[gominimal-pkgmgr-mgr]

Update glibc-bedrock-2.42 2.42 → 2.44

Source: gnu:glibc
Released: 63 days ago (2026-07-24)

Pkgscan: clean — diff against the prior version surfaced no newly-introduced suspicious patterns.

Vulnerability impact

Partition analysis at 2.44 (uses each advisory's fixed-version, vulnerable-range, affected-ranges, and fix-commit ancestry to decide):

• 10 cleared — the new version is outside the advisory's affected range, OR the tag's lineage includes a known fix-commit. These will drop off the next scan.

Vulnerabilities fixed (10)

This update clears 10 vulnerabilities affecting 2.42:

CVE / GHSA	CPE	Severity	Fixed in
CVE-2026-5450	(gnu, glibc)	CRITICAL	via range: >= 2.7, <= 2.43
CVE-2025-15281	(gnu, glibc)	HIGH	2.43
CVE-2026-0861	(gnu, glibc)	HIGH	via range: >= 2.30, <= 2.42
CVE-2026-0915	(gnu, glibc)	HIGH	via range: >= 2.0, <= 2.42
CVE-2026-4046	(gnu, glibc)	HIGH	via range: <= 2.43
CVE-2026-4437	(gnu, glibc)	HIGH	via range: >= 2.34, <= 2.43
CVE-2026-5435	(gnu, glibc)	HIGH	via range: <= 2.43
CVE-2026-5928	(gnu, glibc)	HIGH	via range: <= 2.43
CVE-2026-4438	(gnu, glibc)	MEDIUM	via range: >= 2.34, <= 2.43
CVE-2026-6238	(gnu, glibc)	MEDIUM	via range: <= 2.43

Components changed

CycloneDX component delta (declared materials — the package's own version, not a dependency-tree diff)

	Component	Old	New
~	glibc-bedrock-2.42	2.42	2.44

Changes

	Old	New
Version	2.42	2.44
SHA256	d1775e32e4628e64...	37f600f2bef3c5e8...
Size	19.9 MB	20.6 MB
Source	gs://minimal-staging-archives/glibc-2.42.tar.xz	gs://minimal-staging-archives/glibc-2.44.tar.xz

• License: (GPL-2.0-only AND GPL-3.0-only AND LGPL-2.1-only) (source: tarball)

Quality suggestions

• Missing tests block. This package has no standalone tests, so the buildbot will only verify compilation — not functional correctness. Consider adding a minimal smoke test (e.g., a --version or small round-trip invocation) as part of this PR so future bumps catch regressions. See packages/python/build.ncl for a simple example.

---

Created by pkgmgr

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: gominimal/pkgs/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: e3a5b9c7-ec38-47b2-97cc-6cba60583f64

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[bryan-minimal]

Closing: glibc-bedrock-2.42 is a frozen hex0-ladder rung (pkgmgr-rs#884) and should never get an update PR. The freeze's runtime-shipping guard unfroze it for this run because rustc-1.91.1 (a Rust bootstrap rung from #667) was not on the freeze list yet, so it looked like a shipped package's runtime dep. Fix: add the Rust bootstrap chain (mrustc → rustc-1.97.1) to data/frozen_packages.toml (pkgmgr-rs PR incoming). Opened autonomously by auto-fix; nothing merged.