FEDORA-2026-91259c13b9
Packages in this update:
- 0ad-0.28.0-7.fc45
- abiword-3.0.8-6.fc45
- adobe-afdko-4.0.3-5.fc45
- akonadi-server-26.08.1-2.fc45
- anaconda-45.27-2.fc45
- anjuta-3.34.0-32.fc45
- appstream-1.1.3-4.fc45
- appstream-generator-0.10.1-5.fc45
- aqbanking-6.9.2-2.fc45
- aqualung-2.0-13.fc45
- ardour6-6.9.0-35.fc45
- ardour7-7.5.0-26.fc45
- ardour8-8.12.0-14.fc45
- ardour9-9.8.0-2.fc45
- aria2-1.37.0-12.fc45
- armacycles-ad-0.2.9.3.0-2.20260806gitv0.2.9.3.0.fc45
- artikulate-26.08.1-2.fc45
- asterisk-23.5.0-5.fc45.1
- atomes-1.3.1-5.fc45
- atril-1.28.7-2.fc45
- audacious-plugins-4.6.1-7.fc45
- augeas-1.14.2-0.13.20260408gitada6219.fc45
- autofs-5.1.9-15.fc45
- autogen-5.18.16-37.fc45
- bijiben-40.2-11.fc45
- bind-9.18.50-35.fc45
- bind9-next-9.21.22-5.fc45
- blackbox-terminal-0.15.2-3.fc45
- bluefish-2.4.2-3.fc45
- bodr-10-30.fc45
- bookworm-1.1.3-0.21.20200414git.c7c3643.fc45
- booth-1.2-10.fc45
- brasero-3.12.3-30.fc45
- budgie-control-center-2.1.3-2.fc45
- cairo-dock-3.6.2-5.fc45
- cairo-dock-plug-ins-3.6.2-9.fc45
- caja-1.28.0-13.fc45
- caja-actions-1.28.0-11.fc45
- caja-extensions-1.28.0-13.fc45
- cantor-26.08.1-2.fc45
- caribou-0.4.21-54.fc45
- castget-2.0.1-27.fc45
- certmonger-0.79.21-10.fc45
- cgreen-1.7.0-4.fc45
- chatty-0.8.9-11.fc45
- chemical-mime-data-0.1.94-44.fc45
- cinnamon-6.7.8^unstable-2.fc45
- clamav-1.4.6-2.fc45
- clang18-18.1.8-11.fc45
- collada-dom-2.5.0-47.fc45
- collectd-5.12.0-71.fc45
- compiz-0.8.18-22.fc45
- compizconfig-python-0.8.18-24.fc45
- compiz-plugins-experimental-0.8.18-18.fc45
- compiz-plugins-extra-0.8.18-18.fc45
- compiz-plugins-main-0.8.18-18.fc45
- conky-1.24.2-3.fc45
- cptutils-1.82-8.fc45
- createrepo_c-1.2.1-11.fc45
- ctags-6.2.1-5.fc45
- cyrus-imapd-3.12.4-2.fc45
- darktable-5.6.1-3.fc45
- davix-0.8.10-11.fc45
- dcmtk-3.6.9-9.fc45
- ddccontrol-3.3.0-2.fc45
- denemo-2.6.0-22.fc45
- dia-0.97.3-34.fc45
- dicomanonymizer-1-0.22.20210920gitf076264.fc45
- diffmark-0.10-40.fc45
- digikam-9.1.0-5.fc45
- dleyna-0.8.3-11.fc45
- dnf5-5.4.5.0-2.fc45
- docbook5-schemas-5.1-19.fc45
- docbook5-style-xsl-1.79.2-28.fc45
- docbook-dtds-1.0-93.fc45
- docbook-simple-1.1-39.fc45
- docbook-slides-3.4.0-40.fc45
- docbook-style-xsl-1.79.2-29.fc45
- dumpet-2.1-36.fc45
- dvdauthor-0.7.2-31.fc45
- ebook-tools-0.2.2-33.fc45
- emacs-31.1-5.fc45
- envytools-0.0-0.36.git20200810.fc45
- eom-1.28.1-4.fc45
- epiphany-51.0-2.fc45
- erlang-cowboy-2.18.0-2.fc45
- erofs-utils-1.9.4-2.fc45
- evince-48.1-11.fc45
- evolution-3.62.0-2.fc45
- evolution-data-server-3.62.0-2.fc45
- evolution-ews-3.62.0-2.fc45
- evolution-rspam-0.6.0-67.fc45
- ezstream-1.0.2-17.fc45
- fcitx-4.2.9.9-15.fc45
- fence-agents-4.17.0-4.fc45
- ffmpeg-9.0.2-2.fc45
- flam3-3.1.1-13.fc45
- flatpak-1.19.0^really1.18.2-3.fc45
- flatpak-builder-1.4.12-2.fc45
- flickcurl-1.26-33.fc45
- florence-0.6.3-31.fc45
- folks-0.15.12-11.fc45
- fontconfig-2.18.3-2.fc45
- fontforge-20251009-6.fc45
- foomatic-4.0.13-38.fc45
- foundry-1.2.0-2.fc45
- freewrl-6.7-5.20240420gitb3254b1.fc45
- frogr-1.7-11.fc45
- fuse-emulator-1.6.0-16.fc45
- gambas3-3.22.1-2.fc45
- GAPDoc-1.6.10-4.fc45
- gcc-16.2.1-2.fc45.1
- GConf2-3.2.6-51.fc45
- gdal-3.13.3-2.fc45
- gdcm-3.0.24-24.fc45
- gdigi-0.4.0-20140233gitcada964d.fc45
- geany-plugins-2.1-6.fc45
- geary-46.0-22.fc45
- gettext-1.0-4.fc45
- gimp-3.2.6-2.fc45
- gitg-50-5.fc45
- glabels-3.4.1-35.fc45
- glade-3.40.0-18.fc45
- glusterfs-11.2-12.fc45
- gnome-applets-3.58.0-4.fc45
- gnome-app-list-2026.08-2.fc45
- gnome-boxes-50.0-8.fc45
- gnome-builder-50.0-5.fc45
- gnome-calculator-51.0-2.fc45
- gnome-chemistry-utils-0.14.17-57.fc45
- gnome-connections-51.0-2.fc45
- gnome-control-center-51.0-2.fc45
- gnome-doc-utils-0.20.10-48.fc45
- gnome-epub-thumbnailer-1.8-6.fc45
- gnome-maps-51.1-2.fc45
- gnome-online-accounts-3.58.1-4.fc45
- gnome-panel-3.58.1-7.fc45
- gnome-radio-83.0.2-2.fc45
- gnome-vfs2-2.24.4-53.fc45
- gnote-51~beta-2.fc45
- gnucash-5.16-2.fc45
- gnucobol-3.2-12.fc45
- gnumeric-1.12.59-8.fc45
- gnustep-base-1.31.0-11.fc45
- goffice-0.10.57-6.fc45
- gpac-26.07.0-5.fc45
- gpscorrelate-2.1-8.fc45
- gpx-viewer-0.4.0-35.fc45
- gq-1.3.4-59.fc45
- GraphicsMagick-1.3.45-11.fc45
- gretl-2026b-2.fc45
- gridsite-3.0.0-0.40.20260121git7a7b764.fc45
- grilo-plugins-0.3.18-14.fc45
- grisbi-2.0.5-12.fc45
- gsequencer-8.4.2-2.fc45
- gssntlmssp-1.3.2-2.fc45
- gssproxy-0.9.2-13.fc45
- gst-editing-services-1.28.7-2.fc45
- gstreamer1-plugins-bad-free-1.28.7-2.fc45
- gstreamer1-plugins-good-1.28.7-2.fc45
- gtkpod-2.1.5-36.fc45
- gtk-sharp2-2.12.45-28.fc45
- gtksourceview2-2.11.2-48.fc45
- gtksourceview3-3.24.11-19.fc45
- gtksourceview4-4.8.4-13.fc45
- gtksourceview5-5.21.0-3.fc45
- gtranslator-50.0-7.fc45
- guestfs-tools-1.57.3-2.fc45
- gupnp-1.6.10-4.fc45
- gupnp-av-0.14.5-4.fc45
- gupnp-dlna-0.12.0-22.fc45
- gupnp-tools-0.12.4-3.fc45
- gvfs-1.62.0-2.fc45
- happy-2.1.7-3.fc45
- hidrd-0.2.0-29.20180117git7e94881a.fc45
- hitori-44.0-10.fc45
- hivex-1.3.24-22.fc45
- httpd-2.4.68-7.fc45
- hwloc-2.14.0-3.fc45
- icecast-2.4.4-29.fc45
- igraph-1.0.1-4.fc45
- ImageMagick-7.1.2.31-2.fc45
- inkscape-1.4.4-5.fc45
- input-pad-1.1.0-7.fc45
- intel-lpmd-0.1.0^git20260608.40d18a6-2.fc45
- Io-language-20170906-30.fc45
- jgmenu-4.6.0-2.fc45
- kanatest-0.4.10-0.1.D20170810git19dd1a7d.fc45.21
- kdelibs3-3.5.10-138.fc45
- kdelibs-4.14.38-56.fc45
- kf5-akonadi-server-23.08.5-15.fc45
- kf6-kdoctools-6.30.0-2.fc45
- kf6-kio-6.30.0-2.fc45
- khelpcenter-26.08.1-2.fc45
- kitinerary-26.08.1-2.fc45
- ktouch-26.08.1-2.fc45
- labwc-0.20.2-2.fc45
- labwc-tweaks-0.1.0-3.fc45
- lasem-0.6.0-6.fc45
- lash-0.5.4-60.fc45
- lasso-2.9.0-11.fc45
- lastpass-cli-1.6.1-7.fc45
- libabigail-2.10-4.fc45
- libabw-0.1.4-2.fc45
- libaccounts-glib-1.25-28.fc45
- libarchive-3.8.9-2.fc45
- libavif-1.3.0-7.fc45
- libbluray-1.4.0-5.fc45
- libbonobo-2.32.1-36.fc45
- libbonoboui-2.24.5-35.fc45
- libcmis-0.6.3-2.fc45
- libcmpiutil-0.5.7-31.fc45
- libcompizconfig-0.8.18-22.fc45
- libcomps-0.1.24-5.fc45
- libdap-3.21.1-5.fc45
- libdatovka-0.7.4-2.fc45
- libeasyfc-0.14.1-9.fc45
- libe-book-0.1.4-2.fc45
- libecoli-0.11.7-3.fc45
- libei-1.6.0-3.fc45
- libetonyek-0.1.13-4.fc45
- libgda5-5.2.10-30.fc45
- libgda-6.0.0-28.fc45
- libgdamm-4.99.11-26.fc45
- libgdl-3.40.0-16.fc45
- libgedit-gtksourceview-299.7.0-3.fc45
- libgepub-0.7.3-14.fc45
- libglade2-2.6.4-39.fc45
- libgnomecanvas-2.30.3-35.fc45
- libgnt-2.14.3-4.fc45
- libgphoto2-2.5.33-4.fc45
- libgpod-0.8.3-59.fc45
- libgrss-0.7.0-26.fc45
- libgsf-1.14.59-2.fc45
- libguestfs-1.61.3-3.fc45
- libgweather-4.6.0-6.fc45
- libideviceactivation-1.1.1^20250907git9ca1851-3.fc45
- libiio-0.26-12.fc45
- libisds-0.11.2-17.fc45
- liblangtag-0.6.8-2.fc45
- liblouisutdml-2.12.0-10.fc45
- liblxi-1.22-6.fc45
- libmateweather-1.28.0-12.fc45
- libmodsecurity-3.0.16-3.fc45
- libmusicbrainz5-5.1.0-32.fc45
- libnbd-1.25.7-3.fc45
- libodfgen-0.1.8-18.fc45
- libosinfo-1.12.0-12.fc45
- libpeas-2.2.1-9.fc45
- libqalculate-5.11.0-3.fc45
- libqb-2.0.10-3.fc45
- libquentier-0.5.0-26.fc45
- librasterlite2-1.1.0-0.23.beta1.fc45
- libreoffice-26.8.1.1-0.2.fc45
- librepo-1.21.1-2.fc45
- libreport-2.17.15-14.fc45
- librsvg2-2.63.2-2.fc45
- libs3-4.1-0.28.20190408git287e4be.fc45
- libsbml-5.20.5-18.fc45
- libsbw-2.12.2-23.fc45
- libsexy-0.1.11-51.fc45
- libsolv-0.7.40-2.fc45
- libsoup-2.74.3-12.fc45
- libspatialite-5.1.0-14.fc45
- libtnc-1.25-53.fc45
- libvirt-12.6.0-2.fc45
- libvirt-glib-5.0.0-11.fc45
- libvirt-sandbox-0.8.0-22.fc45
- libvisio-0.1.11-4.fc45
- libwebcam-0.2.5-26.fc45
- libwmf-0.2.16-2.fc45
- libxkbcommon-1.13.1-4.fc45
- libxklavier-5.4-32.fc45
- libxml2_2.13-2.13.9-4.fc45
- libxml2-2.15.4-1.fc45
- libxml++-2.42.3-10.fc45
- libxml++30-3.2.5-9.fc45
- libxml++40-4.4.0-3.fc45
- libxml++50-5.4.0-7.fc45
- libxslt-1.1.43-10.fc45
- libzypp-17.38.1-4.fc45
- liferea-2.0.1-2.fc45
- lighttpd-1.4.85-3.fc45
- linsmith-0.99.33-16.fc45
- lldpd-1.0.18-8.fc45
- llvm20-20.1.8-13.fc45
- llvm21-21.1.8-10.fc45
- llvm22-22.1.8-2.fc45
- llvm-23.1.2-2.fc45
- localsearch-3.12.0-2.fc45
- logjam-4.6.2-41.fc45
- lordsawar-0.3.2-20.fc45
- lxappearance-obconf-0.2.4-5.fc45
- lxpanel-0.11.1^20260313git4dec3d0d-3.fc45
- m17n-lib-1.8.6-5.fc45
- Macaulay2-1.26.06-4.fc45
- mail-notification-5.4-119.git.9ae8768.fc45
- mallard-rng-1.1.0-18.fc45
- mapnik-4.3.1-2.fc45
- mapserver-8.6.5-6.fc45
- mariadb10.11-10.11.18-4.fc45
- mariadb11.8-11.8.8-101.fc45
- mariadb12.3-12.3.2-101.fc45
- mate-applets-1.28.1-6.fc45
- mate-calc-1.28.0-11.fc45
- mate-control-center-1.28.2-2.fc45
- mate-media-1.28.1-9.fc45
- mate-notification-daemon-1.28.5-5.fc45
- mate-system-monitor-1.28.1-9.fc45
- mediaconch-25.04-4.fc45
- mlt-7.40.0-3.fc45
- mobile-broadband-provider-info-20240407-7.fc45
- mod_auth_mellon-0.19.1-7.fc45
- mod_security-2.9.14-2.fc45
- moreutils-0.70-3.fc45
- mstflint-4.36.0-4.fc45
- nagios-plugins-bonding-1.4-31.fc45
- nagios-plugins-openmanage-3.7.12-29.fc45
- nemiver-0.9.6-30.fc45
- netcdf-4.10.1-4.fc45
- netpbm-11.14-3.fc45
- NetworkManager-openconnect-1.2.10-13.fc45
- newsboat-2.44-3.fc45
- nexus-4.4.3-28.fc45
- nfs-utils-2.9.2-1.rc1.fc45.1
- nghttp2-1.69.0-6.fc45
- nginx-1.30.5-2.fc45
- nip2-8.9.1-11.fc45
- noctalia-5.1.0-2.fc45
- nordugrid-arc-7.2.0-2.fc45
- nx-libs-3.5.99.27-11.fc45
- oath-toolkit-2.6.14-4.fc45
- obconf-2.0.4-32.20150213git63ec47.fc45
- obconf-qt-0.16.6-4.fc45
- ocaml-gettext-0.5.0-12.fc45
- ochusha-0.6.0.1-0.25.cvs20100817T0000.fc45
- oddjob-0.34.7-20.fc45
- openbabel-3.2.0-7.fc45
- openbox-3.6.1-32.fc45
- openconnect-9.21-3.fc45
- opendnssec-2.1.14-6.fc45
- openlierox-0.58-0.43.rc5.fc45
- openscad-2021.01-33.fc45
- openscap-1.4.4-10.fc45
- opensips-4.0.2-4.fc45
- openslide-4.0.1-3.fc45
- open-vm-tools-13.1.0-9.fc45
- openwsman-2.8.1-22.fc45
- osc-source_validator-0.43-2.fc45
- osinfo-db-tools-1.12.0-10.fc45
- osmo-0.4.4-7.fc45
- ots-0.5.0-38.fc45
- pacemaker-3.0.3-2.fc45
- pam_mount-2.20-8.fc45
- pasdoc-1.0.4-3.fc45
- PDAL-2.10.2-5.fc45
- perl-RDF-Trine-Node-Literal-XML-0.16-23.fc45
- perl-XML-LibXML-2.0213-4.fc45
- perl-XML-LibXML-Devel-SetLineNumber-0.002-35.fc45
- pgmodeler-1.2.2-4.fc45
- phodav-3.0-15.fc45
- php-8.5.11-2.fc45
- php-libvirt-0.5.8-7.fc45
- php-pecl-xmlrpc-1.0.0~rc3-20.fc45
- pidgin-2.14.14-6.fc45
- pidgin-chime-1.5-16.fc45
- pidgin-sipe-1.25.0-27.fc45
- pluma-1.28.1-4.fc45
- podofo0.10-0.10.5-5.fc45
- podofo-1.1.2-2.fc45
- postgresql16-16.14-5.fc45
- postgresql16-postgis-3.6.4-6.fc45
- postgresql17-17.9-10.fc45
- postgresql17-postgis-3.6.4-6.fc45
- postgresql18-18.3-12.fc45
- postgresql18-postgis-3.6.4-6.fc45
- postgresql19-19beta1-6.fc45
- pragha-1.3.3-36.fc45
- pspp-2.1.1-7.fc45
- pymol-3.1.0-18.fc45
- python-firehose-0.5-40.fc45
- python-html5-parser-0.4.12-14.fc45
- python-igraph-1.0.0-6.fc45
- python-lxml-6.1.1-7.fc45
- python-ovirt-engine-sdk4-4.6.2-17.fc45
- python-pyside6-6.11.2-2.fc45
- qdl-2.8-3.fc45
- qgis-4.2.2-2.fc45
- qt5-qtwebkit-5.212.0-0.101alpha4.fc45
- qt6-qtwebengine-6.11.2-4.fc45
- ramond-0.5-33.fc45
- raptor2-2.0.15-53.fc45
- rarian-0.8.6-8.fc45
- recoll-1.44.2-2.fc45
- rest-0.10.2-13.fc45
- rest0.7-0.8.1-13.fc45
- rhythmbox-3.5.0-2.fc45
- R-igraph-2.2.3-3.fc45
- root-6.40.04-2.fc45
- rpminspect-2.1-6.fc45
- rrdtool-1.11.0-2.fc45
- rubygem-nokogiri-1.19.4-5.fc45
- R-xml2-1.5.2-4.fc45
- R-XML-3.99.0.23-3.fc45
- rygel-46.0-2.fc45
- s3fs-fuse-1.97-4.fc45
- sane-airscan-0.99.36-4.fc45
- sane-backends-1.4.0-9.fc45
- sbd-1.5.2-7.fc45
- scribus-1.6.6-10.fc45
- sgml-common-0.6.3-70.fc45
- shared-mime-info-2.5.1-3.fc45
- shigofumi-0.9-17.fc45
- shotwell-33.0-2.fc45
- snapper-0.13.0-5.fc45
- snownews-1.9-15.fc45
- sooperlooper-1.7.9-6.fc45
- soundmodem-0.20-40.fc45
- soundtracker-1.0.5-5.fc45
- sparse-0.6.4-4.gce1a6720f69e.fc45.9
- spatialite-tools-5.1.0a-8.fc45
- sqliteodbc-0.99991-12.fc45
- srcpd-2.1.7-8.fc45
- sssd-2.13.1-7.fc45
- strongswan-6.1.0-2.fc45
- subtitleeditor-0.56.2-7.fc45
- syncevolution-2.0.0-22.fc45
- synfig-1.5.4-4.fc45
- synfigstudio-1.5.4-3.fc45
- systemtap-5.6-2.fc45
- t4k_common-0.1.1-42.fc45
- teg-0.13.0-6.fc45
- telepathy-gabble-0.18.4-29.fc45
- telepathy-salut-0.8.1-37.fc45
- tellico-4.1.2-9.fc45
- thermald-2.5.13-2.fc45
- tinyows-1.2.2-10.fc45
- tinysparql-3.12.0-2.fc45
- tiptop-2.3.2-8.fc45
- tomboy-1.15.9-27.fc45
- totem-pl-parser-3.26.7-4.fc45
- transactional-update-6.0.6-4.fc45
- tuba-0.10.3-5.fc45
- tuxpaint-0.9.35-6.fc45
- tvtime-1.0.11-3.fc45
- twinkle-1.11.0-2.fc45
- umbrello-26.08.1-2.fc45
- usbguard-1.1.4-7.fc45
- uwsgi-2.0.31-17.fc45
- vdr-epg-daemon-1.3.29-19.fc45
- verbiste-0.1.49-8.fc45
- vfrnav-20230429-38.fc45
- vhostmd-1.2-3.fc45
- vim-syntastic-3.10.0-32.fc45
- virt-top-1.1.3-3.fc45
- virt-v2v-2.13.6-2.fc45
- virt-viewer-11.0-20.fc45
- vlc-3.0.24-3.fc45
- vtk-9.6.2-13.fc45
- warmux-11.04.1-45.fc45
- wayfire-config-manager-0.10.0-3.fc45
- wayland-1.26.0-3.fc45
- webkitgtk-2.54.0-3.fc45
- wf-config-0.10.0-4.fc45
- wireshark-4.6.8-3.fc45
- wmbusmeters-3.0.0-2.fc45
- wv-1.2.9-43.fc45
- xar-1.8.0.417.1-21.fc45
- xcb-proto-1.17.0-12.fc45
- xed-3.9.0-2.fc45
- xfce4-weather-plugin-0.12.0-2.fc45
- xgrep-0.08-37.fc45
- xhtml1-dtds-1.0-20020801.26.fc45
- xiphos-4.5.0-2.fc45
- xml2-0.5-35.fc45
- xmlsec1-1.3.11-7.fc45
- xmms2-0.9.7-9.fc45
- xmoto-0.6.3-8.fc45
- xournalpp-1.3.7-2.fc45
- xreader-4.6.9-2.fc45
- xrootd-6.1.1-2.fc45
- xscreensaver-6.16-3.fc45
- YafaRay-3.5.1-59.fc45
- yaz-5.38.0-3.fc45
- yelp-49.2-2.fc45
- yelp-tools-42.1-15.fc45
- zabbix-7.4.15-2.fc45
- zypper-1.14.94-3.fc45
Update description:
libxml2 updated to version 2.15.4, compat libxml2_2.13 added, and rebuilds of packages linking to libxml2. Packages that FTBFS will require the compat package. It should be installed automatically by dnf if required.
Fix for CVE-2026-84975
Prevent arbitrary code execution in flymake.
Update to 51.0
New upstream development version 1.57.3
This release fixes handling SuSE metadata. We deliver it mainly to provide an up-to-date version string.
LLVM 23.1.2 update
Fix FTBFS with a modern radcli2
* Tue Sep 08 2026 Klaus Wenninger <
kwenning@redhat.com> - 3.0.3-1
- Update for new upstream release tarball: Pacemaker-3.0.3,
for full details, see included
ChangeLog.md file or
https://github.com/ClusterLabs/pacemaker/releases/tag/Pacemaker-3.0.3
- move from deprecated py3_build & py3_install to
pyproject_wheel & pyproject_install
- adapt python-package files to the new tooling
- disable "-Waggregate-return" in cmocka files
PHP version 8.5.11 (24 Sep 2026)
BCMath:
- Fixed out-of-bounds read in bc_is_zero_for_scale() when scale exceeds n_scale. (Ilia Alshanetsky)
Core:
- Fixed out-of-bounds reads during automatic UTF-16/32 encoding detection. (Yudai Takada)
- Fixed bug GH-15375 (Nested "yield from" skips items after a valid() or next() call on the inner generator). (iliaal)
- Fixed bug GH-23232 (lone namespace separator asks the autoloader for an empty class name). (spawnia)
- Fixed bug GH-23301 (Nested "yield from" yields a value twice when the middle generator delegates again). (Lazizbek Ergashev)
DOM:
- Fixed NamedNodeMap::getNamedItemNS() with an empty URI not matching the null namespace in spec-following mode. (Ilia Alshanetsky)
- Fixed stale getElementsByClassName() and other node list caches after className/classList writes and attribute removals. (Ilia Alshanetsky)
- Fixed a use-after-free when cloning a DOMNameSpaceNode after DOMDocument::xinclude(). (iliaal)
- Fixed a crash in DOMXPath when a php:function callback receives a nodeset and a later callback returns a node from another document. (iliaal)
- Fixed bug GH-23331 (UAF when node_list_unlink() skips attribute children that still have a live wrapper). (iliaal)
- Fixed a use-after-free when Dom\Element::setAttributeNS() replaces the value of an attribute whose child still has a live wrapper. (iliaal)
GD:
- Fixed imageaffinematrixget() and imageaffinematrixconcat() reporting the wrong argument in error messages. (Weilin Du)
FPM:
- Fixed bug GH-19320 (FPM UID and GID overflow). (Pratik Bhujel)
- Fixed GHSA-62xp-839h-2637 (IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison). (CVE-2026-91768) (Alexandre Daubois)
Intl:
- Fixed grapheme_strpos() and grapheme_strrpos() with an empty needle returning UTF-16 offsets instead of grapheme offsets. (Ilia Alshanetsky)
- Fixed a memory leak when dumping IntlCalendar instances. (Ilia Alshanetsky)
- Fixed a memory leak when iterating IntlBreakIterator::getPartsIterator() results. (iliaal)
- Fixed a double-free when IntlGregorianCalendar construction fails after the ICU constructor adopts the TimeZone. (iliaal)
- Fixed bug GH-23094 (NumberFormatter parsing offsets use UTF-16 positions for UTF-8 strings). (ColumbusLabs)
- Fixed Locale::parseLocale() reading past a trailing '-' or '_'. (iliaal, Xuyang Zhang)
- Fixed grapheme_str_split() treating UBRK_DONE as a byte index. (iliaal)
- Fixed a leak in Locale::getKeywords() when a keyword value cannot be read. (iliaal)
- Fixed a use-after-free when IntlRuleBasedBreakIterator is constructed from compiled rules. (iliaal)
MBString:
- Fixed mb_ereg_replace() emitting a NUL or out-of-bounds bytes in the replacement when a \k<name> backref has no closing delimiter. (Ilia Alshanetsky)
MySQLnd:
- Fixed GHSA-r6x9-5r99-36j7 (Various packet overreads in mysqlnd wire protocol). (CVE-2025-1218) (Jakub Zelenka, Nora Dossche)
ODBC:
- Fixed odbc_field_len(), odbc_field_scale() and odbc_field_type() returning uninitialized memory when SQLColAttribute fails. (Ilia Alshanetsky)
Opcache:
- Fixed opcache.protect_memory race under ZTS. (realFlowControl)
- Fixed a tracing JIT crash when compiling a side trace for a method of a class that could not be stored in the inheritance cache. (GH-21710) (Arnaud, iliaal)
- Fixed a crash when the huge page SHM remap discarded mappings outside the reserved address range. (Piotr Hałas)
OpenSSL:
- Fixed GHSA-vvx9-73fr-5jjx (TLS hostname verification falls back to CN after SAN mismatch). (CVE-2026-91769) (Jakub Zelenka)
- Fixed GHSA-xr7j-rvgx-xq5p (Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN). (CVE-2026-91767) (Jakub Zelenka)
PDO:
- Fixed a leak when a persistent connection failed a liveness check with no other live PDO handle. (iliaal)
PDO_PGSQL:
- Fixed PDO::CURSOR_SCROLL statements failing under lazy fetching (PDO::ATTR_PREFETCH => 0). (KentarouTakeda)
PDO Sqlite:
- Fixed bug GH-20214 (PDO::FETCH_DEFAULT unexpected behavior with PDOStatement::setFetchMode). (SakiTakamachi)
Phar:
- Fixed bug GH-23418 (Use-after-free when looking up mounted directories). (Weilin Du)
- Fixed bug GH-23477 (Memory leak on duplicate native Phar manifest entries). (Weilin Du)
- Fixed GHSA-j3wh-g957-2m85 (Integer overflow in phar_tar_number() allowing TAR archive entry injection). (CVE-2026-6103) (Jakub Zelenka)
Readline:
- Fixed the interactive shell not waiting for the pager process to exit. (Weilin Du)
SOAP:
- Fixed WSDL cache corruption when a soap:header defines headerfaults. (Ilia Alshanetsky)
- Fixed stack overflow when parsing a WSDL with self-referential schema groups or attributeGroups. (Ilia Alshanetsky)
- Fixed GHSA-rgrp-mwpx-f6rm (Unbounded recursion in server-side cleanup_xml_node()). (CVE-2026-91765) (Alexandre Daubois)
- Fixed GHSA-cj93-vc83-wgqv (Integer overflow to buffer overflow in SOAP HTTP parsing). (CVE-2025-14181) (Nora Dossche, Jakub Zelenka)
Standard:
- Fixed a segfault when a stream filter callback unsets StreamBucket::$data before re-attaching the bucket. (iliaal)
- Fixed GHSA-7875-c8px-7q5f (Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header). (CVE-2026-93682) (Ilia Alshanetsky, Jordi Kroon)
- Fixed read buffer compaction in php_stream_filter_flush(). (crystarm)
- Fixed bug GH-22410 (Incorrect float behavior with large numbers). (arshidkv12)
- Fixed GH-23338 (fsockopen()/pfsockopen() ValueError reported wrong argument number for $timeout). (lacatoire)
- Fixed bug GH-23576 (Next index for array returned from array_keys() is wrong). (Lazizbek Ergashev)
- Fixed GHSA-88hq-2827-7pg6 (Out-of-bounds read in convert. stream filters when line-break-chars contains NUL). (CVE-2026-92842*) (geeknik)
- Fixed GHSA-fpwc-w8rq-cr92 (Cross-origin credential leak in HTTP stream wrapper redirects). (CVE-2026-91766) (Alexandre Daubois)
SimpleXML:
- Fixed writing to a dimension of the object returned by attributes() not creating the attribute. (Ilia Alshanetsky)
- Fixed child elements of the element returned by SimpleXMLElement::addChild() not being accessible by property name when namespaces are involved. (Ilia Alshanetsky)
SAPI:
- Fixed fuzzer targets failing to build in isolation. (Mrmaxmeier)
- Fixed returns uninitialized value on LiteSpeed lsapi SAPI (Go Kudo)
Update to podofo-1.1.2.
Backport fix for CVE-2026-73515.
- Update to 6.1.0 for CVE-2026-78123, CVE-2026-78124, CVE-2026-78126, CVE-2026-78127, CVE-2026-78129, CVE-2026-78130, CVE-2026-78131, CVE-2026-78132, CVE-2026-78133, CVE-2026-78134 and CVE-2026-78135
Upstream release, see wiki page below for detailed notes.
Update to twinkle-1.11.0.
VLC 3.0.24: https://code.videolan.org/videolan/vlc/-/tags/3.0.24
- Switch GUI to Qt6
- Re-enable AS-DCP plugin
- Disable RDP plugin
- Disable Real RTSP plugin
7.4.15
