Aggregator

FEDORA-2026-695d1995f3 Packages in this update:

• rust-pore-0.1.17-15.fc43

Update description:

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

This provides added protection against trusting compromised certificates.

FEDORA-2026-12c8566832 Packages in this update:

• rust-rbw-1.13.2-8.fc45

Update description:

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

This provides added protection against trusting compromised certificates.

FEDORA-2026-1958bf759f Packages in this update:

• rust-sequoia-sq-1.5.0-2.fc45

Update description:

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

This provides added protection against trusting compromised certificates.

FEDORA-2026-ac6450bb30 Packages in this update:

• nodejs22-22.23.4-4.fc45

Update description:

Security release. Update to 22.23.4

Changelog * Thu Oct 15 2026 Andrei Radchenko <aradchen@redhat.com> - 1:22.23.3-2 - Update internal brace-expansion package to 2.1.6

• Closing previously addressed bugs

FEDORA-2026-0f070b8878 Packages in this update:

• nodejs22-22.23.4-4.fc44

Update description:

Security release. Update to 22.23.4

Changelog * Thu Oct 15 2026 Andrei Radchenko <aradchen@redhat.com> - 1:22.23.3-2 - Update internal brace-expansion package to 2.1.6

• Closing previously addressed bugs

FEDORA-2026-743263799b Packages in this update:

• nodejs26-26.12.1-2.fc45

Update description:

Security release. Update to 26.12.1

FEDORA-2026-5c08945adb Packages in this update:

• nodejs24-24.22.1-3.fc44

Update description:

Rebase to 24.22.1 with additional downstream patches

Rebase to Node.js 24.21.0, pulling in the upstream security releases and refreshed bundled dependencies: undici 7.29.1, nghttp2 1.70.0, npm 11.19.0, tar 7.5.19, pacote 21.5.1, brace-expansion 5.0.7.

FEDORA-2026-d6c2df6970 Packages in this update:

• nodejs24-24.22.1-3.fc45

Update description:

Rebase to 24.22.1 with additional downstream patches

Rebase to Node.js 24.21.0, pulling in the upstream security releases and refreshed bundled dependencies: undici 7.29.1, nghttp2 1.70.0, npm 11.19.0, tar 7.5.19, pacote 21.5.1, brace-expansion 5.0.7.

FEDORA-2026-2ce86ea8f8 Packages in this update:

• rust-siguldry-fedora-autopen-0.2.2-4.fc45

Update description:

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

This provides added protection against trusting compromised certificates.

FEDORA-2026-d39bedb422 Packages in this update:

• gpsd-3.27.5-8.fc45

Update description:

Security fix for CVE-2026-60122

FEDORA-2026-85f1c692b7 Packages in this update:

• gpsd-3.27.5-8.fc44

Update description:

Security fix for CVE-2026-60122

FEDORA-2026-81337e9cbe Packages in this update:

• kernel-7.2.15-100.fc43

Update description:

The 7.2.15 stable kernel update contains a number of important fixes across the tree.

FEDORA-2026-7a0f444c64 Packages in this update:

• kernel-7.2.15-300.fc45

Update description:

The 7.2.15 stable kernel update contains a number of important fixes across the tree.

FEDORA-2026-778424cb43 Packages in this update:

• kernel-7.2.15-200.fc44

Update description:

The 7.2.15 stable kernel update contains a number of important fixes across the tree.

FEDORA-EPEL-2026-4194d9df6f Packages in this update:

• libopenmpt-0.8.10-1.el10_2

Update description: libopenmpt 0.8.10 (2026-10-31)

• [Sec] SymMOD: Potential divison by 0 when trying to decode an embedded IMA ADPCM WAV sample claiming to contain 0 audio channels (r25831).
• [Bug] SymMOD: It was possible that a fact chunk of an embedded WAV file claimed an impossibly big sample length for an IMA ADPCM sample, causing unnecessarily large memory allocations.
• Volume column portamento effect memory was not updated properly during seeking, causing notes to continue playing at the wrong pitch.

libopenmpt 0.8.9 (2026-08-19)

• [Sec] Possible heap out-of-bounds write when loading SymMOD files containing WAV IMA ADPCM samples (r25623, r25645). See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx
• [Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25609, r25615).

libopenmpt 0.8.8 (2026-08-15)

• IT: Due to an Impulse Tracker bug in Compatible Gxx mode, Envelope Carry may not resume the envelope from the correct position when there is both an instrument number and tone portamento next to a note.
• XM: NitroTracker ignores instrument numbers where there is no note next to them, so they are no longer imported. Fixes various NitroTracker-made XMs such as notominous-a19.xm.
• STK: Loosen heuristics a bit to allow STK.CRB-GreatMuzaxs6 to load.

• GT2: Loading file versions 6 and later was broken since libopenmpt 0.8.0.

• mpg123: Update to v1.33.7 (2026-08-03).

• miniz: Update to v3.1.2 (2026-07-01).
• pugixml: Update to v1.16 (2026-06-16).

FEDORA-EPEL-2026-3423413067 Packages in this update:

• libopenmpt-0.8.10-1.el8

Update description: libopenmpt 0.8.10 (2026-10-31)

• [Sec] SymMOD: Potential divison by 0 when trying to decode an embedded IMA ADPCM WAV sample claiming to contain 0 audio channels (r25831).
• [Bug] SymMOD: It was possible that a fact chunk of an embedded WAV file claimed an impossibly big sample length for an IMA ADPCM sample, causing unnecessarily large memory allocations.
• Volume column portamento effect memory was not updated properly during seeking, causing notes to continue playing at the wrong pitch.

libopenmpt 0.8.9 (2026-08-19)

• [Sec] Possible heap out-of-bounds write when loading SymMOD files containing WAV IMA ADPCM samples (r25623, r25645). See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx
• [Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25609, r25615).

libopenmpt 0.8.8 (2026-08-15)

• IT: Due to an Impulse Tracker bug in Compatible Gxx mode, Envelope Carry may not resume the envelope from the correct position when there is both an instrument number and tone portamento next to a note.
• XM: NitroTracker ignores instrument numbers where there is no note next to them, so they are no longer imported. Fixes various NitroTracker-made XMs such as notominous-a19.xm.
• STK: Loosen heuristics a bit to allow STK.CRB-GreatMuzaxs6 to load.

• GT2: Loading file versions 6 and later was broken since libopenmpt 0.8.0.

• mpg123: Update to v1.33.7 (2026-08-03).

• miniz: Update to v3.1.2 (2026-07-01).
• pugixml: Update to v1.16 (2026-06-16).