Fedora Security Advisories

• knot-3.5.8-1.fc45

Update to 3.5.8 (security fixes in XDP, DDNS, and TSIG).

• environment-modules-5.6.2-1.fc43

Update to 5.6.2 (fix CVE-2026-85013)

• GitPython-3.1.62-1.fc44

Update to 3.1.62 (close RHBZ#2529282)

• Fixes GHSA-hmq2-w58f-27jc

• python-configargparse-1.7.7-1.el9

Update to 1.7.7.

Version 1.7.6 is a security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values.

Version 1.7.7 contains a bug fix: args with a custom argparse.Action and nargs can now be set from a config file.

• environment-modules-5.6.2-1.fc44

Update to 5.6.2 (fix CVE-2026-85013)

• python-configargparse-1.7.7-1.el10_3

Update to 1.7.7.

Version 1.7.6 is a security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values.

Version 1.7.7 contains a bug fix: args with a custom argparse.Action and nargs can now be set from a config file.

• perl-Dancer2-1.1.2-4.fc43

Dancer2 générates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there.

• perl-Dancer2-2.0.1-4.fc44

Dancer2 générates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there.

• perl-Dancer2-2.1.0-3.fc45

Dancer2 générates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there.

• python-configargparse-1.7.7-1.el10_4

Update to 1.7.7.

Version 1.7.6 is a security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values.

Version 1.7.7 contains a bug fix: args with a custom argparse.Action and nargs can now be set from a config file.

• python-configargparse-1.7.7-1.fc43

Update to 1.7.7.

Version 1.7.6 is a security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values.

Version 1.7.7 contains a bug fix: args with a custom argparse.Action and nargs can now be set from a config file.

• python-configargparse-1.7.7-1.fc44

Update to 1.7.7.

Version 1.7.6 is a security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values.

Version 1.7.7 contains a bug fix: args with a custom argparse.Action and nargs can now be set from a config file.

• python-configargparse-1.7.7-1.fc45

Update to 1.7.7.

Version 1.7.6 is a security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values.

Version 1.7.7 contains a bug fix: args with a custom argparse.Action and nargs can now be set from a config file.

• rust-lru0.16-0.16.4-1.el9
• rust-lru-0.18.4-1.el9

Update lru crate to version 0.18.4 and add a compat package for version 0.16.

This fixes an obscure potential use-after-free issue: https://rustsec.org/advisories/RUSTSEC-2026-0253.html

Rebuild tracker: https://forge.fedoraproject.org/rust/backlog/issues/39

• rust-lru0.16-0.16.4-1.el10_4
• rust-lru-0.18.4-1.el10_4

Update lru crate to version 0.18.4 and add a compat package for version 0.16.

This fixes an obscure potential use-after-free issue: https://rustsec.org/advisories/RUSTSEC-2026-0253.html

Rebuild tracker: https://forge.fedoraproject.org/rust/backlog/issues/39

• rust-lru0.16-0.16.4-1.fc43
• rust-lru-0.18.4-1.fc43

Update lru crate to version 0.18.4 and add a compat package for version 0.16.

This fixes an obscure potential use-after-free issue: https://rustsec.org/advisories/RUSTSEC-2026-0253.html

Rebuild tracker: https://forge.fedoraproject.org/rust/backlog/issues/39

• rust-lru0.16-0.16.4-1.fc44
• rust-lru-0.18.4-1.fc44

Update lru crate to version 0.18.4 and add a compat package for version 0.16.

This fixes an obscure potential use-after-free issue: https://rustsec.org/advisories/RUSTSEC-2026-0253.html

Rebuild tracker: https://forge.fedoraproject.org/rust/backlog/issues/39

• rust-lru0.16-0.16.4-1.fc45
• rust-lru-0.18.4-1.fc45

Update lru crate to version 0.18.4 and add a compat package for version 0.16.

This fixes an obscure potential use-after-free issue: https://rustsec.org/advisories/RUSTSEC-2026-0253.html

Rebuild tracker: https://forge.fedoraproject.org/rust/backlog/issues/39

• rust-lru0.16-0.16.4-1.fc46
• rust-lru-0.18.4-1.fc46

Update lru crate to version 0.18.4 and add a compat package for version 0.16.

This fixes an obscure potential use-after-free issue: https://rustsec.org/advisories/RUSTSEC-2026-0253.html

Rebuild tracker: https://forge.fedoraproject.org/rust/backlog/issues/39

• perl-Data-Entropy-0.010-1.fc44

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. This update fixes that issue (CVE-2026-18536).