Re: [bitbake-devel] [PATCH 0/2] fetch2/wget: limit auth headers on checkstatus redirects

On Wed, 2026-06-10 at 09:54 +0200, Alexander Kanavin via
lists.openembedded.org wrote:
> Unusually, this was rapidly merged to master almost immediately after
> the patches were posted. Is this a sensitive security issue, or what
> is the rationale?

I did actually mean to merge it to master-next, test, then merge to
master in a bit but there is a security issue in there unfortunately
:(. 

Basically we could lead auth headers to the wrong servers.

Cheers,

Richard