Aggregator

FEDORA-2026-b6615c7ae7 Packages in this update:

• roundcubemail-1.7.6-1.fc45

Update description: Release 1.7.6

• Enable PHP 8.6 support (#10368, #10362)
• LDAP: Fix TypeError on group members listing with PHP 8 (#10364)
• Fix/Improve handling of IMAP literal strings
• Fix fatal error when a SORT/THREAD/SEARCH/ESEARCH command response includes untagged responses (#10361)
• Fix TypeError when archiving all messages via select-all (#10107)
• Fix temporary files permissions to 0600 (#10328)
• Fix refresh interval setting showing "never" when the configured value is not one of the predefined intervals (#10292)
• Fix installto.sh and update.sh reporting success when an upgrade step fails (#10326)
• Newmail_notifier: Fix restoring skin favicons defined with rel="icon" (#9575)
• LDAP: Fix website link including the labeledURI label (#8816)
• Fix non-ASCII special folder names displayed in UTF7-IMAP encoding when real names are shown (#10375)
• Security: Fix open redirect via IMAP error recovery on attachment get
• Security: Fix so Received: header includes only trusted hostname and forwarded IP from a trusted proxy
• Security: Fix bug where some managesieve destructive actions could have been triggered cross-site via GET
• Security: Fix Sieve script injection via a rule operator
• Security: Fix Sieve script injection via set/include modifiers
• Security: Fix bug where resolve_url() ignored trusted host setting
• Security: Fix mail header injection via a MDN subject
• Security: Fix HTTP request injection via the spellcheck ATD backend
• Security: Fix IMAP command injection via CRLF in _uid parameter with messages_cache enabled
• Security: Fix SSRF in CSS proxy via incomplete is_local_url() nip.io/sslip.io bypass
• Security: Fix CSRF validation bypass for file-only POST requests
• Security: Fix disabled_actions restriction bypass by writing '_' instead of '-' in the action name
• Security: Fix CSRF validation bypass for mail purge/expunge commands
• Security: Fix passing potentally unsafe attachment content into ImageMagick on image type conversion
• Security: Fix Unbounded CPU loop/DoS in rcube_session::unserialize() via a negative length token
• Security: Fix SSRF filter (is_local_url()) bypass via 6to4 (2002::/16) addresses
• Security: Fix so IMAP host input is validated more strictly

FEDORA-2026-f67031546e Packages in this update:

• roundcubemail-1.7.6-1.fc44

Update description: Release 1.7.6

• Enable PHP 8.6 support (#10368, #10362)
• LDAP: Fix TypeError on group members listing with PHP 8 (#10364)
• Fix/Improve handling of IMAP literal strings
• Fix fatal error when a SORT/THREAD/SEARCH/ESEARCH command response includes untagged responses (#10361)
• Fix TypeError when archiving all messages via select-all (#10107)
• Fix temporary files permissions to 0600 (#10328)
• Fix refresh interval setting showing "never" when the configured value is not one of the predefined intervals (#10292)
• Fix installto.sh and update.sh reporting success when an upgrade step fails (#10326)
• Newmail_notifier: Fix restoring skin favicons defined with rel="icon" (#9575)
• LDAP: Fix website link including the labeledURI label (#8816)
• Fix non-ASCII special folder names displayed in UTF7-IMAP encoding when real names are shown (#10375)
• Security: Fix open redirect via IMAP error recovery on attachment get
• Security: Fix so Received: header includes only trusted hostname and forwarded IP from a trusted proxy
• Security: Fix bug where some managesieve destructive actions could have been triggered cross-site via GET
• Security: Fix Sieve script injection via a rule operator
• Security: Fix Sieve script injection via set/include modifiers
• Security: Fix bug where resolve_url() ignored trusted host setting
• Security: Fix mail header injection via a MDN subject
• Security: Fix HTTP request injection via the spellcheck ATD backend
• Security: Fix IMAP command injection via CRLF in _uid parameter with messages_cache enabled
• Security: Fix SSRF in CSS proxy via incomplete is_local_url() nip.io/sslip.io bypass
• Security: Fix CSRF validation bypass for file-only POST requests
• Security: Fix disabled_actions restriction bypass by writing '_' instead of '-' in the action name
• Security: Fix CSRF validation bypass for mail purge/expunge commands
• Security: Fix passing potentally unsafe attachment content into ImageMagick on image type conversion
• Security: Fix Unbounded CPU loop/DoS in rcube_session::unserialize() via a negative length token
• Security: Fix SSRF filter (is_local_url()) bypass via 6to4 (2002::/16) addresses
• Security: Fix so IMAP host input is validated more strictly

FEDORA-2026-ab2aaea969 Packages in this update:

• composer-2.11.2-1.fc44

Update description: [2.11.2] 2026-11-11

• Security: Fixed arbitrary command execution via the prevent_url_access_callable transport option being loaded from composer.lock / vendor/composer/installed.json (GHSA-jhfp-4ppm-crmm)
• Security: Fixed malicious zip archives being able to write files outside of the package directory via symlinked entries when extraction falls back from unzip to ZipArchive (GHSA-w6hj-6587-3jh5)
• Security: Fixed inline repository HTTP credentials being sent to dist mirrors on other hosts supplied by a crafted composer.lock / vendor/composer/installed.json (GHSA-x82q-x274-r6pq)
• Security: Updated the bundled symfony/filesystem to a version fixing a disclosed vulnerability present in the one shipped with 2.11.1 (GHSA-6prc-h956-hxjq)
• Security: Fixed Authorization and Cookie headers set in request options, e.g. via a repository's http.header option, being resent when following a redirect to another origin (#13253)
• Security: Fixed non-auth config settings being read from a project's auth.json and the COMPOSER_AUTH env var, and home being read from a project's composer.json, these are now ignored with a warning (#13208)
• Security: Fixed IPs blocked by the prevent_ip_access_callable transport option only being rejected after the request had been sent, and rejected in-flight downloads not being stopped (#13255)
• Added exclude-branches option to VCS repositories to skip branches matching the given patterns, e.g. bot-managed ones (#13235)
• Added support for setting allow-git-fallback to false in GitLab, Bitbucket and Forgejo repositories to fail on API errors instead of falling back to a git clone (#13234)
• Added a 30 seconds stall timeout so downloads from a server which accepts the connection but never responds are aborted and retried instead of hanging for 300 seconds, configurable or disabled via the COMPOSER_HTTP_STALL_TIMEOUT env var (#13243)
• Improved performance of security advisory lookups by querying the API only once per package name (#13202)
• Improved performance of VCS repository updates by skipping the default branch lookup when the git mirror is up to date (#13224)
• Improved performance and memory usage of dependency resolution, package loading and sorting, and repository traversal (#13187, #13188, #13194, #13197, #13200, #13211, #13217, #13218)
• Improved performance with micro-optimizations in path and URL handling, lock file and installed.php generation, archiving and TLS/HTTP helpers (#13189, #13190, #13191, #13192, #13193, #13195, #13196, #13198, #13214, #13215, #13216, #13220, #13222)
• Fixed config failing with a schema error or corrupting composer.json by turning nested {} into [] when adding or removing dotted sub-keys (#13210)
• Fixed config --unset, remove and require leaving in place or duplicating composer.json keys which are set to null (#13225)
• Fixed dist URLs of codeberg.org packages and bitbucket zip archives not being updated when requiring a specific commit with dev-branch#hash (#13242)
• Fixed an undefined array key warning hiding the real error when curl 8.23+ fails to parse a URL (#13252)

FEDORA-EPEL-2026-d02b793e7f Packages in this update:

• composer-2.11.2-1.el10_3

Update description: [2.11.2] 2026-11-11

• Security: Fixed arbitrary command execution via the prevent_url_access_callable transport option being loaded from composer.lock / vendor/composer/installed.json (GHSA-jhfp-4ppm-crmm)
• Security: Fixed malicious zip archives being able to write files outside of the package directory via symlinked entries when extraction falls back from unzip to ZipArchive (GHSA-w6hj-6587-3jh5)
• Security: Fixed inline repository HTTP credentials being sent to dist mirrors on other hosts supplied by a crafted composer.lock / vendor/composer/installed.json (GHSA-x82q-x274-r6pq)
• Security: Updated the bundled symfony/filesystem to a version fixing a disclosed vulnerability present in the one shipped with 2.11.1 (GHSA-6prc-h956-hxjq)
• Security: Fixed Authorization and Cookie headers set in request options, e.g. via a repository's http.header option, being resent when following a redirect to another origin (#13253)
• Security: Fixed non-auth config settings being read from a project's auth.json and the COMPOSER_AUTH env var, and home being read from a project's composer.json, these are now ignored with a warning (#13208)
• Security: Fixed IPs blocked by the prevent_ip_access_callable transport option only being rejected after the request had been sent, and rejected in-flight downloads not being stopped (#13255)
• Added exclude-branches option to VCS repositories to skip branches matching the given patterns, e.g. bot-managed ones (#13235)
• Added support for setting allow-git-fallback to false in GitLab, Bitbucket and Forgejo repositories to fail on API errors instead of falling back to a git clone (#13234)
• Added a 30 seconds stall timeout so downloads from a server which accepts the connection but never responds are aborted and retried instead of hanging for 300 seconds, configurable or disabled via the COMPOSER_HTTP_STALL_TIMEOUT env var (#13243)
• Improved performance of security advisory lookups by querying the API only once per package name (#13202)
• Improved performance of VCS repository updates by skipping the default branch lookup when the git mirror is up to date (#13224)
• Improved performance and memory usage of dependency resolution, package loading and sorting, and repository traversal (#13187, #13188, #13194, #13197, #13200, #13211, #13217, #13218)
• Improved performance with micro-optimizations in path and URL handling, lock file and installed.php generation, archiving and TLS/HTTP helpers (#13189, #13190, #13191, #13192, #13193, #13195, #13196, #13198, #13214, #13215, #13216, #13220, #13222)
• Fixed config failing with a schema error or corrupting composer.json by turning nested {} into [] when adding or removing dotted sub-keys (#13210)
• Fixed config --unset, remove and require leaving in place or duplicating composer.json keys which are set to null (#13225)
• Fixed dist URLs of codeberg.org packages and bitbucket zip archives not being updated when requiring a specific commit with dev-branch#hash (#13242)
• Fixed an undefined array key warning hiding the real error when curl 8.23+ fails to parse a URL (#13252)

FEDORA-2026-479af584c3 Packages in this update:

• composer-2.11.2-1.fc45

Update description: [2.11.2] 2026-11-11

• Security: Fixed arbitrary command execution via the prevent_url_access_callable transport option being loaded from composer.lock / vendor/composer/installed.json (GHSA-jhfp-4ppm-crmm)
• Security: Fixed malicious zip archives being able to write files outside of the package directory via symlinked entries when extraction falls back from unzip to ZipArchive (GHSA-w6hj-6587-3jh5)
• Security: Fixed inline repository HTTP credentials being sent to dist mirrors on other hosts supplied by a crafted composer.lock / vendor/composer/installed.json (GHSA-x82q-x274-r6pq)
• Security: Updated the bundled symfony/filesystem to a version fixing a disclosed vulnerability present in the one shipped with 2.11.1 (GHSA-6prc-h956-hxjq)
• Security: Fixed Authorization and Cookie headers set in request options, e.g. via a repository's http.header option, being resent when following a redirect to another origin (#13253)
• Security: Fixed non-auth config settings being read from a project's auth.json and the COMPOSER_AUTH env var, and home being read from a project's composer.json, these are now ignored with a warning (#13208)
• Security: Fixed IPs blocked by the prevent_ip_access_callable transport option only being rejected after the request had been sent, and rejected in-flight downloads not being stopped (#13255)
• Added exclude-branches option to VCS repositories to skip branches matching the given patterns, e.g. bot-managed ones (#13235)
• Added support for setting allow-git-fallback to false in GitLab, Bitbucket and Forgejo repositories to fail on API errors instead of falling back to a git clone (#13234)
• Added a 30 seconds stall timeout so downloads from a server which accepts the connection but never responds are aborted and retried instead of hanging for 300 seconds, configurable or disabled via the COMPOSER_HTTP_STALL_TIMEOUT env var (#13243)
• Improved performance of security advisory lookups by querying the API only once per package name (#13202)
• Improved performance of VCS repository updates by skipping the default branch lookup when the git mirror is up to date (#13224)
• Improved performance and memory usage of dependency resolution, package loading and sorting, and repository traversal (#13187, #13188, #13194, #13197, #13200, #13211, #13217, #13218)
• Improved performance with micro-optimizations in path and URL handling, lock file and installed.php generation, archiving and TLS/HTTP helpers (#13189, #13190, #13191, #13192, #13193, #13195, #13196, #13198, #13214, #13215, #13216, #13220, #13222)
• Fixed config failing with a schema error or corrupting composer.json by turning nested {} into [] when adding or removing dotted sub-keys (#13210)
• Fixed config --unset, remove and require leaving in place or duplicating composer.json keys which are set to null (#13225)
• Fixed dist URLs of codeberg.org packages and bitbucket zip archives not being updated when requiring a specific commit with dev-branch#hash (#13242)
• Fixed an undefined array key warning hiding the real error when curl 8.23+ fails to parse a URL (#13252)

FEDORA-EPEL-2026-8d9e3a7486 Packages in this update:

• composer-2.11.2-1.el10_4

Update description: [2.11.2] 2026-11-11

• Security: Fixed arbitrary command execution via the prevent_url_access_callable transport option being loaded from composer.lock / vendor/composer/installed.json (GHSA-jhfp-4ppm-crmm)
• Security: Fixed malicious zip archives being able to write files outside of the package directory via symlinked entries when extraction falls back from unzip to ZipArchive (GHSA-w6hj-6587-3jh5)
• Security: Fixed inline repository HTTP credentials being sent to dist mirrors on other hosts supplied by a crafted composer.lock / vendor/composer/installed.json (GHSA-x82q-x274-r6pq)
• Security: Updated the bundled symfony/filesystem to a version fixing a disclosed vulnerability present in the one shipped with 2.11.1 (GHSA-6prc-h956-hxjq)
• Security: Fixed Authorization and Cookie headers set in request options, e.g. via a repository's http.header option, being resent when following a redirect to another origin (#13253)
• Security: Fixed non-auth config settings being read from a project's auth.json and the COMPOSER_AUTH env var, and home being read from a project's composer.json, these are now ignored with a warning (#13208)
• Security: Fixed IPs blocked by the prevent_ip_access_callable transport option only being rejected after the request had been sent, and rejected in-flight downloads not being stopped (#13255)
• Added exclude-branches option to VCS repositories to skip branches matching the given patterns, e.g. bot-managed ones (#13235)
• Added support for setting allow-git-fallback to false in GitLab, Bitbucket and Forgejo repositories to fail on API errors instead of falling back to a git clone (#13234)
• Added a 30 seconds stall timeout so downloads from a server which accepts the connection but never responds are aborted and retried instead of hanging for 300 seconds, configurable or disabled via the COMPOSER_HTTP_STALL_TIMEOUT env var (#13243)
• Improved performance of security advisory lookups by querying the API only once per package name (#13202)
• Improved performance of VCS repository updates by skipping the default branch lookup when the git mirror is up to date (#13224)
• Improved performance and memory usage of dependency resolution, package loading and sorting, and repository traversal (#13187, #13188, #13194, #13197, #13200, #13211, #13217, #13218)
• Improved performance with micro-optimizations in path and URL handling, lock file and installed.php generation, archiving and TLS/HTTP helpers (#13189, #13190, #13191, #13192, #13193, #13195, #13196, #13198, #13214, #13215, #13216, #13220, #13222)
• Fixed config failing with a schema error or corrupting composer.json by turning nested {} into [] when adding or removing dotted sub-keys (#13210)
• Fixed config --unset, remove and require leaving in place or duplicating composer.json keys which are set to null (#13225)
• Fixed dist URLs of codeberg.org packages and bitbucket zip archives not being updated when requiring a specific commit with dev-branch#hash (#13242)
• Fixed an undefined array key warning hiding the real error when curl 8.23+ fails to parse a URL (#13252)

FEDORA-EPEL-2026-308fca30bf Packages in this update:

• composer-2.11.2-1.el9

Update description: [2.11.2] 2026-11-11

• Security: Fixed arbitrary command execution via the prevent_url_access_callable transport option being loaded from composer.lock / vendor/composer/installed.json (GHSA-jhfp-4ppm-crmm)
• Security: Fixed malicious zip archives being able to write files outside of the package directory via symlinked entries when extraction falls back from unzip to ZipArchive (GHSA-w6hj-6587-3jh5)
• Security: Fixed inline repository HTTP credentials being sent to dist mirrors on other hosts supplied by a crafted composer.lock / vendor/composer/installed.json (GHSA-x82q-x274-r6pq)
• Security: Updated the bundled symfony/filesystem to a version fixing a disclosed vulnerability present in the one shipped with 2.11.1 (GHSA-6prc-h956-hxjq)
• Security: Fixed Authorization and Cookie headers set in request options, e.g. via a repository's http.header option, being resent when following a redirect to another origin (#13253)
• Security: Fixed non-auth config settings being read from a project's auth.json and the COMPOSER_AUTH env var, and home being read from a project's composer.json, these are now ignored with a warning (#13208)
• Security: Fixed IPs blocked by the prevent_ip_access_callable transport option only being rejected after the request had been sent, and rejected in-flight downloads not being stopped (#13255)
• Added exclude-branches option to VCS repositories to skip branches matching the given patterns, e.g. bot-managed ones (#13235)
• Added support for setting allow-git-fallback to false in GitLab, Bitbucket and Forgejo repositories to fail on API errors instead of falling back to a git clone (#13234)
• Added a 30 seconds stall timeout so downloads from a server which accepts the connection but never responds are aborted and retried instead of hanging for 300 seconds, configurable or disabled via the COMPOSER_HTTP_STALL_TIMEOUT env var (#13243)
• Improved performance of security advisory lookups by querying the API only once per package name (#13202)
• Improved performance of VCS repository updates by skipping the default branch lookup when the git mirror is up to date (#13224)
• Improved performance and memory usage of dependency resolution, package loading and sorting, and repository traversal (#13187, #13188, #13194, #13197, #13200, #13211, #13217, #13218)
• Improved performance with micro-optimizations in path and URL handling, lock file and installed.php generation, archiving and TLS/HTTP helpers (#13189, #13190, #13191, #13192, #13193, #13195, #13196, #13198, #13214, #13215, #13216, #13220, #13222)
• Fixed config failing with a schema error or corrupting composer.json by turning nested {} into [] when adding or removing dotted sub-keys (#13210)
• Fixed config --unset, remove and require leaving in place or duplicating composer.json keys which are set to null (#13225)
• Fixed dist URLs of codeberg.org packages and bitbucket zip archives not being updated when requiring a specific commit with dev-branch#hash (#13242)
• Fixed an undefined array key warning hiding the real error when curl 8.23+ fails to parse a URL (#13252)

FEDORA-2026-36c0aba2e1 Packages in this update:

• composer-2.11.2-1.fc43

Update description: [2.11.2] 2026-11-11

• Security: Fixed arbitrary command execution via the prevent_url_access_callable transport option being loaded from composer.lock / vendor/composer/installed.json (GHSA-jhfp-4ppm-crmm)
• Security: Fixed malicious zip archives being able to write files outside of the package directory via symlinked entries when extraction falls back from unzip to ZipArchive (GHSA-w6hj-6587-3jh5)
• Security: Fixed inline repository HTTP credentials being sent to dist mirrors on other hosts supplied by a crafted composer.lock / vendor/composer/installed.json (GHSA-x82q-x274-r6pq)
• Security: Updated the bundled symfony/filesystem to a version fixing a disclosed vulnerability present in the one shipped with 2.11.1 (GHSA-6prc-h956-hxjq)
• Security: Fixed Authorization and Cookie headers set in request options, e.g. via a repository's http.header option, being resent when following a redirect to another origin (#13253)
• Security: Fixed non-auth config settings being read from a project's auth.json and the COMPOSER_AUTH env var, and home being read from a project's composer.json, these are now ignored with a warning (#13208)
• Security: Fixed IPs blocked by the prevent_ip_access_callable transport option only being rejected after the request had been sent, and rejected in-flight downloads not being stopped (#13255)
• Added exclude-branches option to VCS repositories to skip branches matching the given patterns, e.g. bot-managed ones (#13235)
• Added support for setting allow-git-fallback to false in GitLab, Bitbucket and Forgejo repositories to fail on API errors instead of falling back to a git clone (#13234)
• Added a 30 seconds stall timeout so downloads from a server which accepts the connection but never responds are aborted and retried instead of hanging for 300 seconds, configurable or disabled via the COMPOSER_HTTP_STALL_TIMEOUT env var (#13243)
• Improved performance of security advisory lookups by querying the API only once per package name (#13202)
• Improved performance of VCS repository updates by skipping the default branch lookup when the git mirror is up to date (#13224)
• Improved performance and memory usage of dependency resolution, package loading and sorting, and repository traversal (#13187, #13188, #13194, #13197, #13200, #13211, #13217, #13218)
• Improved performance with micro-optimizations in path and URL handling, lock file and installed.php generation, archiving and TLS/HTTP helpers (#13189, #13190, #13191, #13192, #13193, #13195, #13196, #13198, #13214, #13215, #13216, #13220, #13222)
• Fixed config failing with a schema error or corrupting composer.json by turning nested {} into [] when adding or removing dotted sub-keys (#13210)
• Fixed config --unset, remove and require leaving in place or duplicating composer.json keys which are set to null (#13225)
• Fixed dist URLs of codeberg.org packages and bitbucket zip archives not being updated when requiring a specific commit with dev-branch#hash (#13242)
• Fixed an undefined array key warning hiding the real error when curl 8.23+ fails to parse a URL (#13252)

FEDORA-2026-3205211f60 Packages in this update:

• dr_libs-0^20261030.35b5c39-3.fc45

Update description:

Update to 0^20261030.35b5c39

• dr_flac 0.13.4
• dr_mp3 0.7.4
• dr_wav 0.14.6

FEDORA-EPEL-2026-13e46770aa Packages in this update:

• incron-0.5.12-31.el9

Update description:

Fix to disallow non root users from passing their own config file.

FEDORA-EPEL-2026-28046962ee Packages in this update:

• incron-0.5.12-31.el8

Update description:

Fix to disallow non root users from passing their own config file.

FEDORA-2026-93de20052b Packages in this update:

• incron-0.5.12-31.fc45

Update description:

Fix to disallow non root users from passing their own config file.

FEDORA-EPEL-2026-2ffde1f2b7 Packages in this update:

• incron-0.5.12-31.el10_4

Update description:

Fix to disallow non root users from passing their own config file.

FEDORA-2026-4b67d2e4ac Packages in this update:

• incron-0.5.12-31.fc44

Update description:

Fix to disallow non root users from passing their own config file.

FEDORA-2026-db7a3ef92b Packages in this update:

• incron-0.5.12-31.fc43

Update description:

Fix to disallow non root users from passing their own config file.

FEDORA-2026-3f54d4b3cd Packages in this update:

• incron-0.5.12-31.fc46

Update description:

Automatic update for incron-0.5.12-31.fc46.

Changelog * Tue Nov 10 2026 Kevin Fenzi <kevin@scrye.com> - 0.5.12-31 - Add Patch to stop non root users using their own config. Fixes rhbz#2568586

FEDORA-2026-67db247b7f Packages in this update:

• et-6.2.11-5.fc45

Update description:

Security fixes from et 7.1.x, backported to 6.2.11, and telemetry disabled.

Security fixes (backported from et 7.1.0 and 7.1.1, one commit per upstream fix; see https://github.com/MisterTea/EternalTerminal/issues/923):

• Pre-authentication denial of service: stuck or silent peers, slow reconnects and accept() resource exhaustion could block or crash etserver for every user
• etserver and the router no longer abort on malformed packets or registrations
• Router session ownership is taken from the kernel's peer credentials, and both ends of the Unix HTM control socket are authenticated
• etserver no longer does root file operations or connections on Unix socket paths chosen by the client

Telemetry disabled (CVE-2023-23558):

et is now built with telemetry disabled on all architectures. This removes the bundled sentry-native and its fixed paths in /tmp, and drops the libcurl dependency. The default /etc/et.cfg now says telemetry = false. An existing et.cfg that still says telemetry = true is harmless: the setting does nothing in this build.

Packaging: the bundled() Provides and License: now match the bundled libraries actually shipped.

Note: this update stays on 6.2.11, which keeps the 6.x command-line options. et 7.x changes several short options to match OpenSSH, so it is only in Rawhide.