Fedora Security Advisories

• ruby-build-20261023-1.el9

Update to 20261023

• ruby-build-20261023-1.el10_3

Update to 20261023

• ruby-build-20261023-1.el10_4

Update to 20261023

• ruby-build-20261023-1.el10_2

Update to 20261023

• ruby-build-20261023-1.fc44

Update to 20261023

• ruby-build-20261023-1.fc45

Update to 20261023

• jupyterlab-4.6.3-1.fc44
• python-jupyter-builder-1.2.3-1.fc44
• python-jupyterlab-server-2.28.1-2.fc44
• python-jupytext-1.19.6-2.fc44
• python-nbdime-4.0.4-7.fc44
• python-notebook-7.6.3-1.fc44

New versions of packages in Jupyter stack including Jupyterlab and Notebook.

• goose-1.45.0-2.el10_2

Update to goose-1.45.0-2.el10_2.

• goose-1.45.0-2.el10_4

Update to goose-1.45.0-2.el10_4.

• goose-1.45.0-2.el10_3

Update to goose-1.45.0-2.el10_3.

• goose-1.45.0-2.el9

Update to goose-1.45.0-2.el9.

• goose-1.45.0-2.fc43

Update to goose-1.45.0-2.fc43.

• goose-1.45.0-2.fc45

Update to goose-1.45.0-2.fc45.

• goose-1.45.0-2.fc44

Update to goose-1.45.0-2.fc44.

• composer-2.11.0-1.fc44

• Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
• Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
• Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
• Security: Fixed svn passwords not being redacted from debug output (#13171)
• Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
• Improved dependency resolution performance and memory usage (#13174)
• Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
• Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
• Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

• composer-2.11.0-1.el10_4

• Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
• Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
• Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
• Security: Fixed svn passwords not being redacted from debug output (#13171)
• Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
• Improved dependency resolution performance and memory usage (#13174)
• Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
• Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
• Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

• composer-2.11.0-1.el10_2

• Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
• Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
• Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
• Security: Fixed svn passwords not being redacted from debug output (#13171)
• Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
• Improved dependency resolution performance and memory usage (#13174)
• Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
• Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
• Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

• composer-2.11.0-1.fc43

• Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
• Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
• Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
• Security: Fixed svn passwords not being redacted from debug output (#13171)
• Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
• Improved dependency resolution performance and memory usage (#13174)
• Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
• Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
• Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

• composer-2.11.0-1.el9

• Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
• Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
• Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
• Security: Fixed svn passwords not being redacted from debug output (#13171)
• Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
• Improved dependency resolution performance and memory usage (#13174)
• Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
• Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
• Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

• composer-2.11.0-1.el10_3

• Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
• Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
• Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
• Security: Fixed svn passwords not being redacted from debug output (#13171)
• Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
• Improved dependency resolution performance and memory usage (#13174)
• Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
• Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
• Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)