Tuesday 18th August 2026

Fedora Project

• Updated proftpd to 1.3.9d in F-43, F-44, F-45, Rawhide, EPEL-10.2 and EPEL-10:

  • SSH channel open request from authenticated client with max packet size of zero lead to infinite loop (GH#2242)

  • Aborted/failed data transfers incorrectly clear any "EPSV ALL" state (GH#2255)

  • Possible use-after-free issue via FTP STAT command using -C option; note that the -C option is now silently ignored for FTP STAT commands (GH#2265)

  • Passive FTP data transfers do not honour AllowForeignAddress policy properly (GH#2272)

  • Empty password fields should be rejected by the mod_sql_passwd module (GH#2275)

  • Empty password fields should be rejected by the mod_auth_file module (GH#2279)

  • .ftpaccess file policy bypass possible in certain configurations (GH#2282)

Local Packages

• Updated proftpd to 1.3.9d as per the Fedora version

• Updated proftpd (release candidate) to 1.3.10rc4:

  • SSH channel open request from authenticated client with max packet size of zero lead to infinite loop (GH#2242)

  • Aborted/failed data transfers incorrectly clear any "EPSV ALL" state (GH#2255)

  • Cross-filesystem RNTO fallback follows source and destination symlinks unexpectedly (GH#2256)

  • Add mod_procfs to the list of modules compiled in by default (GH#2261)

  • Possible use-after-free issue via FTP STAT command using -C option; note that the -C option is now silently ignored for FTP STAT commands (GH#2265)

  • Passive FTP data transfers do not honour AllowForeignAddress policy properly (GH#2272)

  • Empty password fields should be rejected by the mod_sql_passwd module (GH#2275)

  • Empty password fields should be rejected by the mod_auth_file module (GH#2279)

  • .ftpaccess file policy bypass possible in certain configurations (GH#2282)

Monday 17th August 2026

Local Packages

• Updated curl in the development repo to new upstream release candidate 8.22.0~rc1

Sunday 16th August 2026

Fedora Project

• Updated perl-GD to 2.91 in Rawhide:

  • Add JXL, UHDR support for new libgd-2.4.0 (from git)

  • JXL: newFromJxl/newFromJxlData readers, jxl() writer (lossless/distance/effort), magic-byte autodetection in new()

  • UHDR: New GD::UHDR class (newFromFile/newFromData, width/height/hasGainMap, resize/crop/rotate/mirror, file/write, getSdr)

  • Work around libgd 2.4.0 gd.h no longer declaring gdImageBoundsSafe()

  • IMAGEQUANT: trueColorToPaletteSetMethod/SetQuality and the GD_QUANT_* constants for the libimagequant-backed quantizer

  • Guard for installations without libimagequant

  • Fix imagequant feature autodetection in Makefile.PL (libimagequant surfaces in gdlib.pc's Libs.private, not Requires.private)

  • Embed rpath (Linux) and fix stale blib/lib/GD/Image.pm so 'make test' reliably exercises the just-configured libgd; fix GD_LIQ detection from the deprecated gdlib-config script

  • Add Affine transformations (GH#21): GD::Image affine matrix builders (affineIdentity/Scale/Rotate/ShearHorizontal/ShearVertical/Translate/Concat/Invert/Flip/Expansion/Rectilinear/Equal/ApplyToPoint) and transformAffineGetImage/transformAffineCopy/transformAffineBoundingBox, wrapping gdAffine*/gdTransformAffine* (libgd >= 2.1.0); fix GD_AFFINE_* constant visibility (same enum/#ifdef issue as GD_QUANT_*)

  • Add more previously-unbound libgd methods (libgd >= 2.1.0 unless noted): paletteToTrueColor, crop, cropAuto, cropThreshold, colorReplace, colorReplaceArray, colorReplaceThreshold, convolution, resolution; cloneImage, getTrueColorPixel, perceptualDiff (libgd >= 2.4.0); clone() now uses the native gdImageClone() when available, fixing truecolor-ness loss on the old new()+copy() fallback; fix GD_CROP_* constant visibility (same enum/#ifdef issue as GD_QUANT_*)

  • Animated WebP support (libgd >= 2.4.0): new GD::WebpAnimWriter (new/addImage/finish, wrapping gdWebpWriteOpenPtr/AddImage/PtrFinish) and GD::WebpAnimReader (newFromData/info/nextImage, wrapping gdWebpReadOpenCtx/GetInfo/NextImage) classes

  • Animated/multi-image JXL support (libgd >= 2.4.0): new GD::JxlAnimWriter (new/addImage/finish, wrapping gdJxlWriteOpenPtr/AddImage/PtrFinish) and GD::JxlAnimReader (newFromData/info/nextImage, wrapping gdJxlReadOpenCtx/GetInfo/NextImage) classes, mirroring GD::WebpAnimReader/Writer

  • Multi-page TIFF support (libgd >= 2.4.0): new GD::TiffMultiWriter (new/addImage/finish, wrapping gdTiffWriteOpenPtr/AddImage/PtrFinish) and GD::TiffMultiReader (newFromData/info/nextImage, wrapping gdTiffReadOpenCtx/GetInfo/NextImage) classes, mirroring GD::WebpAnimReader/Writer (pages have no per-page delay; nextImage() returns a page-info hashref instead); also adds the GD_TIFF_* writer option constants (colorspace, compression, resolution unit, alpha type)

  • Per-format header introspection (libgd >= 2.4.0): new GD::Image->pngInfoData/jpegInfoData/gifInfoData/bmpInfoData/avifInfoData/heifInfoData class methods, wrapping gd{Png,Jpeg,Gif,Bmp,Avif,Heif}GetInfoCtx; each reads just the container facts (dimensions, bit depth, and similar) from an in-memory buffer without fully decoding the image

  • Fixed a longstanding bug in the in-memory gdIOCtx used by every newFrom*Data()/*InfoData() method: its getC() callback never advanced the read position, so any decoder reading a buffer byte-by-byte (as the new bmpInfoData()'s BMP header parser does) would spin re-reading the first byte forever; PNG, JPEG, GIF, WebP, TIFF, JXL, AVIF and HEIF decoding were unaffected because they read through the bulk getBuf() callback instead, which was already correct

  • Worked around inconsistent success/failure return conventions across libgd's new Get*InfoCtx functions: gdPngGetInfoCtx, gdJpegGetInfoCtx, gdAvifGetInfoCtx and gdHeifGetInfoCtx all return 0 on success despite two of their own header comments claiming the opposite, while gdGifGetInfoCtx and gdBmpGetInfoCtx return 1 on success as documented

  • t/affine.t: Compare affineInvert(scale(2,3))'s result with an epsilon (1e-6) instead of exact is_deeply, since -Duselongdouble perls compute the division in extended precision, giving a last-few-ULP-different 1/3 than a plain double (GH#68)

Local Packages

• Updated perl-DBI to 1.652:

  • DBI now requires perl-5.12, driven by CVE's

  • Fix test for perl configured without threads (caught by perl-5.45.1)

  • Small doc fix (GH#155)

  • Add suggested dependency (GH#145)

  • Force placeholder limit on :# and :p# too (CVE-2026-73194)

  • Limit statements to 292 Mb in preparse (CVE-2026-73193)

  • Add a security policy (GH#174)

  • Add dbm_updatable_key attribute to DBD::DBM to configure how keys are updated

  • Fix missing import in DBI::DBD::SqlEngine

  • Fix !Caller2 caller loss when $^P is set (GH#184)

• I had to add a patch to fix build on i686 (GH#189)

Saturday 15th August 2026

Fedora Project

• Updated perl-GD to 2.87 in Rawhide:

  • Fix OpenBSD support (GH#63)

  • Fix $image->compare() usages (GH#64, GH#65)

  • Fix tiff test without libimagequant (GH#66)

Thursday 13th August 2026

• Updated perl-Business-ISBN-Data to 20260812.001 in Rawhide:

  • Data update for 2026-08-12

Local Packages

• Branched the development repository for Fedora 45