epel-devel October 2026

epel-devel@lists.fedoraproject.org

6 participants
47 discussions

Fedora EPEL 10.2 updates-testing report
by updates＠fedoraproject.org 08 Oct '26

08 Oct '26

The following Fedora EPEL 10.2 Security updates need testing: Age URL 14 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-3f535077b3 aom-3.13.3-1.el10_2 libheif-1.23.5-4.el10_2 6 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-96afd3621b openbao-2.6.4-1.el10_2 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-c3ee85c015 GitPython-3.2.0-1.el10_2 python-mkdocs-rss-plugin-1.17.4-2.el10_2 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-a918489cff baresip-4.12.0-1.el10_2 libre-4.12.0-1.el10_2 3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-6aaa054bb4 zabbix7.0-7.0.31-1.el10_2 2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-0f7d08267e 7zip-26.04-1.el10_2 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-b799c5dced wordpress-6.9.10-1.el10_2 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-57bdc9acc3 jfrog-cli-2.126.0-1.el10_2 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-05efddaadc syncthing-2.1.6-1.el10_2 The following builds have been pushed to Fedora EPEL 10.2 updates-testing chezmoi-2.73.0-2.el10_2 ipv6calc-4.4.1-1.el10_2 radicale-3.8.3-1.el10_2 rust-insta-1.49.0-1.el10_2 rust-onefetch-2.27.1-5.el10_2 rust-thin-vec-0.2.21-1.el10_2 rust-tree-sitter-qmljs-0.3.1-1.el10_2 Details about builds: ================================================================================ chezmoi-2.73.0-2.el10_2 (FEDORA-EPEL-2026-3512df73a1) Manage your dotfiles across multiple diverse machines -------------------------------------------------------------------------------- Update Information: Update to 2.73.0 -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Mikel Olasagasti Uranga <mikel(a)olasagasti.info> - 2.73.0-1 - Update to 2.73.0 - Closes rhbz#2525992 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2530577 - CVE-2026-56855 chezmoi: golang.org/x/crypto/ssh: Denial of Service via crafted messages [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530577 [ 2 ] Bug #2530813 - CVE-2026-78662 chezmoi: golang.org/x/crypto/ssh: Denial of Service via channel request flooding [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530813 [ 3 ] Bug #2533085 - CVE-2026-89090 chezmoi: Amazon AWS SDK for Go v2: Denial of Service via crafted event stream header [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2533085 -------------------------------------------------------------------------------- ================================================================================ ipv6calc-4.4.1-1.el10_2 (FEDORA-EPEL-2026-f0a610df06) IPv6/IPv4 address information, format change, filter and calculation utility -------------------------------------------------------------------------------- Update Information: Final release 4.4.1 -------------------------------------------------------------------------------- ChangeLog: * Sat Oct 3 2026 Peter Bieringer <pb(a)bieringer.de> - 4.4.1-1 - Final release 4.4.1 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2545503 - ipv6calc-4.4.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2545503 -------------------------------------------------------------------------------- ================================================================================ radicale-3.8.3-1.el10_2 (FEDORA-EPEL-2026-8e56bec607) A simple CalDAV (calendar) and CardDAV (contact) server -------------------------------------------------------------------------------- Update Information: Update to 3.8.3 -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Peter Bieringer <pb(a)bieringer.de> - 3.8.3-1 - Update to 3.8.3 * Tue Oct 6 2026 Peter Bieringer <pb(a)bieringer.de> - 3.8.2-1 - Update to 3.8.2 * Thu Sep 24 2026 Peter Bieringer <pb(a)bieringer.de> - 3.8.1-1 - Update to 3.8.1 * Thu Sep 3 2026 Peter Bieringer <pb(a)bieringer.de> - 3.8.0-1 - Update to 3.8.0 - Use radicale.service from contrib * Thu Aug 6 2026 Peter Bieringer <pb(a)bieringer.de> - 3.7.8-1 - Update to 3.7.8 * Sun Jul 19 2026 Peter Bieringer <pb(a)bieringer.de> - 3.7.7-1 - Update to 3.7.7 * Tue Jul 7 2026 Peter Bieringer <pb(a)bieringer.de> - 3.7.6-1 - Update to 3.7.6 * Tue Jun 30 2026 Peter Bieringer <pb(a)bieringer.de> - Add missing requirement InfCloud-fontware to InfCloud - Extend SELinux policy for access to /run/systemd/userdb/io.systemd.DynamicUser on start * Sun Jun 14 2026 Peter Bieringer <pb(a)bieringer.de> - 3.7.5-1 - Update to 3.7.5 * Thu May 28 2026 Peter Bieringer <pb(a)bieringer.de> - 3.7.4-1 - Update to 3.7.4 * Thu May 14 2026 Peter Bieringer <pb(a)bieringer.de> - 3.7.3-1 - Update to 3.7.3 * Wed Apr 29 2026 Peter Bieringer <pb(a)bieringer.de> - 3.7.2-1 - Update to 3.7.2 * Wed Apr 15 2026 Peter Bieringer <pb(a)bieringer.de> - 3.7.1-2 - Rework selinux by using macros and align location of policy * Sun Apr 12 2026 Peter Bieringer <pb(a)bieringer.de> - 3.7.1-1 - Update to 3.7.1 * Sun Apr 5 2026 Peter Bieringer <pb(a)bieringer.de> - 3.7.0-1 - Update to 3.7.0 * Tue Feb 24 2026 Peter Bieringer <pb(a)bieringer.de> - 3.6.1-1 - Update to 3.6.1 -------------------------------------------------------------------------------- ================================================================================ rust-insta-1.49.0-1.el10_2 (FEDORA-EPEL-2026-447d0848da) Snapshot testing library for Rust -------------------------------------------------------------------------------- Update Information: Update to version 1.49.0 -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 1.49.0-1 - Update to version 1.49.0; Fixes RHBZ#2545477 * Tue Sep 1 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 1.48.0-1 - Update to version 1.48.0; Fixes RHBZ#2452072 * Fri Jul 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.46.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2545477 - rust-insta-1.49.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2545477 -------------------------------------------------------------------------------- ================================================================================ rust-onefetch-2.27.1-5.el10_2 (FEDORA-EPEL-2026-e54d718960) Command-line Git information tool -------------------------------------------------------------------------------- Update Information: Backport fix for CVE-2026-100866 from 3.0.0 -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 2.27.1-5 - Backport fix for CVE-2026-100866 from 3.0.0 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2542294 - CVE-2026-100866 rust-onefetch: onefetch: Terminal escape sequence injection via unsanitized manifest fields [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2542294 -------------------------------------------------------------------------------- ================================================================================ rust-thin-vec-0.2.21-1.el10_2 (FEDORA-EPEL-2026-1a54ab5abe) Vec that takes up less space on the stack -------------------------------------------------------------------------------- Update Information: Version 0.2.21 (2026-10-08) When collecting into a ThinVec, pass the size hint to with_capacity. Implement Index/IndexMut. Update ZST docs. -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.2.21-1 - Update to version 0.2.21; Fixes RHBZ#2547750 * Wed Sep 16 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.2.20-1 - Update to version 0.2.20; Fixes RHBZ#2535563 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2547750 - rust-thin-vec-0.2.21 is available https://bugzilla.redhat.com/show_bug.cgi?id=2547750 -------------------------------------------------------------------------------- ================================================================================ rust-tree-sitter-qmljs-0.3.1-1.el10_2 (FEDORA-EPEL-2026-2d2c51f366) QML grammar for the tree-sitter parsing library -------------------------------------------------------------------------------- Update Information: Update tree-sitter-qmljs to 0.3.1 https://github.com/yuja/tree-sitter-qmljs/compare/0.3.0...0.3.1 -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Michel Lind <salimma(a)fedoraproject.org> - 0.3.1-1 - Update to version 0.3.1; Resolves RHBZ#2499359 * Fri Jul 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.3.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.3.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2499359 - rust-tree-sitter-qmljs-0.3.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2499359 --------------------------------------------------------------------------------

1 0

Fedora EPEL 10.3 updates-testing report
by updates＠fedoraproject.org 08 Oct '26

08 Oct '26

The following Fedora EPEL 10.3 Security updates need testing: Age URL 105 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-e6d245c837 haveged-1.9.26-1.el10_3 6 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-c45a714e8d openbao-2.6.4-1.el10_3 6 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-36f6602332 simdjson-5.0.1-1.el10_3 6 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-0781e8eb3f python3.13-3.13.16-1.el10_3 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-b8f0b437b3 GitPython-3.2.0-1.el10_3 python-mkdocs-rss-plugin-1.17.4-2.el10_3 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-48c2e2c10b baresip-4.12.0-1.el10_3 libre-4.12.0-1.el10_3 3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-042a8bf4e4 zabbix7.0-7.0.31-1.el10_3 2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-e527d77d36 7zip-26.04-1.el10_3 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-98aa985c34 wordpress-7.1.3-1.el10_3 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-bfe0e6cebc jfrog-cli-2.126.0-1.el10_3 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-67a0bf9fc1 openvpn-2.7.8-1.el10_3 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-7addd7a2bf syncthing-2.1.6-1.el10_3 The following builds have been pushed to Fedora EPEL 10.3 updates-testing cachelib-19.2026.10.05.00-2.el10_3 chezmoi-2.73.0-2.el10_3 folly-rpm-macros-46-11.el10_3 libmongocrypt-1.20.5-1.el10_3 mcrouter-2026.10.05.00-2.el10_3 python-orjson-3.13.0-1.el10_3 pythoncapi-compat-0^20261007.ebbf075-1.el10_3 radicale-3.8.3-1.el10_3 rust-insta-1.49.0-1.el10_3 rust-onefetch-2.27.1-10.el10_3 rust-thin-vec-0.2.21-1.el10_3 rust-tree-sitter-cmake-0.7.5-1.el10_3 rust-tree-sitter-fsharp-0.3.12-1.el10_3 rust-tree-sitter-qmljs-0.3.1-1.el10_3 Details about builds: ================================================================================ cachelib-19.2026.10.05.00-2.el10_3 (FEDORA-EPEL-2026-5a5851865e) Pluggable caching engine for scale high performance cache services -------------------------------------------------------------------------------- Update Information: Initial EPEL 10 release of cachelib and mcrouter -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Michel Lind <salimma(a)fedoraproject.org> - 19.2026.10.05.00-2 - Stop the vendored glog being built as a shared library - Carry the getdeps manifest fix: glog set BUILD_SHARED_LIBS=ON unconditionally, so a static build still linked a shared libglog * Thu Oct 8 2026 Michel Lind <salimma(a)fedoraproject.org> - 19.2026.10.05.00-1 - Update to 2026.10.05.00 and build on EPEL 10 - Drop the getdeps vendor-record patch, which this tag contains - Carry the EL 10 system package mappings for getdeps, so EL takes fmt, gflags, googletest, benchmark, fast_float and Boost from EPEL, uses zlib- ng there and stops asking for the lz4-static EL does not have - Add a second vendor tarball for EL with the one dependency it cannot take from the system, glog, and its license override - Require folly-rpm-macros 46-11, which installs without licensecheck and pulls in the git that getdeps needs to apply a manifest patchfile * Tue Sep 29 2026 Michel Lind <salimma(a)fedoraproject.org> - 19.2026.09.28.00-2 - Require folly-rpm-macros 46-9 - Pick up CMAKE_SKIP_INSTALL_RPATH=ON, which keeps cachelib's relocatable- tarball RPATH out of the installed executables, where rpminspect fails it as both an invalid runpath and an annocheck hardening failure * Tue Sep 29 2026 Michel Lind <salimma(a)fedoraproject.org> - 19.2026.09.28.00-1 - Update to 2026.09.28.00 - Drop the folly FindLibDwarf, wangle OpenSSL 4.0 and cachebench binary_trace_gen patches, whose fixes the tag's pins contain - Regenerate the vendored dependencies from the tag's pins - Add a license_check_only bcond: check the vendored licenses of a new tarball in minutes, without the full build * Fri Sep 25 2026 Michel Lind <salimma(a)fedoraproject.org> - 19.2026.09.14.00^38.ee4c153-3 - Correct the License tag and version the bundled() Provides - Add BSL-1.0, Zlib, MIT-CMU and LicenseRef-Fedora-Public-Domain: mvfst's third-party expected.hpp and optional.h, folly's Crc32cDetail.cpp and liboqs's brg_endian.h and AES code carry those licenses in their file headers and are compiled in; found by the licensecheck pass the check now runs (folly-rpm-macros 46-3) - bundled() Provides are now versioned, from the version getdeps records per vendored project (<tag>^<distance>.<commit>, or the archive version) - Delete fbthrift's Go bindings in %prep; exclude the build-only CMake helpers (GPL-2.0 find modules, NCSA CheckAtomic.cmake) from the scans - Move the license check to the start of %build, and run its expensive per-file pass only when the vendor tarball is not the one recorded as having passed it * Fri Sep 18 2026 Michel Lind <salimma(a)fedoraproject.org> - 19.2026.09.14.00^38.ee4c153-2 - Fix the folly F14 fallback for libstdc++ 16, which broke ppc64le * Fri Sep 18 2026 Michel Lind <salimma(a)fedoraproject.org> - 19.2026.09.14.00^38.ee4c153-1 - Build with getdeps and vendored dependencies via %getdeps_* macros - Vendor folly, fizz, wangle, mvfst and fbthrift (and liboqs and magic_enum, which Fedora retired or ships in an older layout) instead of requiring lockstep Fedora packages of them; add vendor.sh to produce Source1 from the spec - Generate the BuildRequires from the getdeps manifests - Ship two statically linked executables, cachebench and cachelib_binary_trace_gen (upstream's binary_trace_gen, renamed), and no libraries; drop -devel and obsolete it - Version is <major>.<weekly tag>, with ^<distance>.<shortcommit> from git describe appended for a snapshot; add snapshot.sh to print the %%global lines; drop the forge macros, Source0 is a plain GitHub archive URL named %%{name}-%%{version}.tar.gz like Source1 - Declare SourceLicense and list the License one identifier per line under %%{shrink:}, with the per-project breakdown as comments; install and verify the licenses of the vendored tree - Update to snapshot ee4c153e (38 commits past v2026.09.14.00), drop the four patches that no longer apply, carry seven that are all upstream or in review - Require folly-rpm-macros >= 46, the first version with the macros * Wed Jul 15 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 17^20250203-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Thu Jun 25 2026 František Zatloukal <fzatlouk(a)redhat.com> - 17^20250203-6 - Rebuilt for fmt/spdlog * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 17^20250203-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 17^20250203-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Wed Nov 12 2025 Benjamin A. Beasley <code(a)musicinmybrain.net> - 17^20250203-3 - Rebuilt for gtest 1.17.0 * Wed Jul 23 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 17^20250203-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Fri Feb 7 2025 Michel Lind <salimma(a)fedoraproject.org> - 17^20250203-1 - Update to the 2025.02.03.00 tag; Fixes: RHBZ#2341686 * Thu Jan 16 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 17^20240819-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild -------------------------------------------------------------------------------- ================================================================================ chezmoi-2.73.0-2.el10_3 (FEDORA-EPEL-2026-841bd2ed2f) Manage your dotfiles across multiple diverse machines -------------------------------------------------------------------------------- Update Information: Update to 2.73.0 -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Mikel Olasagasti Uranga <mikel(a)olasagasti.info> - 2.73.0-1 - Update to 2.73.0 - Closes rhbz#2525992 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2530577 - CVE-2026-56855 chezmoi: golang.org/x/crypto/ssh: Denial of Service via crafted messages [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530577 [ 2 ] Bug #2530813 - CVE-2026-78662 chezmoi: golang.org/x/crypto/ssh: Denial of Service via channel request flooding [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530813 [ 3 ] Bug #2533085 - CVE-2026-89090 chezmoi: Amazon AWS SDK for Go v2: Denial of Service via crafted event stream header [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2533085 -------------------------------------------------------------------------------- ================================================================================ folly-rpm-macros-46-11.el10_3 (FEDORA-EPEL-2026-5a5851865e) RPM macros for building Meta's C++ projects with getdeps -------------------------------------------------------------------------------- Update Information: Initial EPEL 10 release of cachelib and mcrouter -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Michel Lind <salimma(a)fedoraproject.org> - 46-11 - Require git, which getdeps needs to apply a manifest's patchfile - Requires: git-core, so the buildroot has it wherever these macros run * Wed Oct 7 2026 Michel Lind <salimma(a)fedoraproject.org> - 46-10 - Let the macros work on EPEL, where licensecheck does not exist - Require licensecheck only on Fedora, so the package is installable on EPEL - The check helper reports it as unavailable and falls back to the license- file scan instead of failing * Tue Sep 29 2026 Michel Lind <salimma(a)fedoraproject.org> - 46-9 - Never install an RPATH into the executables - Pass CMAKE_SKIP_INSTALL_RPATH=ON to every getdeps build, so a project's relocatable-tarball RPATH stays out of the installed binaries - Document that the release comes from fedpkg verrel, not from builds * Tue Sep 29 2026 Michel Lind <salimma(a)fedoraproject.org> - 46-8 - Document the license_check_only bcond in AGENTS.md - Record how to check a new vendor tarball's licenses without the build, and why restricting the full pass to one architecture was rejected * Tue Sep 29 2026 Michel Lind <salimma(a)fedoraproject.org> - 46-7 - Document the unnumbered Patch: convention in AGENTS.md - Every patch is applied and unnumbered Patch: works on everything we target, EPEL 9 included, so specs should not number them * Fri Sep 25 2026 Michel Lind <salimma(a)fedoraproject.org> - 46-6 - Note the folly-rpm-macros version-release convention in AGENTS.md - folly-rpm-macros' Version is the current Fedora release number, so a meaningful macro change moves only the release; dependents must require version-release (>= 46-3) and be bumped in the same round * Fri Sep 25 2026 Michel Lind <salimma(a)fedoraproject.org> - 46-5 - Stop tracking the license helper's __pycache__ - Drop the .pyc committed by accident in 46-3 and ignore __pycache__, local src.rpms and the mock result directory * Fri Sep 25 2026 Michel Lind <salimma(a)fedoraproject.org> - 46-4 - Add AGENTS.md: how to maintain the getdeps-based packages - New AGENTS.md distilling what maintaining cachelib, mcrouter and future getdeps packages needs: the static-only model, the spec anatomy and version scheme, the vendoring and license workflows, the build environment, and the upstream fixes each package carries * Thu Sep 24 2026 Michel Lind <salimma(a)fedoraproject.org> - 46-3 - Version the bundled() Provides, prune excluded code, scan file headers - getdeps_vendor.prov emits bundled(<name>) = <version> from the version getdeps.py vendor now records (a tag, <tag>^<distance>.<commit> for a snapshot, or the version in a download URL), unversioned only when it could not determine one; sparsemap is provided as tsl-sparse-map - %getdeps_vendor_license_check also runs licensecheck (SPDX output) over the tree and requires the License tag to cover every identifier found - New %getdeps_vendor_prune deletes the directories the license config excludes, for %prep * Fri Sep 18 2026 Michel Lind <salimma(a)fedoraproject.org> - 46-2 - Take the job count from %limit_build's output instead of running it * Fri Sep 18 2026 Michel Lind <salimma(a)fedoraproject.org> - 46-1 - Add %getdeps_* macros for getdeps builds; drop the pre-getdeps ones - Add %getdeps_generate_buildrequires, %getdeps_build, %getdeps_install, %getdeps_test and %getdeps_vendor_license_{buildrequires,install,check} - Link the vendored stack statically into the executables; no shared- library mode - Provide bundled() for vendored projects via getdeps_vendor.attr - Depend on go-vendor-tools, cmake-rpm-macros and python3 - Drop %%folly_arches, %%folly_toolchain and the folly-srpm-macros subpackage (obsoleted); nothing uses them * Wed Jul 15 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 37-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 37-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Wed Jul 23 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 37-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Thu Jan 16 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 37-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild -------------------------------------------------------------------------------- ================================================================================ libmongocrypt-1.20.5-1.el10_3 (FEDORA-EPEL-2026-ed4f884deb) The companion C library for client side encryption in drivers -------------------------------------------------------------------------------- Update Information: libmongocryp 1.20.5 Fixed Fix possible abort parsing endpoints. Reject more payloads that cannot be decrypted in explicit decryption. Fix more degenerate cases of masterKey parsing. -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Remi Collet <remi(a)remirepo.net> - 1.20.5-1 - update to 1.20.5 -------------------------------------------------------------------------------- ================================================================================ mcrouter-2026.10.05.00-2.el10_3 (FEDORA-EPEL-2026-5a5851865e) Memcached protocol router for scaling Memcached deployments -------------------------------------------------------------------------------- Update Information: Initial EPEL 10 release of cachelib and mcrouter -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Michel Lind <salimma(a)fedoraproject.org> - 2026.10.05.00-2 - Stop the vendored glog being built as a shared library - Carry the getdeps manifest fix: glog set BUILD_SHARED_LIBS=ON unconditionally, so a static build still linked a shared libglog * Thu Oct 8 2026 Michel Lind <salimma(a)fedoraproject.org> - 2026.10.05.00-1 - Update to 2026.10.05.00 and build on EPEL 10 - First build from a weekly tag: the export now ships build/fbcode_builder and the dependency pins, so the snapshot globals are gone - Drop the getdeps vendor-record patch, which this tag contains - Rebase the gflags and Boost patch: upstream no longer declares mcrouter_propagate_folly_request_context in lib/MessageQueue.h, so that file needs no gflags include - Carry the EL 10 system package mappings for getdeps, so EL takes fmt, gflags, googletest, benchmark, fast_float and Boost from EPEL, uses zlib- ng there and stops asking for the lz4-static EL does not have - Add a second vendor tarball for EL with the one dependency it cannot take from the system, glog, and its license override - Require folly-rpm-macros 46-11, which installs without licensecheck and pulls in the git that getdeps needs to apply a manifest patchfile * Tue Sep 29 2026 Michel Lind <salimma(a)fedoraproject.org> - 2026.09.21.00^1.d8b07b0-4 - Require folly-rpm-macros 46-9 - Pick up CMAKE_SKIP_INSTALL_RPATH=ON, so no relocatable-tarball RPATH reaches the installed executables * Tue Sep 29 2026 Michel Lind <salimma(a)fedoraproject.org> - 2026.09.21.00^1.d8b07b0-3 - Add a license_check_only bcond - Run the license check and stop before the build, so a new vendor tarball can be checked against the License tag in minutes * Fri Sep 25 2026 Michel Lind <salimma(a)fedoraproject.org> - 2026.09.21.00^1.d8b07b0-2 - Version the bundled() Provides, complete the License tag, prune unneeded code - bundled() Provides now carry the version getdeps records for each vendored project (<tag>^<distance>.<commit>, liboqs 0.12.0) - Add BSL-1.0, Zlib, MIT-CMU and LicenseRef-Fedora-Public-Domain to the License tag: per-file licenses in mvfst's third-party headers, folly's Crc32cDetail.cpp and liboqs's brg_endian.h and AES code, all compiled in, found by the licensecheck pass the license check now runs - Delete fbthrift's Go bindings and the autotools m4/ directory in %prep; exclude the build-only CMake helpers (GPL-2.0 find modules, NCSA CheckAtomic.cmake) from the license scans - Run the license check at the start of %build, with its per-file pass only when the vendor tarball is not the one recorded as checked - Drop the wangle OpenSSL 4 patch, landed upstream; spell Memcached * Fri Sep 25 2026 Michel Lind <salimma(a)fedoraproject.org> - 2026.09.21.00^1.d8b07b0-1 - Build with getdeps and vendored dependencies via %getdeps_* macros - Update to snapshot d8b07b00, one commit past v2026.09.21.00 and the first to ship build/fbcode_builder; the build now goes through getdeps, vendoring folly, fizz, wangle, mvfst, fbthrift and liboqs instead of requiring the retired Fedora packages of the Meta stack - Ship the mcrouter and mcpiper executables statically linked; nothing else (no libraries or headers) - Re-enable ppc64le: the folly F14 fallback ambiguity behind rhbz#2344416 is fixed by a carried patch and the scratch build passes - Version is the upstream weekly tag, with ^<distance>.<shortcommit> appended for a snapshot; pass it to CMake as MCROUTER_PACKAGE_VERSION, which the CMake conversion had left at "0.1.0-dev" - Declare SourceLicense; the License tag lists the vendored projects' licenses and is verified against the vendored tree in %check - Add vendor.sh and snapshot.sh; drop the autotools-era distutils patch -------------------------------------------------------------------------------- ================================================================================ python-orjson-3.13.0-1.el10_3 (FEDORA-EPEL-2026-a69ecfdef4) Fast, correct Python JSON library -------------------------------------------------------------------------------- Update Information: 3.13.0 - 2026-08-17 Added Serialize new Python 3.15 built-in type frozendict identical to dict (PEP 814). -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 3.13.0-1 - Update to 3.13.0 (close RHBZ#2547510) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2547510 - python-orjson-3.13.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2547510 -------------------------------------------------------------------------------- ================================================================================ pythoncapi-compat-0^20261007.ebbf075-1.el10_3 (FEDORA-EPEL-2026-aa1760f39f) Python C API compatibility -------------------------------------------------------------------------------- Update Information: Update to 0^20261007.ebbf075 Enable Py_SETREF/XSETREF on Python 3.16 limited C API Update to 0^20261005.cb1eadf Add support for the limited C API (Py_LIMITED_API) -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 1:0^20261007.ebbf075-1 - Update to 0^20261007.ebbf075 * Mon Oct 5 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 1:0^20261005.cb1eadf-1 - Update to 0^20261005.cb1eadf -------------------------------------------------------------------------------- ================================================================================ radicale-3.8.3-1.el10_3 (FEDORA-EPEL-2026-df1aa2d7fc) A simple CalDAV (calendar) and CardDAV (contact) server -------------------------------------------------------------------------------- Update Information: Update to 3.8.3 Update to 3.8.2 -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Peter Bieringer <pb(a)bieringer.de> - 3.8.3-1 - Update to 3.8.3 * Tue Oct 6 2026 Peter Bieringer <pb(a)bieringer.de> - 3.8.2-1 - Update to 3.8.2 * Thu Sep 24 2026 Peter Bieringer <pb(a)bieringer.de> - 3.8.1-1 - Update to 3.8.1 * Thu Sep 3 2026 Peter Bieringer <pb(a)bieringer.de> - 3.8.0-1 - Update to 3.8.0 - Use radicale.service from contrib -------------------------------------------------------------------------------- References: [ 1 ] Bug #2546290 - radicale-3.8.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2546290 -------------------------------------------------------------------------------- ================================================================================ rust-insta-1.49.0-1.el10_3 (FEDORA-EPEL-2026-4903d23e1a) Snapshot testing library for Rust -------------------------------------------------------------------------------- Update Information: Update to version 1.49.0 -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 1.49.0-1 - Update to version 1.49.0; Fixes RHBZ#2545477 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2545477 - rust-insta-1.49.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2545477 -------------------------------------------------------------------------------- ================================================================================ rust-onefetch-2.27.1-10.el10_3 (FEDORA-EPEL-2026-f2037995cd) Command-line Git information tool -------------------------------------------------------------------------------- Update Information: Backport fix for CVE-2026-100866 from 3.0.0 -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 2.27.1-10 - Backport fix for CVE-2026-100866 from 3.0.0 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2542294 - CVE-2026-100866 rust-onefetch: onefetch: Terminal escape sequence injection via unsanitized manifest fields [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2542294 -------------------------------------------------------------------------------- ================================================================================ rust-thin-vec-0.2.21-1.el10_3 (FEDORA-EPEL-2026-234e2d32dd) Vec that takes up less space on the stack -------------------------------------------------------------------------------- Update Information: Version 0.2.21 (2026-10-08) When collecting into a ThinVec, pass the size hint to with_capacity. Implement Index/IndexMut. Update ZST docs. -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.2.21-1 - Update to version 0.2.21; Fixes RHBZ#2547750 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2547750 - rust-thin-vec-0.2.21 is available https://bugzilla.redhat.com/show_bug.cgi?id=2547750 -------------------------------------------------------------------------------- ================================================================================ rust-tree-sitter-cmake-0.7.5-1.el10_3 (FEDORA-EPEL-2026-fceff22318) CMake grammar for tree-sitter -------------------------------------------------------------------------------- Update Information: Update tree-sitter-cmake to 0.7.5 fix: handle bracketed strings with ] at the end of its content -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Michel Lind <salimma(a)fedoraproject.org> - 0.7.5-1 - Update to version 0.7.5; Resolves RHBZ#2532741 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2532741 - rust-tree-sitter-cmake-0.7.5 is available https://bugzilla.redhat.com/show_bug.cgi?id=2532741 -------------------------------------------------------------------------------- ================================================================================ rust-tree-sitter-fsharp-0.3.12-1.el10_3 (FEDORA-EPEL-2026-705002ff47) Fsharp grammar for the tree-sitter parsing library -------------------------------------------------------------------------------- Update Information: Update tree-sitter-fsharp to 0.3.12 Changelog: https://github.com/ionide/tree-sitter-fsharp/blob/0.3.12/CHANGELOG.md -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Michel Lind <salimma(a)fedoraproject.org> - 0.3.12-1 - Update to version 0.3.12; Resolves RHBZ#2520209 * Fri Jul 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.3.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2520209 - rust-tree-sitter-fsharp-0.3.12 is available https://bugzilla.redhat.com/show_bug.cgi?id=2520209 -------------------------------------------------------------------------------- ================================================================================ rust-tree-sitter-qmljs-0.3.1-1.el10_3 (FEDORA-EPEL-2026-c1f0db6b9f) QML grammar for the tree-sitter parsing library -------------------------------------------------------------------------------- Update Information: Update tree-sitter-qmljs to 0.3.1 https://github.com/yuja/tree-sitter-qmljs/compare/0.3.0...0.3.1 -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Michel Lind <salimma(a)fedoraproject.org> - 0.3.1-1 - Update to version 0.3.1; Resolves RHBZ#2499359 * Fri Jul 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.3.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.3.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2499359 - rust-tree-sitter-qmljs-0.3.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2499359 --------------------------------------------------------------------------------

1 0

Fedora EPEL 10.4 updates-testing report
by updates＠fedoraproject.org 08 Oct '26

08 Oct '26

The following Fedora EPEL 10.4 Security updates need testing: Age URL 9 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-6769292d4a ntfs-3g-2026.9.28-1.el10_4 ntfs-3g-system-compression-1.1-2.el10_4 partclone-0.3.50-2.el10_4 testdisk-7.2-2.el10_4 6 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-8a421bf5fb simdjson-5.0.1-1.el10_4 6 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-0498f387fb python3.13-3.13.16-1.el10_4 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-45c2ca66b6 baresip-4.12.0-1.el10_4 libre-4.12.0-1.el10_4 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-58b3caf388 GitPython-3.2.0-1.el10_4 python-mkdocs-rss-plugin-1.17.4-2.el10_4 3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-3e248bfcbd zabbix7.0-7.0.31-1.el10_4 2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-15b5988543 exim-4.100.1-1.el10_4 2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-7b07dd12c9 7zip-26.04-1.el10_4 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-0d5bab9c2d wordpress-7.1.3-1.el10_4 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-6126086652 jfrog-cli-2.126.0-1.el10_4 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1363ecb05b openvpn-2.7.8-1.el10_4 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-79e0927ac1 syncthing-2.1.6-1.el10_4 The following builds have been pushed to Fedora EPEL 10.4 updates-testing bsh-2.1.0-19.el10_4 catimg-2.8.0-4.el10_4 chezmoi-2.73.0-2.el10_4 encapsule-0.5.1-2.el10_4 ghc-shell-monad-0.6.10-3.el10_4 ghc-toml-reader-0.3.0.0-1.el10_4 libmongocrypt-1.20.5-1.el10_4 php-pecl-rpminfo-1.2.2-2.el10_4 php8.4-pecl-rpminfo-1.2.2-1.el10_4 python-orjson-3.13.0-1.el10_4 pythoncapi-compat-0^20261007.ebbf075-1.el10_4 radicale-3.8.3-1.el10_4 rust-byte-unit-5.2.6-1.el10_4 rust-insta-1.49.0-1.el10_4 rust-onefetch-2.28.1-4.el10_4 rust-tera-2.4.0-1.el10_4 rust-thin-vec-0.2.21-1.el10_4 rust-tree-sitter-cmake-0.7.5-1.el10_4 rust-tree-sitter-fsharp-0.3.12-1.el10_4 rust-tree-sitter-qmljs-0.3.1-1.el10_4 tor-0.4.9.14-1.el10_4 Details about builds: ================================================================================ bsh-2.1.0-19.el10_4 (FEDORA-EPEL-2026-27ca918678) Lightweight Scripting for Java -------------------------------------------------------------------------------- Update Information: EPEL10 build rhbz#2499650 -------------------------------------------------------------------------------- ChangeLog: * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0:2.1.0-19 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0:2.1.0-18 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Mon Jul 28 2025 jiri vanek <jvanek(a)redhat.com> - 0:2.1.0-17 - Rebuilt for java-25-openjdk as preffered jdk * Wed Jul 23 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0:2.1.0-16 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Thu Jan 16 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0:2.1.0-15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Wed Jul 17 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 0:2.1.0-14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild * Wed May 22 2024 Marian Koncek <mkoncek(a)redhat.com> - 0:2.1.0-13 - Fix license field * Tue Feb 27 2024 Jiri Vanek <jvanek(a)redhat.com> - 0:2.1.0-12 - Rebuilt for java-21-openjdk as system jdk * Tue Jan 23 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 0:2.1.0-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild * Fri Jan 19 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 0:2.1.0-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2499650 - Please branch and build bsh in epel10 https://bugzilla.redhat.com/show_bug.cgi?id=2499650 -------------------------------------------------------------------------------- ================================================================================ catimg-2.8.0-4.el10_4 (FEDORA-EPEL-2026-ebf9e5689e) Print images in a terminal with 256 colors support -------------------------------------------------------------------------------- Update Information: Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild -------------------------------------------------------------------------------- ChangeLog: * Wed Jul 15 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Thu Nov 27 2025 K. de Jong <keesdejong(a)fedoraproject.org> - 2.8.0-1 - New upstream release * Wed Aug 13 2025 K. de Jong <keesdejong(a)fedoraproject.org> - 2.7.0-15 - Update CMake to version 3.x * Wed Jul 23 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.7.0-14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Thu Jan 16 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.7.0-13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Wed Jul 17 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.7.0-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2544706 - Please build catimg for epel10 https://bugzilla.redhat.com/show_bug.cgi?id=2544706 -------------------------------------------------------------------------------- ================================================================================ chezmoi-2.73.0-2.el10_4 (FEDORA-EPEL-2026-bae07a9f85) Manage your dotfiles across multiple diverse machines -------------------------------------------------------------------------------- Update Information: Update to 2.73.0 -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Mikel Olasagasti Uranga <mikel(a)olasagasti.info> - 2.73.0-1 - Update to 2.73.0 - Closes rhbz#2525992 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2530577 - CVE-2026-56855 chezmoi: golang.org/x/crypto/ssh: Denial of Service via crafted messages [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530577 [ 2 ] Bug #2530813 - CVE-2026-78662 chezmoi: golang.org/x/crypto/ssh: Denial of Service via channel request flooding [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530813 [ 3 ] Bug #2533085 - CVE-2026-89090 chezmoi: Amazon AWS SDK for Go v2: Denial of Service via crafted event stream header [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2533085 -------------------------------------------------------------------------------- ================================================================================ encapsule-0.5.1-2.el10_4 (FEDORA-EPEL-2026-04594c4962) Run isolated toolbox containers with podman -------------------------------------------------------------------------------- Update Information: https://fedoraproject.org/wiki/Changes/Encapsule_devel_containers -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 29 2026 Jens-Ulrik Petersen <petersen(a)redhat.com> - 0.5.1-2 - shell-monad and toml-reader were packaged in Fedora * Wed Sep 16 2026 Jens Petersen <petersen(a)redhat.com> - 0.5.1-1 - https://hackage.haskell.org/package/encapsule-0.5.1/changelog * Mon Sep 14 2026 Jens Petersen <petersen(a)redhat.com> - 0.5-2 - add ncpsl shortname * Mon Sep 14 2026 Jens Petersen <petersen(a)redhat.com> - 0.5-1 - https://hackage.haskell.org/package/encapsule-0.5/changelog * Fri Aug 7 2026 Jens Petersen <petersen(a)redhat.com> - 0.4.1-1 - https://hackage.haskell.org/package/encapsule-0.4.1/changelog * Tue Aug 4 2026 Jens Petersen <petersen(a)redhat.com> - 0.4-1 - https://hackage.haskell.org/package/encapsule-0.4/changelog * Tue Jul 21 2026 Jens Petersen <petersen(a)redhat.com> - 0.3-1 - https://hackage.haskell.org/package/encapsule-0.3/changelog * Fri Jul 17 2026 Jens Petersen <petersen(a)redhat.com> - 0.2.1-1 - https://hackage.haskell.org/package/constrained-toolbox-0.2.1/candidate/cha… * Fri Jul 17 2026 Jens Petersen <petersen(a)redhat.com> - 0.2-1 - https://hackage.haskell.org/package/constrained-toolbox-0.2/candidate/chang… * Tue Jul 7 2026 Jens Petersen <petersen(a)redhat.com> - 0.1-1 - https://hackage.haskell.org/package/constrained-toolbox-0.1/candidate/chang… -------------------------------------------------------------------------------- References: [ 1 ] Bug #2101811 - Review Request: ghc-shell-monad - Shell monad https://bugzilla.redhat.com/show_bug.cgi?id=2101811 [ 2 ] Bug #2511001 - Review Request: encapsule - Run isolated toolbox containers with podman https://bugzilla.redhat.com/show_bug.cgi?id=2511001 [ 3 ] Bug #2530525 - Review Request: ghc-toml-reader - TOML format parser compliant with v1.0.0 https://bugzilla.redhat.com/show_bug.cgi?id=2530525 -------------------------------------------------------------------------------- ================================================================================ ghc-shell-monad-0.6.10-3.el10_4 (FEDORA-EPEL-2026-04594c4962) Shell monad -------------------------------------------------------------------------------- Update Information: https://fedoraproject.org/wiki/Changes/Encapsule_devel_containers -------------------------------------------------------------------------------- ChangeLog: * Wed Sep 9 2026 Jens Petersen <petersen(a)redhat.com> - 0.6.10-3 - update to cabal-rpm-2.3.2 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2101811 - Review Request: ghc-shell-monad - Shell monad https://bugzilla.redhat.com/show_bug.cgi?id=2101811 [ 2 ] Bug #2511001 - Review Request: encapsule - Run isolated toolbox containers with podman https://bugzilla.redhat.com/show_bug.cgi?id=2511001 [ 3 ] Bug #2530525 - Review Request: ghc-toml-reader - TOML format parser compliant with v1.0.0 https://bugzilla.redhat.com/show_bug.cgi?id=2530525 -------------------------------------------------------------------------------- ================================================================================ ghc-toml-reader-0.3.0.0-1.el10_4 (FEDORA-EPEL-2026-04594c4962) TOML format parser compliant with v1.0.0 -------------------------------------------------------------------------------- Update Information: https://fedoraproject.org/wiki/Changes/Encapsule_devel_containers -------------------------------------------------------------------------------- ChangeLog: * Wed Sep 9 2026 Jens Petersen <petersen(a)redhat.com> - 0.3.0.0-1 - spec file generated by cabal-rpm-2.4.0 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2101811 - Review Request: ghc-shell-monad - Shell monad https://bugzilla.redhat.com/show_bug.cgi?id=2101811 [ 2 ] Bug #2511001 - Review Request: encapsule - Run isolated toolbox containers with podman https://bugzilla.redhat.com/show_bug.cgi?id=2511001 [ 3 ] Bug #2530525 - Review Request: ghc-toml-reader - TOML format parser compliant with v1.0.0 https://bugzilla.redhat.com/show_bug.cgi?id=2530525 -------------------------------------------------------------------------------- ================================================================================ libmongocrypt-1.20.5-1.el10_4 (FEDORA-EPEL-2026-681badcdad) The companion C library for client side encryption in drivers -------------------------------------------------------------------------------- Update Information: libmongocryp 1.20.5 Fixed Fix possible abort parsing endpoints. Reject more payloads that cannot be decrypted in explicit decryption. Fix more degenerate cases of masterKey parsing. -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Remi Collet <remi(a)remirepo.net> - 1.20.5-1 - update to 1.20.5 -------------------------------------------------------------------------------- ================================================================================ php-pecl-rpminfo-1.2.2-2.el10_4 (FEDORA-EPEL-2026-3a9ea1aef1) RPM information -------------------------------------------------------------------------------- Update Information: Version 1.2.2 - 2026-10-08 Update PHP License from version 3 to version 4 (BSD-3-Clause) Compatibility with PHP 8.6 -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Remi Collet <remi(a)remirepo.net> - 1.2.2-2 - update to 1.2.2 - drop pear/pecl dependency - sources from github -------------------------------------------------------------------------------- ================================================================================ php8.4-pecl-rpminfo-1.2.2-1.el10_4 (FEDORA-EPEL-2026-3a9ea1aef1) RPM information -------------------------------------------------------------------------------- Update Information: Version 1.2.2 - 2026-10-08 Update PHP License from version 3 to version 4 (BSD-3-Clause) Compatibility with PHP 8.6 -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Remi Collet <remi(a)remirepo.net> - 1.2.2-1 - update to 1.2.2 - drop pear/pecl dependency - sources from github -------------------------------------------------------------------------------- ================================================================================ python-orjson-3.13.0-1.el10_4 (FEDORA-EPEL-2026-3ef365cc5c) Fast, correct Python JSON library -------------------------------------------------------------------------------- Update Information: 3.13.0 - 2026-08-17 Added Serialize new Python 3.15 built-in type frozendict identical to dict (PEP 814). -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 3.13.0-1 - Update to 3.13.0 (close RHBZ#2547510) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2547510 - python-orjson-3.13.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2547510 -------------------------------------------------------------------------------- ================================================================================ pythoncapi-compat-0^20261007.ebbf075-1.el10_4 (FEDORA-EPEL-2026-6fcc3d5569) Python C API compatibility -------------------------------------------------------------------------------- Update Information: Update to 0^20261007.ebbf075 Enable Py_SETREF/XSETREF on Python 3.16 limited C API Update to 0^20261005.cb1eadf Add support for the limited C API (Py_LIMITED_API) -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 1:0^20261007.ebbf075-1 - Update to 0^20261007.ebbf075 * Mon Oct 5 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 1:0^20261005.cb1eadf-1 - Update to 0^20261005.cb1eadf -------------------------------------------------------------------------------- ================================================================================ radicale-3.8.3-1.el10_4 (FEDORA-EPEL-2026-231f3c2b30) A simple CalDAV (calendar) and CardDAV (contact) server -------------------------------------------------------------------------------- Update Information: Update to 3.8.3 Update to 3.8.2 -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Peter Bieringer <pb(a)bieringer.de> - 3.8.3-1 - Update to 3.8.3 * Tue Oct 6 2026 Peter Bieringer <pb(a)bieringer.de> - 3.8.2-1 - Update to 3.8.2 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2546290 - radicale-3.8.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2546290 -------------------------------------------------------------------------------- ================================================================================ rust-byte-unit-5.2.6-1.el10_4 (FEDORA-EPEL-2026-25c08ad1da) Library for interacting with units of bytes -------------------------------------------------------------------------------- Update Information: Update to version 5.2.6: fix numeric conversions and improve serialization -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 5.2.6-1 - Update to version 5.2.6; Fixes RHBZ#2532710 * Fri Jul 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 5.2.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2532710 - rust-byte-unit-5.2.6 is available https://bugzilla.redhat.com/show_bug.cgi?id=2532710 -------------------------------------------------------------------------------- ================================================================================ rust-insta-1.49.0-1.el10_4 (FEDORA-EPEL-2026-b0858cd5a2) Snapshot testing library for Rust -------------------------------------------------------------------------------- Update Information: Update to version 1.49.0 -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 1.49.0-1 - Update to version 1.49.0; Fixes RHBZ#2545477 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2545477 - rust-insta-1.49.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2545477 -------------------------------------------------------------------------------- ================================================================================ rust-onefetch-2.28.1-4.el10_4 (FEDORA-EPEL-2026-013960599f) Command-line Git information tool -------------------------------------------------------------------------------- Update Information: Backport fix for CVE-2026-100866 from 3.0.0 -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 2.28.1-4 - Backport fix for CVE-2026-100866 from 3.0.0 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2542294 - CVE-2026-100866 rust-onefetch: onefetch: Terminal escape sequence injection via unsanitized manifest fields [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2542294 -------------------------------------------------------------------------------- ================================================================================ rust-tera-2.4.0-1.el10_4 (FEDORA-EPEL-2026-0b604a1d2e) Template engine for Rust based on Jinja2/Django -------------------------------------------------------------------------------- Update Information: 2.4.0 (2026-09-11) Add implicit parameters for components Add Tera::render_component_with_implicits and Tera::render_component_with_implicits_to to render a component with implicit parameters as a separate context. Fix bug in unique filter treating distinct maps as the same Fix some deserializing issues with Value -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 2.4.0-1 - Update to version 2.4.0; Fixes RHBZ#2531901 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2531901 - rust-tera-2.4.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2531901 -------------------------------------------------------------------------------- ================================================================================ rust-thin-vec-0.2.21-1.el10_4 (FEDORA-EPEL-2026-513aa98f6b) Vec that takes up less space on the stack -------------------------------------------------------------------------------- Update Information: Version 0.2.21 (2026-10-08) When collecting into a ThinVec, pass the size hint to with_capacity. Implement Index/IndexMut. Update ZST docs. -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.2.21-1 - Update to version 0.2.21; Fixes RHBZ#2547750 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2547750 - rust-thin-vec-0.2.21 is available https://bugzilla.redhat.com/show_bug.cgi?id=2547750 -------------------------------------------------------------------------------- ================================================================================ rust-tree-sitter-cmake-0.7.5-1.el10_4 (FEDORA-EPEL-2026-ec88f15a33) CMake grammar for tree-sitter -------------------------------------------------------------------------------- Update Information: Update tree-sitter-cmake to 0.7.5 fix: handle bracketed strings with ] at the end of its content -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Michel Lind <salimma(a)fedoraproject.org> - 0.7.5-1 - Update to version 0.7.5; Resolves RHBZ#2532741 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2532741 - rust-tree-sitter-cmake-0.7.5 is available https://bugzilla.redhat.com/show_bug.cgi?id=2532741 -------------------------------------------------------------------------------- ================================================================================ rust-tree-sitter-fsharp-0.3.12-1.el10_4 (FEDORA-EPEL-2026-bf3ac20067) Fsharp grammar for the tree-sitter parsing library -------------------------------------------------------------------------------- Update Information: Update tree-sitter-fsharp to 0.3.12 Changelog: https://github.com/ionide/tree-sitter-fsharp/blob/0.3.12/CHANGELOG.md -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Michel Lind <salimma(a)fedoraproject.org> - 0.3.12-1 - Update to version 0.3.12; Resolves RHBZ#2520209 * Fri Jul 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.3.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2520209 - rust-tree-sitter-fsharp-0.3.12 is available https://bugzilla.redhat.com/show_bug.cgi?id=2520209 -------------------------------------------------------------------------------- ================================================================================ rust-tree-sitter-qmljs-0.3.1-1.el10_4 (FEDORA-EPEL-2026-e52d053046) QML grammar for the tree-sitter parsing library -------------------------------------------------------------------------------- Update Information: Update tree-sitter-qmljs to 0.3.1 https://github.com/yuja/tree-sitter-qmljs/compare/0.3.0...0.3.1 -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Michel Lind <salimma(a)fedoraproject.org> - 0.3.1-1 - Update to version 0.3.1; Resolves RHBZ#2499359 * Fri Jul 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.3.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.3.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2499359 - rust-tree-sitter-qmljs-0.3.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2499359 -------------------------------------------------------------------------------- ================================================================================ tor-0.4.9.14-1.el10_4 (FEDORA-EPEL-2026-4032d817f5) Anonymizing overlay network for TCP -------------------------------------------------------------------------------- Update Information: Update to latest upstream release -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Marcel Härry <mh+fedora(a)scrit.ch> - 0.4.9.14-1 - Update to latest upstream release bz#2529909 * Fri Jul 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.4.9.11-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2521282 - CVE-2026-77584 tor: Tor: Use-after-free vulnerability via CONFLUX_LINK cell handling [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521282 [ 2 ] Bug #2521284 - CVE-2026-77638 tor: Tor: Onion Service Impersonation via Race Condition [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521284 [ 3 ] Bug #2521286 - CVE-2026-77639 tor: Tor: Denial of Service via compression bomb bypass [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521286 [ 4 ] Bug #2521288 - CVE-2026-77640 tor: Tor: Denial of Service via truncated zlib/gzip stream decompression [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521288 [ 5 ] Bug #2521290 - CVE-2026-77642 tor: Tor: Denial of Service via out-of-bounds write in signature parsing [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521290 [ 6 ] Bug #2521980 - CVE-2026-77587 tor: Tor: Denial of Service via use-after-free vulnerability [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521980 [ 7 ] Bug #2529909 - tor-0.4.9.14 is available https://bugzilla.redhat.com/show_bug.cgi?id=2529909 [ 8 ] Bug #2530533 - CVE-2026-87724 tor: Tor: Denial of Service via misinterpretation of congestion-control extension [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530533 --------------------------------------------------------------------------------

1 0

Fedora EPEL 9 updates-testing report
by updates＠fedoraproject.org 08 Oct '26

08 Oct '26

The following Fedora EPEL 9 Security updates need testing: Age URL 323 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-9a55de96db xpdf-4.06-1.el9 105 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-71571c82db postgresql16-anonymizer-3.1.1-2.el9 6 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-e0e0737425 GitPython-3.2.0-1.el9 6 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-46350ad475 openbao-2.6.4-1.el9 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-01f818d873 simdjson-5.0.1-1.el9 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-d64ba97176 python3.13-3.13.16-1.el9 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-9b46dea8e0 baresip-4.12.0-1.el9 libre-4.12.0-1.el9 3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-d82469a549 zabbix-6.0.48-1.el9 3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-0879abafaa zabbix7.0-7.0.31-1.el9 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-923ac1e238 chromium-154.0.8037.97-1.el9 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-61a5ea9fcd exim-4.100.1-1.el9 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-29947f7caa 7zip-26.04-1.el9 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-15d6637cee wordpress-6.9.10-1.el9 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-7f96cebc19 jfrog-cli-2.126.0-1.el9 The following builds have been pushed to Fedora EPEL 9 updates-testing chezmoi-2.73.0-2.el9 hamlib-4.5.5-2.el9 pythoncapi-compat-0^20261007.ebbf075-1.el9 radicale-3.8.3-1.el9 rust-byte-unit-5.2.6-1.el9 rust-insta-1.49.0-1.el9 rust-onefetch-2.28.1-4.el9 rust-tree-sitter-cmake-0.7.5-1.el9 rust-tree-sitter-fsharp-0.3.12-1.el9 rust-tree-sitter-qmljs-0.3.1-1.el9 tor-0.4.9.14-1.el9 Details about builds: ================================================================================ chezmoi-2.73.0-2.el9 (FEDORA-EPEL-2026-07ec8eb40b) Manage your dotfiles across multiple diverse machines -------------------------------------------------------------------------------- Update Information: Update to 2.73.0 -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Mikel Olasagasti Uranga <mikel(a)olasagasti.info> - 2.73.0-1 - Update to 2.73.0 - Closes rhbz#2525992 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2530577 - CVE-2026-56855 chezmoi: golang.org/x/crypto/ssh: Denial of Service via crafted messages [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530577 [ 2 ] Bug #2530813 - CVE-2026-78662 chezmoi: golang.org/x/crypto/ssh: Denial of Service via channel request flooding [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530813 [ 3 ] Bug #2533085 - CVE-2026-89090 chezmoi: Amazon AWS SDK for Go v2: Denial of Service via crafted event stream header [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2533085 -------------------------------------------------------------------------------- ================================================================================ hamlib-4.5.5-2.el9 (FEDORA-EPEL-2026-fe6a64f63f) Run-time library to control radio transceivers and receivers -------------------------------------------------------------------------------- Update Information: This is an update fixing stack out-of-bounds write and uninitialized memory disclosure (CVE-2026-54634). -------------------------------------------------------------------------------- ChangeLog: * Tue Oct 6 2026 Jaroslav Škarvada <jskarvad(a)redhat.com> - 4.5.5-2 - Fixed stack out-of-bounds write and uninitialized memory disclosure Resolves: CVE-2026-54634 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2539332 - CVE-2026-54634 hamlib: Hamlib: Remote Unauthenticated Memory Corruption and Information Disclosure via `send_raw` command [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2539332 -------------------------------------------------------------------------------- ================================================================================ pythoncapi-compat-0^20261007.ebbf075-1.el9 (FEDORA-EPEL-2026-377f1b1587) Python C API compatibility -------------------------------------------------------------------------------- Update Information: Update to 0^20261007.ebbf075 Enable Py_SETREF/XSETREF on Python 3.16 limited C API Update to 0^20261005.cb1eadf Add support for the limited C API (Py_LIMITED_API) -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 1:0^20261007.ebbf075-1 - Update to 0^20261007.ebbf075 * Mon Oct 5 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 1:0^20261005.cb1eadf-1 - Update to 0^20261005.cb1eadf -------------------------------------------------------------------------------- ================================================================================ radicale-3.8.3-1.el9 (FEDORA-EPEL-2026-718b500fa7) A simple CalDAV (calendar) and CardDAV (contact) server -------------------------------------------------------------------------------- Update Information: Update to 3.8.3 Update to 3.8.2 -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Peter Bieringer <pb(a)bieringer.de> - 3.8.3-1 - Update to 3.8.3 * Tue Oct 6 2026 Peter Bieringer <pb(a)bieringer.de> - 3.8.2-1 - Update to 3.8.2 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2546290 - radicale-3.8.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2546290 -------------------------------------------------------------------------------- ================================================================================ rust-byte-unit-5.2.6-1.el9 (FEDORA-EPEL-2026-acb69fb7f8) Library for interacting with units of bytes -------------------------------------------------------------------------------- Update Information: Update to version 5.2.6: fix numeric conversions and improve serialization -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 5.2.6-1 - Update to version 5.2.6; Fixes RHBZ#2532710 * Fri Jul 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 5.2.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2532710 - rust-byte-unit-5.2.6 is available https://bugzilla.redhat.com/show_bug.cgi?id=2532710 -------------------------------------------------------------------------------- ================================================================================ rust-insta-1.49.0-1.el9 (FEDORA-EPEL-2026-c1419369c6) Snapshot testing library for Rust -------------------------------------------------------------------------------- Update Information: Update to version 1.49.0 -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 1.49.0-1 - Update to version 1.49.0; Fixes RHBZ#2545477 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2545477 - rust-insta-1.49.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2545477 -------------------------------------------------------------------------------- ================================================================================ rust-onefetch-2.28.1-4.el9 (FEDORA-EPEL-2026-f0ef1f4b16) Command-line Git information tool -------------------------------------------------------------------------------- Update Information: Backport fix for CVE-2026-100866 from 3.0.0 -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 2.28.1-4 - Backport fix for CVE-2026-100866 from 3.0.0 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2542294 - CVE-2026-100866 rust-onefetch: onefetch: Terminal escape sequence injection via unsanitized manifest fields [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2542294 -------------------------------------------------------------------------------- ================================================================================ rust-tree-sitter-cmake-0.7.5-1.el9 (FEDORA-EPEL-2026-19acde255e) CMake grammar for tree-sitter -------------------------------------------------------------------------------- Update Information: Update tree-sitter-cmake to 0.7.5 fix: handle bracketed strings with ] at the end of its content -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Michel Lind <salimma(a)fedoraproject.org> - 0.7.5-1 - Update to version 0.7.5; Resolves RHBZ#2532741 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2532741 - rust-tree-sitter-cmake-0.7.5 is available https://bugzilla.redhat.com/show_bug.cgi?id=2532741 -------------------------------------------------------------------------------- ================================================================================ rust-tree-sitter-fsharp-0.3.12-1.el9 (FEDORA-EPEL-2026-da65422182) Fsharp grammar for the tree-sitter parsing library -------------------------------------------------------------------------------- Update Information: Update tree-sitter-fsharp to 0.3.12 Changelog: https://github.com/ionide/tree-sitter-fsharp/blob/0.3.12/CHANGELOG.md -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Michel Lind <salimma(a)fedoraproject.org> - 0.3.12-1 - Update to version 0.3.12; Resolves RHBZ#2520209 * Fri Jul 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.3.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2520209 - rust-tree-sitter-fsharp-0.3.12 is available https://bugzilla.redhat.com/show_bug.cgi?id=2520209 -------------------------------------------------------------------------------- ================================================================================ rust-tree-sitter-qmljs-0.3.1-1.el9 (FEDORA-EPEL-2026-3c517e29e4) QML grammar for the tree-sitter parsing library -------------------------------------------------------------------------------- Update Information: Update tree-sitter-qmljs to 0.3.1 https://github.com/yuja/tree-sitter-qmljs/compare/0.3.0...0.3.1 -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Michel Lind <salimma(a)fedoraproject.org> - 0.3.1-1 - Update to version 0.3.1; Resolves RHBZ#2499359 * Fri Jul 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.3.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.3.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2499359 - rust-tree-sitter-qmljs-0.3.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2499359 -------------------------------------------------------------------------------- ================================================================================ tor-0.4.9.14-1.el9 (FEDORA-EPEL-2026-2cce141a86) Anonymizing overlay network for TCP -------------------------------------------------------------------------------- Update Information: Update to latest upstream release -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Marcel Härry <mh+fedora(a)scrit.ch> - 0.4.9.14-1 - Update to latest upstream release bz#2529909 * Fri Jul 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.4.9.11-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2521282 - CVE-2026-77584 tor: Tor: Use-after-free vulnerability via CONFLUX_LINK cell handling [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521282 [ 2 ] Bug #2521284 - CVE-2026-77638 tor: Tor: Onion Service Impersonation via Race Condition [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521284 [ 3 ] Bug #2521286 - CVE-2026-77639 tor: Tor: Denial of Service via compression bomb bypass [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521286 [ 4 ] Bug #2521288 - CVE-2026-77640 tor: Tor: Denial of Service via truncated zlib/gzip stream decompression [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521288 [ 5 ] Bug #2521290 - CVE-2026-77642 tor: Tor: Denial of Service via out-of-bounds write in signature parsing [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521290 [ 6 ] Bug #2521980 - CVE-2026-77587 tor: Tor: Denial of Service via use-after-free vulnerability [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521980 [ 7 ] Bug #2529909 - tor-0.4.9.14 is available https://bugzilla.redhat.com/show_bug.cgi?id=2529909 [ 8 ] Bug #2530533 - CVE-2026-87724 tor: Tor: Denial of Service via misinterpretation of congestion-control extension [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530533 --------------------------------------------------------------------------------

1 0

Fedora EPEL 8 updates-testing report
by updates＠fedoraproject.org 08 Oct '26

08 Oct '26

The following Fedora EPEL 8 Security updates need testing: Age URL 323 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-5b2095e2c2 xpdf-4.06-1.el8 6 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-be34e6a49a openbao-2.6.4-1.el8 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-0b2b7eab8b baresip-4.12.0-1.el8 libre-4.12.0-1.el8 3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-097fd3579f zabbix6.0-6.0.48-1.el8 3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-367fe24aeb zabbix7.0-7.0.31-1.el8 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-71b80f48fa exim-4.100.1-1.el8 The following builds have been pushed to Fedora EPEL 8 updates-testing hamlib-4.5.5-2.el8 radicale-3.8.3-1.el8 Details about builds: ================================================================================ hamlib-4.5.5-2.el8 (FEDORA-EPEL-2026-9219ea595c) Run-time library to control radio transceivers and receivers -------------------------------------------------------------------------------- Update Information: This is an update fixing stack out-of-bounds write and uninitialized memory disclosure (CVE-2026-54634). -------------------------------------------------------------------------------- ChangeLog: * Tue Oct 6 2026 Jaroslav Škarvada <jskarvad(a)redhat.com> - 4.5.5-2 - Fixed stack out-of-bounds write and uninitialized memory disclosure Resolves: CVE-2026-54634 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2539332 - CVE-2026-54634 hamlib: Hamlib: Remote Unauthenticated Memory Corruption and Information Disclosure via `send_raw` command [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2539332 -------------------------------------------------------------------------------- ================================================================================ radicale-3.8.3-1.el8 (FEDORA-EPEL-2026-1989c13b32) A simple CalDAV (calendar) and CardDAV (contact) server -------------------------------------------------------------------------------- Update Information: Update to 3.8.3 Update to 3.8.2 -------------------------------------------------------------------------------- ChangeLog: * Thu Oct 8 2026 Peter Bieringer <pb(a)bieringer.de> - 3.8.3-1 - Update to 3.8.3 * Tue Oct 6 2026 Peter Bieringer <pb(a)bieringer.de> - 3.8.2-1 - Update to 3.8.2 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2546290 - radicale-3.8.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2546290 --------------------------------------------------------------------------------

1 0

qt6 in EPEL9 being updated
by Troy Dawson 08 Oct '26

08 Oct '26

qt6 from epel9 is being updated from 6.6.2 to 6.10.3 KDE in epel9 is based on qt5, so there aren't too many packages that depend on this. qt6 also tries to be quite backwards compatible, so again, very few packages will be affected by this. But the list isn't zero. The following need to be rebuilt with some type of update (usually grabbing the epel10 version) obs-studio qcoro qt-creator qt6ct zeal obs-studio - This is the hard one, and I still do not have a solution. If anyone has a way to get it to build, I'm open to suggestions. With Qt-6.10 Qt::GuiPrivate was changed to Qt::Gui because they feel it is stable. I tried the simple patch of switching everything. Didn't work. I tried using some of the upstream patches, but I guess I'm missing one or two. Upgrading also fails in different ways. If you want to test installs, or test builds (especially obs-studio) it is in copr at https://copr.fedorainfracloud.org/coprs/g/kdesig/epel9-qt6-update/ Troy Dawson

2 3

Orphaning python-sphinxcontrib-apidoc
by Miro Hrončok 08 Oct '26

08 Oct '26

Hello, we have orphaned python-sphinxcontrib-apidoc in EPEL. The package does not install in epel9: https://bugzilla.redhat.com/2510867 If you wish to take it over, let me know. -- Miro Hrončok -- Phone: +420777974800

3 5

Fedora EPEL 8 updates-testing report
by updates＠fedoraproject.org 07 Oct '26

07 Oct '26

The following Fedora EPEL 8 Security updates need testing: Age URL 322 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-5b2095e2c2 xpdf-4.06-1.el8 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-be34e6a49a openbao-2.6.4-1.el8 3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-0b2b7eab8b baresip-4.12.0-1.el8 libre-4.12.0-1.el8 2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-097fd3579f zabbix6.0-6.0.48-1.el8 2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-367fe24aeb zabbix7.0-7.0.31-1.el8 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-71b80f48fa exim-4.100.1-1.el8 The following builds have been pushed to Fedora EPEL 8 updates-testing xrootd-5.9.8-1.el8 Details about builds: ================================================================================ xrootd-5.9.8-1.el8 (FEDORA-EPEL-2026-4c38ee5e5c) Extended ROOT file server -------------------------------------------------------------------------------- Update Information: XRootD 5.9.8 / 6,2,0 -------------------------------------------------------------------------------- ChangeLog: * Tue Oct 6 2026 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 1:5.9.8-1 - Update to version 5.9.8 --------------------------------------------------------------------------------

1 0

Fedora EPEL 9 updates-testing report
by updates＠fedoraproject.org 07 Oct '26

07 Oct '26

The following Fedora EPEL 9 Security updates need testing: Age URL 322 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-9a55de96db xpdf-4.06-1.el9 104 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-71571c82db postgresql16-anonymizer-3.1.1-2.el9 13 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-12b7f6fc6c aom-3.13.3-1.el9 libheif-1.23.5-2.el9 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-e0e0737425 GitPython-3.2.0-1.el9 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-46350ad475 openbao-2.6.4-1.el9 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-01f818d873 simdjson-5.0.1-1.el9 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-d64ba97176 python3.13-3.13.16-1.el9 3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-9b46dea8e0 baresip-4.12.0-1.el9 libre-4.12.0-1.el9 2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-d82469a549 zabbix-6.0.48-1.el9 2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-0879abafaa zabbix7.0-7.0.31-1.el9 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-923ac1e238 chromium-154.0.8037.97-1.el9 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-61a5ea9fcd exim-4.100.1-1.el9 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-29947f7caa 7zip-26.04-1.el9 The following builds have been pushed to Fedora EPEL 9 updates-testing clash-meta-1.19.32-1.el9 jfrog-cli-2.126.0-1.el9 lagrange-1.21.2-1.el9 rust-cursive_core-0.4.7-1.el9 rust-jiff-0.2.38-1.el9 the_foundation-1.13.1-1.el9 wordpress-6.9.10-1.el9 xrootd-5.9.8-1.el9 Details about builds: ================================================================================ clash-meta-1.19.32-1.el9 (FEDORA-EPEL-2026-3bd169105d) A rule based network proxy tool, also be known as mihomo -------------------------------------------------------------------------------- Update Information: Update to 1.19.32 upstream release -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Nianqing Yao <imbearchild(a)outlook.com> - 1.19.32-1 - Update to 1.19.32 upstream release -------------------------------------------------------------------------------- ================================================================================ jfrog-cli-2.126.0-1.el9 (FEDORA-EPEL-2026-7f96cebc19) CLI to automate access to JFrog products -------------------------------------------------------------------------------- Update Information: Update to 2.126.0. -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Simone Caronni <negativo17(a)gmail.com> - 2.126.0-1 - Update to 2.126.0 and exclude tests using Artifactory test helpers -------------------------------------------------------------------------------- References: [ 1 ] Bug #2530605 - CVE-2026-56855 jfrog-cli: golang.org/x/crypto/ssh: Denial of Service via crafted messages [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530605 [ 2 ] Bug #2530627 - CVE-2026-56855 jfrog-cli: golang.org/x/crypto/ssh: Denial of Service via crafted messages [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530627 [ 3 ] Bug #2530787 - CVE-2026-78662 jfrog-cli: golang.org/x/crypto/ssh: Denial of Service via channel request flooding [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530787 [ 4 ] Bug #2530816 - CVE-2026-78662 jfrog-cli: golang.org/x/crypto/ssh: Denial of Service via channel request flooding [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530816 [ 5 ] Bug #2533824 - CVE-2026-53495 jfrog-cli: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2533824 [ 6 ] Bug #2539458 - CVE-2026-71556 jfrog-cli: go-git: Arbitrary file read/write via symbolic link resolution [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2539458 [ 7 ] Bug #2539460 - CVE-2026-71556 jfrog-cli: go-git: Arbitrary file read/write via symbolic link resolution [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2539460 [ 8 ] Bug #2546634 - jfrog-cli-2.126.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2546634 -------------------------------------------------------------------------------- ================================================================================ lagrange-1.21.2-1.el9 (FEDORA-EPEL-2026-86de13811b) A Beautiful Gemini Client -------------------------------------------------------------------------------- Update Information: v1.21.2 Updated the bundled monospace font (Iosevka): no ligatures, 4% wider. Quitting the app is disabled while the Titan upload dialog is open. (The contents are autosaved in case of a crash.) Fixed visibility of selected text against different backgrounds. Fixed feed refresh not getting triggered when due. Fixed potential crash when an inline prompt is immediately visible at launch. TUI: Fixed potential hang in the text renderer. v1.21.1 Fixed: Sidebar tab buttons lack a background color in the second split (clipping issue). Fixed: Handling input events in the correct prompt when multiple prompts are open. Fixed: Auto-opened input prompt dialog was duplicated when opening the same link again without first dismissing the first prompt. Fixed: Auto-opened input prompt randomly becoming unresponsive. v1.21.0 New features: Inline input prompts. By default, input prompts appear below the originating link, much like inline images. This allows accessing the rest of the page normally while entering input. Links marked "Assume This URL Requires Input" will pre-populate with an inline prompt UI. Option to choose default mode for prompts: inline, top, or bottom. Gopher: Support for TLS, i.e., "gophers://". Server certificates are handled similarly to Gemini, which means they are verified using TOFU and trusted root CAs. "Use on This Domain" in identity context menu. Appearance option to make scroll bars thicker. Changes and enhancements: Input prompts are no longer strictly modal: a click outside the dialog turns the dialog non-modal, allowing normal access to page contents and links. Improved sidebar layout. Sidebars are now top-level siblings of the document area, which means the tab buttons don't overlap the sidebar area. Click middle mouse button to scroll vertically. (No longer necessary to keep holding the button down.) Middle-clicking on links and list items still behaves as before (open in background tab). Optional build features are listed in Debug Information. For example, whether JPEG XL support is enabled. Window placement is persistent also in multi-window arrangements (saved and restored). Placement of previously open windows is stored persistently. On Windows and Linux, closing the last tab no longer quits the app. Registered the app as a "nex://" URL handler. Linux: Declare the app as a "misfin://" handler in the .desktop file. Compatibility with OpenSSL 4. Windows: It is now possible to build the app with MSVC (using vcpkg). Updated UI translations. Fixes: Opening ZIP archives with prepended arbitrary data (e.g., self-extracing archives). The redirect limit (5) only applies to Gemini, not Titan. It was being triggered by consecutive edits/uploads. Bookmark URI normalization issue that possibly caused duplicated bookmarks to appear. Gopher: Don't apply URI path normalization to selectors. Gopher: Parsing tilde-prefixed username from selector. Gopher/Finger: Spurious autoreloads due to fetched document not getting a timestamp. Underscore-prefix words should not break after the underscore. Overflowing text with "View as Plain Text". Improved hover highlight contrast with "Gray" UI accent color. Drag action in sidebar is cancelled if the sidebar is dismissed. Potential crash when splitting the view with multiple tabs open. macOS: Potential crash after all windows closed. TUI: Keep the menubar always visible (top line also used for shortcut keys). -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Michel Lind <salimma(a)fedoraproject.org> - 1.21.2-1 - Update to 1.21.2 - Resolves rhbz#2417370 - Bump minimum the_Foundation version to 1.12.0 * Thu Jul 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.19.3-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.19.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2417370 - lagrange-1.21.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2417370 [ 2 ] Bug #2417512 - the_foundation-1.13.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2417512 -------------------------------------------------------------------------------- ================================================================================ rust-cursive_core-0.4.7-1.el9 (FEDORA-EPEL-2026-fd63a4f02f) Core components for the Cursive TUI -------------------------------------------------------------------------------- Update Information: Update to version 0.4.7. -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.4.7-1 - Update to version 0.4.7; Fixes RHBZ#2488448 - Allow compact_str 0.10 * Fri Jul 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.4.6-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.4.6-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.4.6-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2488448 - rust-cursive_core-0.4.7 is available https://bugzilla.redhat.com/show_bug.cgi?id=2488448 -------------------------------------------------------------------------------- ================================================================================ rust-jiff-0.2.38-1.el9 (FEDORA-EPEL-2026-2f49e378b8) Date-time library that encourages you to jump into the pit of success -------------------------------------------------------------------------------- Update Information: Update to version 0.2.38; this release updates Jiff’s bundled copy of the IANA Time Zone Database to 2026e, but we always use the system tzdata. -------------------------------------------------------------------------------- ChangeLog: * Tue Oct 6 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.2.38-1 - Update to version 0.2.38; Fixes RHBZ#2546699 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2546699 - rust-jiff-0.2.38 is available https://bugzilla.redhat.com/show_bug.cgi?id=2546699 -------------------------------------------------------------------------------- ================================================================================ the_foundation-1.13.1-1.el9 (FEDORA-EPEL-2026-86de13811b) Opinionated C11 library for low-level functionality -------------------------------------------------------------------------------- Update Information: v1.21.2 Updated the bundled monospace font (Iosevka): no ligatures, 4% wider. Quitting the app is disabled while the Titan upload dialog is open. (The contents are autosaved in case of a crash.) Fixed visibility of selected text against different backgrounds. Fixed feed refresh not getting triggered when due. Fixed potential crash when an inline prompt is immediately visible at launch. TUI: Fixed potential hang in the text renderer. v1.21.1 Fixed: Sidebar tab buttons lack a background color in the second split (clipping issue). Fixed: Handling input events in the correct prompt when multiple prompts are open. Fixed: Auto-opened input prompt dialog was duplicated when opening the same link again without first dismissing the first prompt. Fixed: Auto-opened input prompt randomly becoming unresponsive. v1.21.0 New features: Inline input prompts. By default, input prompts appear below the originating link, much like inline images. This allows accessing the rest of the page normally while entering input. Links marked "Assume This URL Requires Input" will pre-populate with an inline prompt UI. Option to choose default mode for prompts: inline, top, or bottom. Gopher: Support for TLS, i.e., "gophers://". Server certificates are handled similarly to Gemini, which means they are verified using TOFU and trusted root CAs. "Use on This Domain" in identity context menu. Appearance option to make scroll bars thicker. Changes and enhancements: Input prompts are no longer strictly modal: a click outside the dialog turns the dialog non-modal, allowing normal access to page contents and links. Improved sidebar layout. Sidebars are now top-level siblings of the document area, which means the tab buttons don't overlap the sidebar area. Click middle mouse button to scroll vertically. (No longer necessary to keep holding the button down.) Middle-clicking on links and list items still behaves as before (open in background tab). Optional build features are listed in Debug Information. For example, whether JPEG XL support is enabled. Window placement is persistent also in multi-window arrangements (saved and restored). Placement of previously open windows is stored persistently. On Windows and Linux, closing the last tab no longer quits the app. Registered the app as a "nex://" URL handler. Linux: Declare the app as a "misfin://" handler in the .desktop file. Compatibility with OpenSSL 4. Windows: It is now possible to build the app with MSVC (using vcpkg). Updated UI translations. Fixes: Opening ZIP archives with prepended arbitrary data (e.g., self-extracing archives). The redirect limit (5) only applies to Gemini, not Titan. It was being triggered by consecutive edits/uploads. Bookmark URI normalization issue that possibly caused duplicated bookmarks to appear. Gopher: Don't apply URI path normalization to selectors. Gopher: Parsing tilde-prefixed username from selector. Gopher/Finger: Spurious autoreloads due to fetched document not getting a timestamp. Underscore-prefix words should not break after the underscore. Overflowing text with "View as Plain Text". Improved hover highlight contrast with "Gray" UI accent color. Drag action in sidebar is cancelled if the sidebar is dismissed. Potential crash when splitting the view with multiple tabs open. macOS: Potential crash after all windows closed. TUI: Keep the menubar always visible (top line also used for shortcut keys). -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 15 2026 Packit <hello(a)packit.dev> - 1.13.1-1 - Update to 1.13.1 upstream release - Resolves: rhbz#2417512 * Tue Sep 15 2026 Yaakov Selkowitz <yselkowi(a)redhat.com> - 1.10.1-6 - Remove obsolete patch * Fri Jul 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.10.1-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Fri Jun 12 2026 Yaakov Selkowitz <yselkowi(a)redhat.com> - 1.10.1-4 - Rebuilt for openssl 4.0 * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.10.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2417370 - lagrange-1.21.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2417370 [ 2 ] Bug #2417512 - the_foundation-1.13.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2417512 -------------------------------------------------------------------------------- ================================================================================ wordpress-6.9.10-1.el9 (FEDORA-EPEL-2026-15d6637cee) Blog tool and publishing platform -------------------------------------------------------------------------------- Update Information: WordPress 6.9.10 Security Release Security updates included in this release A stored XSS on the Comments administration page, exploitable via pending comments, reported by Thomas Chauchefoin at Trail of Bits A DoS issue in the WP_Http::make_absolute_url() method, reported by Anthropic A second-Order SQL injection in WordPress WXR export, reported by Anthropic A weakness allowing Author role users to sticky posts, reported by Anthropic Unauthenticated disclosure of comments on private & unpublished posts, reported by Ananda Dhakal from Patchstack Imgur embeds are vulnerable to XSS, reported by Zhengyu Liu, Jingcheng Yang, and Gavin Zhong Forgeable parameters passed to the {status}_{type} hook can lead to action name collision, reported by Alex Concha of the WordPress security team -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Remi Collet <remi(a)remirepo.net> - 6.9.10-1 - WordPress 6.9.10 Security Release -------------------------------------------------------------------------------- ================================================================================ xrootd-5.9.8-1.el9 (FEDORA-EPEL-2026-4b6060af9d) Extended ROOT file server -------------------------------------------------------------------------------- Update Information: XRootD 5.9.8 / 6,2,0 -------------------------------------------------------------------------------- ChangeLog: * Tue Oct 6 2026 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 1:5.9.8-1 - Update to version 5.9.8 --------------------------------------------------------------------------------

1 0

Fedora EPEL 10.4 updates-testing report
by updates＠fedoraproject.org 07 Oct '26

07 Oct '26

The following Fedora EPEL 10.4 Security updates need testing: Age URL 8 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-6769292d4a ntfs-3g-2026.9.28-1.el10_4 ntfs-3g-system-compression-1.1-2.el10_4 partclone-0.3.50-2.el10_4 testdisk-7.2-2.el10_4 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-32677c15c7 openbao-2.6.4-1.el10_4 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-8a421bf5fb simdjson-5.0.1-1.el10_4 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-0498f387fb python3.13-3.13.16-1.el10_4 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-45c2ca66b6 baresip-4.12.0-1.el10_4 libre-4.12.0-1.el10_4 3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-58b3caf388 GitPython-3.2.0-1.el10_4 python-mkdocs-rss-plugin-1.17.4-2.el10_4 2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-3e248bfcbd zabbix7.0-7.0.31-1.el10_4 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-15b5988543 exim-4.100.1-1.el10_4 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-7b07dd12c9 7zip-26.04-1.el10_4 The following builds have been pushed to Fedora EPEL 10.4 updates-testing clash-meta-1.19.32-1.el10_4 fftw2-2.1.5-55.el10_4 jfrog-cli-2.126.0-1.el10_4 lagrange-1.21.2-1.el10_4 openvpn-2.7.8-1.el10_4 python-astropy-iers-data-0.2026.10.5.1.0.7-1.el10_4 python-uv-build-0.12.23-1.el10_4 quassel-0.14.0-17.el10_4 ruff-0.16.10-1.el10_4 rust-astral_async_http_range_reader-0.12.0-1.el10_4 rust-astral_async_zip-0.0.21-1.el10_4 rust-cursive_core-0.4.7-1.el10_4 rust-jiff-0.2.38-1.el10_4 sandogasa-0.25.3-1.el10_4 sympy-1.14.0-3.el10_4 syncthing-2.1.6-1.el10_4 the_foundation-1.13.1-1.el10_4 uv-0.12.23-1.el10_4 wordpress-7.1.3-1.el10_4 xrootd-6.2.0-1.el10_4 Details about builds: ================================================================================ clash-meta-1.19.32-1.el10_4 (FEDORA-EPEL-2026-48e16803e1) A rule based network proxy tool, also be known as mihomo -------------------------------------------------------------------------------- Update Information: Update to 1.19.32 upstream release -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Nianqing Yao <imbearchild(a)outlook.com> - 1.19.32-1 - Update to 1.19.32 upstream release -------------------------------------------------------------------------------- ================================================================================ fftw2-2.1.5-55.el10_4 (FEDORA-EPEL-2026-c2fc52d5cd) Fast Fourier Transform library (version 2) -------------------------------------------------------------------------------- Update Information: Initial for epel10 -------------------------------------------------------------------------------- ChangeLog: * Wed Jul 15 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.1.5-55 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.1.5-54 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Wed Jul 23 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.1.5-53 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Thu Jan 16 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.1.5-52 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Thu Jul 25 2024 Miroslav Suchý <msuchy(a)redhat.com> - 2.1.5-51 - convert license to SPDX * Wed Jul 17 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.1.5-50 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2477589 - Please fftw2 to epel10, epel10.1 and epel10.2 branches https://bugzilla.redhat.com/show_bug.cgi?id=2477589 -------------------------------------------------------------------------------- ================================================================================ jfrog-cli-2.126.0-1.el10_4 (FEDORA-EPEL-2026-6126086652) CLI to automate access to JFrog products -------------------------------------------------------------------------------- Update Information: Update to 2.126.0. -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Simone Caronni <negativo17(a)gmail.com> - 2.126.0-1 - Update to 2.126.0 and exclude tests using Artifactory test helpers -------------------------------------------------------------------------------- References: [ 1 ] Bug #2530605 - CVE-2026-56855 jfrog-cli: golang.org/x/crypto/ssh: Denial of Service via crafted messages [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530605 [ 2 ] Bug #2530627 - CVE-2026-56855 jfrog-cli: golang.org/x/crypto/ssh: Denial of Service via crafted messages [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530627 [ 3 ] Bug #2530787 - CVE-2026-78662 jfrog-cli: golang.org/x/crypto/ssh: Denial of Service via channel request flooding [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530787 [ 4 ] Bug #2530816 - CVE-2026-78662 jfrog-cli: golang.org/x/crypto/ssh: Denial of Service via channel request flooding [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2530816 [ 5 ] Bug #2533824 - CVE-2026-53495 jfrog-cli: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2533824 [ 6 ] Bug #2539458 - CVE-2026-71556 jfrog-cli: go-git: Arbitrary file read/write via symbolic link resolution [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2539458 [ 7 ] Bug #2539460 - CVE-2026-71556 jfrog-cli: go-git: Arbitrary file read/write via symbolic link resolution [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2539460 [ 8 ] Bug #2546634 - jfrog-cli-2.126.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2546634 -------------------------------------------------------------------------------- ================================================================================ lagrange-1.21.2-1.el10_4 (FEDORA-EPEL-2026-b69d931a9f) A Beautiful Gemini Client -------------------------------------------------------------------------------- Update Information: v1.21.2 Updated the bundled monospace font (Iosevka): no ligatures, 4% wider. Quitting the app is disabled while the Titan upload dialog is open. (The contents are autosaved in case of a crash.) Fixed visibility of selected text against different backgrounds. Fixed feed refresh not getting triggered when due. Fixed potential crash when an inline prompt is immediately visible at launch. TUI: Fixed potential hang in the text renderer. v1.21.1 Fixed: Sidebar tab buttons lack a background color in the second split (clipping issue). Fixed: Handling input events in the correct prompt when multiple prompts are open. Fixed: Auto-opened input prompt dialog was duplicated when opening the same link again without first dismissing the first prompt. Fixed: Auto-opened input prompt randomly becoming unresponsive. v1.21.0 New features: Inline input prompts. By default, input prompts appear below the originating link, much like inline images. This allows accessing the rest of the page normally while entering input. Links marked "Assume This URL Requires Input" will pre-populate with an inline prompt UI. Option to choose default mode for prompts: inline, top, or bottom. Gopher: Support for TLS, i.e., "gophers://". Server certificates are handled similarly to Gemini, which means they are verified using TOFU and trusted root CAs. "Use on This Domain" in identity context menu. Appearance option to make scroll bars thicker. Changes and enhancements: Input prompts are no longer strictly modal: a click outside the dialog turns the dialog non-modal, allowing normal access to page contents and links. Improved sidebar layout. Sidebars are now top-level siblings of the document area, which means the tab buttons don't overlap the sidebar area. Click middle mouse button to scroll vertically. (No longer necessary to keep holding the button down.) Middle-clicking on links and list items still behaves as before (open in background tab). Optional build features are listed in Debug Information. For example, whether JPEG XL support is enabled. Window placement is persistent also in multi-window arrangements (saved and restored). Placement of previously open windows is stored persistently. On Windows and Linux, closing the last tab no longer quits the app. Registered the app as a "nex://" URL handler. Linux: Declare the app as a "misfin://" handler in the .desktop file. Compatibility with OpenSSL 4. Windows: It is now possible to build the app with MSVC (using vcpkg). Updated UI translations. Fixes: Opening ZIP archives with prepended arbitrary data (e.g., self-extracing archives). The redirect limit (5) only applies to Gemini, not Titan. It was being triggered by consecutive edits/uploads. Bookmark URI normalization issue that possibly caused duplicated bookmarks to appear. Gopher: Don't apply URI path normalization to selectors. Gopher: Parsing tilde-prefixed username from selector. Gopher/Finger: Spurious autoreloads due to fetched document not getting a timestamp. Underscore-prefix words should not break after the underscore. Overflowing text with "View as Plain Text". Improved hover highlight contrast with "Gray" UI accent color. Drag action in sidebar is cancelled if the sidebar is dismissed. Potential crash when splitting the view with multiple tabs open. macOS: Potential crash after all windows closed. TUI: Keep the menubar always visible (top line also used for shortcut keys). -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Michel Lind <salimma(a)fedoraproject.org> - 1.21.2-1 - Update to 1.21.2 - Resolves rhbz#2417370 - Bump minimum the_Foundation version to 1.12.0 * Thu Jul 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.19.3-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.19.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2417370 - lagrange-1.21.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2417370 [ 2 ] Bug #2417512 - the_foundation-1.13.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2417512 -------------------------------------------------------------------------------- ================================================================================ openvpn-2.7.8-1.el10_4 (FEDORA-EPEL-2026-1363ecb05b) A full-featured TLS VPN solution -------------------------------------------------------------------------------- Update Information: Update to upstream 2.7.8 release -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Frank Lichtenheld <frank(a)lichtenheld.com> - 2.7.8-1 - Update to upstream 2.7.8 release -------------------------------------------------------------------------------- ================================================================================ python-astropy-iers-data-0.2026.10.5.1.0.7-1.el10_4 (FEDORA-EPEL-2026-c542f1659c) IERS Earth Rotation and Leap Second tables for the astropy core package -------------------------------------------------------------------------------- Update Information: Automatic update for python-astropy-iers-data-0.2026.10.5.1.0.7-1.el10_4. Changelog for python-astropy-iers-data * Mon Oct 05 2026 Packit <hello(a)packit.dev> - 0.2026.10.5.1.0.7-1 - Update to 0.2026.10.5.1.0.7 upstream release - Resolves: rhbz#2542271 -------------------------------------------------------------------------------- ChangeLog: * Mon Oct 5 2026 Packit <hello(a)packit.dev> - 0.2026.10.5.1.0.7-1 - Update to 0.2026.10.5.1.0.7 upstream release - Resolves: rhbz#2542271 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2542271 - python-astropy-iers-data-0.2026.10.5.1.0.7 is available https://bugzilla.redhat.com/show_bug.cgi?id=2542271 -------------------------------------------------------------------------------- ================================================================================ python-uv-build-0.12.23-1.el10_4 (FEDORA-EPEL-2026-a8331a4a06) The uv build backend -------------------------------------------------------------------------------- Update Information: Update uv and python-uv-build to 0.12.23 and ruff to 0.16.10. -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.12.23-1 - Update to 0.12.23 (close RHBZ#2545538) * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.12.22-1 - Update to 0.12.22 (close RHBZ#2544913) * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.12.21-1 - Update to 0.12.21 (close RHBZ#2542890) -------------------------------------------------------------------------------- ================================================================================ quassel-0.14.0-17.el10_4 (FEDORA-EPEL-2026-d0a84c5d7b) A modern distributed IRC system -------------------------------------------------------------------------------- Update Information: fix build on epel10 (fixes fedora#2532963) -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Georg Sauthoff <mail(a)gms.tf> - 0.14.0-17 - fix build on epel10 (fixes fedora#2532963) * Thu Jul 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.14.0-16 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Fri Jun 12 2026 Yaakov Selkowitz <yselkowi(a)redhat.com> - 0.14.0-15 - Rebuilt for openssl 4.0 * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.14.0-14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Sat Jan 10 2026 Georg Sauthoff <mail(a)gms.tf> - 0.14.0-13 - Drop call to %sysusers_create_compat * Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.14.0-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Sat Jan 18 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.14.0-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2532963 - Please build quassel for EPEL10 https://bugzilla.redhat.com/show_bug.cgi?id=2532963 -------------------------------------------------------------------------------- ================================================================================ ruff-0.16.10-1.el10_4 (FEDORA-EPEL-2026-a8331a4a06) Extremely fast Python linter and code formatter -------------------------------------------------------------------------------- Update Information: Update uv and python-uv-build to 0.12.23 and ruff to 0.16.10. -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.16.10-1 - Update to 0.16.10 (close RHBZ#2544707) -------------------------------------------------------------------------------- ================================================================================ rust-astral_async_http_range_reader-0.12.0-1.el10_4 (FEDORA-EPEL-2026-a8331a4a06) Library for streaming reading of files over HTTP using range requests -------------------------------------------------------------------------------- Update Information: Update uv and python-uv-build to 0.12.23 and ruff to 0.16.10. -------------------------------------------------------------------------------- ChangeLog: * Sat Sep 5 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.12.0-1 - Update to version 0.12.0; Fixes RHBZ#2528488 -------------------------------------------------------------------------------- ================================================================================ rust-astral_async_zip-0.0.21-1.el10_4 (FEDORA-EPEL-2026-a8331a4a06) Asynchronous ZIP archive reading/writing crate -------------------------------------------------------------------------------- Update Information: Update uv and python-uv-build to 0.12.23 and ruff to 0.16.10. -------------------------------------------------------------------------------- ChangeLog: * Sat Sep 5 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.0.21-1 - Update to version 0.0.21; Fixes RHBZ#2524624 * Fri Jul 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.0.20-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild -------------------------------------------------------------------------------- ================================================================================ rust-cursive_core-0.4.7-1.el10_4 (FEDORA-EPEL-2026-3514a2a7eb) Core components for the Cursive TUI -------------------------------------------------------------------------------- Update Information: Update to version 0.4.7. -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.4.7-1 - Update to version 0.4.7; Fixes RHBZ#2488448 - Allow compact_str 0.10 * Fri Jul 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.4.6-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.4.6-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.4.6-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2488448 - rust-cursive_core-0.4.7 is available https://bugzilla.redhat.com/show_bug.cgi?id=2488448 -------------------------------------------------------------------------------- ================================================================================ rust-jiff-0.2.38-1.el10_4 (FEDORA-EPEL-2026-817c36d36b) Date-time library that encourages you to jump into the pit of success -------------------------------------------------------------------------------- Update Information: Update to version 0.2.38; this release updates Jiff’s bundled copy of the IANA Time Zone Database to 2026e, but we always use the system tzdata. -------------------------------------------------------------------------------- ChangeLog: * Tue Oct 6 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.2.38-1 - Update to version 0.2.38; Fixes RHBZ#2546699 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2546699 - rust-jiff-0.2.38 is available https://bugzilla.redhat.com/show_bug.cgi?id=2546699 -------------------------------------------------------------------------------- ================================================================================ sandogasa-0.25.3-1.el10_4 (FEDORA-EPEL-2026-e8b007c8ef) A collection of Fedora and CentOS packaging tools -------------------------------------------------------------------------------- Update Information: Update sandogasa to v0.25.3 ebranch file-requests — asks dist-git before asking a person. A package already branched is asked to be built, not branched; where you hold access it prints and offers to run fedpkg request-branch, then asks whether to file a record anyway. Such a record is assigned to you, and the depends_on links between requests are sent as minor updates. fedora-cve-triage, statically linked dependencies — a CVE in a Rust crate or a Go module is answered from the buildroot that compiled the package, or from its declared bundled copy. A Go module is found by its import path, since NVD's product name resolves to nothing. Absence from a buildroot clears a bug only where the package builds against packaged libraries, never where it vendors them. fedora-cve-triage, EPEL bugs — an EPEL branch is read as the distro beneath it with EPEL layered over, so golang and plexus-utils stop looking unpackaged. The reassignment pass runs before every check that reads a branch. fedora-cve-triage, findings reach the bug — a conclusive finding is recorded as a comment and the Triaged keyword, marked with the analysis that reached it so later runs neither redo the work nor repeat themselves. A build already carrying the fix is closed against the Bodhi update that shipped it. fedora-cve-triage, fewer wrong answers — a tool name must be a binary Fedora ships, so "of" and "invalid" stop reading as unshipped tools; a vendored Go module is no longer mistaken for the toolchain; and the fixed-version prompt says what the CVE is in, which page claims the fix, and which bugs the answer settles. Full details: https://github.com/slopfest/sandogasa/blob/v0.25.3/CHANGELOG.md#v0253 -------------------------------------------------------------------------------- ChangeLog: * Tue Oct 6 2026 Michel Lind <salimma(a)fedoraproject.org> - 0.25.3-1 - Update to version 0.25.3; Resolves: rhbz#2546771 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2546771 - sandogasa-0.25.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=2546771 -------------------------------------------------------------------------------- ================================================================================ sympy-1.14.0-3.el10_4 (FEDORA-EPEL-2026-abeff866b7) A Python library for symbolic mathematics -------------------------------------------------------------------------------- Update Information: restore python-mpmath dependency rhbz#2547478 -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Kaleb S KEITHLEY <kkeithle(a)redhat.com> - 1.14.0-3 - restore mpmath dependency in pyproject.toml -------------------------------------------------------------------------------- References: [ 1 ] Bug #2547478 - sympy needs mpmath https://bugzilla.redhat.com/show_bug.cgi?id=2547478 -------------------------------------------------------------------------------- ================================================================================ syncthing-2.1.6-1.el10_4 (FEDORA-EPEL-2026-79e0927ac1) Continuous File Synchronization -------------------------------------------------------------------------------- Update Information: Update to version 2.1.6. Release notes: https://github.com/syncthing/syncthing/releases/tag/v2.1.4 https://github.com/syncthing/syncthing/releases/tag/v2.1.5 https://github.com/syncthing/syncthing/releases/tag/v2.1.6 -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Fabio Valentini <decathorpe(a)gmail.com> - 2.1.6-1 - Update to version 2.1.6; Fixes RHBZ#2529696 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2535980 - CVE-2026-77407 syncthing: RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Fields [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2535980 -------------------------------------------------------------------------------- ================================================================================ the_foundation-1.13.1-1.el10_4 (FEDORA-EPEL-2026-b69d931a9f) Opinionated C11 library for low-level functionality -------------------------------------------------------------------------------- Update Information: v1.21.2 Updated the bundled monospace font (Iosevka): no ligatures, 4% wider. Quitting the app is disabled while the Titan upload dialog is open. (The contents are autosaved in case of a crash.) Fixed visibility of selected text against different backgrounds. Fixed feed refresh not getting triggered when due. Fixed potential crash when an inline prompt is immediately visible at launch. TUI: Fixed potential hang in the text renderer. v1.21.1 Fixed: Sidebar tab buttons lack a background color in the second split (clipping issue). Fixed: Handling input events in the correct prompt when multiple prompts are open. Fixed: Auto-opened input prompt dialog was duplicated when opening the same link again without first dismissing the first prompt. Fixed: Auto-opened input prompt randomly becoming unresponsive. v1.21.0 New features: Inline input prompts. By default, input prompts appear below the originating link, much like inline images. This allows accessing the rest of the page normally while entering input. Links marked "Assume This URL Requires Input" will pre-populate with an inline prompt UI. Option to choose default mode for prompts: inline, top, or bottom. Gopher: Support for TLS, i.e., "gophers://". Server certificates are handled similarly to Gemini, which means they are verified using TOFU and trusted root CAs. "Use on This Domain" in identity context menu. Appearance option to make scroll bars thicker. Changes and enhancements: Input prompts are no longer strictly modal: a click outside the dialog turns the dialog non-modal, allowing normal access to page contents and links. Improved sidebar layout. Sidebars are now top-level siblings of the document area, which means the tab buttons don't overlap the sidebar area. Click middle mouse button to scroll vertically. (No longer necessary to keep holding the button down.) Middle-clicking on links and list items still behaves as before (open in background tab). Optional build features are listed in Debug Information. For example, whether JPEG XL support is enabled. Window placement is persistent also in multi-window arrangements (saved and restored). Placement of previously open windows is stored persistently. On Windows and Linux, closing the last tab no longer quits the app. Registered the app as a "nex://" URL handler. Linux: Declare the app as a "misfin://" handler in the .desktop file. Compatibility with OpenSSL 4. Windows: It is now possible to build the app with MSVC (using vcpkg). Updated UI translations. Fixes: Opening ZIP archives with prepended arbitrary data (e.g., self-extracing archives). The redirect limit (5) only applies to Gemini, not Titan. It was being triggered by consecutive edits/uploads. Bookmark URI normalization issue that possibly caused duplicated bookmarks to appear. Gopher: Don't apply URI path normalization to selectors. Gopher: Parsing tilde-prefixed username from selector. Gopher/Finger: Spurious autoreloads due to fetched document not getting a timestamp. Underscore-prefix words should not break after the underscore. Overflowing text with "View as Plain Text". Improved hover highlight contrast with "Gray" UI accent color. Drag action in sidebar is cancelled if the sidebar is dismissed. Potential crash when splitting the view with multiple tabs open. macOS: Potential crash after all windows closed. TUI: Keep the menubar always visible (top line also used for shortcut keys). -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 15 2026 Packit <hello(a)packit.dev> - 1.13.1-1 - Update to 1.13.1 upstream release - Resolves: rhbz#2417512 * Tue Sep 15 2026 Yaakov Selkowitz <yselkowi(a)redhat.com> - 1.10.1-6 - Remove obsolete patch * Fri Jul 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.10.1-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Fri Jun 12 2026 Yaakov Selkowitz <yselkowi(a)redhat.com> - 1.10.1-4 - Rebuilt for openssl 4.0 * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.10.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2417370 - lagrange-1.21.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2417370 [ 2 ] Bug #2417512 - the_foundation-1.13.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2417512 -------------------------------------------------------------------------------- ================================================================================ uv-0.12.23-1.el10_4 (FEDORA-EPEL-2026-a8331a4a06) An extremely fast Python package installer and resolver, written in Rust -------------------------------------------------------------------------------- Update Information: Update uv and python-uv-build to 0.12.23 and ruff to 0.16.10. -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.12.23-1 - Update to 0.12.23 (close RHBZ#2545539) * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.12.22-1 - Update to 0.12.22 (close RHBZ#2544914) * Wed Oct 7 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.12.21-1 - Update to 0.12.21 (close RHBZ#2542901) -------------------------------------------------------------------------------- ================================================================================ wordpress-7.1.3-1.el10_4 (FEDORA-EPEL-2026-0d5bab9c2d) Blog tool and publishing platform -------------------------------------------------------------------------------- Update Information: WordPress 7.1.3 Maintenance and Security Release Security updates included in this release A stored XSS on the Comments administration page, exploitable via pending comments, reported by Thomas Chauchefoin at Trail of Bits A DoS issue in the WP_Http::make_absolute_url() method, reported by Anthropic A second-Order SQL injection in WordPress WXR export, reported by Anthropic A weakness allowing Author role users to sticky posts, reported by Anthropic Unauthenticated disclosure of comments on private & unpublished posts, reported by Ananda Dhakal from Patchstack Imgur embeds are vulnerable to XSS, reported by Zhengyu Liu, Jingcheng Yang, and Gavin Zhong Forgeable parameters passed to the {status}_{type} hook can lead to action name collision, reported by Alex Concha of the WordPress security team -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2026 Remi Collet <remi(a)remirepo.net> -7.1.3-1 - WordPress 7.1.3 Maintenance and Security Release -------------------------------------------------------------------------------- ================================================================================ xrootd-6.2.0-1.el10_4 (FEDORA-EPEL-2026-e9c2610b07) Extended ROOT file server -------------------------------------------------------------------------------- Update Information: XRootD 5.9.8 / 6,2,0 -------------------------------------------------------------------------------- ChangeLog: * Tue Oct 6 2026 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 1:6.2.0-1 - Update to version 6.2.0 * Fri Sep 11 2026 Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl> - 1:6.1.1-2 - Rebuilt for libxml-2.5.4 --------------------------------------------------------------------------------

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

epel-devel October 2026