A recent change in oe-core (00864cf5bc meta: Add tag in SRC_URI to multiple recipes) had a hidden clash with fragments/yocto/sbom-cve-check:

Since the fragment sets SRCREV = AUTOREV, this overrides at build time and do_unpack fails because it is comparing against the tag SRCREV in the recipes for sbom-cve-check-update-cvelist-native and sbom-cve-check-update-nvd-native.

The failure looks like:

ERROR: sbom-cve-check-update-nvd-native-2026.06.24-000003-r0 do_unpack: Bitbake Fetcher Error: FetchError("The revision the git tag 'v2026.06.24-000003' resolved to didn't match the SRCREV in use (11e62eba27133a54836b7a081d05ff96f72d879b vs bce4f8648122d68567c07df0260567592e36250b)", 'git://github.com/fkie-cad/nvd-json-data-feeds.git;branch=main;protocol=https;destsuffix=;tag=v2026.06.24-000003')

where bce4f86 was the HEAD on branch 'main' at the time the build was run and 11e62eb is the tag SRCREV for v2026.06.24-000003.

This has been fixed in oe-core commit:
ff6f41cc6e fragments/yocto/sbom-cve-check: fix conflict with tag=

However, we should probably test the fragment as part of patch review smoke tests to prevent future surprises.

This would have caused the 'metrics' job to blow up, most likely, as that is the only place we currently utilize 'sbom-cve-check' in yocto-autobuilder-helper.