505dd4f16b80be8b8c3c1eb8f8916ee71c1ac1d562c71a5ca6d6fa522b4624b16e7a6eb67c654f66cd70 SHA512 48816f0d47e44e13b841937f70a4479a5a912ad1bf150640c8e157010853381806af2a1ba8959eced17c630abf9ae6e22f041bb4bed856a6b93f213b3210378a
+DIST gzip-1.14_p20260901.tar.xz 834840 BLAKE2B e78aff73b626d3a68ac84ebe590a6a2d67c106aaf7a7ffe1195131322f9ce3fe5fc35a12de4950b29bda4aaf684f8e829425e79186b525544b2c7e0abac45bec SHA512 b2ff6352f819c14de98e87ab5ce54d21b6201d3a00c90163ca769cd72de6a636a8d50b7576e63a963f219820605a43e3744dbfca251f6755f8d62de75575b55a
+DIST gzip-1.14_p20260901.tar.xz.sig 833 BLAKE2B 503c5ab9607658fa48ce857155563a0b264d2a398b84e2814cb537bb9d351471dd86743ec98b60f17f76b2365edd785363709e2883a540661d5f93b358a11857 SHA512 35c78a77f2f40e330f5950e028452e488f2758347e3c09b711c540a9bf1f4d289e617b07060b39c640f79827a321f5ed9f2c72d1791b6e4a98678ca1ed96e3a9