epel-devel May 2026

epel-devel@lists.fedoraproject.org

6 participants
59 discussions

[Fedocal] Reminder meeting : EPEL Steering Committee
by tdawson＠redhat.com 12 May '26

12 May '26

Dear all, You are kindly invited to the meeting: EPEL Steering Committee on 2026-05-13 from 18:00:00 to 19:00:00 UTC At meeting-1(a)chat.fedoraproject.org The meeting will be about: https://chat.fedoraproject.org/#/room/#meeting:fedoraproject.org This is the weekly EPEL Steering Committee Meeting. A general agenda is the following: #topic aloha #topic EPEL Issues https://pagure.io/epel/issues * https://pagure.io/epel/issues?tags=meeting&status=Open #topic Old Business (if needed) #topic General Issues / Open Floor Source: https://calendar.fedoraproject.org//meeting/11230/

1 0

Fedora EPEL 8 updates-testing report
by updates＠fedoraproject.org 11 May '26

11 May '26

The following Fedora EPEL 8 Security updates need testing: Age URL 173 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-5b2095e2c2 xpdf-4.06-1.el8 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-3f6bf23440 apptainer-1.5.0-1.el8 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-4394a54d4e valkey-8.0.9-1.el8 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-f90771ac28 coturn-4.11.0-1.el8 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-f027656c88 zabbix6.0-6.0.46-1.el8 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-2231087f23 zabbix7.0-7.0.26-1.el8 The following builds have been pushed to Fedora EPEL 8 updates-testing editorconfig-0.12.11-1.el8 libmd-1.2.0-1.el8 perl-Net-CIDR-Lite-0.24-1.el8 python-jq-1.5.0-1.el8 signify-33-1.el8 Details about builds: ================================================================================ editorconfig-0.12.11-1.el8 (FEDORA-EPEL-2026-e4d7315140) Parser for EditorConfig files written in C -------------------------------------------------------------------------------- Update Information: Update to 0.12.11: security fix for CVE-2026-40489. -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.12.11-1 - Update to 0.12.11 (close RHBZ#2458650) - Fixes CVE-2026-40489 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2458650 - editorconfig-0.12.11 is available https://bugzilla.redhat.com/show_bug.cgi?id=2458650 -------------------------------------------------------------------------------- ================================================================================ libmd-1.2.0-1.el8 (FEDORA-EPEL-2026-59ec17ff07) Library that provides message digest functions from BSD systems -------------------------------------------------------------------------------- Update Information: libmd 1.2.0 build: Fix out-of-tree build build: Refactor autogen call into before_script build: Add a new vpath-tests CI test man: Sync SHA2 changes from OpenBSD build: Add a coverage regex to the CI job build: Rename LIBMD_ABI to SOVERSION doc: Remove «All rights reserved» from COPYING build: Add Maintainer and License fields to the .pc file doc: Remove redundant «Copyright ©» prefix from Copyright field in COPYING doc: Move derived code attribution to a Comment field Add SHA3 and SHAKE support Add internal explicit_bzero() support Add internal endian conversion functions support Fix and hook SHA3 and SHAKE support Remove spurious blank lines at the beginning of functions build: Request tar-ustar format for distribution build: Set TAR_OPTIONS to avoid leaking maintainer information on dist -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Robert Scheck <robert(a)fedoraproject.org> 1.2.0-1 - Upgrade to 1.2.0 (#2468687) * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Thu Jul 24 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Mon Jan 20 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Fri Jan 17 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Thu Jul 18 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild * Thu Jan 25 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild * Sun Jan 21 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild * Thu Jul 20 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2468687 - libmd-1.2.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2468687 -------------------------------------------------------------------------------- ================================================================================ perl-Net-CIDR-Lite-0.24-1.el8 (FEDORA-EPEL-2026-423f2faaf7) Perl extension for merging IPv4 or IPv6 CIDR addresses -------------------------------------------------------------------------------- Update Information: This update addresses some input validation issues: Reject Unicode digits and trailing newlines in parser inputs (CVE-2026-45190) Reject zero-padded CIDR masks (CVE-2026-45191) -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Paul Howarth <paul(a)city-fan.org> - 0.24-1 - Update to 0.24 - Reject Unicode digits and trailing newlines in parser inputs (CVE-2026-45190) - Reject zero-padded CIDR masks (CVE-2026-45191) -------------------------------------------------------------------------------- ================================================================================ python-jq-1.5.0-1.el8 (FEDORA-EPEL-2026-6985bc3140) Python bindings for jq -------------------------------------------------------------------------------- Update Information: First Fedora/EPEL release -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Steve Traylen <steve.traylen(a)cern.ch> - 1.5.0-1 - First EPEL8 release -------------------------------------------------------------------------------- ================================================================================ signify-33-1.el8 (FEDORA-EPEL-2026-6f113b184d) Sign and verify signatures on files -------------------------------------------------------------------------------- Update Information: signify v33 (2026-05-11) Added New Meson-based build system, which also works with Muon. This is considered experimental for now, and therefore the existing GNU Make-based one is still supported. Changed Development has moved to Codeberg, with the old GitHub repository now being a mirror. Try to detect whether the compiler supports the bounded attribute via __has_attribute(), and enable its usage automatically when available. Updated sources from upstream OpenBSD and libbsd 0.12.1. Fixed Fix compilation issues when -Wimplicit-function-declaration is in effect, which is the case with Clang 16 and GCC 13 (or newer). -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Robert Scheck <robert(a)fedoraproject.org> - 33-1 - Update to release v33 (#2469961) * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 32-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 32-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Sun Jan 19 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 32-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Sat Jul 20 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 32-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2469961 - signify-33 is available https://bugzilla.redhat.com/show_bug.cgi?id=2469961 --------------------------------------------------------------------------------

1 0

Fedora EPEL 10.1 updates-testing report
by updates＠fedoraproject.org 11 May '26

11 May '26

The following Fedora EPEL 10.1 Security updates need testing: Age URL 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-99bca16ce8 GitPython-3.1.50-1.el10_1 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-74045c244b apptainer-1.5.0-1.el10_1 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-8d74a3f689 coturn-4.11.0-1.el10_1 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-b71cd02867 pgbouncer-1.25.2-1.el10_1 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-7ac763fa4a zabbix7.0-7.0.26-1.el10_1 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-805a24d208 SDL2_image-2.8.12-1.el10_1 The following builds have been pushed to Fedora EPEL 10.1 updates-testing chromium-148.0.7778.96-1.el10_1 libmd-1.2.0-1.el10_1 perl-Net-CIDR-Lite-0.24-1.el10_1 python-python-multipart-0.0.28-1.el10_1 signify-33-1.el10_1 Details about builds: ================================================================================ chromium-148.0.7778.96-1.el10_1 (FEDORA-EPEL-2026-87143ca0fd) A WebKit (Blink) powered web browser that Google doesn't want you to use -------------------------------------------------------------------------------- Update Information: Update to 148.0.7778.96 CVE-2026-7896: Integer overflow in Blink CVE-2026-7897: Use after free in Mobile CVE-2026-7898: Use after free in Chromoting CVE-2026-7899: Out of bounds read and write in V8 CVE-2026-7900: Heap buffer overflow in ANGLE CVE-2026-7901: Use after free in ANGLE CVE-2026-7902: Out of bounds memory access in V8 CVE-2026-7903: Integer overflow in ANGLE CVE-2026-7904: Out of bounds read in Fonts CVE-2026-7905: Insufficient validation of untrusted input in Media CVE-2026-7906: Use after free in SVG CVE-2026-7907: Use after free in DOM CVE-2026-7908: Use after free in Fullscreen CVE-2026-7909: Inappropriate implementation in ServiceWorker CVE-2026-7910: Use after free in Views CVE-2026-7911: Use after free in Aura CVE-2026-7912: Integer overflow in GPU CVE-2026-7913: Insufficient policy enforcement in DevTools CVE-2026-7914: Type Confusion in Accessibility CVE-2026-7915: Insufficient data validation in DevTools CVE-2026-7916: Insufficient data validation in InterestGroups CVE-2026-7917: Use after free in Fullscreen CVE-2026-7918: Use after free in GPU CVE-2026-7919: Use after free in Aura CVE-2026-7920: Use after free in Skia CVE-2026-7921: Use after free in Passwords CVE-2026-7922: Use after free in ServiceWorker CVE-2026-7923: Out of bounds write in Skia CVE-2026-7924: Uninitialized Use in Dawn CVE-2026-7925: Use after free in Chromoting CVE-2026-7926: Use after free in PresentationAPI CVE-2026-7927: Type Confusion in Runtime CVE-2026-7928: Use after free in WebRTC CVE-2026-7929: Use after free in MediaRecording CVE-2026-7930: Insufficient validation of untrusted input in Cookies CVE-2026-7931: Insufficient validation of untrusted input in iOS CVE-2026-7932: Insufficient policy enforcement in Downloads CVE-2026-7933: Out of bounds read in WebCodecs CVE-2026-7934: Insufficient validation of untrusted input in Popup Blocker CVE-2026-7935: Inappropriate implementation in Speech CVE-2026-7936: Object lifecycle issue in V8 CVE-2026-7937: Insufficient policy enforcement in DevTools CVE-2026-7938: Use after free in CSS CVE-2026-7939: Inappropriate implementation in SanitizerAPI CVE-2026-7940: Use after free in V8 CVE-2026-7941: Insufficient validation of untrusted input in Mobile CVE-2026-7942: Integer overflow in ANGLE CVE-2026-7943: Insufficient validation of untrusted input in ANGLE CVE-2026-7944: Insufficient validation of untrusted input in Persistent Cache CVE-2026-7945: Insufficient validation of untrusted input in COOP CVE-2026-7946: Insufficient policy enforcement in WebUI CVE-2026-7947: Insufficient validation of untrusted input in Network CVE-2026-7948: Race in Chromoting CVE-2026-7949: Out of bounds read in Skia CVE-2026-7950: Out of bounds read and write in GFX CVE-2026-7951: Out of bounds write in WebRTC CVE-2026-7952: Insufficient policy enforcement in Extensions CVE-2026-7953: Insufficient validation of untrusted input in Omnibox CVE-2026-7954: Race in Shared Storage CVE-2026-7955: Uninitialized Use in GPU CVE-2026-7956: Use after free in Navigation CVE-2026-7957: Out of bounds write in Media CVE-2026-7958: Inappropriate implementation in ServiceWorker CVE-2026-7959: Inappropriate implementation in Navigation CVE-2026-7960: Race in Speech CVE-2026-7961: Insufficient validation of untrusted input in Permissions CVE-2026-7962: Insufficient policy enforcement in DirectSockets CVE-2026-7963: Inappropriate implementation in ServiceWorker CVE-2026-7964: Insufficient validation of untrusted input in FileSystem CVE-2026-7965: Insufficient validation of untrusted input in DevTools CVE-2026-7966: Insufficient validation of untrusted input in SiteIsolation CVE-2026-7967: Insufficient validation of untrusted input in Navigation CVE-2026-7968: Insufficient validation of untrusted input in CORS CVE-2026-7969: Integer overflow in Network CVE-2026-7970: Use after free in TopChrome CVE-2026-7971: Inappropriate implementation in ORB CVE-2026-7972: Uninitialized Use in GPU CVE-2026-7973: Integer overflow in Dawn CVE-2026-7974: Use after free in Blink CVE-2026-7975: Use after free in DevTools CVE-2026-7976: Use after free in Views CVE-2026-7977: Inappropriate implementation in Canvas CVE-2026-7978: Inappropriate implementation in Companion CVE-2026-7979: Inappropriate implementation in Media CVE-2026-7980: Use after free in WebAudio CVE-2026-7981: Out of bounds read in Codecs CVE-2026-7982: Uninitialized Use in WebCodecs CVE-2026-7983: Out of bounds read in Dawn CVE-2026-7984: Use after free in ReadingMode CVE-2026-7985: Use after free in GPU CVE-2026-7986: Insufficient policy enforcement in Autofill CVE-2026-7987: Use after free in WebRTC CVE-2026-7988: Type Confusion in WebRTC CVE-2026-7989: Insufficient data validation in DataTransfer CVE-2026-7990: Insufficient validation of untrusted input in Updater CVE-2026-7991: Use after free in UI CVE-2026-7992: Insufficient validation of untrusted input in UI CVE-2026-7993: Insufficient validation of untrusted input in Payments CVE-2026-7994: Inappropriate implementation in Chromoting CVE-2026-7995: Out of bounds read in AdFilter CVE-2026-7996: Insufficient validation of untrusted input in SSL CVE-2026-7997: Insufficient validation of untrusted input in Updater CVE-2026-7998: Insufficient validation of untrusted input in Dialog CVE-2026-7999: Inappropriate implementation in V8 CVE-2026-8000: Insufficient validation of untrusted input in ChromeDriver CVE-2026-8001: Use after free in Printing CVE-2026-8002: Use after free in Audio CVE-2026-8003: Insufficient validation of untrusted input in TabGroups CVE-2026-8004: Insufficient policy enforcement in DevTools CVE-2026-8005: Insufficient validation of untrusted input in Cast CVE-2026-8006: Insufficient policy enforcement in DevTools CVE-2026-8007: Insufficient validation of untrusted input in Cast CVE-2026-8008: Inappropriate implementation in DevTools CVE-2026-8009: Inappropriate implementation in Cast CVE-2026-8010: Insufficient validation of untrusted input in SiteIsolation CVE-2026-8011: Insufficient policy enforcement in Search CVE-2026-8012: Inappropriate implementation in MHTML CVE-2026-8013: Insufficient validation of untrusted input in FedCM CVE-2026-8014: Inappropriate implementation in Preload CVE-2026-8015: Inappropriate implementation in Media CVE-2026-8016: Use after free in WebRTC CVE-2026-8017: Side-channel information leakage in Media CVE-2026-8018: Insufficient policy enforcement in DevTools CVE-2026-8019: Insufficient policy enforcement in WebApp CVE-2026-8020: Uninitialized Use in GPU CVE-2026-8021: Script injection in UI CVE-2026-8022: Inappropriate implementation in MHTML -------------------------------------------------------------------------------- ChangeLog: * Wed May 6 2026 Than Ngo <than(a)redhat.com> - 148.0.7778.96-1 - Update to 148.0.7778.96 * CVE-2026-7896: Integer overflow in Blink * CVE-2026-7897: Use after free in Mobile * CVE-2026-7898: Use after free in Chromoting * CVE-2026-7899: Out of bounds read and write in V8 * CVE-2026-7900: Heap buffer overflow in ANGLE * CVE-2026-7901: Use after free in ANGLE * CVE-2026-7902: Out of bounds memory access in V8 * CVE-2026-7903: Integer overflow in ANGLE * CVE-2026-7904: Out of bounds read in Fonts * CVE-2026-7905: Insufficient validation of untrusted input in Media * CVE-2026-7906: Use after free in SVG * CVE-2026-7907: Use after free in DOM * CVE-2026-7908: Use after free in Fullscreen * CVE-2026-7909: Inappropriate implementation in ServiceWorker * CVE-2026-7910: Use after free in Views * CVE-2026-7911: Use after free in Aura * CVE-2026-7912: Integer overflow in GPU * CVE-2026-7913: Insufficient policy enforcement in DevTools * CVE-2026-7914: Type Confusion in Accessibility * CVE-2026-7915: Insufficient data validation in DevTools * CVE-2026-7916: Insufficient data validation in InterestGroups * CVE-2026-7917: Use after free in Fullscreen * CVE-2026-7918: Use after free in GPU * CVE-2026-7919: Use after free in Aura * CVE-2026-7920: Use after free in Skia * CVE-2026-7921: Use after free in Passwords * CVE-2026-7922: Use after free in ServiceWorker * CVE-2026-7923: Out of bounds write in Skia * CVE-2026-7924: Uninitialized Use in Dawn * CVE-2026-7925: Use after free in Chromoting * CVE-2026-7926: Use after free in PresentationAPI * CVE-2026-7927: Type Confusion in Runtime * CVE-2026-7928: Use after free in WebRTC * CVE-2026-7929: Use after free in MediaRecording * CVE-2026-7930: Insufficient validation of untrusted input in Cookies * CVE-2026-7931: Insufficient validation of untrusted input in iOS * CVE-2026-7932: Insufficient policy enforcement in Downloads * CVE-2026-7933: Out of bounds read in WebCodecs * CVE-2026-7934: Insufficient validation of untrusted input in Popup Blocker * CVE-2026-7935: Inappropriate implementation in Speech * CVE-2026-7936: Object lifecycle issue in V8 * CVE-2026-7937: Insufficient policy enforcement in DevTools * CVE-2026-7938: Use after free in CSS * CVE-2026-7939: Inappropriate implementation in SanitizerAPI * CVE-2026-7940: Use after free in V8 * CVE-2026-7941: Insufficient validation of untrusted input in Mobile * CVE-2026-7942: Integer overflow in ANGLE * CVE-2026-7943: Insufficient validation of untrusted input in ANGLE * CVE-2026-7944: Insufficient validation of untrusted input in Persistent Cache * CVE-2026-7945: Insufficient validation of untrusted input in COOP * CVE-2026-7946: Insufficient policy enforcement in WebUI * CVE-2026-7947: Insufficient validation of untrusted input in Network * CVE-2026-7948: Race in Chromoting * CVE-2026-7949: Out of bounds read in Skia * CVE-2026-7950: Out of bounds read and write in GFX * CVE-2026-7951: Out of bounds write in WebRTC * CVE-2026-7952: Insufficient policy enforcement in Extensions * CVE-2026-7953: Insufficient validation of untrusted input in Omnibox * CVE-2026-7954: Race in Shared Storage * CVE-2026-7955: Uninitialized Use in GPU * CVE-2026-7956: Use after free in Navigation * CVE-2026-7957: Out of bounds write in Media * CVE-2026-7958: Inappropriate implementation in ServiceWorker * CVE-2026-7959: Inappropriate implementation in Navigation * CVE-2026-7960: Race in Speech * CVE-2026-7961: Insufficient validation of untrusted input in Permissions * CVE-2026-7962: Insufficient policy enforcement in DirectSockets * CVE-2026-7963: Inappropriate implementation in ServiceWorker * CVE-2026-7964: Insufficient validation of untrusted input in FileSystem * CVE-2026-7965: Insufficient validation of untrusted input in DevTools * CVE-2026-7966: Insufficient validation of untrusted input in SiteIsolation * CVE-2026-7967: Insufficient validation of untrusted input in Navigation * CVE-2026-7968: Insufficient validation of untrusted input in CORS * CVE-2026-7969: Integer overflow in Network * CVE-2026-7970: Use after free in TopChrome * CVE-2026-7971: Inappropriate implementation in ORB * CVE-2026-7972: Uninitialized Use in GPU * CVE-2026-7973: Integer overflow in Dawn * CVE-2026-7974: Use after free in Blink * CVE-2026-7975: Use after free in DevTools * CVE-2026-7976: Use after free in Views * CVE-2026-7977: Inappropriate implementation in Canvas * CVE-2026-7978: Inappropriate implementation in Companion * CVE-2026-7979: Inappropriate implementation in Media * CVE-2026-7980: Use after free in WebAudio * CVE-2026-7981: Out of bounds read in Codecs * CVE-2026-7982: Uninitialized Use in WebCodecs * CVE-2026-7983: Out of bounds read in Dawn * CVE-2026-7984: Use after free in ReadingMode * CVE-2026-7985: Use after free in GPU * CVE-2026-7986: Insufficient policy enforcement in Autofill * CVE-2026-7987: Use after free in WebRTC * CVE-2026-7988: Type Confusion in WebRTC * CVE-2026-7989: Insufficient data validation in DataTransfer * CVE-2026-7990: Insufficient validation of untrusted input in Updater * CVE-2026-7991: Use after free in UI * CVE-2026-7992: Insufficient validation of untrusted input in UI * CVE-2026-7993: Insufficient validation of untrusted input in Payments * CVE-2026-7994: Inappropriate implementation in Chromoting * CVE-2026-7995: Out of bounds read in AdFilter * CVE-2026-7996: Insufficient validation of untrusted input in SSL * CVE-2026-7997: Insufficient validation of untrusted input in Updater * CVE-2026-7998: Insufficient validation of untrusted input in Dialog * CVE-2026-7999: Inappropriate implementation in V8 * CVE-2026-8000: Insufficient validation of untrusted input in ChromeDriver * CVE-2026-8001: Use after free in Printing * CVE-2026-8002: Use after free in Audio * CVE-2026-8003: Insufficient validation of untrusted input in TabGroups * CVE-2026-8004: Insufficient policy enforcement in DevTools * CVE-2026-8005: Insufficient validation of untrusted input in Cast * CVE-2026-8006: Insufficient policy enforcement in DevTools * CVE-2026-8007: Insufficient validation of untrusted input in Cast * CVE-2026-8008: Inappropriate implementation in DevTools * CVE-2026-8009: Inappropriate implementation in Cast * CVE-2026-8010: Insufficient validation of untrusted input in SiteIsolation * CVE-2026-8011: Insufficient policy enforcement in Search * CVE-2026-8012: Inappropriate implementation in MHTML * CVE-2026-8013: Insufficient validation of untrusted input in FedCM * CVE-2026-8014: Inappropriate implementation in Preload * CVE-2026-8015: Inappropriate implementation in Media * CVE-2026-8016: Use after free in WebRTC * CVE-2026-8017: Side-channel information leakage in Media * CVE-2026-8018: Insufficient policy enforcement in DevTools * CVE-2026-8019: Insufficient policy enforcement in WebApp * CVE-2026-8020: Uninitialized Use in GPU * CVE-2026-8021: Script injection in UI * CVE-2026-8022: Inappropriate implementation in MHTML - Remove old remoting-no-tests patch - Remove fix_GL_native_pixmap_import_support_reset_in_GpuInit patch - Fix build error causing by sanitizer defines in GN - Refresh rust-enable-unstable_feature patch - Fix build error with system rust compiler - Fix build error causing by new clang++ options which are not supported yet - Fix build error causing by harfbuzz library rename -------------------------------------------------------------------------------- References: [ 1 ] Bug #2468371 - CVE-2026-7896 CVE-2026-7897 CVE-2026-7898 CVE-2026-7899 CVE-2026-7900 CVE-2026-7901 CVE-2026-7902 CVE-2026-7903 CVE-2026-7904 CVE-2026-7905 CVE-2026-7906 CVE-2026-7907 CVE-2026-7908 CVE-2026-7909 CVE-2026-7910 ... chromium: various flaws [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2468371 -------------------------------------------------------------------------------- ================================================================================ libmd-1.2.0-1.el10_1 (FEDORA-EPEL-2026-5d44c45bda) Library that provides message digest functions from BSD systems -------------------------------------------------------------------------------- Update Information: libmd 1.2.0 build: Fix out-of-tree build build: Refactor autogen call into before_script build: Add a new vpath-tests CI test man: Sync SHA2 changes from OpenBSD build: Add a coverage regex to the CI job build: Rename LIBMD_ABI to SOVERSION doc: Remove «All rights reserved» from COPYING build: Add Maintainer and License fields to the .pc file doc: Remove redundant «Copyright ©» prefix from Copyright field in COPYING doc: Move derived code attribution to a Comment field Add SHA3 and SHAKE support Add internal explicit_bzero() support Add internal endian conversion functions support Fix and hook SHA3 and SHAKE support Remove spurious blank lines at the beginning of functions build: Request tar-ustar format for distribution build: Set TAR_OPTIONS to avoid leaking maintainer information on dist -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Robert Scheck <robert(a)fedoraproject.org> 1.2.0-1 - Upgrade to 1.2.0 (#2468687) * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Thu Jul 24 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Mon Jan 20 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Fri Jan 17 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2468687 - libmd-1.2.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2468687 -------------------------------------------------------------------------------- ================================================================================ perl-Net-CIDR-Lite-0.24-1.el10_1 (FEDORA-EPEL-2026-f56395a765) Perl extension for merging IPv4 or IPv6 CIDR addresses -------------------------------------------------------------------------------- Update Information: This update addresses some input validation issues: Reject Unicode digits and trailing newlines in parser inputs (CVE-2026-45190) Reject zero-padded CIDR masks (CVE-2026-45191) -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Paul Howarth <paul(a)city-fan.org> - 0.24-1 - Update to 0.24 - Reject Unicode digits and trailing newlines in parser inputs (CVE-2026-45190) - Reject zero-padded CIDR masks (CVE-2026-45191) -------------------------------------------------------------------------------- ================================================================================ python-python-multipart-0.0.28-1.el10_1 (FEDORA-EPEL-2026-863b32e1e3) A streaming multipart parser for Python -------------------------------------------------------------------------------- Update Information: 0.0.28 (2026-05-10) Speed up partial-boundary tail scan via bytes.find Cap multipart boundary length at 256 bytes -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Packit <hello(a)packit.dev> - 0.0.28-1 - Update to 0.0.28 upstream release - Resolves: rhbz#2468595 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2468595 - python-python-multipart-0.0.28 is available https://bugzilla.redhat.com/show_bug.cgi?id=2468595 -------------------------------------------------------------------------------- ================================================================================ signify-33-1.el10_1 (FEDORA-EPEL-2026-9924e62d61) Sign and verify signatures on files -------------------------------------------------------------------------------- Update Information: signify v33 (2026-05-11) Added New Meson-based build system, which also works with Muon. This is considered experimental for now, and therefore the existing GNU Make-based one is still supported. Changed Development has moved to Codeberg, with the old GitHub repository now being a mirror. Try to detect whether the compiler supports the bounded attribute via __has_attribute(), and enable its usage automatically when available. Updated sources from upstream OpenBSD and libbsd 0.12.1. Fixed Fix compilation issues when -Wimplicit-function-declaration is in effect, which is the case with Clang 16 and GCC 13 (or newer). -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Robert Scheck <robert(a)fedoraproject.org> - 33-1 - Update to release v33 (#2469961) * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 32-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 32-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Sun Jan 19 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 32-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2469961 - signify-33 is available https://bugzilla.redhat.com/show_bug.cgi?id=2469961 --------------------------------------------------------------------------------

1 0

Fedora EPEL 10.3 updates-testing report
by updates＠fedoraproject.org 11 May '26

11 May '26

The following Fedora EPEL 10.3 Security updates need testing: Age URL 19 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-a5d0ca57c2 nuclei-3.8.0-1.el10_3 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-66ed147b70 gh-2.92.0-1.el10_3 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-a0e68dfa17 python-click-8.1.7-7.el10_3 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-ee98895c61 GitPython-3.1.50-1.el10_3 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-4b95f570ed rust-astral-tokio-tar-0.6.1-1.el10_3 uv-0.11.11-1.el10_3 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-2f250c3cfd apptainer-1.5.0-1.el10_3 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1f569c1659 coturn-4.11.0-1.el10_3 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1f33c80992 pgbouncer-1.25.2-1.el10_3 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-bc4da63b7d libgit2_1.9-1.9.3-1.el10_3 nix-2.31.5-1.el10_3 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-c40a843b1e zabbix7.0-7.0.26-1.el10_3 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-3e472e2cf8 SDL2_image-2.8.12-1.el10_3 The following builds have been pushed to Fedora EPEL 10.3 updates-testing chromium-148.0.7778.96-1.el10_3 fedora-repoquery-0.8.2-1.el10_3 libmd-1.2.0-1.el10_3 perl-Net-CIDR-Lite-0.24-1.el10_3 postgresql18-pg_partman-5.4.3-2.el10_3 python-jq-1.7.0-1.el10_3 python-keystoneauth1-5.13.1-4.el10_3 python-openstackclient-9.0.0-4.el10_3 python-python-multipart-0.0.28-1.el10_3 qbittorrent-5.1.4-4.el10_3 rust-cargo-vendor-filterer-0.5.18-5.el10_3 rust-databake-0.2.1-1.el10_3 rust-databake-derive-0.2.1-1.el10_3 rust-nu-ansi-term-0.50.3-1.el10_3 rust-rpki-0.18.6-4.el10_3 rust-sequoia-openpgp-2.3.0-1.el10_3 rust-which-8.0.2-1.el10_3 signify-33-1.el10_3 Details about builds: ================================================================================ chromium-148.0.7778.96-1.el10_3 (FEDORA-EPEL-2026-11dcfd4c9f) A WebKit (Blink) powered web browser that Google doesn't want you to use -------------------------------------------------------------------------------- Update Information: Update to 148.0.7778.96 CVE-2026-7896: Integer overflow in Blink CVE-2026-7897: Use after free in Mobile CVE-2026-7898: Use after free in Chromoting CVE-2026-7899: Out of bounds read and write in V8 CVE-2026-7900: Heap buffer overflow in ANGLE CVE-2026-7901: Use after free in ANGLE CVE-2026-7902: Out of bounds memory access in V8 CVE-2026-7903: Integer overflow in ANGLE CVE-2026-7904: Out of bounds read in Fonts CVE-2026-7905: Insufficient validation of untrusted input in Media CVE-2026-7906: Use after free in SVG CVE-2026-7907: Use after free in DOM CVE-2026-7908: Use after free in Fullscreen CVE-2026-7909: Inappropriate implementation in ServiceWorker CVE-2026-7910: Use after free in Views CVE-2026-7911: Use after free in Aura CVE-2026-7912: Integer overflow in GPU CVE-2026-7913: Insufficient policy enforcement in DevTools CVE-2026-7914: Type Confusion in Accessibility CVE-2026-7915: Insufficient data validation in DevTools CVE-2026-7916: Insufficient data validation in InterestGroups CVE-2026-7917: Use after free in Fullscreen CVE-2026-7918: Use after free in GPU CVE-2026-7919: Use after free in Aura CVE-2026-7920: Use after free in Skia CVE-2026-7921: Use after free in Passwords CVE-2026-7922: Use after free in ServiceWorker CVE-2026-7923: Out of bounds write in Skia CVE-2026-7924: Uninitialized Use in Dawn CVE-2026-7925: Use after free in Chromoting CVE-2026-7926: Use after free in PresentationAPI CVE-2026-7927: Type Confusion in Runtime CVE-2026-7928: Use after free in WebRTC CVE-2026-7929: Use after free in MediaRecording CVE-2026-7930: Insufficient validation of untrusted input in Cookies CVE-2026-7931: Insufficient validation of untrusted input in iOS CVE-2026-7932: Insufficient policy enforcement in Downloads CVE-2026-7933: Out of bounds read in WebCodecs CVE-2026-7934: Insufficient validation of untrusted input in Popup Blocker CVE-2026-7935: Inappropriate implementation in Speech CVE-2026-7936: Object lifecycle issue in V8 CVE-2026-7937: Insufficient policy enforcement in DevTools CVE-2026-7938: Use after free in CSS CVE-2026-7939: Inappropriate implementation in SanitizerAPI CVE-2026-7940: Use after free in V8 CVE-2026-7941: Insufficient validation of untrusted input in Mobile CVE-2026-7942: Integer overflow in ANGLE CVE-2026-7943: Insufficient validation of untrusted input in ANGLE CVE-2026-7944: Insufficient validation of untrusted input in Persistent Cache CVE-2026-7945: Insufficient validation of untrusted input in COOP CVE-2026-7946: Insufficient policy enforcement in WebUI CVE-2026-7947: Insufficient validation of untrusted input in Network CVE-2026-7948: Race in Chromoting CVE-2026-7949: Out of bounds read in Skia CVE-2026-7950: Out of bounds read and write in GFX CVE-2026-7951: Out of bounds write in WebRTC CVE-2026-7952: Insufficient policy enforcement in Extensions CVE-2026-7953: Insufficient validation of untrusted input in Omnibox CVE-2026-7954: Race in Shared Storage CVE-2026-7955: Uninitialized Use in GPU CVE-2026-7956: Use after free in Navigation CVE-2026-7957: Out of bounds write in Media CVE-2026-7958: Inappropriate implementation in ServiceWorker CVE-2026-7959: Inappropriate implementation in Navigation CVE-2026-7960: Race in Speech CVE-2026-7961: Insufficient validation of untrusted input in Permissions CVE-2026-7962: Insufficient policy enforcement in DirectSockets CVE-2026-7963: Inappropriate implementation in ServiceWorker CVE-2026-7964: Insufficient validation of untrusted input in FileSystem CVE-2026-7965: Insufficient validation of untrusted input in DevTools CVE-2026-7966: Insufficient validation of untrusted input in SiteIsolation CVE-2026-7967: Insufficient validation of untrusted input in Navigation CVE-2026-7968: Insufficient validation of untrusted input in CORS CVE-2026-7969: Integer overflow in Network CVE-2026-7970: Use after free in TopChrome CVE-2026-7971: Inappropriate implementation in ORB CVE-2026-7972: Uninitialized Use in GPU CVE-2026-7973: Integer overflow in Dawn CVE-2026-7974: Use after free in Blink CVE-2026-7975: Use after free in DevTools CVE-2026-7976: Use after free in Views CVE-2026-7977: Inappropriate implementation in Canvas CVE-2026-7978: Inappropriate implementation in Companion CVE-2026-7979: Inappropriate implementation in Media CVE-2026-7980: Use after free in WebAudio CVE-2026-7981: Out of bounds read in Codecs CVE-2026-7982: Uninitialized Use in WebCodecs CVE-2026-7983: Out of bounds read in Dawn CVE-2026-7984: Use after free in ReadingMode CVE-2026-7985: Use after free in GPU CVE-2026-7986: Insufficient policy enforcement in Autofill CVE-2026-7987: Use after free in WebRTC CVE-2026-7988: Type Confusion in WebRTC CVE-2026-7989: Insufficient data validation in DataTransfer CVE-2026-7990: Insufficient validation of untrusted input in Updater CVE-2026-7991: Use after free in UI CVE-2026-7992: Insufficient validation of untrusted input in UI CVE-2026-7993: Insufficient validation of untrusted input in Payments CVE-2026-7994: Inappropriate implementation in Chromoting CVE-2026-7995: Out of bounds read in AdFilter CVE-2026-7996: Insufficient validation of untrusted input in SSL CVE-2026-7997: Insufficient validation of untrusted input in Updater CVE-2026-7998: Insufficient validation of untrusted input in Dialog CVE-2026-7999: Inappropriate implementation in V8 CVE-2026-8000: Insufficient validation of untrusted input in ChromeDriver CVE-2026-8001: Use after free in Printing CVE-2026-8002: Use after free in Audio CVE-2026-8003: Insufficient validation of untrusted input in TabGroups CVE-2026-8004: Insufficient policy enforcement in DevTools CVE-2026-8005: Insufficient validation of untrusted input in Cast CVE-2026-8006: Insufficient policy enforcement in DevTools CVE-2026-8007: Insufficient validation of untrusted input in Cast CVE-2026-8008: Inappropriate implementation in DevTools CVE-2026-8009: Inappropriate implementation in Cast CVE-2026-8010: Insufficient validation of untrusted input in SiteIsolation CVE-2026-8011: Insufficient policy enforcement in Search CVE-2026-8012: Inappropriate implementation in MHTML CVE-2026-8013: Insufficient validation of untrusted input in FedCM CVE-2026-8014: Inappropriate implementation in Preload CVE-2026-8015: Inappropriate implementation in Media CVE-2026-8016: Use after free in WebRTC CVE-2026-8017: Side-channel information leakage in Media CVE-2026-8018: Insufficient policy enforcement in DevTools CVE-2026-8019: Insufficient policy enforcement in WebApp CVE-2026-8020: Uninitialized Use in GPU CVE-2026-8021: Script injection in UI CVE-2026-8022: Inappropriate implementation in MHTML -------------------------------------------------------------------------------- ChangeLog: * Wed May 6 2026 Than Ngo <than(a)redhat.com> - 148.0.7778.96-1 - Update to 148.0.7778.96 * CVE-2026-7896: Integer overflow in Blink * CVE-2026-7897: Use after free in Mobile * CVE-2026-7898: Use after free in Chromoting * CVE-2026-7899: Out of bounds read and write in V8 * CVE-2026-7900: Heap buffer overflow in ANGLE * CVE-2026-7901: Use after free in ANGLE * CVE-2026-7902: Out of bounds memory access in V8 * CVE-2026-7903: Integer overflow in ANGLE * CVE-2026-7904: Out of bounds read in Fonts * CVE-2026-7905: Insufficient validation of untrusted input in Media * CVE-2026-7906: Use after free in SVG * CVE-2026-7907: Use after free in DOM * CVE-2026-7908: Use after free in Fullscreen * CVE-2026-7909: Inappropriate implementation in ServiceWorker * CVE-2026-7910: Use after free in Views * CVE-2026-7911: Use after free in Aura * CVE-2026-7912: Integer overflow in GPU * CVE-2026-7913: Insufficient policy enforcement in DevTools * CVE-2026-7914: Type Confusion in Accessibility * CVE-2026-7915: Insufficient data validation in DevTools * CVE-2026-7916: Insufficient data validation in InterestGroups * CVE-2026-7917: Use after free in Fullscreen * CVE-2026-7918: Use after free in GPU * CVE-2026-7919: Use after free in Aura * CVE-2026-7920: Use after free in Skia * CVE-2026-7921: Use after free in Passwords * CVE-2026-7922: Use after free in ServiceWorker * CVE-2026-7923: Out of bounds write in Skia * CVE-2026-7924: Uninitialized Use in Dawn * CVE-2026-7925: Use after free in Chromoting * CVE-2026-7926: Use after free in PresentationAPI * CVE-2026-7927: Type Confusion in Runtime * CVE-2026-7928: Use after free in WebRTC * CVE-2026-7929: Use after free in MediaRecording * CVE-2026-7930: Insufficient validation of untrusted input in Cookies * CVE-2026-7931: Insufficient validation of untrusted input in iOS * CVE-2026-7932: Insufficient policy enforcement in Downloads * CVE-2026-7933: Out of bounds read in WebCodecs * CVE-2026-7934: Insufficient validation of untrusted input in Popup Blocker * CVE-2026-7935: Inappropriate implementation in Speech * CVE-2026-7936: Object lifecycle issue in V8 * CVE-2026-7937: Insufficient policy enforcement in DevTools * CVE-2026-7938: Use after free in CSS * CVE-2026-7939: Inappropriate implementation in SanitizerAPI * CVE-2026-7940: Use after free in V8 * CVE-2026-7941: Insufficient validation of untrusted input in Mobile * CVE-2026-7942: Integer overflow in ANGLE * CVE-2026-7943: Insufficient validation of untrusted input in ANGLE * CVE-2026-7944: Insufficient validation of untrusted input in Persistent Cache * CVE-2026-7945: Insufficient validation of untrusted input in COOP * CVE-2026-7946: Insufficient policy enforcement in WebUI * CVE-2026-7947: Insufficient validation of untrusted input in Network * CVE-2026-7948: Race in Chromoting * CVE-2026-7949: Out of bounds read in Skia * CVE-2026-7950: Out of bounds read and write in GFX * CVE-2026-7951: Out of bounds write in WebRTC * CVE-2026-7952: Insufficient policy enforcement in Extensions * CVE-2026-7953: Insufficient validation of untrusted input in Omnibox * CVE-2026-7954: Race in Shared Storage * CVE-2026-7955: Uninitialized Use in GPU * CVE-2026-7956: Use after free in Navigation * CVE-2026-7957: Out of bounds write in Media * CVE-2026-7958: Inappropriate implementation in ServiceWorker * CVE-2026-7959: Inappropriate implementation in Navigation * CVE-2026-7960: Race in Speech * CVE-2026-7961: Insufficient validation of untrusted input in Permissions * CVE-2026-7962: Insufficient policy enforcement in DirectSockets * CVE-2026-7963: Inappropriate implementation in ServiceWorker * CVE-2026-7964: Insufficient validation of untrusted input in FileSystem * CVE-2026-7965: Insufficient validation of untrusted input in DevTools * CVE-2026-7966: Insufficient validation of untrusted input in SiteIsolation * CVE-2026-7967: Insufficient validation of untrusted input in Navigation * CVE-2026-7968: Insufficient validation of untrusted input in CORS * CVE-2026-7969: Integer overflow in Network * CVE-2026-7970: Use after free in TopChrome * CVE-2026-7971: Inappropriate implementation in ORB * CVE-2026-7972: Uninitialized Use in GPU * CVE-2026-7973: Integer overflow in Dawn * CVE-2026-7974: Use after free in Blink * CVE-2026-7975: Use after free in DevTools * CVE-2026-7976: Use after free in Views * CVE-2026-7977: Inappropriate implementation in Canvas * CVE-2026-7978: Inappropriate implementation in Companion * CVE-2026-7979: Inappropriate implementation in Media * CVE-2026-7980: Use after free in WebAudio * CVE-2026-7981: Out of bounds read in Codecs * CVE-2026-7982: Uninitialized Use in WebCodecs * CVE-2026-7983: Out of bounds read in Dawn * CVE-2026-7984: Use after free in ReadingMode * CVE-2026-7985: Use after free in GPU * CVE-2026-7986: Insufficient policy enforcement in Autofill * CVE-2026-7987: Use after free in WebRTC * CVE-2026-7988: Type Confusion in WebRTC * CVE-2026-7989: Insufficient data validation in DataTransfer * CVE-2026-7990: Insufficient validation of untrusted input in Updater * CVE-2026-7991: Use after free in UI * CVE-2026-7992: Insufficient validation of untrusted input in UI * CVE-2026-7993: Insufficient validation of untrusted input in Payments * CVE-2026-7994: Inappropriate implementation in Chromoting * CVE-2026-7995: Out of bounds read in AdFilter * CVE-2026-7996: Insufficient validation of untrusted input in SSL * CVE-2026-7997: Insufficient validation of untrusted input in Updater * CVE-2026-7998: Insufficient validation of untrusted input in Dialog * CVE-2026-7999: Inappropriate implementation in V8 * CVE-2026-8000: Insufficient validation of untrusted input in ChromeDriver * CVE-2026-8001: Use after free in Printing * CVE-2026-8002: Use after free in Audio * CVE-2026-8003: Insufficient validation of untrusted input in TabGroups * CVE-2026-8004: Insufficient policy enforcement in DevTools * CVE-2026-8005: Insufficient validation of untrusted input in Cast * CVE-2026-8006: Insufficient policy enforcement in DevTools * CVE-2026-8007: Insufficient validation of untrusted input in Cast * CVE-2026-8008: Inappropriate implementation in DevTools * CVE-2026-8009: Inappropriate implementation in Cast * CVE-2026-8010: Insufficient validation of untrusted input in SiteIsolation * CVE-2026-8011: Insufficient policy enforcement in Search * CVE-2026-8012: Inappropriate implementation in MHTML * CVE-2026-8013: Insufficient validation of untrusted input in FedCM * CVE-2026-8014: Inappropriate implementation in Preload * CVE-2026-8015: Inappropriate implementation in Media * CVE-2026-8016: Use after free in WebRTC * CVE-2026-8017: Side-channel information leakage in Media * CVE-2026-8018: Insufficient policy enforcement in DevTools * CVE-2026-8019: Insufficient policy enforcement in WebApp * CVE-2026-8020: Uninitialized Use in GPU * CVE-2026-8021: Script injection in UI * CVE-2026-8022: Inappropriate implementation in MHTML - Remove old remoting-no-tests patch - Remove fix_GL_native_pixmap_import_support_reset_in_GpuInit patch - Fix build error causing by sanitizer defines in GN - Refresh rust-enable-unstable_feature patch - Fix build error with system rust compiler - Fix build error causing by new clang++ options which are not supported yet - Fix build error causing by harfbuzz library rename -------------------------------------------------------------------------------- References: [ 1 ] Bug #2468371 - CVE-2026-7896 CVE-2026-7897 CVE-2026-7898 CVE-2026-7899 CVE-2026-7900 CVE-2026-7901 CVE-2026-7902 CVE-2026-7903 CVE-2026-7904 CVE-2026-7905 CVE-2026-7906 CVE-2026-7907 CVE-2026-7908 CVE-2026-7909 CVE-2026-7910 ... chromium: various flaws [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2468371 -------------------------------------------------------------------------------- ================================================================================ fedora-repoquery-0.8.2-1.el10_3 (FEDORA-EPEL-2026-bbdbb8d596) Fedora release repos package query tool -------------------------------------------------------------------------------- Update Information: https://hackage.haskell.org/package/fedora-repoquery-0.8.2/changelog -------------------------------------------------------------------------------- ChangeLog: * Sun May 10 2026 Jens Petersen <petersen(a)redhat.com> - 0.8.2-1 - https://hackage.haskell.org/package/fedora-repoquery-0.8.2/changelog -------------------------------------------------------------------------------- ================================================================================ libmd-1.2.0-1.el10_3 (FEDORA-EPEL-2026-627ddcf8b6) Library that provides message digest functions from BSD systems -------------------------------------------------------------------------------- Update Information: libmd 1.2.0 build: Fix out-of-tree build build: Refactor autogen call into before_script build: Add a new vpath-tests CI test man: Sync SHA2 changes from OpenBSD build: Add a coverage regex to the CI job build: Rename LIBMD_ABI to SOVERSION doc: Remove «All rights reserved» from COPYING build: Add Maintainer and License fields to the .pc file doc: Remove redundant «Copyright ©» prefix from Copyright field in COPYING doc: Move derived code attribution to a Comment field Add SHA3 and SHAKE support Add internal explicit_bzero() support Add internal endian conversion functions support Fix and hook SHA3 and SHAKE support Remove spurious blank lines at the beginning of functions build: Request tar-ustar format for distribution build: Set TAR_OPTIONS to avoid leaking maintainer information on dist -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Robert Scheck <robert(a)fedoraproject.org> 1.2.0-1 - Upgrade to 1.2.0 (#2468687) * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Thu Jul 24 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Mon Jan 20 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Fri Jan 17 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2468687 - libmd-1.2.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2468687 -------------------------------------------------------------------------------- ================================================================================ perl-Net-CIDR-Lite-0.24-1.el10_3 (FEDORA-EPEL-2026-5ff59e836c) Perl extension for merging IPv4 or IPv6 CIDR addresses -------------------------------------------------------------------------------- Update Information: This update addresses some input validation issues: Reject Unicode digits and trailing newlines in parser inputs (CVE-2026-45190) Reject zero-padded CIDR masks (CVE-2026-45191) -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Paul Howarth <paul(a)city-fan.org> - 0.24-1 - Update to 0.24 - Reject Unicode digits and trailing newlines in parser inputs (CVE-2026-45190) - Reject zero-padded CIDR masks (CVE-2026-45191) -------------------------------------------------------------------------------- ================================================================================ postgresql18-pg_partman-5.4.3-2.el10_3 (FEDORA-EPEL-2026-7a28717d12) PostgresSQL Partition Manager -------------------------------------------------------------------------------- Update Information: Initial build for epel10 -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Pavol Sloboda <psloboda(a)redhat.com> - 5.4.3-2 - Updated the tests to require the non distro default name of pg_partman instead of the distro default one to ensure it is being found * Thu Apr 30 2026 Pavol Sloboda <psloboda(a)redhat.com> - 5.4.3-1 - Initial commit for epel10 -------------------------------------------------------------------------------- ================================================================================ python-jq-1.7.0-1.el10_3 (FEDORA-EPEL-2026-bab12de8ec) Python bindings for jq -------------------------------------------------------------------------------- Update Information: First Fedora/EPEL release -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Steve Traylen <steve.traylen(a)cern.ch> - 1.7.0-1 - First epel10 release 1.7.0 - Resolves: rhbz#2468634 -------------------------------------------------------------------------------- ================================================================================ python-keystoneauth1-5.13.1-4.el10_3 (FEDORA-EPEL-2026-afae045d60) Authentication Library for OpenStack Clients -------------------------------------------------------------------------------- Update Information: Addition of "extra" packages for kerberos oauth saml2 -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Steve Traylen <steve.traylen(a)cern.ch> - 5.13.1-4 - Extra packages, kerberos, oauth, saml2 and betamax -------------------------------------------------------------------------------- ================================================================================ python-openstackclient-9.0.0-4.el10_3 (FEDORA-EPEL-2026-7269ad6d5b) OpenStack Command-line Client -------------------------------------------------------------------------------- Update Information: Create openstack-completion user earlier On EL10 the sysuser compat macros are still required. While the user was being created it was not early enough and /var/lib/openstack-completion had the wrong ownership. -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Steve Traylen <steve.traylen(a)cern.ch> - 9.0.0-4 - Create openstack-completion user earlier -------------------------------------------------------------------------------- ================================================================================ python-python-multipart-0.0.28-1.el10_3 (FEDORA-EPEL-2026-37d2dd8e24) A streaming multipart parser for Python -------------------------------------------------------------------------------- Update Information: 0.0.28 (2026-05-10) Speed up partial-boundary tail scan via bytes.find Cap multipart boundary length at 256 bytes -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Packit <hello(a)packit.dev> - 0.0.28-1 - Update to 0.0.28 upstream release - Resolves: rhbz#2468595 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2468595 - python-python-multipart-0.0.28 is available https://bugzilla.redhat.com/show_bug.cgi?id=2468595 -------------------------------------------------------------------------------- ================================================================================ qbittorrent-5.1.4-4.el10_3 (FEDORA-EPEL-2026-0a06cc5229) A Bittorrent Client -------------------------------------------------------------------------------- Update Information: Import to epel10 -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Charalampos Stratakis <cstratak(a)redhat.com> - 1:5.1.4-4 - Import to epel10 - Fixes: rhbz#2420428 * Thu Apr 16 2026 Jan Grulich <jgrulich(a)redhat.com> - 1:5.1.4-3 - Rebuild (qt6) * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:5.1.4-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Thu Nov 20 2025 Lumír Balhar <lbalhar(a)redhat.com> - 1:5.1.4-1 - Update to 5.1.4 (rhbz#2416036) * Tue Nov 11 2025 Charalampos Stratakis <cstratak(a)redhat.com> - 1:5.1.3-1 - Update to 5.1.3 - Fixes: rhbz#2413975 * Tue Sep 30 2025 Jan Grulich <jgrulich(a)redhat.com> - 1:5.1.2-3 - Rebuild (qt6) * Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:5.1.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Fri Jul 4 2025 Charalampos Stratakis <cstratak(a)redhat.com> - 1:5.1.2-1 - Update to 5.1.2 - Fixes: rhbz#2375872 * Mon Jun 23 2025 Charalampos Stratakis <cstratak(a)redhat.com> - 1:5.1.1-1 - Update to 5.1.1 - Fixes: rhbz#2374308 * Fri May 9 2025 Charalampos Stratakis <cstratak(a)redhat.com> - 1:5.1.0-1 - Update to 5.1.0 - Fixes: rhbz#2359332 * Tue Mar 25 2025 Jan Grulich <jgrulich(a)redhat.com> - 1:5.0.4-2 - Rebuild (qt6) * Wed Feb 26 2025 Charalampos Stratakis <cstratak(a)redhat.com> - 1:5.0.4-1 - Update to 5.0.4 - Fixes: rhbz#2346210 * Sat Jan 18 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:5.0.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Wed Dec 25 2024 Filipe Rosset <rosset.filipe(a)gmail.com> - 1:5.0.3-1 - Update to 5.0.3 fixes rhbz#2332941 * Sat Nov 23 2024 Filipe Rosset <rosset.filipe(a)gmail.com> - 1:5.0.2-1 - Update to 5.0.2 fix rhbz#2326888 * Sun Nov 3 2024 Filipe Rosset <rosset.filipe(a)gmail.com> - 1:5.0.1-1 - Update to 5.0.1 to fix CVE-2024-51774 and rhbz#2322277 * Mon Oct 14 2024 Jan Grulich <jgrulich(a)redhat.com> - 1:5.0.0-2 - Rebuild (qt6) * Tue Oct 1 2024 Charalampos Stratakis <cstratak(a)redhat.com> - 1:5.0.0-1 - Update to 5.0.0 - Fixes: rhbz#2305922 * Fri Jul 26 2024 Miroslav Suchý <msuchy(a)redhat.com> - 1:4.6.5-3 - convert license to SPDX * Fri Jul 19 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 1:4.6.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild * Mon May 27 2024 Leigh Scott <leigh123linux(a)gmail.com> - 1:4.6.5-1 - Update to 4.6.5 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2420428 - Please branch and build qbittorrent in epel10 https://bugzilla.redhat.com/show_bug.cgi?id=2420428 -------------------------------------------------------------------------------- ================================================================================ rust-cargo-vendor-filterer-0.5.18-5.el10_3 (FEDORA-EPEL-2026-bdae0e453c) Cargo vendor, but with filtering for platforms and more -------------------------------------------------------------------------------- Update Information: Rebuild with version 0.10.79 of the openssl crate which includes fixes for the following security issues: CVE-2026-41676 / GHSA-pqf5-4pqq-29f5 CVE-2026-41677 / GHSA-xmgf-hq76-4vx2 CVE-2026-41678 / GHSA-8c75-8mhr-p7r9 CVE-2026-41681 / GHSA-ghm9-cr32-g9qj CVE-2026-41898 / GHSA-hppc-g8h3-xhp3 CVE-2026-42327 / GHSA-xp3w-r5p5-63rr CVE-2026-44662 / GHSA-xv59-967r-8726 -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Fabio Valentini <decathorpe(a)gmail.com> - 0.5.18-5 - Rebuild for rust-openssl CVE-2026-{41676,41677,41678,41681,41898,42327,44662} -------------------------------------------------------------------------------- ================================================================================ rust-databake-0.2.1-1.el10_3 (FEDORA-EPEL-2026-c7d7a323b4) Trait that lets structs represent themselves as (const) Rust expressions -------------------------------------------------------------------------------- Update Information: Update the databake and databake-derive crates to version 0.2.1. -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Fabio Valentini <decathorpe(a)gmail.com> - 0.2.1-1 - Update to version 0.2.1; Fixes RHBZ#2453897 * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.2.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.2.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild -------------------------------------------------------------------------------- ================================================================================ rust-databake-derive-0.2.1-1.el10_3 (FEDORA-EPEL-2026-c7d7a323b4) Custom derive for the databake crate -------------------------------------------------------------------------------- Update Information: Update the databake and databake-derive crates to version 0.2.1. -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Fabio Valentini <decathorpe(a)gmail.com> - 0.2.1-1 - Update to version 0.2.1; Fixes RHBZ#2453898 * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.2.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.2.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild -------------------------------------------------------------------------------- ================================================================================ rust-nu-ansi-term-0.50.3-1.el10_3 (FEDORA-EPEL-2026-9e4b053774) Library for ANSI terminal colors and styles (bold, underline) -------------------------------------------------------------------------------- Update Information: Update to version 0.50.3. -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Fabio Valentini <decathorpe(a)gmail.com> - 0.50.3-1 - Update to version 0.50.3; Fixes RHBZ#2403166 * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.50.1-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.50.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Sun Jan 19 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.50.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild -------------------------------------------------------------------------------- ================================================================================ rust-rpki-0.18.6-4.el10_3 (FEDORA-EPEL-2026-700bfa1f73) Library for validating and creating RPKI data -------------------------------------------------------------------------------- Update Information: Rebuild with version 0.10.79 of the openssl crate which includes fixes for the following security issues: CVE-2026-41676 / GHSA-pqf5-4pqq-29f5 CVE-2026-41677 / GHSA-xmgf-hq76-4vx2 CVE-2026-41678 / GHSA-8c75-8mhr-p7r9 CVE-2026-41681 / GHSA-ghm9-cr32-g9qj CVE-2026-41898 / GHSA-hppc-g8h3-xhp3 CVE-2026-42327 / GHSA-xp3w-r5p5-63rr CVE-2026-44662 / GHSA-xv59-967r-8726 -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Fabio Valentini <decathorpe(a)gmail.com> - 0.18.6-4 - Rebuild for rust-openssl CVE-2026-{41676,41677,41678,41681,41898,42327,44662} * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.18.6-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.18.6-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild -------------------------------------------------------------------------------- ================================================================================ rust-sequoia-openpgp-2.3.0-1.el10_3 (FEDORA-EPEL-2026-24edbee165) OpenPGP data types and associated machinery -------------------------------------------------------------------------------- Update Information: Update sequoia-openpgp to version 2.3.0. This includes three security relevant fixes (assigned CVE-2026-42783, CVE-2026-42784, and CVE-not-assigned-yet), see "Notable fixes" in the release notes: https://gitlab.com/sequoia-pgp/sequoia/-/raw/openpgp/v2.3.0/openpgp/NEWS -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Fabio Valentini <decathorpe(a)gmail.com> - 2.3.0-1 - Update to version 2.3.0; Fixes RHBZ#2469048 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2469048 - rust-sequoia-openpgp-2.3.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2469048 -------------------------------------------------------------------------------- ================================================================================ rust-which-8.0.2-1.el10_3 (FEDORA-EPEL-2026-a8920e2291) Rust equivalent of Unix command "which" -------------------------------------------------------------------------------- Update Information: Update to version 8.0.2. -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Fabio Valentini <decathorpe(a)gmail.com> - 8.0.2-1 - Update to version 8.0.2; Fixes RHBZ#2445632 -------------------------------------------------------------------------------- ================================================================================ signify-33-1.el10_3 (FEDORA-EPEL-2026-bdfccc3511) Sign and verify signatures on files -------------------------------------------------------------------------------- Update Information: signify v33 (2026-05-11) Added New Meson-based build system, which also works with Muon. This is considered experimental for now, and therefore the existing GNU Make-based one is still supported. Changed Development has moved to Codeberg, with the old GitHub repository now being a mirror. Try to detect whether the compiler supports the bounded attribute via __has_attribute(), and enable its usage automatically when available. Updated sources from upstream OpenBSD and libbsd 0.12.1. Fixed Fix compilation issues when -Wimplicit-function-declaration is in effect, which is the case with Clang 16 and GCC 13 (or newer). -------------------------------------------------------------------------------- ChangeLog: * Mon May 11 2026 Robert Scheck <robert(a)fedoraproject.org> - 33-1 - Update to release v33 (#2469961) * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 32-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jul 25 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 32-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Sun Jan 19 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 32-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2469961 - signify-33 is available https://bugzilla.redhat.com/show_bug.cgi?id=2469961 --------------------------------------------------------------------------------

1 0

Fedora EPEL 9 updates-testing report
by updates＠fedoraproject.org 10 May '26

10 May '26

The following Fedora EPEL 9 Security updates need testing: Age URL 172 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-9a55de96db xpdf-4.06-1.el9 18 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-e794b68cc6 nuclei-3.8.0-1.el9 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-76e7234279 rust-astral-tokio-tar-0.6.1-1.el9 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-3faabe7ef7 python-click-8.0.3-2.el9 3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-d67d81b1fd GitPython-3.1.50-1.el9 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-0d0ae895c6 apptainer-1.5.0-1.el9 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-03f0bea6c6 coturn-4.11.0-1.el9 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-68c1078728 pgbouncer-1.25.2-1.el9 The following builds have been pushed to Fedora EPEL 9 updates-testing SDL2_image-2.8.12-1.el9 Details about builds: ================================================================================ SDL2_image-2.8.12-1.el9 (FEDORA-EPEL-2026-cafd3c6afd) Image loading library for SDL -------------------------------------------------------------------------------- Update Information: Update to bugfix release 2.8.12. -------------------------------------------------------------------------------- ChangeLog: * Sun May 10 2026 Simone Caronni <negativo17(a)gmail.com> - 2.8.12-1 - Update to 2.8.12 * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.8-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.8-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Wed Jul 23 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.8-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Thu Mar 27 2025 Sérgio Basto <sergio(a)serjux.com> - 2.8.8-1 - Update SDL2_image to 2.8.8 - Resolves: rhbz#2354332 * Mon Mar 3 2025 Sérgio Basto <sergio(a)serjux.com> - 2.8.6-1 - Update SDL2_image to 2.8.6 * Sun Feb 2 2025 Sérgio Basto <sergio(a)serjux.com> - 2.8.4-3 - Rebuild for jpegxl (libjxl) 0.11.1 * Thu Jan 16 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.4-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Wed Jan 1 2025 Sérgio Basto <sergio(a)serjux.com> - 2.8.4-1 - Update SDL2_image to 2.8.4 * Wed Sep 4 2024 Miroslav Suchý <msuchy(a)redhat.com> - 2.8.2-7 - convert license to SPDX * Wed Jul 17 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.2-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2455888 - CVE-2026-35444 SDL2_image: SDL_image: Information disclosure via crafted XCF files [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2455888 [ 2 ] Bug #2455889 - CVE-2026-35444 SDL2_image: SDL_image: Information disclosure via crafted XCF files [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2455889 [ 3 ] Bug #2456290 - SDL2_image-2.8.12 is available https://bugzilla.redhat.com/show_bug.cgi?id=2456290 --------------------------------------------------------------------------------

1 0

Fedora EPEL 8 updates-testing report
by updates＠fedoraproject.org 10 May '26

10 May '26

The following Fedora EPEL 8 Security updates need testing: Age URL 171 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-5b2095e2c2 xpdf-4.06-1.el8 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-3f6bf23440 apptainer-1.5.0-1.el8 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-4394a54d4e valkey-8.0.9-1.el8 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-f90771ac28 coturn-4.11.0-1.el8 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-f027656c88 zabbix6.0-6.0.46-1.el8 The following builds have been pushed to Fedora EPEL 8 updates-testing zabbix7.0-7.0.26-1.el8 Details about builds: ================================================================================ zabbix7.0-7.0.26-1.el8 (FEDORA-EPEL-2026-2231087f23) Open-source monitoring solution for your IT infrastructure -------------------------------------------------------------------------------- Update Information: Update to 7.0.26 -------------------------------------------------------------------------------- ChangeLog: * Thu May 7 2026 Orion Poplawski <orion(a)nwra.com> - 7.0.26-1 - Update to 7.0.26 (CVE-2026-23927, CVE-2026-23928) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2467040 - CVE-2026-23928 zabbix7.0: Zabbix: Cross-Site Scripting (XSS) vulnerability allows unauthorized actions via injected JavaScript in widgets. [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2467040 [ 2 ] Bug #2467047 - CVE-2026-23927 zabbix7.0: Zabbix Agent 2: Oracle database credential disclosure via TNS connection string injection [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2467047 --------------------------------------------------------------------------------

1 0

Fedora EPEL 10.2 updates-testing report
by updates＠fedoraproject.org 10 May '26

10 May '26

The following Fedora EPEL 10.2 Security updates need testing: Age URL 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-f98849630c python-click-8.1.7-7.el10_2 3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-9c33ae0785 GitPython-3.1.50-1.el10_2 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-a534ee8ff4 apptainer-1.5.0-1.el10_2 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-c9267b6791 coturn-4.11.0-1.el10_2 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-7318ce33f7 pgbouncer-1.25.2-1.el10_2 The following builds have been pushed to Fedora EPEL 10.2 updates-testing SDL2_image-2.8.12-1.el10_2 fedora-repoquery-0.8.1-1.el10_2 gn-2395^20260509.78e67afc82fa-1.el10_2 rust-retry-policies-0.5.2-1.el10_2 zabbix7.0-7.0.26-1.el10_2 Details about builds: ================================================================================ SDL2_image-2.8.12-1.el10_2 (FEDORA-EPEL-2026-1a68814ed6) Image loading library for SDL -------------------------------------------------------------------------------- Update Information: Update to bugfix release 2.8.12. -------------------------------------------------------------------------------- ChangeLog: * Sun May 10 2026 Simone Caronni <negativo17(a)gmail.com> - 2.8.12-1 - Update to 2.8.12 * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.8-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.8-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Wed Jul 23 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.8-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Thu Mar 27 2025 Sérgio Basto <sergio(a)serjux.com> - 2.8.8-1 - Update SDL2_image to 2.8.8 - Resolves: rhbz#2354332 * Mon Mar 3 2025 Sérgio Basto <sergio(a)serjux.com> - 2.8.6-1 - Update SDL2_image to 2.8.6 * Sun Feb 2 2025 Sérgio Basto <sergio(a)serjux.com> - 2.8.4-3 - Rebuild for jpegxl (libjxl) 0.11.1 * Thu Jan 16 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.4-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Wed Jan 1 2025 Sérgio Basto <sergio(a)serjux.com> - 2.8.4-1 - Update SDL2_image to 2.8.4 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2455888 - CVE-2026-35444 SDL2_image: SDL_image: Information disclosure via crafted XCF files [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2455888 [ 2 ] Bug #2455889 - CVE-2026-35444 SDL2_image: SDL_image: Information disclosure via crafted XCF files [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2455889 [ 3 ] Bug #2456290 - SDL2_image-2.8.12 is available https://bugzilla.redhat.com/show_bug.cgi?id=2456290 -------------------------------------------------------------------------------- ================================================================================ fedora-repoquery-0.8.1-1.el10_2 (FEDORA-EPEL-2026-db0755cff2) Fedora release repos package query tool -------------------------------------------------------------------------------- Update Information: https://hackage.haskell.org/package/fedora-repoquery-0.8.1/changelog -------------------------------------------------------------------------------- ChangeLog: * Fri Mar 20 2026 Jens Petersen <petersen(a)redhat.com> - 0.8.1-1 - https://hackage.haskell.org/package/fedora-repoquery-0.8.1/changelog * Fri Jan 30 2026 Jens Petersen <petersen(a)redhat.com> - 0.8-3 - Bump release * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.8-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- ================================================================================ gn-2395^20260509.78e67afc82fa-1.el10_2 (FEDORA-EPEL-2026-849f5f6f2a) Meta-build system that generates build files for Ninja -------------------------------------------------------------------------------- Update Information: Update to version 2395 -------------------------------------------------------------------------------- ChangeLog: * Sat May 9 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 2395^20260509.78e67afc82fa-1 - Update to version 2395 -------------------------------------------------------------------------------- ================================================================================ rust-retry-policies-0.5.2-1.el10_2 (FEDORA-EPEL-2026-64e15f80e2) Collection of plug-and-play retry policies for Rust projects -------------------------------------------------------------------------------- Update Information: Update to version 0.5.2; uses rand 0.10. -------------------------------------------------------------------------------- ChangeLog: * Sat May 9 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.5.2-1 - Update to version 0.5.2; Fixes RHBZ#2468479 * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.5.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2468479 - rust-retry-policies-0.5.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2468479 -------------------------------------------------------------------------------- ================================================================================ zabbix7.0-7.0.26-1.el10_2 (FEDORA-EPEL-2026-fd1f02dffc) Open-source monitoring solution for your IT infrastructure -------------------------------------------------------------------------------- Update Information: Update to 7.0.26 -------------------------------------------------------------------------------- ChangeLog: * Sun May 10 2026 Orion Poplawski <orion(a)nwra.com> - 7.0.26-1 - Update to 7.0.26 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2467040 - CVE-2026-23928 zabbix7.0: Zabbix: Cross-Site Scripting (XSS) vulnerability allows unauthorized actions via injected JavaScript in widgets. [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2467040 [ 2 ] Bug #2467047 - CVE-2026-23927 zabbix7.0: Zabbix Agent 2: Oracle database credential disclosure via TNS connection string injection [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2467047 --------------------------------------------------------------------------------

1 0

Fedora EPEL 10.1 updates-testing report
by updates＠fedoraproject.org 10 May '26

10 May '26

The following Fedora EPEL 10.1 Security updates need testing: Age URL 3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-99bca16ce8 GitPython-3.1.50-1.el10_1 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-74045c244b apptainer-1.5.0-1.el10_1 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-8d74a3f689 coturn-4.11.0-1.el10_1 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-b71cd02867 pgbouncer-1.25.2-1.el10_1 The following builds have been pushed to Fedora EPEL 10.1 updates-testing SDL2_image-2.8.12-1.el10_1 gn-2395^20260509.78e67afc82fa-1.el10_1 zabbix7.0-7.0.26-1.el10_1 Details about builds: ================================================================================ SDL2_image-2.8.12-1.el10_1 (FEDORA-EPEL-2026-805a24d208) Image loading library for SDL -------------------------------------------------------------------------------- Update Information: Update to bugfix release 2.8.12. -------------------------------------------------------------------------------- ChangeLog: * Sun May 10 2026 Simone Caronni <negativo17(a)gmail.com> - 2.8.12-1 - Update to 2.8.12 * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.8-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.8-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Wed Jul 23 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.8-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Thu Mar 27 2025 Sérgio Basto <sergio(a)serjux.com> - 2.8.8-1 - Update SDL2_image to 2.8.8 - Resolves: rhbz#2354332 * Mon Mar 3 2025 Sérgio Basto <sergio(a)serjux.com> - 2.8.6-1 - Update SDL2_image to 2.8.6 * Sun Feb 2 2025 Sérgio Basto <sergio(a)serjux.com> - 2.8.4-3 - Rebuild for jpegxl (libjxl) 0.11.1 * Thu Jan 16 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.4-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Wed Jan 1 2025 Sérgio Basto <sergio(a)serjux.com> - 2.8.4-1 - Update SDL2_image to 2.8.4 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2455888 - CVE-2026-35444 SDL2_image: SDL_image: Information disclosure via crafted XCF files [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2455888 [ 2 ] Bug #2455889 - CVE-2026-35444 SDL2_image: SDL_image: Information disclosure via crafted XCF files [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2455889 [ 3 ] Bug #2456290 - SDL2_image-2.8.12 is available https://bugzilla.redhat.com/show_bug.cgi?id=2456290 -------------------------------------------------------------------------------- ================================================================================ gn-2395^20260509.78e67afc82fa-1.el10_1 (FEDORA-EPEL-2026-058061b244) Meta-build system that generates build files for Ninja -------------------------------------------------------------------------------- Update Information: Update to version 2395 -------------------------------------------------------------------------------- ChangeLog: * Sat May 9 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 2395^20260509.78e67afc82fa-1 - Update to version 2395 -------------------------------------------------------------------------------- ================================================================================ zabbix7.0-7.0.26-1.el10_1 (FEDORA-EPEL-2026-7ac763fa4a) Open-source monitoring solution for your IT infrastructure -------------------------------------------------------------------------------- Update Information: Update to 7.0.26 -------------------------------------------------------------------------------- ChangeLog: * Sun May 10 2026 Orion Poplawski <orion(a)nwra.com> - 7.0.26-1 - Update to 7.0.26 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2467040 - CVE-2026-23928 zabbix7.0: Zabbix: Cross-Site Scripting (XSS) vulnerability allows unauthorized actions via injected JavaScript in widgets. [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2467040 [ 2 ] Bug #2467047 - CVE-2026-23927 zabbix7.0: Zabbix Agent 2: Oracle database credential disclosure via TNS connection string injection [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2467047 --------------------------------------------------------------------------------

1 0

Fedora EPEL 10.3 updates-testing report
by updates＠fedoraproject.org 10 May '26

10 May '26

The following Fedora EPEL 10.3 Security updates need testing: Age URL 18 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-a5d0ca57c2 nuclei-3.8.0-1.el10_3 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-66ed147b70 gh-2.92.0-1.el10_3 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-a0e68dfa17 python-click-8.1.7-7.el10_3 3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-ee98895c61 GitPython-3.1.50-1.el10_3 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-2f250c3cfd apptainer-1.5.0-1.el10_3 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1f569c1659 coturn-4.11.0-1.el10_3 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1f33c80992 pgbouncer-1.25.2-1.el10_3 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-bc4da63b7d libgit2_1.9-1.9.3-1.el10_3 nix-2.31.5-1.el10_3 The following builds have been pushed to Fedora EPEL 10.3 updates-testing SDL2_image-2.8.12-1.el10_3 rust-astral-tokio-tar-0.6.1-1.el10_3 rust-retry-policies-0.5.2-1.el10_3 uv-0.11.11-1.el10_3 zabbix7.0-7.0.26-1.el10_3 Details about builds: ================================================================================ SDL2_image-2.8.12-1.el10_3 (FEDORA-EPEL-2026-3e472e2cf8) Image loading library for SDL -------------------------------------------------------------------------------- Update Information: Update to bugfix release 2.8.12. -------------------------------------------------------------------------------- ChangeLog: * Sun May 10 2026 Simone Caronni <negativo17(a)gmail.com> - 2.8.12-1 - Update to 2.8.12 * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.8-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jan 16 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.8-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Wed Jul 23 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.8-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Thu Mar 27 2025 Sérgio Basto <sergio(a)serjux.com> - 2.8.8-1 - Update SDL2_image to 2.8.8 - Resolves: rhbz#2354332 * Mon Mar 3 2025 Sérgio Basto <sergio(a)serjux.com> - 2.8.6-1 - Update SDL2_image to 2.8.6 * Sun Feb 2 2025 Sérgio Basto <sergio(a)serjux.com> - 2.8.4-3 - Rebuild for jpegxl (libjxl) 0.11.1 * Thu Jan 16 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.8.4-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Wed Jan 1 2025 Sérgio Basto <sergio(a)serjux.com> - 2.8.4-1 - Update SDL2_image to 2.8.4 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2455888 - CVE-2026-35444 SDL2_image: SDL_image: Information disclosure via crafted XCF files [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2455888 [ 2 ] Bug #2455889 - CVE-2026-35444 SDL2_image: SDL_image: Information disclosure via crafted XCF files [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2455889 [ 3 ] Bug #2456290 - SDL2_image-2.8.12 is available https://bugzilla.redhat.com/show_bug.cgi?id=2456290 -------------------------------------------------------------------------------- ================================================================================ rust-astral-tokio-tar-0.6.1-1.el10_3 (FEDORA-EPEL-2026-4b95f570ed) Rust implementation of an async TAR file reader and writer -------------------------------------------------------------------------------- Update Information: Update uv to 0.11.11. Update the astral-tokio-tar Rust crate to 0.6.1, fixing security advisories GHSA-xx64-wwv2-hcqq and GHSA-fp55-jw48-c537. -------------------------------------------------------------------------------- ChangeLog: * Tue May 5 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.6.1-1 - Update to version 0.6.1 - Fixes GHSA-fp55-jw48-c537; fixes GHSA-xx64-wwv2-hcqq -------------------------------------------------------------------------------- References: [ 1 ] Bug #2466654 - uv-0.11.9 is available https://bugzilla.redhat.com/show_bug.cgi?id=2466654 -------------------------------------------------------------------------------- ================================================================================ rust-retry-policies-0.5.2-1.el10_3 (FEDORA-EPEL-2026-4795b98173) Collection of plug-and-play retry policies for Rust projects -------------------------------------------------------------------------------- Update Information: Update to version 0.5.2; uses rand 0.10. -------------------------------------------------------------------------------- ChangeLog: * Sat May 9 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.5.2-1 - Update to version 0.5.2; Fixes RHBZ#2468479 * Sat Jan 17 2026 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.5.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2468479 - rust-retry-policies-0.5.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2468479 -------------------------------------------------------------------------------- ================================================================================ uv-0.11.11-1.el10_3 (FEDORA-EPEL-2026-4b95f570ed) An extremely fast Python package installer and resolver, written in Rust -------------------------------------------------------------------------------- Update Information: Update uv to 0.11.11. Update the astral-tokio-tar Rust crate to 0.6.1, fixing security advisories GHSA-xx64-wwv2-hcqq and GHSA-fp55-jw48-c537. -------------------------------------------------------------------------------- ChangeLog: * Fri May 8 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.11.11-1 - Update to 0.11.11 (close RHBZ#2466908) * Wed May 6 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.11.10-1 - Update to 0.11.10 (close RHBZ#2466908) * Tue May 5 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.11.9-1 - Update to 0.11.9 (close RHBZ#2466654) * Thu Apr 16 2026 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.11.7-1 - Update to 0.11.7 (close RHBZ#2458860) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2466654 - uv-0.11.9 is available https://bugzilla.redhat.com/show_bug.cgi?id=2466654 -------------------------------------------------------------------------------- ================================================================================ zabbix7.0-7.0.26-1.el10_3 (FEDORA-EPEL-2026-c40a843b1e) Open-source monitoring solution for your IT infrastructure -------------------------------------------------------------------------------- Update Information: Update to 7.0.26 -------------------------------------------------------------------------------- ChangeLog: * Sun May 10 2026 Orion Poplawski <orion(a)nwra.com> - 7.0.26-1 - Update to 7.0.26 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2467040 - CVE-2026-23928 zabbix7.0: Zabbix: Cross-Site Scripting (XSS) vulnerability allows unauthorized actions via injected JavaScript in widgets. [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2467040 [ 2 ] Bug #2467047 - CVE-2026-23927 zabbix7.0: Zabbix Agent 2: Oracle database credential disclosure via TNS connection string injection [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2467047 --------------------------------------------------------------------------------

1 0

Fwd: Retired my packages on EPEL
by Michael J Gruber 10 May '26

10 May '26

Resending to epel-devel instead, sorry. ---------- Forwarded message --------- From: <epel-announce-owner(a)lists.fedoraproject.org> Date: So., 10. Mai 2026 um 21:29 Uhr Subject: Retired my packages on EPEL To: <mjg(a)fedoraproject.org> Your message to the epel-announce mailing-list was rejected for the following reasons: The message is not from a list member The original message as received by Mailman is attached. ---------- Forwarded message ---------- From: Michael J Gruber <mjg(a)fedoraproject.org> To: epel-announce(a)lists.fedoraproject.org Cc: Bcc: Date: Sun, 10 May 2026 21:29:33 +0200 Subject: Retired my packages on EPEL Hi there, as announced on EPEL-devel 2 weeks ago, I have now retired my packages on EPEL, unless there were other maintainers: BibTool impressive mupdf notmuch python-pytzdata sfsexp All packages are in good shape. Indeed, between my announcement back then and retirement, I've fixed an FTBFS bug for mupdf due to a recent llvm update. All retirements were done on the leading branch (e.g. "epel10", but not "epel10.x" for x in 0 1 2). Let's hope this is correct. Michael

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

epel-devel May 2026