Tuesday 4th August 2026

Fedora Project

• Updated perl-DateTime-Format-XSD to 0.5 in Rawhide:

  • DateTime::Format::ISO8601 minimum version update to 0.19 for nanoseconds fix

  • Added a SECURITY Policy
  • Minor packaging updates

• Updated proftpd (1.3.9c) in Rawhide and EPEL-10 to update mod_procfs to 0.3:

  • Block access to sysfs as well as procfs filesystems

Local Packages

• Updated perl-Module-CoreList to 5.20260803:

  • Updated for v5.40.5
  • Updated for v5.42.3
  • Updated for v5.45.2

• Updated proftpd (1.3.9c) as per the Fedora version

Monday 3rd August 2026

Local Packages

• Updated curl (8.21.0) to enable zstd compression support in full config from Fedora 45 onwards

Wednesday 29th July 2026

Local Packages

• Updated proftpd (1.3.10rc3) to update mod_procfs to 0.3:

  • Also block access to sysfs filesystems

Tuesday 28th July 2026

Fedora Project

• Merged PR#5 for perl-Compress-Raw-Lzma (2.221) in Rawhide: Disable optional dependencies in RHEL

• Merged PR#1 for perl-Module-Build-Tiny (0.053) in Rawhide: Conditionalize CPAN::Requirements::Dynamic dependency

• Updated proftpd (1.3.8d in EPEL-9 and 1.3.6e in EPEL-8):

  • Address another avenue for SQL injection, via custom SQLUserInfo queries

  • Fix SFTP request payload length underflow calculation (GH#2115, CVE-2026-53994)

  • Fix signed integer overflow via scp file size record parser (CVE-2026-63091)

  • Fix heap buffer overflow via SFTP packet reassembly (GH#2190, CVE-2026-63090)

  • Add mod_procfs, enabled by default: this addresses CVE-2026-35025 (ACL bypass via /proc/self/root path prefix); the mod_procfs module disallows file accesses via procfs filesystems

Monday 27th July 2026

Fedora Project

• Updated perl-Business-ISBN-Data to 20260724.001 in Rawhide:

  • Data update for 2026-07-24

• Updated perl-Module-Pluggable to 6.4 in Rawhide:

  • Add a CI/CD pipeline for the first time in 26 years

  • Add the ability to make search search "strict" and only walk the given search_dirs

  • Add much more documentation to Module::Pluggable::Object

  • Make it so that you can give each search_path its own custom options

  • Finally fix spurious test failure because of already installed modules

  • Remove optional_features from Makefile.PL META_MERGE that sometimes caused installation confusion

  • Add the ability to have different sorting algorithms
  • Fix the issues with OSX extended-attributes on files
  • Clean up old stale core-lib

Local Packages

• Rebuilt all perl-based packages for Perl 5.44 in Rawhide

• Rebuilt bluefish (2.4.2), libxml2 (2.13.9) and libxslt (1.1.43) for the Python 3.15.0b4 ABI change in Rawhide

• Updated dovecot (2.4.4) to obsolete dovecot-fts-xapian (PR#9) in F-45 and later builds as it is no longer maintained; included fts flatcurve is a possible replacement

• Updated perl-ExtUtils-ParseXS to 3.64:

  • Respect output arguments in INTERFACES

  • PERL_UNUSED_VAR() the CV declared when an ALIAS or XSINTERFACE_FUNC_SET has been seen

• Updated perl-Module-Pluggable to 6.4 as per the Fedora version

• Updated perl-Symbol-Util (0.0203) to run the pod spelling release test with LANG=en_US.UTF-8 to address dictionary issues

• Updated perl-YAML to 1.321:

  • Going back to decimal version numbering to make existing comparisons like 'if $YAML::VERSION >= 1.15' work (GH#233)