Aggregator

• glib-networking-2.80.1-4.fc43

Fixes CVE-2026-103963

• nautilus-51.1-2.fc45

Fix CVE-2026-111802

• nautilus-50.4-2.fc44

Fix CVE-2026-111802

• libheif-1.23.7-1.fc43

Latest upstream security bugfix release. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.7 .

• libheif-1.23.7-1.el10_3

Latest upstream security bugfix release. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.7 .

• libheif-1.23.7-1.fc44

Latest upstream security bugfix release. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.7 .

• libheif-1.23.7-1.el10_4

Latest upstream security bugfix release. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.7 .

• libheif-1.23.7-1.el10_2

Latest upstream security bugfix release. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.7 .

• libheif-1.23.7-1.fc45

Latest upstream security bugfix release. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.7 .

• python-boto3-1.43.122-1.fc43
• python-botocore-1.43.122-1.fc43
• python-s3transfer-0.19.3-1.fc43

Latest updates.

• composer-2.11.1-1.fc45

• Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
• Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
• Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
• Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
• Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
• Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)

• Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
• Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
• Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
• Security: Fixed svn passwords not being redacted from debug output (#13171)
• Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
• Improved dependency resolution performance and memory usage (#13174)
• Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
• Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
• Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

• composer-2.11.1-1.el9

• Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
• Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
• Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
• Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
• Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
• Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)

• Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
• Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
• Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
• Security: Fixed svn passwords not being redacted from debug output (#13171)
• Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
• Improved dependency resolution performance and memory usage (#13174)
• Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
• Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
• Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

• composer-2.11.1-1.el10_2

• Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
• Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
• Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
• Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
• Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
• Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)

• Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
• Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
• Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
• Security: Fixed svn passwords not being redacted from debug output (#13171)
• Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
• Improved dependency resolution performance and memory usage (#13174)
• Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
• Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
• Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

• composer-2.11.1-1.el10_4

• Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
• Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
• Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
• Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
• Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
• Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)

• Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
• Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
• Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
• Security: Fixed svn passwords not being redacted from debug output (#13171)
• Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
• Improved dependency resolution performance and memory usage (#13174)
• Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
• Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
• Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

• composer-2.11.1-1.fc44

• Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
• Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
• Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
• Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
• Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
• Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)

• Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
• Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
• Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
• Security: Fixed svn passwords not being redacted from debug output (#13171)
• Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
• Improved dependency resolution performance and memory usage (#13174)
• Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
• Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
• Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

• composer-2.11.1-1.el10_3

• Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
• Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
• Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
• Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
• Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
• Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)

• Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
• Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
• Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
• Security: Fixed svn passwords not being redacted from debug output (#13171)
• Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
• Improved dependency resolution performance and memory usage (#13174)
• Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
• Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
• Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

• composer-2.11.1-1.fc43

• Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
• Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
• Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
• Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
• Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
• Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)

• Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
• Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
• Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
• Security: Fixed svn passwords not being redacted from debug output (#13171)
• Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
• Improved dependency resolution performance and memory usage (#13174)
• Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
• Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
• Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

• fasterxml-oss-parent-69-1.fc44
• jackson-annotations-2.18.12-1.fc44
• jackson-bom-2.18.12-1.fc44
• jackson-core-2.18.12-1.fc44
• jackson-databind-2.18.12-1.fc44
• jackson-jaxrs-providers-2.18.12-1.fc44
• jackson-modules-base-2.18.12-1.fc44
• jackson-parent-2.18.4-1.fc44

Fix CVE-2026-89407 CVE-2026-89425 CVE-2026-68497 CVE-2026-68498 CVE-2026-83557 CVE-2026-19032 CVE-2026-91777 across aligned packages updated to version 2.18.12

• python-boto3-1.43.122-1.fc44
• python-botocore-1.43.122-1.fc44

Latest updates.