The following Fedora EPEL 10.2 Security updates need testing:
Age URL
3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-a6032e771d yarnpkg-1.22.22-16.el10_2
3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-5e2a143387 python-python-multipart-0.0.22-1.el10_2
3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-5e00b7a772 java-latest-openjdk-26.0.0.0.32-0.0.1.ea.el10_2 java-latest-openjdk-portable-26.0.0.0.32-0.1.ea.rolling.el8
The following builds have been pushed to Fedora EPEL 10.2 updates-testing
audiofile-0.3.6-44.el10_2
chromium-144.0.7559.109-1.el10_2
composer-2.9.5-1.el10_2
dns-root-data-2026260100-2.el10_2
epstool-3.08-33.el10_2
git-credential-oauth-0.17.2-1.el10_2
libva-nvidia-driver-0.0.15-1.el10_2
nvtop-3.3.1-2.el10_2
partclone-0.3.44-1.el10_2
prosody-13.0.4-1.el10_2
python-aiostream-0.7.0-3.el10_2
python-orjson-3.11.6-1.el10_2
python-rich-toolkit-0.17.2-1.el10_2
rpminspect-2.1-1.el10_2
rust-v_frame-0.5.0-1.el10_2
rust-v_frame0.3-0.3.9-1.el10_2
tomcat-native-2.0.12-1.el10_2
vdirsyncer-0.20.0-3.el10_2
xrootd-s3-http-0.6.3-1.el10_2
Details about builds:
================================================================================
audiofile-0.3.6-44.el10_2 (FEDORA-EPEL-2026-c873366271)
Library for accessing various audio file formats
--------------------------------------------------------------------------------
Update Information:
Initial EL-10 build
--------------------------------------------------------------------------------
ChangeLog:
* Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:0.3.6-44
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:0.3.6-43
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Wed Jul 23 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:0.3.6-42
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Tue May 27 2025 Jitka Plesnikova <jplesnik(a)redhat.com> - 1:0.3.6-41
- Rebuilt for flac 1.5.0
* Thu Jan 16 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:0.3.6-40
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Wed Jul 17 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:0.3.6-39
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Mon Jan 22 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:0.3.6-38
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Fri Jan 19 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:0.3.6-37
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2435361 - Please branch and build audiofile in epel10.
https://bugzilla.redhat.com/show_bug.cgi?id=2435361
--------------------------------------------------------------------------------
================================================================================
chromium-144.0.7559.109-1.el10_2 (FEDORA-EPEL-2026-3aa83c53c2)
A WebKit (Blink) powered web browser that Google doesn't want you to use
--------------------------------------------------------------------------------
Update Information:
Update to 144.0.7559.109
* CVE-2026-1504: Inappropriate implementation in Background Fetch API
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Than Ngo <than(a)redhat.com> - 144.0.7559.109-1
- Update to 144.0.7559.109
* CVE-2026-1504: Inappropriate implementation in Background Fetch API
--------------------------------------------------------------------------------
================================================================================
composer-2.9.5-1.el10_2 (FEDORA-EPEL-2026-1a096fc45e)
Dependency Manager for PHP
--------------------------------------------------------------------------------
Update Information:
Version 2.9.5 - 2026-01-29
Added support for new pie download-url-methods (#12727)
Fixed detection of 7z when installed as 7za on some linux systems (#12731)
Fixed warning because of the symfony/process CVE, 2.9.4 had a workaround already
Version 2.9.4 - 2026-01-22
Added active plugins to the diagnose command output (#12706)
Fixed HTTP/3 causing issues with proxies (#12699)
Fixed show command regression with long descriptions containing unicode
characters (#12704)
Fixed regression handling invalid unicode sequences in output (#12707)
Fixed git rev-list usages to support older pre-2.33 git versions (#12705)
Fixed issue handling paths with = in them on Windows (#12726)
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Remi Collet <remi(a)remirepo.net> - 2.9.5-1
- update to 2.9.5
* Thu Jan 22 2026 Remi Collet <remi(a)remirepo.net> - 2.9.4-1
- update to 2.9.4
--------------------------------------------------------------------------------
================================================================================
dns-root-data-2026260100-2.el10_2 (FEDORA-EPEL-2026-c623fa5dcd)
DNS root hints and DNSSEC trust anchor
--------------------------------------------------------------------------------
Update Information:
Switch to python based tools for own Fedora implemented implementation, without
relying on perl packages. Use Python to extract keys instead.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 27 2026 Petr Menšík <pemensik(a)redhat.com> - 2026260100-2
- Add separate utils subpackage
* Tue Jan 27 2026 Petr Menšík <pemensik(a)redhat.com> - 2026260100-1
- Switch to python based tool by Paul Hoffman
* Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 2025080400-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 2025080400-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Mon Oct 20 2025 Petr Menšík <pemensik(a)redhat.com> - 2025080400-2
- Ignore specific versions of sources.
* Mon Oct 20 2025 Petr Menšík <pemensik(a)redhat.com> - 2025080400-1
- Initial version after review
--------------------------------------------------------------------------------
================================================================================
epstool-3.08-33.el10_2 (FEDORA-EPEL-2026-7189704a5c)
A utility to create or extract preview images in EPS files
--------------------------------------------------------------------------------
Update Information:
Rebuilt for EPEL10
--------------------------------------------------------------------------------
ChangeLog:
* Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.08-33
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Wed Jul 23 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.08-32
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Thu Jan 16 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.08-31
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Thu Jul 25 2024 Miroslav Suchý <msuchy(a)redhat.com> - 3.08-30
- convert license to SPDX
* Wed Jul 17 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.08-29
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Wed Jan 24 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.08-28
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Fri Jan 19 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.08-27
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2424547 - Please branch and build epstool in epel10
https://bugzilla.redhat.com/show_bug.cgi?id=2424547
--------------------------------------------------------------------------------
================================================================================
git-credential-oauth-0.17.2-1.el10_2 (FEDORA-EPEL-2026-b83bed8afd)
Git credential helper for GitHub and other forges using OAuth
--------------------------------------------------------------------------------
Update Information:
Automatic update for git-credential-oauth-0.17.2-1.el10_2.
Changelog for git-credential-oauth
* Wed Jan 14 2026 Packit <hello(a)packit.dev> - 0.17.2-1
- Update to 0.17.2 upstream release
- Resolves: rhbz#2429551
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 14 2026 Packit <hello(a)packit.dev> - 0.17.2-1
- Update to 0.17.2 upstream release
- Resolves: rhbz#2429551
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2429551 - git-credential-oauth-0.17.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2429551
--------------------------------------------------------------------------------
================================================================================
libva-nvidia-driver-0.0.15-1.el10_2 (FEDORA-EPEL-2026-11bc39775b)
A VA-API implemention using NVIDIA's NVDEC
--------------------------------------------------------------------------------
Update Information:
Update to 0.0.15.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Jan 30 2026 Simone Caronni <negativo17(a)gmail.com> - 0.0.15-1
- Update to 0.0.15
* Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.0.14-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Thu Jul 24 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.0.14-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2435250 - libva-nvidia-driver-0.0.15 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2435250
--------------------------------------------------------------------------------
================================================================================
nvtop-3.3.1-2.el10_2 (FEDORA-EPEL-2026-826bba1855)
GPU process monitoring for various devices
--------------------------------------------------------------------------------
Update Information:
3.3.1
Fix a regression that would miss-report available device memory of NVIDIA GPUs
Integrate effective/efficiency usage within the GPU utilization metric
3.3.0
New in this release
Target support
Rockchip NPU - @feilongfl
MetaX GPUs - @zhenyu-xu-metax
Enflame GCU - @QShen3
Improvements
More memory reporting in one-shot mode - @mintyleaf
CTRL + L will reset the ncurses interface - @cipri-tom + @claude
GPU and MEM have separate clock fields - @KaeLL
Effective load metric, i.e., the percentage utilization weighted by the ratio
(Current Power / Max Power) - @airvzxf
Fixes
Fix assertion failure on processing the same client ID twice - @Andrew1326
Application desktop metadata install paths and name - @michel-slm
New PPA maintainer - @QuentiumYT
Fixes for Mali GPU - @larunbe
Power draw for Intel Battelmage - @Steve-Tech
Unified memory usage reporting on Nvidia GPUs - @sbhavani
AMDGPU integrated graphics accounts for both VRAM and GTT - @superm1
Misc
Manpage update - @polluks
Fix typos - @oxyzenQ
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Michel Lind <salimma(a)fedoraproject.org> - 3.3.1-2
- Drop upstreamed patches
* Sun Jan 18 2026 Packit <hello(a)packit.dev> - 3.3.1-1
- Update to 3.3.1
- Resolves rhbz#2430383
* Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.2.0-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Thu Jul 24 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.2.0-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Sun Apr 6 2025 Michel Lind <salimma(a)fedoraproject.org> - 3.2.0-4
- Number patches for EL8
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2430383 - nvtop-3.3.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2430383
--------------------------------------------------------------------------------
================================================================================
partclone-0.3.44-1.el10_2 (FEDORA-EPEL-2026-e7fc1402b9)
Utility to clone and restore a partition
--------------------------------------------------------------------------------
Update Information:
partclone v0.3.44
Fix --disable-xxhash compile issue
Downgrade gettext requirement to 0.19 for better compatibility
Switch XSL stylesheet back to URL with --nonet
Fix NTFS from 512e/n to 4kn
Fix and support both, static and dynamic builds
partclone v0.3.42
Update docs
Remove libtool generated files
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Robert Scheck <robert(a)fedoraproject.org> 0.3.44-1
- Upgrade to 0.3.44 (#2433151)
* Fri Jan 23 2026 Robert Scheck <robert(a)fedoraproject.org> 0.3.42-1
- Upgrade to 0.3.42 (#2430752 #c1)
* Wed Jan 21 2026 Robert Scheck <robert(a)fedoraproject.org> 0.3.41-1
- Upgrade to 0.3.41 (#2430752)
* Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.3.40-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2433151 - partclone-0.3.44 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2433151
--------------------------------------------------------------------------------
================================================================================
prosody-13.0.4-1.el10_2 (FEDORA-EPEL-2026-58c03107bf)
Flexible communications server for Jabber/XMPP
--------------------------------------------------------------------------------
Update Information:
Prosody 13.0.4
Upstream is pleased to announce a new minor release from their stable branch.
Upstream encourages any deployments using 13.0.3 to upgrade, partly due to a bug
that was introduced into UUID generation in that release. Upstream is not aware
of any direct consequences of this bug, but it may cause compatibility problems
with other software.
Although not strictly bug fixes, upstream sneaked in some configuration-related
improvements to this release which help make configuring Prosody a little easier
and more reliable. Upstream is highlighting them because these changes have a
chance to impact some rare configurations.
The first change is to prevent mod_pubsub from being loaded on a VirtualHost
(easily done if you accidentally add it to your global modules_enabled list).
Loading mod_pubsub on a normal user host can lead to unexpected behaviour. Now
it will log an error and refuse to load if you do that.
The second change is to simplify configuration of archiving in MUCs. Practically
all modern clients now use XEP-0313 to synchronize message history. For
VirtualHosts this is implemented in mod_mam, and for MUC components it is
implemented in mod_muc_mam. From this release, things get much simpler: loading
mod_mam (globally or directly on a MUC component) will automatically load
mod_muc_mam on the MUC component. This means most people (e.g. who have mod_mam
loaded globally on their server) can now remove “muc_mam” from modules_enabled
in their MUC component configuration. It will be loaded automatically.
This last point does mean that if you have mod_mam enabled globally, but do not
want it enabled on your MUCs, you now have to state that explicitly by adding
“mam” to modules_disabled under the MUC’s Component. Be aware that such a
configuration may lead to missing messages in group chats.
A summary of changes in this release:
Fixes and improvements
mod_s2s: Fix traceback when outgoing s2s queue is full
util.uuid: Fix padding of group 2 of UUIDv7 to use zeroes
Minor changes
core.modulemanager: Fix shell commands on components
mod_s2s: Explicitly prevent sending recursive error replies when queue is full
modulemanager: Allow component modules to specify additional inherited modules
prosodyctl check features: Use modulemanager to calculate modules that will
actually be loaded
prosodyctl check features: change recommendation from mod_muc_mam to mod_mam
prosodyctl check config: Fix traceback when zero modules are enabled
mod_pubsub: Fail early if loaded outside of a component to prevent
misconfiguration
doap: Add XEP-0486
mod_pubsub/commands: Fix listing item numbers along with item names
mod_account_activity: Handle authentication provider returning no user info
mod_mam: Automatically load mod_muc_mam if loaded on a MUC component
mod_muc: Inherit mod_mam if globally loaded
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Robert Scheck <robert(a)fedoraproject.org> 13.0.4-1
- Upgrade to 13.0.4 (#2432633)
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 13.0.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2432633 - prosody-13.0.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2432633
--------------------------------------------------------------------------------
================================================================================
python-aiostream-0.7.0-3.el10_2 (FEDORA-EPEL-2026-ff2b852c8a)
Generator-based operators for asynchronous iteration
--------------------------------------------------------------------------------
Update Information:
Initial EPEL 10 release
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Michel Lind <salimma(a)fedoraproject.org> - 0.7.0-3
- Lower setuptools requirement further to accomodate EPEL 10
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.7.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Fri Sep 26 2025 David Kaufmann <astra(a)ionic.at> - 0.7.0-1
- Version bump
* Fri Sep 19 2025 Python Maint <python-maint(a)redhat.com> - 0.6.1-8
- Rebuilt for Python 3.14.0rc3 bytecode
* Fri Aug 15 2025 Python Maint <python-maint(a)redhat.com> - 0.6.1-7
- Rebuilt for Python 3.14.0rc2 bytecode
* Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.6.1-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Mon Jun 2 2025 Python Maint <python-maint(a)redhat.com> - 0.6.1-5
- Rebuilt for Python 3.14
* Sat Jan 18 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.6.1-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Fri Jul 19 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.6.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Fri Jun 28 2024 Sandro <devel(a)penguinpee.nl> - 0.6.1-2
- Fix running tests (properly)
* Thu Jun 20 2024 David Kaufmann <astra(a)ionic.at> - 0.6.1-1
- Version bump
* Fri Jun 7 2024 Python Maint <python-maint(a)redhat.com> - 0.5.2-4
- Rebuilt for Python 3.13
* Fri Mar 1 2024 David Kaufmann <astra(a)ionic.at> - 0.5.2-1
- Unretired package and updated version
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2422880 - Please branch and build python-aiostream in epel10
https://bugzilla.redhat.com/show_bug.cgi?id=2422880
--------------------------------------------------------------------------------
================================================================================
python-orjson-3.11.6-1.el10_2 (FEDORA-EPEL-2026-1e5052f660)
Fast, correct Python JSON library
--------------------------------------------------------------------------------
Update Information:
3.11.6 - 2026-01-29
===================
Changed
orjson now includes code licensed under the Mozilla Public License 2.0
(MPL-2.0).
Drop support for Python 3.9.
ABI compatibility with CPython 3.15 alpha 5.
Build now depends on Rust 1.89 or later instead of 1.85.
Fixed
Fix sporadic crash serializing deeply nested list of dict.
3.11.5 - 2025-12-06
Changed
Show simple error message instead of traceback when attempting to
build on unsupported Python versions.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 3.11.6-1
- Update to 3.11.6 (close RHBZ#2435304)
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.11.4-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2435304 - python-orjson-3.11.6 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2435304
--------------------------------------------------------------------------------
================================================================================
python-rich-toolkit-0.17.2-1.el10_2 (FEDORA-EPEL-2026-c13d2dd85b)
Rich toolkit for building command-line applications
--------------------------------------------------------------------------------
Update Information:
0.17.2 - 2026-01-29
This release fixed the color detection function, mostly to fix a bug
interfering with forked worker processes (e.g. uvicorn with --workers).
The color query now uses a dedicated file descriptor instead of stdin/stdout,
preventing issues with logging and signal handling in multi-process
environments.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Packit <hello(a)packit.dev> - 0.17.2-1
- Update to 0.17.2 upstream release
- Resolves: rhbz#2435328
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2435328 - python-rich-toolkit-0.17.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2435328
--------------------------------------------------------------------------------
================================================================================
rpminspect-2.1-1.el10_2 (FEDORA-EPEL-2026-703ba8ca02)
Build deviation analysis and compliance tool
--------------------------------------------------------------------------------
Update Information:
Upgrade to rpminspect-2.1
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Dave Cantrell <dcantrell(a)redhat.com> - 2.1-
- Upgrade to rpminspect-2.1
--------------------------------------------------------------------------------
================================================================================
rust-v_frame-0.5.0-1.el10_2 (FEDORA-EPEL-2026-e95aea023c)
Video Frame data structures, originally part of rav1e
--------------------------------------------------------------------------------
Update Information:
Version 0.5.0
[Breaking] Change the copy_from_u8_slice_with_stride to take stride in bytes
instead of in pixels.
This seems to be the more common case from other APIs, and it also addresses a
theoretical edge case
where stride may not be a multiple of byte depth.
Version 0.4.2
Improve performance of rows iterators
Version 0.4.1
Implement ExactSizeIterator and DoubleEndedIterator for plane iterators
Version 0.4.0
[Breaking] Rewrite the API
This is a large change with significant breakage, consumers may want to refer to
the pull request for more context
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 22 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.5.0-1
- Update to version 0.5.0; Fixes RHBZ#2427204
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.3.9-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.3.9-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2427204 - rust-v_frame-0.5.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2427204
--------------------------------------------------------------------------------
================================================================================
rust-v_frame0.3-0.3.9-1.el10_2 (FEDORA-EPEL-2026-e95aea023c)
Video Frame data structures, originally part of rav1e
--------------------------------------------------------------------------------
Update Information:
Version 0.5.0
[Breaking] Change the copy_from_u8_slice_with_stride to take stride in bytes
instead of in pixels.
This seems to be the more common case from other APIs, and it also addresses a
theoretical edge case
where stride may not be a multiple of byte depth.
Version 0.4.2
Improve performance of rows iterators
Version 0.4.1
Implement ExactSizeIterator and DoubleEndedIterator for plane iterators
Version 0.4.0
[Breaking] Rewrite the API
This is a large change with significant breakage, consumers may want to refer to
the pull request for more context
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.3.9-1
- Initial compat package
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2427204 - rust-v_frame-0.5.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2427204
--------------------------------------------------------------------------------
================================================================================
tomcat-native-2.0.12-1.el10_2 (FEDORA-EPEL-2026-e752893e53)
Tomcat native library
--------------------------------------------------------------------------------
Update Information:
Update to latest version
--------------------------------------------------------------------------------
ChangeLog:
* Fri Jan 30 2026 Coty Sutherland <csutherl(a)fedoraproject.org> - 1:2.0.12-1
- Update to 2.0.12
--------------------------------------------------------------------------------
================================================================================
vdirsyncer-0.20.0-3.el10_2 (FEDORA-EPEL-2026-60e93ab8e0)
Synchronize calendars and contacts
--------------------------------------------------------------------------------
Update Information:
Initial EPEL 10 release
--------------------------------------------------------------------------------
ChangeLog:
* Tue Dec 16 2025 Michel Lind <salimma(a)fedoraproject.org> - 0.20.0-3
- Support building with old setuptools (pre-PEP 639)
* Fri Sep 19 2025 Python Maint <python-maint(a)redhat.com> - 0.20.0-2
- Rebuilt for Python 3.14.0rc3 bytecode
* Thu Aug 28 2025 Ben Boeckel <fedora(a)me.benboeckel.net> - 0.20.0-1
- Update to 0.20.0
* Mon Aug 18 2025 Ben Boeckel <fedora(a)me.benboeckel.net> - 0.19.3-6
- Remove atomicwrites dependency (see rhbz#2385436)
* Fri Aug 15 2025 Python Maint <python-maint(a)redhat.com> - 0.19.3-5
- Rebuilt for Python 3.14.0rc2 bytecode
* Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.19.3-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Wed Jul 9 2025 Ben Boeckel <fedora(a)me.benboeckel.net> - 0.19.3-3
- Modernize RPM macros (rhbz#2378494)
* Tue Jun 3 2025 Python Maint <python-maint(a)redhat.com> - 0.19.3-2
- Rebuilt for Python 3.14
* Wed May 21 2025 David Kaufmann <astra(a)ionic.at> - 0.19.3-1
- Update to v0.19.3
* Sun Jan 19 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.19.2-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Wed Sep 4 2024 Miroslav Suchý <msuchy(a)redhat.com> - 0.19.2-6
- convert license to SPDX
* Mon Aug 26 2024 Michel Lind <salimma(a)fedoraproject.org> - 0.19.2-5
- Bump allowed version of aiostream again
- Fixes: RHBZ#2308075
* Sat Jul 20 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.19.2-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Sun Jun 9 2024 Python Maint <python-maint(a)redhat.com> - 0.19.2-3
- Rebuilt for Python 3.13
* Sat Feb 3 2024 David Kaufmann <astra(a)ionic.at> - 0.19.2-1
- Update to v0.19.2
* Sat Jan 27 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.18.0-11
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2323767 - Please branch and build vdirsyncer in epel10
https://bugzilla.redhat.com/show_bug.cgi?id=2323767
--------------------------------------------------------------------------------
================================================================================
xrootd-s3-http-0.6.3-1.el10_2 (FEDORA-EPEL-2026-537d234383)
S3/HTTP/Globus filesystem plugins for XRootD
--------------------------------------------------------------------------------
Update Information:
XRootD S3 http 0.6.3
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 0.6.3-1
- Update to version 0.6.3
- Drop patches accepted upstream
* Tue Jan 20 2026 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 0.6.1-1
- Update to version 0.6.1
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.6.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
The following Fedora EPEL 10.1 Security updates need testing:
Age URL
4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1f5a2c5f39 python-python-multipart-0.0.22-1.el10_1
The following builds have been pushed to Fedora EPEL 10.1 updates-testing
chromium-144.0.7559.109-1.el10_1
composer-2.9.5-1.el10_1
libva-nvidia-driver-0.0.15-1.el10_1
nvtop-3.3.1-2.el10_1
partclone-0.3.44-1.el10_1
prosody-13.0.4-1.el10_1
python-rich-toolkit-0.17.2-1.el10_1
redwax-tool-1.0.0-7.el10_1
xrootd-s3-http-0.6.3-1.el10_1
Details about builds:
================================================================================
chromium-144.0.7559.109-1.el10_1 (FEDORA-EPEL-2026-0123df77aa)
A WebKit (Blink) powered web browser that Google doesn't want you to use
--------------------------------------------------------------------------------
Update Information:
Update to 144.0.7559.109
* CVE-2026-1504: Inappropriate implementation in Background Fetch API
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Than Ngo <than(a)redhat.com> - 144.0.7559.109-1
- Update to 144.0.7559.109
* CVE-2026-1504: Inappropriate implementation in Background Fetch API
--------------------------------------------------------------------------------
================================================================================
composer-2.9.5-1.el10_1 (FEDORA-EPEL-2026-2add0c7de8)
Dependency Manager for PHP
--------------------------------------------------------------------------------
Update Information:
Version 2.9.5 - 2026-01-29
Added support for new pie download-url-methods (#12727)
Fixed detection of 7z when installed as 7za on some linux systems (#12731)
Fixed warning because of the symfony/process CVE, 2.9.4 had a workaround already
Version 2.9.4 - 2026-01-22
Added active plugins to the diagnose command output (#12706)
Fixed HTTP/3 causing issues with proxies (#12699)
Fixed show command regression with long descriptions containing unicode
characters (#12704)
Fixed regression handling invalid unicode sequences in output (#12707)
Fixed git rev-list usages to support older pre-2.33 git versions (#12705)
Fixed issue handling paths with = in them on Windows (#12726)
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Remi Collet <remi(a)remirepo.net> - 2.9.5-1
- update to 2.9.5
* Thu Jan 22 2026 Remi Collet <remi(a)remirepo.net> - 2.9.4-1
- update to 2.9.4
--------------------------------------------------------------------------------
================================================================================
libva-nvidia-driver-0.0.15-1.el10_1 (FEDORA-EPEL-2026-e7c1795fe4)
A VA-API implemention using NVIDIA's NVDEC
--------------------------------------------------------------------------------
Update Information:
Update to 0.0.15.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Jan 30 2026 Simone Caronni <negativo17(a)gmail.com> - 0.0.15-1
- Update to 0.0.15
* Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.0.14-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Thu Jul 24 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.0.14-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2435250 - libva-nvidia-driver-0.0.15 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2435250
--------------------------------------------------------------------------------
================================================================================
nvtop-3.3.1-2.el10_1 (FEDORA-EPEL-2026-9d4e0427cc)
GPU process monitoring for various devices
--------------------------------------------------------------------------------
Update Information:
3.3.1
Fix a regression that would miss-report available device memory of NVIDIA GPUs
Integrate effective/efficiency usage within the GPU utilization metric
3.3.0
New in this release
Target support
Rockchip NPU - @feilongfl
MetaX GPUs - @zhenyu-xu-metax
Enflame GCU - @QShen3
Improvements
More memory reporting in one-shot mode - @mintyleaf
CTRL + L will reset the ncurses interface - @cipri-tom + @claude
GPU and MEM have separate clock fields - @KaeLL
Effective load metric, i.e., the percentage utilization weighted by the ratio
(Current Power / Max Power) - @airvzxf
Fixes
Fix assertion failure on processing the same client ID twice - @Andrew1326
Application desktop metadata install paths and name - @michel-slm
New PPA maintainer - @QuentiumYT
Fixes for Mali GPU - @larunbe
Power draw for Intel Battelmage - @Steve-Tech
Unified memory usage reporting on Nvidia GPUs - @sbhavani
AMDGPU integrated graphics accounts for both VRAM and GTT - @superm1
Misc
Manpage update - @polluks
Fix typos - @oxyzenQ
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Michel Lind <salimma(a)fedoraproject.org> - 3.3.1-2
- Drop upstreamed patches
* Sun Jan 18 2026 Packit <hello(a)packit.dev> - 3.3.1-1
- Update to 3.3.1
- Resolves rhbz#2430383
* Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.2.0-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Thu Jul 24 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.2.0-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Sun Apr 6 2025 Michel Lind <salimma(a)fedoraproject.org> - 3.2.0-4
- Number patches for EL8
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2430383 - nvtop-3.3.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2430383
--------------------------------------------------------------------------------
================================================================================
partclone-0.3.44-1.el10_1 (FEDORA-EPEL-2026-84d75bb04a)
Utility to clone and restore a partition
--------------------------------------------------------------------------------
Update Information:
partclone v0.3.44
Fix --disable-xxhash compile issue
Downgrade gettext requirement to 0.19 for better compatibility
Switch XSL stylesheet back to URL with --nonet
Fix NTFS from 512e/n to 4kn
Fix and support both, static and dynamic builds
partclone v0.3.42
Update docs
Remove libtool generated files
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Robert Scheck <robert(a)fedoraproject.org> 0.3.44-1
- Upgrade to 0.3.44 (#2433151)
* Fri Jan 23 2026 Robert Scheck <robert(a)fedoraproject.org> 0.3.42-1
- Upgrade to 0.3.42 (#2430752 #c1)
* Wed Jan 21 2026 Robert Scheck <robert(a)fedoraproject.org> 0.3.41-1
- Upgrade to 0.3.41 (#2430752)
* Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.3.40-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2433151 - partclone-0.3.44 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2433151
--------------------------------------------------------------------------------
================================================================================
prosody-13.0.4-1.el10_1 (FEDORA-EPEL-2026-439d7e0034)
Flexible communications server for Jabber/XMPP
--------------------------------------------------------------------------------
Update Information:
Prosody 13.0.4
Upstream is pleased to announce a new minor release from their stable branch.
Upstream encourages any deployments using 13.0.3 to upgrade, partly due to a bug
that was introduced into UUID generation in that release. Upstream is not aware
of any direct consequences of this bug, but it may cause compatibility problems
with other software.
Although not strictly bug fixes, upstream sneaked in some configuration-related
improvements to this release which help make configuring Prosody a little easier
and more reliable. Upstream is highlighting them because these changes have a
chance to impact some rare configurations.
The first change is to prevent mod_pubsub from being loaded on a VirtualHost
(easily done if you accidentally add it to your global modules_enabled list).
Loading mod_pubsub on a normal user host can lead to unexpected behaviour. Now
it will log an error and refuse to load if you do that.
The second change is to simplify configuration of archiving in MUCs. Practically
all modern clients now use XEP-0313 to synchronize message history. For
VirtualHosts this is implemented in mod_mam, and for MUC components it is
implemented in mod_muc_mam. From this release, things get much simpler: loading
mod_mam (globally or directly on a MUC component) will automatically load
mod_muc_mam on the MUC component. This means most people (e.g. who have mod_mam
loaded globally on their server) can now remove “muc_mam” from modules_enabled
in their MUC component configuration. It will be loaded automatically.
This last point does mean that if you have mod_mam enabled globally, but do not
want it enabled on your MUCs, you now have to state that explicitly by adding
“mam” to modules_disabled under the MUC’s Component. Be aware that such a
configuration may lead to missing messages in group chats.
A summary of changes in this release:
Fixes and improvements
mod_s2s: Fix traceback when outgoing s2s queue is full
util.uuid: Fix padding of group 2 of UUIDv7 to use zeroes
Minor changes
core.modulemanager: Fix shell commands on components
mod_s2s: Explicitly prevent sending recursive error replies when queue is full
modulemanager: Allow component modules to specify additional inherited modules
prosodyctl check features: Use modulemanager to calculate modules that will
actually be loaded
prosodyctl check features: change recommendation from mod_muc_mam to mod_mam
prosodyctl check config: Fix traceback when zero modules are enabled
mod_pubsub: Fail early if loaded outside of a component to prevent
misconfiguration
doap: Add XEP-0486
mod_pubsub/commands: Fix listing item numbers along with item names
mod_account_activity: Handle authentication provider returning no user info
mod_mam: Automatically load mod_muc_mam if loaded on a MUC component
mod_muc: Inherit mod_mam if globally loaded
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Robert Scheck <robert(a)fedoraproject.org> 13.0.4-1
- Upgrade to 13.0.4 (#2432633)
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 13.0.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2432633 - prosody-13.0.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2432633
--------------------------------------------------------------------------------
================================================================================
python-rich-toolkit-0.17.2-1.el10_1 (FEDORA-EPEL-2026-7201049c42)
Rich toolkit for building command-line applications
--------------------------------------------------------------------------------
Update Information:
0.17.2 - 2026-01-29
This release fixed the color detection function, mostly to fix a bug
interfering with forked worker processes (e.g. uvicorn with --workers).
The color query now uses a dedicated file descriptor instead of stdin/stdout,
preventing issues with logging and signal handling in multi-process
environments.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Packit <hello(a)packit.dev> - 0.17.2-1
- Update to 0.17.2 upstream release
- Resolves: rhbz#2435328
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2435328 - python-rich-toolkit-0.17.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2435328
--------------------------------------------------------------------------------
================================================================================
redwax-tool-1.0.0-7.el10_1 (FEDORA-EPEL-2026-2a11d67238)
The redwax tool
--------------------------------------------------------------------------------
Update Information:
Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Graham Leggett <minfrin(a)sharp.fm> 1.0.0-4
- Fix test case in spec file
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2435060 - redwax-tool: FTBFS in Fedora rawhide/f44
https://bugzilla.redhat.com/show_bug.cgi?id=2435060
--------------------------------------------------------------------------------
================================================================================
xrootd-s3-http-0.6.3-1.el10_1 (FEDORA-EPEL-2026-d6768ab130)
S3/HTTP/Globus filesystem plugins for XRootD
--------------------------------------------------------------------------------
Update Information:
XRootD S3 http 0.6.3
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 0.6.3-1
- Update to version 0.6.3
- Drop patches accepted upstream
* Tue Jan 20 2026 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 0.6.1-1
- Update to version 0.6.1
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.6.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
The following Fedora EPEL 9 Security updates need testing:
Age URL
72 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-9a55de96db xpdf-4.06-1.el9
4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-0e3aa1d4ee rust-sequoia-keystore-server-0.2.0-5.el9 rust-sequoia-sq-1.3.1-9.el9
3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-f542ecf2f3 yarnpkg-1.22.22-16.el9
3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-a6d429d59c java-latest-openjdk-26.0.0.0.32-0.0.1.ea.el9
2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-f9b1069f42 python-python-multipart-0.0.20-2.el9
The following builds have been pushed to Fedora EPEL 9 updates-testing
chromium-144.0.7559.109-1.el9
composer-2.9.5-1.el9
dns-root-data-2026260100-2.el9
editorconfig-0.12.10-1.el9
libva-nvidia-driver-0.0.15-1.el9
nvtop-3.3.1-2.el9
partclone-0.3.44-1.el9
prosody-13.0.4-1.el9
qelectrotech-0.100-1.el9
rpminspect-2.1-1.el9
rust-fb_procfs0.7-0.7.1-6.el9
tomcat-native-1.3.5-1.el9
xorgxrdp-0.10.5-1.el9
xrdp-0.10.5-1.el9
xrootd-s3-http-0.6.3-1.el9
Details about builds:
================================================================================
chromium-144.0.7559.109-1.el9 (FEDORA-EPEL-2026-365332b759)
A WebKit (Blink) powered web browser that Google doesn't want you to use
--------------------------------------------------------------------------------
Update Information:
Update to 144.0.7559.109
* CVE-2026-1504: Inappropriate implementation in Background Fetch API
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Than Ngo <than(a)redhat.com> - 144.0.7559.109-1
- Update to 144.0.7559.109
* CVE-2026-1504: Inappropriate implementation in Background Fetch API
--------------------------------------------------------------------------------
================================================================================
composer-2.9.5-1.el9 (FEDORA-EPEL-2026-f51464fc5e)
Dependency Manager for PHP
--------------------------------------------------------------------------------
Update Information:
Version 2.9.5 - 2026-01-29
Added support for new pie download-url-methods (#12727)
Fixed detection of 7z when installed as 7za on some linux systems (#12731)
Fixed warning because of the symfony/process CVE, 2.9.4 had a workaround already
Version 2.9.4 - 2026-01-22
Added active plugins to the diagnose command output (#12706)
Fixed HTTP/3 causing issues with proxies (#12699)
Fixed show command regression with long descriptions containing unicode
characters (#12704)
Fixed regression handling invalid unicode sequences in output (#12707)
Fixed git rev-list usages to support older pre-2.33 git versions (#12705)
Fixed issue handling paths with = in them on Windows (#12726)
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Remi Collet <remi(a)remirepo.net> - 2.9.5-1
- update to 2.9.5
* Thu Jan 22 2026 Remi Collet <remi(a)remirepo.net> - 2.9.4-1
- update to 2.9.4
--------------------------------------------------------------------------------
================================================================================
dns-root-data-2026260100-2.el9 (FEDORA-EPEL-2026-33868e4df3)
DNS root hints and DNSSEC trust anchor
--------------------------------------------------------------------------------
Update Information:
Switch to python based tools for own Fedora implemented implementation, without
relying on perl packages. Use Python to extract keys instead.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 27 2026 Petr Menšík <pemensik(a)redhat.com> - 2026260100-2
- Add separate utils subpackage
* Tue Jan 27 2026 Petr Menšík <pemensik(a)redhat.com> - 2026260100-1
- Switch to python based tool by Paul Hoffman
* Mon Oct 20 2025 Petr Menšík <pemensik(a)redhat.com> - 2025080400-2
- Ignore specific versions of sources.
* Mon Oct 20 2025 Petr Menšík <pemensik(a)redhat.com> - 2025080400-1
- Initial version after review
--------------------------------------------------------------------------------
================================================================================
editorconfig-0.12.10-1.el9 (FEDORA-EPEL-2026-55289e429f)
Parser for EditorConfig files written in C
--------------------------------------------------------------------------------
Update Information:
v0.12.10
Make path splitting algorithm UNC-aware
Miscellaneous fixes.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 22 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.12.10-1
- Update to 0.12.10 (close RHBZ#2401398)
* Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.12.9-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Wed Jul 23 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.12.9-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Thu Jan 16 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.12.9-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Wed Jul 17 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.12.9-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2401398 - editorconfig-0.12.10 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2401398
--------------------------------------------------------------------------------
================================================================================
libva-nvidia-driver-0.0.15-1.el9 (FEDORA-EPEL-2026-48ef96e169)
A VA-API implemention using NVIDIA's NVDEC
--------------------------------------------------------------------------------
Update Information:
Update to 0.0.15.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Jan 30 2026 Simone Caronni <negativo17(a)gmail.com> - 0.0.15-1
- Update to 0.0.15
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2435250 - libva-nvidia-driver-0.0.15 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2435250
--------------------------------------------------------------------------------
================================================================================
nvtop-3.3.1-2.el9 (FEDORA-EPEL-2026-469e4e7107)
GPU process monitoring for various devices
--------------------------------------------------------------------------------
Update Information:
3.3.1
Fix a regression that would miss-report available device memory of NVIDIA GPUs
Integrate effective/efficiency usage within the GPU utilization metric
3.3.0
New in this release
Target support
Rockchip NPU - @feilongfl
MetaX GPUs - @zhenyu-xu-metax
Enflame GCU - @QShen3
Improvements
More memory reporting in one-shot mode - @mintyleaf
CTRL + L will reset the ncurses interface - @cipri-tom + @claude
GPU and MEM have separate clock fields - @KaeLL
Effective load metric, i.e., the percentage utilization weighted by the ratio
(Current Power / Max Power) - @airvzxf
Fixes
Fix assertion failure on processing the same client ID twice - @Andrew1326
Application desktop metadata install paths and name - @michel-slm
New PPA maintainer - @QuentiumYT
Fixes for Mali GPU - @larunbe
Power draw for Intel Battelmage - @Steve-Tech
Unified memory usage reporting on Nvidia GPUs - @sbhavani
AMDGPU integrated graphics accounts for both VRAM and GTT - @superm1
Misc
Manpage update - @polluks
Fix typos - @oxyzenQ
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Michel Lind <salimma(a)fedoraproject.org> - 3.3.1-2
- Drop upstreamed patches
* Sun Jan 18 2026 Packit <hello(a)packit.dev> - 3.3.1-1
- Update to 3.3.1
- Resolves rhbz#2430383
* Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.2.0-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Thu Jul 24 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.2.0-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Sun Apr 6 2025 Michel Lind <salimma(a)fedoraproject.org> - 3.2.0-4
- Number patches for EL8
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2430383 - nvtop-3.3.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2430383
--------------------------------------------------------------------------------
================================================================================
partclone-0.3.44-1.el9 (FEDORA-EPEL-2026-a6b8a3a83f)
Utility to clone and restore a partition
--------------------------------------------------------------------------------
Update Information:
partclone v0.3.44
Fix --disable-xxhash compile issue
Downgrade gettext requirement to 0.19 for better compatibility
Switch XSL stylesheet back to URL with --nonet
Fix NTFS from 512e/n to 4kn
Fix and support both, static and dynamic builds
partclone v0.3.42
Update docs
Remove libtool generated files
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Robert Scheck <robert(a)fedoraproject.org> 0.3.44-1
- Upgrade to 0.3.44 (#2433151)
* Fri Jan 23 2026 Robert Scheck <robert(a)fedoraproject.org> 0.3.42-1
- Upgrade to 0.3.42 (#2430752 #c1)
* Wed Jan 21 2026 Robert Scheck <robert(a)fedoraproject.org> 0.3.41-1
- Upgrade to 0.3.41 (#2430752)
* Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.3.40-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2433151 - partclone-0.3.44 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2433151
--------------------------------------------------------------------------------
================================================================================
prosody-13.0.4-1.el9 (FEDORA-EPEL-2026-ec363be715)
Flexible communications server for Jabber/XMPP
--------------------------------------------------------------------------------
Update Information:
Prosody 13.0.4
Upstream is pleased to announce a new minor release from their stable branch.
Upstream encourages any deployments using 13.0.3 to upgrade, partly due to a bug
that was introduced into UUID generation in that release. Upstream is not aware
of any direct consequences of this bug, but it may cause compatibility problems
with other software.
Although not strictly bug fixes, upstream sneaked in some configuration-related
improvements to this release which help make configuring Prosody a little easier
and more reliable. Upstream is highlighting them because these changes have a
chance to impact some rare configurations.
The first change is to prevent mod_pubsub from being loaded on a VirtualHost
(easily done if you accidentally add it to your global modules_enabled list).
Loading mod_pubsub on a normal user host can lead to unexpected behaviour. Now
it will log an error and refuse to load if you do that.
The second change is to simplify configuration of archiving in MUCs. Practically
all modern clients now use XEP-0313 to synchronize message history. For
VirtualHosts this is implemented in mod_mam, and for MUC components it is
implemented in mod_muc_mam. From this release, things get much simpler: loading
mod_mam (globally or directly on a MUC component) will automatically load
mod_muc_mam on the MUC component. This means most people (e.g. who have mod_mam
loaded globally on their server) can now remove “muc_mam” from modules_enabled
in their MUC component configuration. It will be loaded automatically.
This last point does mean that if you have mod_mam enabled globally, but do not
want it enabled on your MUCs, you now have to state that explicitly by adding
“mam” to modules_disabled under the MUC’s Component. Be aware that such a
configuration may lead to missing messages in group chats.
A summary of changes in this release:
Fixes and improvements
mod_s2s: Fix traceback when outgoing s2s queue is full
util.uuid: Fix padding of group 2 of UUIDv7 to use zeroes
Minor changes
core.modulemanager: Fix shell commands on components
mod_s2s: Explicitly prevent sending recursive error replies when queue is full
modulemanager: Allow component modules to specify additional inherited modules
prosodyctl check features: Use modulemanager to calculate modules that will
actually be loaded
prosodyctl check features: change recommendation from mod_muc_mam to mod_mam
prosodyctl check config: Fix traceback when zero modules are enabled
mod_pubsub: Fail early if loaded outside of a component to prevent
misconfiguration
doap: Add XEP-0486
mod_pubsub/commands: Fix listing item numbers along with item names
mod_account_activity: Handle authentication provider returning no user info
mod_mam: Automatically load mod_muc_mam if loaded on a MUC component
mod_muc: Inherit mod_mam if globally loaded
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Robert Scheck <robert(a)fedoraproject.org> 13.0.4-1
- Upgrade to 13.0.4 (#2432633)
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 13.0.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2432633 - prosody-13.0.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2432633
--------------------------------------------------------------------------------
================================================================================
qelectrotech-0.100-1.el9 (FEDORA-EPEL-2026-89b89f70cc)
An electric diagrams editor
--------------------------------------------------------------------------------
Update Information:
Overview
This release (v0.100) collects a large set of new features, UI and editor
improvements, element and symbol updates, build and packaging fixes, dependency
upgrades, translations, and a broad set of bug fixes and stability improvements.
It is intended as a stable, feature-rich stepping stone toward the next major
workflows for symbol editing, terminal/strip handling and export improvements.
Highlights / Key Features
Terminal Strip / Terminal Strip Editor
New TerminalStripItem type and related editor workflow added.
Support for drawing and displaying terminal bridges and links in the editor.
Full editor support (layout preview, save/load into .qet files) and undo support
for terminal strip operations.
New Example Projects
Several new example projects included, notably photovoltaic (PV) examples to
help users getting started with PV designs.
Improved Export / Print Handling
Export limits adjusted and better handling of QPainter/printing boundaries to
avoid export artefacts and out-of-range errors.
Export dialog updated to allow larger pixel limits where appropriate.
Element & Symbol Additions
New elements and symbols added (including vendor-specific elements and
additional sensors/Arduino components).
Improvements to element import & metadata handling.
Packaging & Multi-arch Support
Updated packaging scripts for AppImage, Flatpak, Snap and macOS deployment.
Improved aarch64/arm64 support.
Detailed Changes
Editor & UX
Better handling for rotation, flip and mirror operations in the element editor:
Primitives and text rotation behavior improved.
Finer rotation increments and predictable text orientation after
flips/rotations.
Wiring and conductor behavior:
More robust creation and movement of wires and conductor bundles.
Improved text attachment and positioning for wires and improved stability while
editing complex conductor networks.
TerminalStrip editor: see Highlights - includes drawing, preview, layout
editing, persistent storage in the project file and undo support.
Element Editor & Symbol Trim/Sort:
Improved trimming/normalization of element metadata.
Better sorting and error handling for element imports (DXF and other formats).
Small UI improvements: About dialog updates, autosave spinbox ranges, improved
tooltips and mouse-hover help for dynamic texts.
New & Updated Elements
New elements added for industrial and automation workflows (including Siemens-
related elements, logic elements, sensors and Arduino components).
Symbol library additions and cleanup; improved defaults for newly added symbols.
Element meta-data cleanup: article numbers, descriptions, and manufacturer
fields were normalized and trimmed on import.
Export / Printing / PDF
Adjusted internal export limits to avoid hitting QPainter size restrictions;
users can now export larger, high-resolution images/prints in more cases.
Better handling of page sizes and printer-related geometry using QRectF
improvements.
PDF export improvements to increase reliability of exported vector content.
Internationalization & Translations
Large translation updates across many languages: German (DE), French (FR), Dutch
(NL, including nl_BE), Swedish (SV), Italian (IT), Polish (PL), Portuguese-BR
(PT-BR), Serbian (SR), Chinese (Simplified) and others.
Fixes and corrections for many UI strings and localized resources.
Bug Fixes (selected)
Fixed crashes and various null pointer access issues discovered by static and
dynamic testing.
Resolved multiple reported bugs that caused build failures on some platforms
(FTBFS fixes for macOS and others).
Fixed issues with automatic conductor/strand numbering in several edge cases
(referenced Bug 293 in the commit logs).
Resolved text/summary headline issues in the German-language summary generator.
Fixes for a number of visually incorrect renderings and layout corner-cases
during element transformation (rotate/flip/mirror).
Fixed issues that affected export sizes and caused export artifacts (referenced
fixes for bug IDs around #329/#330 in commit notes).
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Remi Collet <remi(a)remirepo.net> - 0.100-1
- update to 0.100
- re-license spec file to CECILL-2.1
- report no usable sources tarball
https://github.com/qelectrotech/qelectrotech-source-mirror/issues/418
- open https://bugzilla.redhat.com/2433755
Please build kf5-kcoreaddons for EPEL 10 (and 10.1)
- open https://bugzilla.redhat.com/2433762
Please build kf5-kwidgetsaddons for EPEL-10 (and 10.1)
--------------------------------------------------------------------------------
================================================================================
rpminspect-2.1-1.el9 (FEDORA-EPEL-2026-ecaccdc662)
Build deviation analysis and compliance tool
--------------------------------------------------------------------------------
Update Information:
Upgrade to rpminspect-2.1
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Dave Cantrell <dcantrell(a)redhat.com> - 2.1-
- Upgrade to rpminspect-2.1
--------------------------------------------------------------------------------
================================================================================
rust-fb_procfs0.7-0.7.1-6.el9 (FEDORA-EPEL-2026-fdc2259bae)
For reading procfs
--------------------------------------------------------------------------------
Update Information:
Bump nix dependency to v0.30.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Fabio Valentini <decathorpe(a)gmail.com> - 0.7.1-6
- Bump nix dependency to v0.30
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.7.1-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.7.1-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Sun Jan 19 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.7.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Fri Jul 19 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.7.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
tomcat-native-1.3.5-1.el9 (FEDORA-EPEL-2026-0676a5a7e1)
Tomcat native library
--------------------------------------------------------------------------------
Update Information:
Update to latest version
--------------------------------------------------------------------------------
ChangeLog:
* Fri Jan 30 2026 Coty Sutherland <csutherl(a)fedoraproject.org> - 1:1.3.5-1
- Update to 1.3.5
--------------------------------------------------------------------------------
================================================================================
xorgxrdp-0.10.5-1.el9 (FEDORA-EPEL-2026-d12ea63356)
Implementation of xrdp backend as Xorg modules
--------------------------------------------------------------------------------
Update Information:
Release notes for xrdp v0.10.5 (2026/01/27)
Security fixes
CVE-2025-68670: Improper bounds checking of domain string length leads to Stack-
based Buffer Overflow
New features
It is now possible to start the xrdp daemon entirely unprivileged from the
service manager (#3599 #3603). If you do this certain restrictions will apply.
See https://github.com/neutrinolabs/xrdp/wiki/Running-the-xrdp-process-as-non-
root for details.
TLS pre-master secrets can now be recorded for packet captures (#3617)
Add a FuseRootReportMaxFree to work around 'no free space' issues with some file
managers (#3639)
Alternate shell names can now be passed to startwm.sh in an environment variable
for more system management control (#3624 #3651)
Updated Xorg paths in sesman.ini to include more recent distros (#3663)
Add Slovenian keyboard (#3668 #3670)
xrdpapi: Add a way to monitor connect/disconnect events (#3693)
Bug fixes
Allow an empty X11 UTF8_STRING to be pasted to the clipboard (#3580 #3582)
Fix a regression introduced in v0.10.x, where it became impossible to connect to
a VNC server which did not support the ExtendedDesktopSize encoding (#3540
#3584)
Fix a regression introduced in v0.10.x related to PAM groups handling (#3594)
Inconsistencies with [MS-RDPBCGR] have been addressed (#3608)
A reference to uninitialised data within the verify_user_pam_userpass.c module
has been fixed (#3638)
Prevent some possible crashes when the RFX encoder is resized (#3590 #3644)
Fixes a regression introduced by GFX development which prevented the JPEG
encoder from working correctly (#3649)
Fixes a regression introduced by #2974 which resulted in the xrdp PID file being
deleted unexpectedly (#3650)
Do not overwrite a VNC port set by the user when not using sesman (#3674)
Fix regression from 0.9.x when freerdp client uses /workarea (#3618 #3676)
Fixes a crash where a resize is attempted with drdynvc disabled (#3672 #3680)
getgrouplist() now compiles on MacOS (#3575)
Various Coverity warnings have been addressed (#3656)
Documentation improvements (#3665)
Internal changes
An unnecessary include of sys/signal.h causing a compile warning on MUSL-C has
been removed (#3679)
Release notes for xorgxrdp v0.10.5 (2026/01/28)
Bug fixes
Fix bug in Chrome pointer detection (#394 #396)
Internal changes
CI: Update FreeBSD xrdp dependency (#398)
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Bojan Smojver <bojan(a)rexursive.com> - 0.10.5-1
- Update to 0.10.5
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.10.4-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.10.4-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1908387 - Windows with transparency show whatever is below
https://bugzilla.redhat.com/show_bug.cgi?id=1908387
[ 2 ] Bug #2279775 - xrdp socketdir not cleaned up on package removal
https://bugzilla.redhat.com/show_bug.cgi?id=2279775
[ 3 ] Bug #2322105 - AltGr on Spanish keyboards
https://bugzilla.redhat.com/show_bug.cgi?id=2322105
[ 4 ] Bug #2323097 - Requesting clarification on the License of xrdp rpm.
https://bugzilla.redhat.com/show_bug.cgi?id=2323097
[ 5 ] Bug #2433438 - CVE-2025-68670 xorgxrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2433438
[ 6 ] Bug #2433439 - CVE-2025-68670 xrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2433439
[ 7 ] Bug #2433440 - CVE-2025-68670 xorgxrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-9]
https://bugzilla.redhat.com/show_bug.cgi?id=2433440
[ 8 ] Bug #2433441 - CVE-2025-68670 xrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-9]
https://bugzilla.redhat.com/show_bug.cgi?id=2433441
[ 9 ] Bug #2433442 - CVE-2025-68670 xorgxrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2433442
[ 10 ] Bug #2433840 - xorgxrdp-0.10.5 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2433840
--------------------------------------------------------------------------------
================================================================================
xrdp-0.10.5-1.el9 (FEDORA-EPEL-2026-d12ea63356)
Open source remote desktop protocol (RDP) server
--------------------------------------------------------------------------------
Update Information:
Release notes for xrdp v0.10.5 (2026/01/27)
Security fixes
CVE-2025-68670: Improper bounds checking of domain string length leads to Stack-
based Buffer Overflow
New features
It is now possible to start the xrdp daemon entirely unprivileged from the
service manager (#3599 #3603). If you do this certain restrictions will apply.
See https://github.com/neutrinolabs/xrdp/wiki/Running-the-xrdp-process-as-non-
root for details.
TLS pre-master secrets can now be recorded for packet captures (#3617)
Add a FuseRootReportMaxFree to work around 'no free space' issues with some file
managers (#3639)
Alternate shell names can now be passed to startwm.sh in an environment variable
for more system management control (#3624 #3651)
Updated Xorg paths in sesman.ini to include more recent distros (#3663)
Add Slovenian keyboard (#3668 #3670)
xrdpapi: Add a way to monitor connect/disconnect events (#3693)
Bug fixes
Allow an empty X11 UTF8_STRING to be pasted to the clipboard (#3580 #3582)
Fix a regression introduced in v0.10.x, where it became impossible to connect to
a VNC server which did not support the ExtendedDesktopSize encoding (#3540
#3584)
Fix a regression introduced in v0.10.x related to PAM groups handling (#3594)
Inconsistencies with [MS-RDPBCGR] have been addressed (#3608)
A reference to uninitialised data within the verify_user_pam_userpass.c module
has been fixed (#3638)
Prevent some possible crashes when the RFX encoder is resized (#3590 #3644)
Fixes a regression introduced by GFX development which prevented the JPEG
encoder from working correctly (#3649)
Fixes a regression introduced by #2974 which resulted in the xrdp PID file being
deleted unexpectedly (#3650)
Do not overwrite a VNC port set by the user when not using sesman (#3674)
Fix regression from 0.9.x when freerdp client uses /workarea (#3618 #3676)
Fixes a crash where a resize is attempted with drdynvc disabled (#3672 #3680)
getgrouplist() now compiles on MacOS (#3575)
Various Coverity warnings have been addressed (#3656)
Documentation improvements (#3665)
Internal changes
An unnecessary include of sys/signal.h causing a compile warning on MUSL-C has
been removed (#3679)
Release notes for xorgxrdp v0.10.5 (2026/01/28)
Bug fixes
Fix bug in Chrome pointer detection (#394 #396)
Internal changes
CI: Update FreeBSD xrdp dependency (#398)
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Bojan Smojver <bojan(a)rexursive.com> - 1:0.10.5-1
- Update to 0.10.5
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:0.10.4-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Tue Nov 4 2025 Tom Callaway <spot(a)fedoraproject.org> - 1:0.10.4-4
- rebuild for new fuse3
* Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:0.10.4-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1908387 - Windows with transparency show whatever is below
https://bugzilla.redhat.com/show_bug.cgi?id=1908387
[ 2 ] Bug #2279775 - xrdp socketdir not cleaned up on package removal
https://bugzilla.redhat.com/show_bug.cgi?id=2279775
[ 3 ] Bug #2322105 - AltGr on Spanish keyboards
https://bugzilla.redhat.com/show_bug.cgi?id=2322105
[ 4 ] Bug #2323097 - Requesting clarification on the License of xrdp rpm.
https://bugzilla.redhat.com/show_bug.cgi?id=2323097
[ 5 ] Bug #2433438 - CVE-2025-68670 xorgxrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2433438
[ 6 ] Bug #2433439 - CVE-2025-68670 xrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2433439
[ 7 ] Bug #2433440 - CVE-2025-68670 xorgxrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-9]
https://bugzilla.redhat.com/show_bug.cgi?id=2433440
[ 8 ] Bug #2433441 - CVE-2025-68670 xrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-9]
https://bugzilla.redhat.com/show_bug.cgi?id=2433441
[ 9 ] Bug #2433442 - CVE-2025-68670 xorgxrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2433442
[ 10 ] Bug #2433840 - xorgxrdp-0.10.5 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2433840
--------------------------------------------------------------------------------
================================================================================
xrootd-s3-http-0.6.3-1.el9 (FEDORA-EPEL-2026-964850c630)
S3/HTTP/Globus filesystem plugins for XRootD
--------------------------------------------------------------------------------
Update Information:
XRootD S3 http 0.6.3
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 0.6.3-1
- Update to version 0.6.3
- Drop patches accepted upstream
* Tue Jan 20 2026 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 0.6.1-1
- Update to version 0.6.1
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.6.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
The following Fedora EPEL 8 Security updates need testing:
Age URL
72 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-5b2095e2c2 xpdf-4.06-1.el8
3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-cf486df588 opencc-1.0.5-4.el8
3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-58d7d41403 java-latest-openjdk-26.0.0.0.32-0.0.1.ea.el8
The following builds have been pushed to Fedora EPEL 8 updates-testing
editorconfig-0.12.10-1.el8
nvtop-3.3.1-2.el8
partclone-0.3.44-1.el8
prosody-13.0.4-1.el8
qelectrotech-0.100-1.el8
rpminspect-2.1-1.el8
xorgxrdp-0.10.5-1.el8
xrdp-0.10.5-1.el8
Details about builds:
================================================================================
editorconfig-0.12.10-1.el8 (FEDORA-EPEL-2026-ebd878d450)
Parser for EditorConfig files written in C
--------------------------------------------------------------------------------
Update Information:
v0.12.10
Make path splitting algorithm UNC-aware
Miscellaneous fixes.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 22 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.12.10-1
- Update to 0.12.10 (close RHBZ#2401398)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2401398 - editorconfig-0.12.10 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2401398
--------------------------------------------------------------------------------
================================================================================
nvtop-3.3.1-2.el8 (FEDORA-EPEL-2026-2243bd3e9e)
GPU process monitoring for various devices
--------------------------------------------------------------------------------
Update Information:
3.3.1
Fix a regression that would miss-report available device memory of NVIDIA GPUs
Integrate effective/efficiency usage within the GPU utilization metric
3.3.0
New in this release
Target support
Rockchip NPU - @feilongfl
MetaX GPUs - @zhenyu-xu-metax
Enflame GCU - @QShen3
Improvements
More memory reporting in one-shot mode - @mintyleaf
CTRL + L will reset the ncurses interface - @cipri-tom + @claude
GPU and MEM have separate clock fields - @KaeLL
Effective load metric, i.e., the percentage utilization weighted by the ratio
(Current Power / Max Power) - @airvzxf
Fixes
Fix assertion failure on processing the same client ID twice - @Andrew1326
Application desktop metadata install paths and name - @michel-slm
New PPA maintainer - @QuentiumYT
Fixes for Mali GPU - @larunbe
Power draw for Intel Battelmage - @Steve-Tech
Unified memory usage reporting on Nvidia GPUs - @sbhavani
AMDGPU integrated graphics accounts for both VRAM and GTT - @superm1
Misc
Manpage update - @polluks
Fix typos - @oxyzenQ
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Michel Lind <salimma(a)fedoraproject.org> - 3.3.1-2
- Drop upstreamed patches
* Sun Jan 18 2026 Packit <hello(a)packit.dev> - 3.3.1-1
- Update to 3.3.1
- Resolves rhbz#2430383
* Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.2.0-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Thu Jul 24 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.2.0-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2430383 - nvtop-3.3.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2430383
--------------------------------------------------------------------------------
================================================================================
partclone-0.3.44-1.el8 (FEDORA-EPEL-2026-91965bae9b)
Utility to clone and restore a partition
--------------------------------------------------------------------------------
Update Information:
partclone v0.3.44
Fix --disable-xxhash compile issue
Downgrade gettext requirement to 0.19 for better compatibility
Switch XSL stylesheet back to URL with --nonet
Fix NTFS from 512e/n to 4kn
Fix and support both, static and dynamic builds
partclone v0.3.42
Update docs
Remove libtool generated files
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Robert Scheck <robert(a)fedoraproject.org> 0.3.44-1
- Upgrade to 0.3.44 (#2433151)
* Fri Jan 23 2026 Robert Scheck <robert(a)fedoraproject.org> 0.3.42-1
- Upgrade to 0.3.42 (#2430752 #c1)
* Wed Jan 21 2026 Robert Scheck <robert(a)fedoraproject.org> 0.3.41-1
- Upgrade to 0.3.41 (#2430752)
* Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.3.40-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2433151 - partclone-0.3.44 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2433151
--------------------------------------------------------------------------------
================================================================================
prosody-13.0.4-1.el8 (FEDORA-EPEL-2026-f5a48f49bc)
Flexible communications server for Jabber/XMPP
--------------------------------------------------------------------------------
Update Information:
Prosody 13.0.4
Upstream is pleased to announce a new minor release from their stable branch.
Upstream encourages any deployments using 13.0.3 to upgrade, partly due to a bug
that was introduced into UUID generation in that release. Upstream is not aware
of any direct consequences of this bug, but it may cause compatibility problems
with other software.
Although not strictly bug fixes, upstream sneaked in some configuration-related
improvements to this release which help make configuring Prosody a little easier
and more reliable. Upstream is highlighting them because these changes have a
chance to impact some rare configurations.
The first change is to prevent mod_pubsub from being loaded on a VirtualHost
(easily done if you accidentally add it to your global modules_enabled list).
Loading mod_pubsub on a normal user host can lead to unexpected behaviour. Now
it will log an error and refuse to load if you do that.
The second change is to simplify configuration of archiving in MUCs. Practically
all modern clients now use XEP-0313 to synchronize message history. For
VirtualHosts this is implemented in mod_mam, and for MUC components it is
implemented in mod_muc_mam. From this release, things get much simpler: loading
mod_mam (globally or directly on a MUC component) will automatically load
mod_muc_mam on the MUC component. This means most people (e.g. who have mod_mam
loaded globally on their server) can now remove “muc_mam” from modules_enabled
in their MUC component configuration. It will be loaded automatically.
This last point does mean that if you have mod_mam enabled globally, but do not
want it enabled on your MUCs, you now have to state that explicitly by adding
“mam” to modules_disabled under the MUC’s Component. Be aware that such a
configuration may lead to missing messages in group chats.
A summary of changes in this release:
Fixes and improvements
mod_s2s: Fix traceback when outgoing s2s queue is full
util.uuid: Fix padding of group 2 of UUIDv7 to use zeroes
Minor changes
core.modulemanager: Fix shell commands on components
mod_s2s: Explicitly prevent sending recursive error replies when queue is full
modulemanager: Allow component modules to specify additional inherited modules
prosodyctl check features: Use modulemanager to calculate modules that will
actually be loaded
prosodyctl check features: change recommendation from mod_muc_mam to mod_mam
prosodyctl check config: Fix traceback when zero modules are enabled
mod_pubsub: Fail early if loaded outside of a component to prevent
misconfiguration
doap: Add XEP-0486
mod_pubsub/commands: Fix listing item numbers along with item names
mod_account_activity: Handle authentication provider returning no user info
mod_mam: Automatically load mod_muc_mam if loaded on a MUC component
mod_muc: Inherit mod_mam if globally loaded
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Robert Scheck <robert(a)fedoraproject.org> 13.0.4-1
- Upgrade to 13.0.4 (#2432633)
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 13.0.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2432633 - prosody-13.0.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2432633
--------------------------------------------------------------------------------
================================================================================
qelectrotech-0.100-1.el8 (FEDORA-EPEL-2026-2f97368019)
An electric diagrams editor
--------------------------------------------------------------------------------
Update Information:
Overview
This release (v0.100) collects a large set of new features, UI and editor
improvements, element and symbol updates, build and packaging fixes, dependency
upgrades, translations, and a broad set of bug fixes and stability improvements.
It is intended as a stable, feature-rich stepping stone toward the next major
workflows for symbol editing, terminal/strip handling and export improvements.
Highlights / Key Features
Terminal Strip / Terminal Strip Editor
New TerminalStripItem type and related editor workflow added.
Support for drawing and displaying terminal bridges and links in the editor.
Full editor support (layout preview, save/load into .qet files) and undo support
for terminal strip operations.
New Example Projects
Several new example projects included, notably photovoltaic (PV) examples to
help users getting started with PV designs.
Improved Export / Print Handling
Export limits adjusted and better handling of QPainter/printing boundaries to
avoid export artefacts and out-of-range errors.
Export dialog updated to allow larger pixel limits where appropriate.
Element & Symbol Additions
New elements and symbols added (including vendor-specific elements and
additional sensors/Arduino components).
Improvements to element import & metadata handling.
Packaging & Multi-arch Support
Updated packaging scripts for AppImage, Flatpak, Snap and macOS deployment.
Improved aarch64/arm64 support.
Detailed Changes
Editor & UX
Better handling for rotation, flip and mirror operations in the element editor:
Primitives and text rotation behavior improved.
Finer rotation increments and predictable text orientation after
flips/rotations.
Wiring and conductor behavior:
More robust creation and movement of wires and conductor bundles.
Improved text attachment and positioning for wires and improved stability while
editing complex conductor networks.
TerminalStrip editor: see Highlights - includes drawing, preview, layout
editing, persistent storage in the project file and undo support.
Element Editor & Symbol Trim/Sort:
Improved trimming/normalization of element metadata.
Better sorting and error handling for element imports (DXF and other formats).
Small UI improvements: About dialog updates, autosave spinbox ranges, improved
tooltips and mouse-hover help for dynamic texts.
New & Updated Elements
New elements added for industrial and automation workflows (including Siemens-
related elements, logic elements, sensors and Arduino components).
Symbol library additions and cleanup; improved defaults for newly added symbols.
Element meta-data cleanup: article numbers, descriptions, and manufacturer
fields were normalized and trimmed on import.
Export / Printing / PDF
Adjusted internal export limits to avoid hitting QPainter size restrictions;
users can now export larger, high-resolution images/prints in more cases.
Better handling of page sizes and printer-related geometry using QRectF
improvements.
PDF export improvements to increase reliability of exported vector content.
Internationalization & Translations
Large translation updates across many languages: German (DE), French (FR), Dutch
(NL, including nl_BE), Swedish (SV), Italian (IT), Polish (PL), Portuguese-BR
(PT-BR), Serbian (SR), Chinese (Simplified) and others.
Fixes and corrections for many UI strings and localized resources.
Bug Fixes (selected)
Fixed crashes and various null pointer access issues discovered by static and
dynamic testing.
Resolved multiple reported bugs that caused build failures on some platforms
(FTBFS fixes for macOS and others).
Fixed issues with automatic conductor/strand numbering in several edge cases
(referenced Bug 293 in the commit logs).
Resolved text/summary headline issues in the German-language summary generator.
Fixes for a number of visually incorrect renderings and layout corner-cases
during element transformation (rotate/flip/mirror).
Fixed issues that affected export sizes and caused export artifacts (referenced
fixes for bug IDs around #329/#330 in commit notes).
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Remi Collet <remi(a)remirepo.net> - 0.100-1
- update to 0.100
- re-license spec file to CECILL-2.1
- report no usable sources tarball
https://github.com/qelectrotech/qelectrotech-source-mirror/issues/418
- open https://bugzilla.redhat.com/2433755
Please build kf5-kcoreaddons for EPEL 10 (and 10.1)
- open https://bugzilla.redhat.com/2433762
Please build kf5-kwidgetsaddons for EPEL-10 (and 10.1)
--------------------------------------------------------------------------------
================================================================================
rpminspect-2.1-1.el8 (FEDORA-EPEL-2026-c0755b5937)
Build deviation analysis and compliance tool
--------------------------------------------------------------------------------
Update Information:
Upgrade to rpminspect-2.1
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Dave Cantrell <dcantrell(a)redhat.com> - 2.1-
- Upgrade to rpminspect-2.1
--------------------------------------------------------------------------------
================================================================================
xorgxrdp-0.10.5-1.el8 (FEDORA-EPEL-2026-5c626357f7)
Implementation of xrdp backend as Xorg modules
--------------------------------------------------------------------------------
Update Information:
Release notes for xrdp v0.10.5 (2026/01/27)
Security fixes
CVE-2025-68670: Improper bounds checking of domain string length leads to Stack-
based Buffer Overflow
New features
It is now possible to start the xrdp daemon entirely unprivileged from the
service manager (#3599 #3603). If you do this certain restrictions will apply.
See https://github.com/neutrinolabs/xrdp/wiki/Running-the-xrdp-process-as-non-
root for details.
TLS pre-master secrets can now be recorded for packet captures (#3617)
Add a FuseRootReportMaxFree to work around 'no free space' issues with some file
managers (#3639)
Alternate shell names can now be passed to startwm.sh in an environment variable
for more system management control (#3624 #3651)
Updated Xorg paths in sesman.ini to include more recent distros (#3663)
Add Slovenian keyboard (#3668 #3670)
xrdpapi: Add a way to monitor connect/disconnect events (#3693)
Bug fixes
Allow an empty X11 UTF8_STRING to be pasted to the clipboard (#3580 #3582)
Fix a regression introduced in v0.10.x, where it became impossible to connect to
a VNC server which did not support the ExtendedDesktopSize encoding (#3540
#3584)
Fix a regression introduced in v0.10.x related to PAM groups handling (#3594)
Inconsistencies with [MS-RDPBCGR] have been addressed (#3608)
A reference to uninitialised data within the verify_user_pam_userpass.c module
has been fixed (#3638)
Prevent some possible crashes when the RFX encoder is resized (#3590 #3644)
Fixes a regression introduced by GFX development which prevented the JPEG
encoder from working correctly (#3649)
Fixes a regression introduced by #2974 which resulted in the xrdp PID file being
deleted unexpectedly (#3650)
Do not overwrite a VNC port set by the user when not using sesman (#3674)
Fix regression from 0.9.x when freerdp client uses /workarea (#3618 #3676)
Fixes a crash where a resize is attempted with drdynvc disabled (#3672 #3680)
getgrouplist() now compiles on MacOS (#3575)
Various Coverity warnings have been addressed (#3656)
Documentation improvements (#3665)
Internal changes
An unnecessary include of sys/signal.h causing a compile warning on MUSL-C has
been removed (#3679)
Release notes for xorgxrdp v0.10.5 (2026/01/28)
Bug fixes
Fix bug in Chrome pointer detection (#394 #396)
Internal changes
CI: Update FreeBSD xrdp dependency (#398)
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 29 2026 Bojan Smojver <bojan(a)rexursive.com> - 0.10.5-1
- Update to 0.10.5
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.10.4-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.10.4-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1908387 - Windows with transparency show whatever is below
https://bugzilla.redhat.com/show_bug.cgi?id=1908387
[ 2 ] Bug #2279775 - xrdp socketdir not cleaned up on package removal
https://bugzilla.redhat.com/show_bug.cgi?id=2279775
[ 3 ] Bug #2322105 - AltGr on Spanish keyboards
https://bugzilla.redhat.com/show_bug.cgi?id=2322105
[ 4 ] Bug #2323097 - Requesting clarification on the License of xrdp rpm.
https://bugzilla.redhat.com/show_bug.cgi?id=2323097
[ 5 ] Bug #2433438 - CVE-2025-68670 xorgxrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2433438
[ 6 ] Bug #2433439 - CVE-2025-68670 xrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2433439
[ 7 ] Bug #2433440 - CVE-2025-68670 xorgxrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-9]
https://bugzilla.redhat.com/show_bug.cgi?id=2433440
[ 8 ] Bug #2433441 - CVE-2025-68670 xrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-9]
https://bugzilla.redhat.com/show_bug.cgi?id=2433441
[ 9 ] Bug #2433442 - CVE-2025-68670 xorgxrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2433442
[ 10 ] Bug #2433840 - xorgxrdp-0.10.5 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2433840
--------------------------------------------------------------------------------
================================================================================
xrdp-0.10.5-1.el8 (FEDORA-EPEL-2026-5c626357f7)
Open source remote desktop protocol (RDP) server
--------------------------------------------------------------------------------
Update Information:
Release notes for xrdp v0.10.5 (2026/01/27)
Security fixes
CVE-2025-68670: Improper bounds checking of domain string length leads to Stack-
based Buffer Overflow
New features
It is now possible to start the xrdp daemon entirely unprivileged from the
service manager (#3599 #3603). If you do this certain restrictions will apply.
See https://github.com/neutrinolabs/xrdp/wiki/Running-the-xrdp-process-as-non-
root for details.
TLS pre-master secrets can now be recorded for packet captures (#3617)
Add a FuseRootReportMaxFree to work around 'no free space' issues with some file
managers (#3639)
Alternate shell names can now be passed to startwm.sh in an environment variable
for more system management control (#3624 #3651)
Updated Xorg paths in sesman.ini to include more recent distros (#3663)
Add Slovenian keyboard (#3668 #3670)
xrdpapi: Add a way to monitor connect/disconnect events (#3693)
Bug fixes
Allow an empty X11 UTF8_STRING to be pasted to the clipboard (#3580 #3582)
Fix a regression introduced in v0.10.x, where it became impossible to connect to
a VNC server which did not support the ExtendedDesktopSize encoding (#3540
#3584)
Fix a regression introduced in v0.10.x related to PAM groups handling (#3594)
Inconsistencies with [MS-RDPBCGR] have been addressed (#3608)
A reference to uninitialised data within the verify_user_pam_userpass.c module
has been fixed (#3638)
Prevent some possible crashes when the RFX encoder is resized (#3590 #3644)
Fixes a regression introduced by GFX development which prevented the JPEG
encoder from working correctly (#3649)
Fixes a regression introduced by #2974 which resulted in the xrdp PID file being
deleted unexpectedly (#3650)
Do not overwrite a VNC port set by the user when not using sesman (#3674)
Fix regression from 0.9.x when freerdp client uses /workarea (#3618 #3676)
Fixes a crash where a resize is attempted with drdynvc disabled (#3672 #3680)
getgrouplist() now compiles on MacOS (#3575)
Various Coverity warnings have been addressed (#3656)
Documentation improvements (#3665)
Internal changes
An unnecessary include of sys/signal.h causing a compile warning on MUSL-C has
been removed (#3679)
Release notes for xorgxrdp v0.10.5 (2026/01/28)
Bug fixes
Fix bug in Chrome pointer detection (#394 #396)
Internal changes
CI: Update FreeBSD xrdp dependency (#398)
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Bojan Smojver <bojan(a)rexursive.com> - 1:0.10.5-1
- Update to 0.10.5
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:0.10.4-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Tue Nov 4 2025 Tom Callaway <spot(a)fedoraproject.org> - 1:0.10.4-4
- rebuild for new fuse3
* Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:0.10.4-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1908387 - Windows with transparency show whatever is below
https://bugzilla.redhat.com/show_bug.cgi?id=1908387
[ 2 ] Bug #2279775 - xrdp socketdir not cleaned up on package removal
https://bugzilla.redhat.com/show_bug.cgi?id=2279775
[ 3 ] Bug #2322105 - AltGr on Spanish keyboards
https://bugzilla.redhat.com/show_bug.cgi?id=2322105
[ 4 ] Bug #2323097 - Requesting clarification on the License of xrdp rpm.
https://bugzilla.redhat.com/show_bug.cgi?id=2323097
[ 5 ] Bug #2433438 - CVE-2025-68670 xorgxrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2433438
[ 6 ] Bug #2433439 - CVE-2025-68670 xrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2433439
[ 7 ] Bug #2433440 - CVE-2025-68670 xorgxrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-9]
https://bugzilla.redhat.com/show_bug.cgi?id=2433440
[ 8 ] Bug #2433441 - CVE-2025-68670 xrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-9]
https://bugzilla.redhat.com/show_bug.cgi?id=2433441
[ 9 ] Bug #2433442 - CVE-2025-68670 xorgxrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2433442
[ 10 ] Bug #2433840 - xorgxrdp-0.10.5 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2433840
--------------------------------------------------------------------------------
The following Fedora EPEL 10.1 Security updates need testing:
Age URL
1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1f5a2c5f39 python-python-multipart-0.0.22-1.el10_1
The following builds have been pushed to Fedora EPEL 10.1 updates-testing
openvpn-2.7_rc6-1.el10_1
perl-No-Worries-1.7-14.el10_1
python-absl-py-2.4.0-1.el10_1
rust-fs-err-3.2.2-1.el10_1
scitokens-cpp-1.3.0-1.el10_1
Details about builds:
================================================================================
openvpn-2.7_rc6-1.el10_1 (FEDORA-EPEL-2026-021d78b8ac)
A full-featured TLS VPN solution
--------------------------------------------------------------------------------
Update Information:
Update to upstream 2.7_rc6 release
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Frank Lichtenheld <frank(a)lichtenheld.com> - 2.7_rc6
- Update to upstream 2.7_rc6 release
--------------------------------------------------------------------------------
================================================================================
perl-No-Worries-1.7-14.el10_1 (FEDORA-EPEL-2026-13785ebd97)
Perl coding without worries
--------------------------------------------------------------------------------
Update Information:
This update brings a new perl-No-Worries package, a collection of convenient
functions for programming in Perl.
--------------------------------------------------------------------------------
ChangeLog:
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.7-14
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.7-13
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Sat Jan 18 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.7-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Mon Dec 9 2024 Petr Pisar <ppisar(a)redhat.com> - 1.7-11
- Modernize a spec file
- Package the tests
* Tue Aug 6 2024 Miroslav Suchý <msuchy(a)redhat.com> - 1.7-10
- convert license to SPDX
* Fri Jul 19 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.7-9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Thu Jan 25 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.7-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Sun Jan 21 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.7-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2433735 - Please branch and build perl-No-Worries for EPEL 10
https://bugzilla.redhat.com/show_bug.cgi?id=2433735
--------------------------------------------------------------------------------
================================================================================
python-absl-py-2.4.0-1.el10_1 (FEDORA-EPEL-2026-ed2fbc4d41)
Abseil Python Common Libraries
--------------------------------------------------------------------------------
Update Information:
2.4.0 (2026-01-28)
Added
Added support for Python 3.14.
Allow $PYTHONBREAKPOINT to affect runcall and post_mortem debugging.
(logging) Propagate **kwargs in conditional/rate-limited logging functions.
Changed
Dropped support for Python 3.8 and 3.9.
(flags) Change internals of absl.flags.get_help_width() implementation.
(cleanup) Modernize Bazel setup with MODULE.bazel.
(cleanup) Modernize type annotations using Python 3.10+ features.
Fixed
(flags) Fix duplicate flag definition when reloading a module.
(typechecking) Correct type signature of absltest.skipThisClass.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Packit <hello(a)packit.dev> - 2.4.0-1
- Update to 2.4.0 upstream release
- Resolves: rhbz#2433802
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2433802 - python-absl-py-2.4.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2433802
--------------------------------------------------------------------------------
================================================================================
rust-fs-err-3.2.2-1.el10_1 (FEDORA-EPEL-2026-d8fd4745f5)
Drop-in replacement for std::fs with more helpful error messages
--------------------------------------------------------------------------------
Update Information:
https://github.com/andrewhickman/fs-err/blob/3.2.2/CHANGELOG.md
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 27 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 3.2.2-1
- Update to version 3.2.2; Fixes RHBZ#2415196
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.1.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2415196 - rust-fs-err-3.2.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2415196
--------------------------------------------------------------------------------
================================================================================
scitokens-cpp-1.3.0-1.el10_1 (FEDORA-EPEL-2026-70efb8f770)
C++ Implementation of the SciTokens Library
--------------------------------------------------------------------------------
Update Information:
Add scitokens-generate-jwks CLI for key generation.
Add environment variable-based configuration on library initialization.
Add per-issuer lock to prevent multiple concurrent queries against issuers
without a known key
Add negative cache for failed issuer lookups (preventing frequent re-queries)
Add monitoring API for per-issuer validation statistics
Add optional background thread for JWKS refresh
Add keycache load, metadata, and delete APIs
Revert "Fix memory leak in rs256_from_coords" by @djw8605
Add CTest-based integration test with JWKS server and TLS infrastructure
Fix segfault if the JSON parser cannot parse the JWKS
Fix float time claims issue and improve error handling
Fix security issue with malicious issuer handling in error messages
Improve JWTVerificationException message to include the invalid issuer
Update usage on verify command to make the TOKENFILE explicit
Read token for scitokens-verify from stdin
Set CURLOPT_NOSIGNAL option in SimpleCurlGet to prevent signal interruptions
Adding asan value to the job name
Turn off building unit tests by default.
Add cmake option SCITOKENS_WITH_ASAN which enables memory checking with the
address sanitizer. Also enable this in CI, so that tests fail if they hit a
memory leak or other memory problem.
Fix memory leak in store_public_ec_key
Fix memory leaks in the unit tests
Fix memory leak in rs256_from_coords
Fix memory leak in scitokens_verify
--------------------------------------------------------------------------------
ChangeLog:
* Thu Dec 11 2025 Brian Bockelman <bbockelman(a)morgridge.org> - 1.3.0-1
- Add scitokens-generate-jwks CLI for key generation.
- Add environment variable-based configuration on library initialization.
- Add per-issuer lock to prevent multiple concurrent queries against issuers without a known key
- Add negative cache for failed issuer lookups (preventing frequent re-queries)
- Add monitoring API for per-issuer validation statistics
- Add optional background thread for JWKS refresh
- Add keycache load, metadata, and delete APIs
- Revert "Fix memory leak in rs256_from_coords" by @djw8605
- Add CTest-based integration test with JWKS server and TLS infrastructure
* Fri Dec 5 2025 Derek Weitzel <dweitzel(a)unl.edu> - 1.2.0-1
- Fix segfault if the JSON parser cannot parse the JWKS
- Fix float time claims issue and improve error handling
- Fix security issue with malicious issuer handling in error messages
- Improve JWTVerificationException message to include the invalid issuer
- Update usage on verify command to make the TOKENFILE explicit
- Read token for scitokens-verify from stdin
- Set CURLOPT_NOSIGNAL option in SimpleCurlGet to prevent signal interruptions
- Adding asan value to the job name
- Turn off building unit tests by default.
- Add cmake option SCITOKENS_WITH_ASAN which enables memory checking with the address sanitizer. Also enable this in CI, so that tests fail if they hit a memory leak or other memory problem.
- Fix memory leak in store_public_ec_key
- Fix memory leaks in the unit tests
- Fix memory leak in rs256_from_coords
- Fix memory leak in scitokens_verify
* Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.3-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
The following Fedora EPEL 8 Security updates need testing:
Age URL
70 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-5b2095e2c2 xpdf-4.06-1.el8
0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-cf486df588 opencc-1.0.5-4.el8
0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-58d7d41403 java-latest-openjdk-26.0.0.0.32-0.0.1.ea.el8
The following builds have been pushed to Fedora EPEL 8 updates-testing
scitokens-cpp-1.3.0-1.el8
xrdp-0.10.5-1.el8
Details about builds:
================================================================================
scitokens-cpp-1.3.0-1.el8 (FEDORA-EPEL-2026-1819f4d1e3)
C++ Implementation of the SciTokens Library
--------------------------------------------------------------------------------
Update Information:
Add scitokens-generate-jwks CLI for key generation.
Add environment variable-based configuration on library initialization.
Add per-issuer lock to prevent multiple concurrent queries against issuers
without a known key
Add negative cache for failed issuer lookups (preventing frequent re-queries)
Add monitoring API for per-issuer validation statistics
Add optional background thread for JWKS refresh
Add keycache load, metadata, and delete APIs
Revert "Fix memory leak in rs256_from_coords" by @djw8605
Add CTest-based integration test with JWKS server and TLS infrastructure
Fix segfault if the JSON parser cannot parse the JWKS
Fix float time claims issue and improve error handling
Fix security issue with malicious issuer handling in error messages
Improve JWTVerificationException message to include the invalid issuer
Update usage on verify command to make the TOKENFILE explicit
Read token for scitokens-verify from stdin
Set CURLOPT_NOSIGNAL option in SimpleCurlGet to prevent signal interruptions
Adding asan value to the job name
Turn off building unit tests by default.
Add cmake option SCITOKENS_WITH_ASAN which enables memory checking with the
address sanitizer. Also enable this in CI, so that tests fail if they hit a
memory leak or other memory problem.
Fix memory leak in store_public_ec_key
Fix memory leaks in the unit tests
Fix memory leak in rs256_from_coords
Fix memory leak in scitokens_verify
--------------------------------------------------------------------------------
ChangeLog:
* Thu Dec 11 2025 Brian Bockelman <bbockelman(a)morgridge.org> - 1.3.0-1
- Add scitokens-generate-jwks CLI for key generation.
- Add environment variable-based configuration on library initialization.
- Add per-issuer lock to prevent multiple concurrent queries against issuers without a known key
- Add negative cache for failed issuer lookups (preventing frequent re-queries)
- Add monitoring API for per-issuer validation statistics
- Add optional background thread for JWKS refresh
- Add keycache load, metadata, and delete APIs
- Revert "Fix memory leak in rs256_from_coords" by @djw8605
- Add CTest-based integration test with JWKS server and TLS infrastructure
* Fri Dec 5 2025 Derek Weitzel <dweitzel(a)unl.edu> - 1.2.0-1
- Fix segfault if the JSON parser cannot parse the JWKS
- Fix float time claims issue and improve error handling
- Fix security issue with malicious issuer handling in error messages
- Improve JWTVerificationException message to include the invalid issuer
- Update usage on verify command to make the TOKENFILE explicit
- Read token for scitokens-verify from stdin
- Set CURLOPT_NOSIGNAL option in SimpleCurlGet to prevent signal interruptions
- Adding asan value to the job name
- Turn off building unit tests by default.
- Add cmake option SCITOKENS_WITH_ASAN which enables memory checking with the address sanitizer. Also enable this in CI, so that tests fail if they hit a memory leak or other memory problem.
- Fix memory leak in store_public_ec_key
- Fix memory leaks in the unit tests
- Fix memory leak in rs256_from_coords
- Fix memory leak in scitokens_verify
* Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.3-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
xrdp-0.10.5-1.el8 (FEDORA-EPEL-2026-5c626357f7)
Open source remote desktop protocol (RDP) server
--------------------------------------------------------------------------------
Update Information:
Release notes for xrdp v0.10.5 (2026/01/27)
Security fixes
CVE-2025-68670: Improper bounds checking of domain string length leads to Stack-
based Buffer Overflow
New features
It is now possible to start the xrdp daemon entirely unprivileged from the
service manager (#3599 #3603). If you do this certain restrictions will apply.
See https://github.com/neutrinolabs/xrdp/wiki/Running-the-xrdp-process-as-non-
root for details.
TLS pre-master secrets can now be recorded for packet captures (#3617)
Add a FuseRootReportMaxFree to work around 'no free space' issues with some file
managers (#3639)
Alternate shell names can now be passed to startwm.sh in an environment variable
for more system management control (#3624 #3651)
Updated Xorg paths in sesman.ini to include more recent distros (#3663)
Add Slovenian keyboard (#3668 #3670)
xrdpapi: Add a way to monitor connect/disconnect events (#3693)
Bug fixes
Allow an empty X11 UTF8_STRING to be pasted to the clipboard (#3580 #3582)
Fix a regression introduced in v0.10.x, where it became impossible to connect to
a VNC server which did not support the ExtendedDesktopSize encoding (#3540
#3584)
Fix a regression introduced in v0.10.x related to PAM groups handling (#3594)
Inconsistencies with [MS-RDPBCGR] have been addressed (#3608)
A reference to uninitialised data within the verify_user_pam_userpass.c module
has been fixed (#3638)
Prevent some possible crashes when the RFX encoder is resized (#3590 #3644)
Fixes a regression introduced by GFX development which prevented the JPEG
encoder from working correctly (#3649)
Fixes a regression introduced by #2974 which resulted in the xrdp PID file being
deleted unexpectedly (#3650)
Do not overwrite a VNC port set by the user when not using sesman (#3674)
Fix regression from 0.9.x when freerdp client uses /workarea (#3618 #3676)
Fixes a crash where a resize is attempted with drdynvc disabled (#3672 #3680)
getgrouplist() now compiles on MacOS (#3575)
Various Coverity warnings have been addressed (#3656)
Documentation improvements (#3665)
Internal changes
An unnecessary include of sys/signal.h causing a compile warning on MUSL-C has
been removed (#3679)
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Bojan Smojver <bojan(a)rexursive.com> - 1:0.10.5-1
- Update to 0.10.5
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:0.10.4-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Tue Nov 4 2025 Tom Callaway <spot(a)fedoraproject.org> - 1:0.10.4-4
- rebuild for new fuse3
* Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:0.10.4-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1908387 - Windows with transparency show whatever is below
https://bugzilla.redhat.com/show_bug.cgi?id=1908387
[ 2 ] Bug #2279775 - xrdp socketdir not cleaned up on package removal
https://bugzilla.redhat.com/show_bug.cgi?id=2279775
[ 3 ] Bug #2322105 - AltGr on Spanish keyboards
https://bugzilla.redhat.com/show_bug.cgi?id=2322105
[ 4 ] Bug #2323097 - Requesting clarification on the License of xrdp rpm.
https://bugzilla.redhat.com/show_bug.cgi?id=2323097
[ 5 ] Bug #2433439 - CVE-2025-68670 xrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2433439
[ 6 ] Bug #2433441 - CVE-2025-68670 xrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-9]
https://bugzilla.redhat.com/show_bug.cgi?id=2433441
--------------------------------------------------------------------------------
The following Fedora EPEL 9 Security updates need testing:
Age URL
69 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-9a55de96db xpdf-4.06-1.el9
1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-0e3aa1d4ee rust-sequoia-keystore-server-0.2.0-5.el9 rust-sequoia-sq-1.3.1-9.el9
0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-f542ecf2f3 yarnpkg-1.22.22-16.el9
0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-a6d429d59c java-latest-openjdk-26.0.0.0.32-0.0.1.ea.el9
The following builds have been pushed to Fedora EPEL 9 updates-testing
gdal3.4-3.4.3-5.el9
python-python-multipart-0.0.20-2.el9
rust-fs-err-3.2.2-1.el9
rust-vergen-8.3.2-8.el9
scitokens-cpp-1.3.0-1.el9
xrdp-0.10.5-1.el9
Details about builds:
================================================================================
gdal3.4-3.4.3-5.el9 (FEDORA-EPEL-2026-0da52f2218)
GIS file format library (GDAL 3.4 version with full features)
--------------------------------------------------------------------------------
Update Information:
New gdal compat package
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 8 2026 Filip Janus <fjanus(a)redhat.com> - 3.4.3-5
- Initial GDAL 3.4 version with alternate naming to avoid conflicts with RHEL gdal
- Renamed package from gdal to gdal3.4
- Library and headers remain unchanged (libgdal.so, /usr/include/gdal/)
- Renamed all binaries with gdal3.4- prefix (e.g., gdal3.4-gdalinfo)
* Tue Jun 24 2025 Orion Poplawski <orion(a)nwra.com> - 3.4.3-4
- Rebuild for proj 9
* Tue Sep 24 2024 Orion Poplawski <orion(a)nwra.com> - 3.4.3-3
- Re-enable java
--------------------------------------------------------------------------------
================================================================================
python-python-multipart-0.0.20-2.el9 (FEDORA-EPEL-2026-f9b1069f42)
A streaming multipart parser for Python
--------------------------------------------------------------------------------
Update Information:
Backport the fix for CVE-2026-24486 / GHSA-wp53-j4wj-2cfg: drop directory path
from filename in File.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 27 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.0.20-2
- Backport the fix for CVE-2026-24486; fixes RHBZ#2433372
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2433372 - CVE-2026-24486 python-python-multipart: Python-Multipart has Arbitrary File Write via Non-Default Configuration [epel-9]
https://bugzilla.redhat.com/show_bug.cgi?id=2433372
--------------------------------------------------------------------------------
================================================================================
rust-fs-err-3.2.2-1.el9 (FEDORA-EPEL-2026-b6e60eaf8b)
Drop-in replacement for std::fs with more helpful error messages
--------------------------------------------------------------------------------
Update Information:
https://github.com/andrewhickman/fs-err/blob/3.2.2/CHANGELOG.md
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 27 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 3.2.2-1
- Update to version 3.2.2; Fixes RHBZ#2415196
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.1.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2415196 - rust-fs-err-3.2.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2415196
--------------------------------------------------------------------------------
================================================================================
rust-vergen-8.3.2-8.el9 (FEDORA-EPEL-2026-ecf893135c)
Generate cargo:rustc-env instructions for use with env!
--------------------------------------------------------------------------------
Update Information:
Bump git2 dependency from v0.19 to v0.20.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Fabio Valentini <decathorpe(a)gmail.com> - 8.3.2-8
- Bump git2 dependency from v0.19 to v0.20
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 8.3.2-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
scitokens-cpp-1.3.0-1.el9 (FEDORA-EPEL-2026-9cfbea2642)
C++ Implementation of the SciTokens Library
--------------------------------------------------------------------------------
Update Information:
Add scitokens-generate-jwks CLI for key generation.
Add environment variable-based configuration on library initialization.
Add per-issuer lock to prevent multiple concurrent queries against issuers
without a known key
Add negative cache for failed issuer lookups (preventing frequent re-queries)
Add monitoring API for per-issuer validation statistics
Add optional background thread for JWKS refresh
Add keycache load, metadata, and delete APIs
Revert "Fix memory leak in rs256_from_coords" by @djw8605
Add CTest-based integration test with JWKS server and TLS infrastructure
Fix segfault if the JSON parser cannot parse the JWKS
Fix float time claims issue and improve error handling
Fix security issue with malicious issuer handling in error messages
Improve JWTVerificationException message to include the invalid issuer
Update usage on verify command to make the TOKENFILE explicit
Read token for scitokens-verify from stdin
Set CURLOPT_NOSIGNAL option in SimpleCurlGet to prevent signal interruptions
Adding asan value to the job name
Turn off building unit tests by default.
Add cmake option SCITOKENS_WITH_ASAN which enables memory checking with the
address sanitizer. Also enable this in CI, so that tests fail if they hit a
memory leak or other memory problem.
Fix memory leak in store_public_ec_key
Fix memory leaks in the unit tests
Fix memory leak in rs256_from_coords
Fix memory leak in scitokens_verify
--------------------------------------------------------------------------------
ChangeLog:
* Thu Dec 11 2025 Brian Bockelman <bbockelman(a)morgridge.org> - 1.3.0-1
- Add scitokens-generate-jwks CLI for key generation.
- Add environment variable-based configuration on library initialization.
- Add per-issuer lock to prevent multiple concurrent queries against issuers without a known key
- Add negative cache for failed issuer lookups (preventing frequent re-queries)
- Add monitoring API for per-issuer validation statistics
- Add optional background thread for JWKS refresh
- Add keycache load, metadata, and delete APIs
- Revert "Fix memory leak in rs256_from_coords" by @djw8605
- Add CTest-based integration test with JWKS server and TLS infrastructure
* Fri Dec 5 2025 Derek Weitzel <dweitzel(a)unl.edu> - 1.2.0-1
- Fix segfault if the JSON parser cannot parse the JWKS
- Fix float time claims issue and improve error handling
- Fix security issue with malicious issuer handling in error messages
- Improve JWTVerificationException message to include the invalid issuer
- Update usage on verify command to make the TOKENFILE explicit
- Read token for scitokens-verify from stdin
- Set CURLOPT_NOSIGNAL option in SimpleCurlGet to prevent signal interruptions
- Adding asan value to the job name
- Turn off building unit tests by default.
- Add cmake option SCITOKENS_WITH_ASAN which enables memory checking with the address sanitizer. Also enable this in CI, so that tests fail if they hit a memory leak or other memory problem.
- Fix memory leak in store_public_ec_key
- Fix memory leaks in the unit tests
- Fix memory leak in rs256_from_coords
- Fix memory leak in scitokens_verify
* Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.3-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
xrdp-0.10.5-1.el9 (FEDORA-EPEL-2026-d12ea63356)
Open source remote desktop protocol (RDP) server
--------------------------------------------------------------------------------
Update Information:
Release notes for xrdp v0.10.5 (2026/01/27)
Security fixes
CVE-2025-68670: Improper bounds checking of domain string length leads to Stack-
based Buffer Overflow
New features
It is now possible to start the xrdp daemon entirely unprivileged from the
service manager (#3599 #3603). If you do this certain restrictions will apply.
See https://github.com/neutrinolabs/xrdp/wiki/Running-the-xrdp-process-as-non-
root for details.
TLS pre-master secrets can now be recorded for packet captures (#3617)
Add a FuseRootReportMaxFree to work around 'no free space' issues with some file
managers (#3639)
Alternate shell names can now be passed to startwm.sh in an environment variable
for more system management control (#3624 #3651)
Updated Xorg paths in sesman.ini to include more recent distros (#3663)
Add Slovenian keyboard (#3668 #3670)
xrdpapi: Add a way to monitor connect/disconnect events (#3693)
Bug fixes
Allow an empty X11 UTF8_STRING to be pasted to the clipboard (#3580 #3582)
Fix a regression introduced in v0.10.x, where it became impossible to connect to
a VNC server which did not support the ExtendedDesktopSize encoding (#3540
#3584)
Fix a regression introduced in v0.10.x related to PAM groups handling (#3594)
Inconsistencies with [MS-RDPBCGR] have been addressed (#3608)
A reference to uninitialised data within the verify_user_pam_userpass.c module
has been fixed (#3638)
Prevent some possible crashes when the RFX encoder is resized (#3590 #3644)
Fixes a regression introduced by GFX development which prevented the JPEG
encoder from working correctly (#3649)
Fixes a regression introduced by #2974 which resulted in the xrdp PID file being
deleted unexpectedly (#3650)
Do not overwrite a VNC port set by the user when not using sesman (#3674)
Fix regression from 0.9.x when freerdp client uses /workarea (#3618 #3676)
Fixes a crash where a resize is attempted with drdynvc disabled (#3672 #3680)
getgrouplist() now compiles on MacOS (#3575)
Various Coverity warnings have been addressed (#3656)
Documentation improvements (#3665)
Internal changes
An unnecessary include of sys/signal.h causing a compile warning on MUSL-C has
been removed (#3679)
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 28 2026 Bojan Smojver <bojan(a)rexursive.com> - 1:0.10.5-1
- Update to 0.10.5
* Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:0.10.4-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Tue Nov 4 2025 Tom Callaway <spot(a)fedoraproject.org> - 1:0.10.4-4
- rebuild for new fuse3
* Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:0.10.4-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1908387 - Windows with transparency show whatever is below
https://bugzilla.redhat.com/show_bug.cgi?id=1908387
[ 2 ] Bug #2279775 - xrdp socketdir not cleaned up on package removal
https://bugzilla.redhat.com/show_bug.cgi?id=2279775
[ 3 ] Bug #2322105 - AltGr on Spanish keyboards
https://bugzilla.redhat.com/show_bug.cgi?id=2322105
[ 4 ] Bug #2323097 - Requesting clarification on the License of xrdp rpm.
https://bugzilla.redhat.com/show_bug.cgi?id=2323097
[ 5 ] Bug #2433439 - CVE-2025-68670 xrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2433439
[ 6 ] Bug #2433441 - CVE-2025-68670 xrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-9]
https://bugzilla.redhat.com/show_bug.cgi?id=2433441
--------------------------------------------------------------------------------