[test-reports] Fedora 39 updates-testing report

The following Fedora 39 Security updates need testing:
 Age  URL
   4  https://bodhi.fedoraproject.org/updates/FEDORA-2023-9a74d212f8  
slurm-22.05.11-2.fc39


The following Fedora 39 Critical Path updates have yet to be approved:
 Age URL
  63  https://bodhi.fedoraproject.org/updates/FEDORA-2023-60969403d0  
go-rpm-macros-3.3.0-1.fc39 go2rpm-1.10.0-1.fc39
  28  https://bodhi.fedoraproject.org/updates/FEDORA-2023-0a947db1d0  
mock-core-configs-39.3-1.fc39
  21  https://bodhi.fedoraproject.org/updates/FEDORA-2023-8fd0890f05   dnf5-5.1.9-1.fc39
  19  https://bodhi.fedoraproject.org/updates/FEDORA-2023-68ad6ada3b  
podman-4.8.2-1.fc39
  11  https://bodhi.fedoraproject.org/updates/FEDORA-2023-ae7f558922  
guestfs-tools-1.51.7-1.fc39
  11  https://bodhi.fedoraproject.org/updates/FEDORA-2023-db59cf7cee  
libphonenumber-8.13.27-1.fc39
  11  https://bodhi.fedoraproject.org/updates/FEDORA-2023-2cfc4d36f1  
libguestfs-1.51.10-1.fc39
   9  https://bodhi.fedoraproject.org/updates/FEDORA-2023-212cdaad25   brltty-6.6-9.fc39
   9  https://bodhi.fedoraproject.org/updates/FEDORA-2023-c12a2a84a4  
toolbox-0.0.99.5-1.fc39
   8  https://bodhi.fedoraproject.org/updates/FEDORA-2023-1874834244  
dhcpcd-10.0.6-1.fc39
   7  https://bodhi.fedoraproject.org/updates/FEDORA-2023-33bc615d45  
edk2-20231122-14.fc39
   2  https://bodhi.fedoraproject.org/updates/FEDORA-2023-3bd19e87a3   llvm-17.0.6-2.fc39
   1  https://bodhi.fedoraproject.org/updates/FEDORA-2023-f13cd1514c  
python-rpds-py-0.16.2-1.fc39
   1  https://bodhi.fedoraproject.org/updates/FEDORA-2023-e6d91821ae  
libqalculate-4.9.0-1.fc39 qalculate-gtk-4.9.0-1.fc39 qalculate-qt-4.9.0-1.fc39
   1  https://bodhi.fedoraproject.org/updates/FEDORA-2023-3108bed60d  
xfce4-settings-4.18.4-1.fc39
   1  https://bodhi.fedoraproject.org/updates/FEDORA-2023-7dc41db148   aom-3.8.0-1.fc39
   1  https://bodhi.fedoraproject.org/updates/FEDORA-2023-e95ec9541e  
distribution-gpg-keys-1.99-1.fc39


The following builds have been pushed to Fedora 39 updates-testing

    ibus-typing-booster-2.24.10-1.fc39
    perl-Spreadsheet-ParseExcel-0.6600-1.fc39
    python-aiohttp-3.9.1-1.fc39
    python-datalad-0.19.5-1.fc39
    python-gbulb-0.6.4-1.fc39
    python-pygls-1.2.1-1.fc39
    python-pysqueezebox-0.5.5-11.fc39
    python-qudida-0.0.4-1.fc39
    python-wled-0.4.4-11.fc39
    simpleini-4.22-1.fc39
    timew-1.7.0-1.fc39
    wl-mirror-0.15.0-1.fc39
    xarchiver-0.5.4.22-1.fc39

Details about builds:


================================================================================
 ibus-typing-booster-2.24.10-1.fc39 (FEDORA-2023-0450d1b7e5)
 A completion input method
--------------------------------------------------------------------------------
Update Information:

Update to 2.24.10 Update the preedit to empty right after deleting surrounding
text when reopening a preedit (Resolves: https://github.com/mike-fabian/ibus-
typing-booster/issues/474) Improve do_reset() (Resolves:
https://github.com/mike-fabian/ibus-typing-booster/issues/473) (Resolves:
https://github.com/mike-fabian/ibus-typing-booster/issues/474) Fix
_record_in_database_and_push_context() Avoid updating the preedit to empty or
hiding it if the preedit is already hidden or empty Do not pass through a key
release event if the corresponding key press event was handled Remove two
probably redundant calls to get_surrounding_text() Hide and clear lookup table
and aux in _update_ui_empty_input_try_completion() if no candidates are found
Make self._ibus_event_sleep_seconds settable via gsettings Avoid more duplicate
calls of _update_preedit() (Resolves: https://github.com/mike-fabian/ibus-
typing-booster/issues/473) (Resolves: https://github.com/mike-fabian/ibus-
typing-booster/issues/474) Fix disappearing first characters or words in the web
clients of WhatsApp and Telegram used in Firefox (Resolves:
https://github.com/mike-fabian/ibus-typing-booster/issues/473) Update emoji
annotations from CLDR
--------------------------------------------------------------------------------
ChangeLog:

* Fri Dec 29 2023 Mike FABIAN <mfabian(a)redhat.com&gt; - 2.24.10-1
- Update to 2.24.10
- Update the preedit to empty right after deleting surrounding text when reopening a
preedit
  (Resolves: https://github.com/mike-fabian/ibus-typing-booster/issues/474)
- Improve do_reset()
  (Resolves: https://github.com/mike-fabian/ibus-typing-booster/issues/473)
  (Resolves: https://github.com/mike-fabian/ibus-typing-booster/issues/474)
- Fix _record_in_database_and_push_context()
- Avoid updating the preedit to empty or  hiding it if the preedit is already hidden or
empty
- Do not pass through a key release event if the corresponding key press event was
handled
- Remove two probably redundant calls to get_surrounding_text()
- Hide and clear lookup table and aux in _update_ui_empty_input_try_completion() if no
candidates are found
- Make self._ibus_event_sleep_seconds settable via gsettings
- Avoid more duplicate calls of _update_preedit()
  (Resolves: https://github.com/mike-fabian/ibus-typing-booster/issues/473)
  (Resolves: https://github.com/mike-fabian/ibus-typing-booster/issues/474)
- Fix disappearing first characters or words in the web clients of WhatsApp and Telegram
used in Firefox
  (Resolves: https://github.com/mike-fabian/ibus-typing-booster/issues/473)
- Update emoji annotations from CLDR
--------------------------------------------------------------------------------


================================================================================
 perl-Spreadsheet-ParseExcel-0.6600-1.fc39 (FEDORA-2023-921f6975c2)
 Extract information from an Excel file
--------------------------------------------------------------------------------
Update Information:

Fix for CVE-2023-7101 (unvalidated input can lead to arbitrary code execution
vulnerability).
--------------------------------------------------------------------------------
ChangeLog:

* Sat Dec 30 2023 Paul Howarth <paul(a)city-fan.org&gt; - 0.6600-1
- Update to 0.66
  - Fix for CVE-2023-7101 (unvalidated input can lead to arbitrary code
    execution vulnerability)
    https://github.com/runrig/spreadsheet-parseexcel/issues/33
- Use author-independent source URL
- Use SPDX-format license tag
- No longer need to fix document file permissions
- Fix permissions verbosely
- Don't assume "pm" suffix on manpage files
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #2255871 - CVE-2023-7101 perl-Spreadsheet-ParseExcel: unvalidated input can
lead to arbitrary code execution vulnerability
        https://bugzilla.redhat.com/show_bug.cgi?id=2255871
--------------------------------------------------------------------------------


================================================================================
 python-aiohttp-3.9.1-1.fc39 (FEDORA-2023-a04cc349e1)
 Python HTTP client/server for asyncio
--------------------------------------------------------------------------------
Update Information:

Security fix for CVE-2023-49081, CVE-2023-49082.  Update `python-aiohttp` to
3.9.1.  Patch `python-pysqeezebox` and `python-wled` so they do not have an
implicit dependency on `python-async-timeout` via `python-aiohttp`.
https://github.com/aio-libs/aiohttp/releases/tag/v3.9.0  https://github.com/aio-
libs/aiohttp/releases/tag/v3.9.1
--------------------------------------------------------------------------------
ChangeLog:

* Thu Nov 30 2023 Benjamin A. Beasley <code(a)musicinmybrain.net&gt; - 3.9.1-1
- Update to 3.9.1 (fix RHBZ#2252236, fix RHBZ#2252249)
- Fixes CVE-2023-49081 and CVE-2023-49082
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #2252236 - TRIAGE CVE-2023-49081 python-aiohttp: aiohttp: HTTP request
modification [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=2252236
  [ 2 ] Bug #2252249 - TRIAGE CVE-2023-49082 python-aiohttp: aiohttp: CRLF injection if
user controls the HTTP method using aiohttp client [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=2252249
  [ 3 ] Bug #2253439 - python-pysqueezebox: Please merge rawhide back to f39 and f38
        https://bugzilla.redhat.com/show_bug.cgi?id=2253439
  [ 4 ] Bug #2253440 - python-wled: Please merge rawhide back to f39 and f38
        https://bugzilla.redhat.com/show_bug.cgi?id=2253440
  [ 5 ] Bug #2254945 - deprecation warning: DeprecationWarning: datetime.datetime.utcnow()
is deprecated and scheduled for removal
        https://bugzilla.redhat.com/show_bug.cgi?id=2254945
--------------------------------------------------------------------------------


================================================================================
 python-datalad-0.19.5-1.fc39 (FEDORA-2023-85da80bf09)
 Keep code, data, containers under control with git and git-annex
--------------------------------------------------------------------------------
Update Information:

Update to 0.19.5: https://github.com/datalad/datalad/releases/tag/0.19.5
--------------------------------------------------------------------------------
ChangeLog:

* Thu Dec 28 2023 Packit <hello(a)packit.dev&gt; - 0.19.5-1
- [packit] 0.19.5 upstream release
- Resolves rhbz#2256119
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #2256119 - python-datalad-0.19.5 is available
        https://bugzilla.redhat.com/show_bug.cgi?id=2256119
--------------------------------------------------------------------------------


================================================================================
 python-gbulb-0.6.4-1.fc39 (FEDORA-2023-4f46460444)
 GLib event loop for tulip (PEP 3156)
--------------------------------------------------------------------------------
Update Information:

Initial import; Fixes: RHBZ#2195957
--------------------------------------------------------------------------------
ChangeLog:

* Sat Dec 30 2023 Davide Cavalca <dcavalca(a)fedoraproject.org&gt; - 0.6.4-1
- Initial import; Fixes: RHBZ#2195957
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #2195957 - Review Request: python-gbulb - GLib event loop for tulip (PEP
3156)
        https://bugzilla.redhat.com/show_bug.cgi?id=2195957
--------------------------------------------------------------------------------


================================================================================
 python-pygls-1.2.1-1.fc39 (FEDORA-2023-068a471c93)
 A pythonic generic language server
--------------------------------------------------------------------------------
Update Information:

update
--------------------------------------------------------------------------------
ChangeLog:

* Sat Dec 30 2023 topazus <topazus(a)outlook.com&gt; - 1.2.1-1
- initial import; rhbz#2256187
--------------------------------------------------------------------------------


================================================================================
 python-pysqueezebox-0.5.5-11.fc39 (FEDORA-2023-a04cc349e1)
 Python library to control Logitech Media Server
--------------------------------------------------------------------------------
Update Information:

Security fix for CVE-2023-49081, CVE-2023-49082.  Update `python-aiohttp` to
3.9.1.  Patch `python-pysqeezebox` and `python-wled` so they do not have an
implicit dependency on `python-async-timeout` via `python-aiohttp`.
https://github.com/aio-libs/aiohttp/releases/tag/v3.9.0  https://github.com/aio-
libs/aiohttp/releases/tag/v3.9.1
--------------------------------------------------------------------------------
ChangeLog:

* Sat Dec  2 2023 Benjamin A. Beasley <code(a)musicinmybrain.net&gt; - 0.5.5-11
- Add explicit async-timeout dependency
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #2252236 - TRIAGE CVE-2023-49081 python-aiohttp: aiohttp: HTTP request
modification [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=2252236
  [ 2 ] Bug #2252249 - TRIAGE CVE-2023-49082 python-aiohttp: aiohttp: CRLF injection if
user controls the HTTP method using aiohttp client [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=2252249
  [ 3 ] Bug #2253439 - python-pysqueezebox: Please merge rawhide back to f39 and f38
        https://bugzilla.redhat.com/show_bug.cgi?id=2253439
  [ 4 ] Bug #2253440 - python-wled: Please merge rawhide back to f39 and f38
        https://bugzilla.redhat.com/show_bug.cgi?id=2253440
  [ 5 ] Bug #2254945 - deprecation warning: DeprecationWarning: datetime.datetime.utcnow()
is deprecated and scheduled for removal
        https://bugzilla.redhat.com/show_bug.cgi?id=2254945
--------------------------------------------------------------------------------


================================================================================
 python-qudida-0.0.4-1.fc39 (FEDORA-2023-8bf20ff3be)
 QuDiDA (QUick and DIrty Domain Adaptation)
--------------------------------------------------------------------------------
Update Information:

``` * Sat Dec 30 2023 Onuralp Sezer <thunderbirdtr(a)fedoraproject.org&gt; - 0.0.4-1
- initial package ```
--------------------------------------------------------------------------------
ChangeLog:

* Sat Dec 30 2023 Onuralp Sezer <thunderbirdtr(a)fedoraproject.org&gt; - 0.0.4-1
- initial package
--------------------------------------------------------------------------------


================================================================================
 python-wled-0.4.4-11.fc39 (FEDORA-2023-a04cc349e1)
 Python client for WLED
--------------------------------------------------------------------------------
Update Information:

Security fix for CVE-2023-49081, CVE-2023-49082.  Update `python-aiohttp` to
3.9.1.  Patch `python-pysqeezebox` and `python-wled` so they do not have an
implicit dependency on `python-async-timeout` via `python-aiohttp`.
https://github.com/aio-libs/aiohttp/releases/tag/v3.9.0  https://github.com/aio-
libs/aiohttp/releases/tag/v3.9.1
--------------------------------------------------------------------------------
ChangeLog:

* Sat Dec  2 2023 Benjamin A. Beasley <code(a)musicinmybrain.net&gt; - 0.4.4-11
- Backport ���Replace async_timeout with asyncio.timeout���, PR#1163
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #2252236 - TRIAGE CVE-2023-49081 python-aiohttp: aiohttp: HTTP request
modification [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=2252236
  [ 2 ] Bug #2252249 - TRIAGE CVE-2023-49082 python-aiohttp: aiohttp: CRLF injection if
user controls the HTTP method using aiohttp client [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=2252249
  [ 3 ] Bug #2253439 - python-pysqueezebox: Please merge rawhide back to f39 and f38
        https://bugzilla.redhat.com/show_bug.cgi?id=2253439
  [ 4 ] Bug #2253440 - python-wled: Please merge rawhide back to f39 and f38
        https://bugzilla.redhat.com/show_bug.cgi?id=2253440
  [ 5 ] Bug #2254945 - deprecation warning: DeprecationWarning: datetime.datetime.utcnow()
is deprecated and scheduled for removal
        https://bugzilla.redhat.com/show_bug.cgi?id=2254945
--------------------------------------------------------------------------------


================================================================================
 simpleini-4.22-1.fc39 (FEDORA-2023-017da9b302)
 Cross-platform C++ library to read and write INI-style configuration files
--------------------------------------------------------------------------------
Update Information:

update
--------------------------------------------------------------------------------
ChangeLog:

* Sat Dec 30 2023 topazus <topazus(a)outlook.com&gt; - 4.22-1
- initial import; rhbz#2256266
--------------------------------------------------------------------------------


================================================================================
 timew-1.7.0-1.fc39 (FEDORA-2023-db76db05ff)
 Timewarrior tracks and reports time
--------------------------------------------------------------------------------
Update Information:

Update to 1.7.0:
https://github.com/GothenburgBitFactory/timewarrior/blob/v1.7.0/ChangeLog
--------------------------------------------------------------------------------
ChangeLog:

* Sun Dec 24 2023 Packit <hello(a)packit.dev&gt; - 1.7.0-1
- [packit] 1.7.0 upstream release
- Resolves rhbz#2255777
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #2255777 - timew-1.7.0 is available
        https://bugzilla.redhat.com/show_bug.cgi?id=2255777
--------------------------------------------------------------------------------


================================================================================
 wl-mirror-0.15.0-1.fc39 (FEDORA-2023-dd3b5342c8)
 Simple Wayland output mirror client
--------------------------------------------------------------------------------
Update Information:

Update to 0.15.0
--------------------------------------------------------------------------------
ChangeLog:

* Sat Dec 30 2023 Aleksei Bavshin <alebastr(a)fedoraproject.org&gt; - 0.15.0-1
- Update to 0.15.0
--------------------------------------------------------------------------------


================================================================================
 xarchiver-0.5.4.22-1.fc39 (FEDORA-2023-7581a3540a)
 Archive manager for Xfce
--------------------------------------------------------------------------------
Update Information:

- update fixing some bugs including a security relevant bug
--------------------------------------------------------------------------------
ChangeLog:

* Sat Dec 30 2023 Fedora Release Monitoring <release-monitoring(a)fedoraproject.org&gt; -
0.5.4.22-1
- Update to 0.5.4.22 (rhbz#2256261)
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #2256261 - xarchiver-0.5.4.22 is available
        https://bugzilla.redhat.com/show_bug.cgi?id=2256261
--------------------------------------------------------------------------------