Thursday 16th July 2026

Fedora Project

• Updated perl-Business-ISBN-Data to 20260715.001 in Rawhide:

  • Data update for 2026-07-15

Local Packages

• Rebuilt ansible-collection-community-libvirt (2.3.0), bluefish (2.4.1), check (0.15.2), curl (8.21.0), davfs2 (1.7.3), dovecot (2.4.4), grepmail (5.3111), gtkwave (3.3.127), Judy (1.0.5), libgpg-error (1.61), libidn (1.44), libnet (1.3), libssh2 (1.11.1), libxml2 (2.13.9), libxslt (1.1.43), mod_fcgid (2.3.9), nmap (7.92), perl-Any-Moose (0.27), perl-Class-XSAccessor (1.19), perl-DBI (1.651), perl-Dir-Self (0.11), perl-Feature-Compat-Class (0.08), perl-HTML-Lint (2.32), perl-IO-AIO (4.81), perl-MCE (1.902), perl-MIME-tools (5.517), perl-MIME-Types (2.30) and perl-Moose (2.4000) for the Fedora_45_Mass_Rebuild

• Updated perl-Module-CoreList to 5.20260708:

  • Updated for v5.44.0

Wednesday 15th July 2026

Fedora Project

• Updated perl-Unicode-UTF8 to 0.75 in Rawhide:

  • Fixed slurp_utf8() leaking the file descriptor if a fatal "utf8" warning (e.g. warnings FATAL => 'utf8') was thrown while reading an ill-formed file

Local Packages

• Updated perl-Unicode-UTF8 to 0.75 as per the Fedora version

Tuesday 14th July 2026

Fedora Project

• Updated geoipupdate to 8.0.0 in Rawhide:

  • BREAKING CHANGE: 'geoipupdate' stops updating on the first error

  • 'NewUpdater' in the unexported 'internal/geoipupdate' package no longer mutates 'http.DefaultTransport' when a proxy is configured; the CLI is the only caller, so there is no user-visible behaviour change (GH#488)

  • Do not retry proxy CONNECT 4xx errors; these are now treated as permanent failures

• Updated perl-DBD-CSV to 0.64 in Rawhide:

  • Next version will require perl-5.12, following DBI

• Updated perl-Unicode-UTF8 to 0.74 in Rawhide:

  • Added slurp_utf8($filename), which reads an entire file and returns its contents decoded from UTF-8 as a character string

  • Added support for older MSVC C compilers by using __inline in place of the C99 inline keyword on pre-Visual Studio 2015 builds

  • Fixed SSE2 detection to only enable the SIMD implementation on 64-bit x86 targets, which prevents unsupported SSE2 code from being selected on 32-bit x86 builds (GH#14)

• Updated perl-YAML-Syck to 1.47 in F-43, F-44, Rawhide, EPEL-9, EPEL-10.2 and EPEL-10:

• Security:

  • Fix four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags (GH#213)

    • CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input

    • CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared between the node and the anchors table

    • CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683)

    • CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input

  • Harden syck_base64dec() to bounds-check each read so it cannot run past a non-NUL-terminated input buffer (defense-in-depth for callers passing raw buffers; GH#213)

• Bug Fixes:

  • Fix: Enforce $MaxDepth on Load to prevent C-stack exhaustion from deeply nested YAML/JSON input; YAML::Syck and JSON::Syck Load now default to 512, matching Dump (GH#204)

  • Fix: Emit YAML canonical forms (.nan, .inf, -.inf) for NaN/Inf values in Dump so they roundtrip with ImplicitTyping instead of reloading as plain strings (GH#201)

• Maintenance:

  • CI: add an AddressSanitizer job that builds the XS with -fsanitize=address and runs the suite plus the CVE trigger inputs to catch libsyck memory-safety defects; de-pin the libasan version so it tracks the runner's GCC (GH#213)

Local Packages

• Updated geoipupdate to 8.0.0 as per the Fedora version

• Updated perl-DBD-CSV to 0.64 as per the Fedora version

• Updated perl-DBI to 1.651:

  • Fix inverted comparisons for strings in DBI::SQL::Nano (CVE-2026-15043)

  • Document that IS NULL matches empty strings in DBI::SQL::Nano

  • Fix DBD::File to ensure that the table is not a symlink outside of f_dir (CVE-2026-15392)

  • Fix an out-of-bounds error when a statement handle has no fields but the source row is not empty (CVE-2026-60082)

  • Add an overridable upper bound $MAX_PATH_DEPTH for DBI::ProfileData (CVE-2026-60081)

• Updated perl-Unicode-UTF8 to 0.74 as per the Fedora version

• Updated perl-YAML-Syck to 1.47 as per the Fedora version

Monday 13th July 2026

Fedora Project

• Updated perl-CPAN-Requirements-Dynamic to 0.003 in Rawhide:

  • Avoid undefinedness warning in config_defined

• Updated perl-Test-Synopsis to 0.18 in Rawhide:

  • Fix: =for test_synopsis directives are now applied regardless of their position relative to the SYNOPSIS code block (GH#20, regression since 0.14)

Local Packages

• Updated perl-CPAN-Requirements-Dynamic to 0.003 as per the Fedora version

• Updated perl-Test-Synopsis to 0.18 as per the Fedora version

Friday 10th July 2026

Fedora Project

• Updated perl-Sereal-Decoder to 5.008 in Rawhide:

  • Decoder now supports 'thaw_allow_classes' and 'thaw_deny_action' to control thaw callbacks during decoding

• Updated perl-Sereal-Encoder to 5.008 in Rawhide:

  • Released to match Decoder version

• Updated perl-Sereal to 5.008 in Rawhide:

  • Decoder now supports 'thaw_allow_classes' and 'thaw_deny_action' to control thaw callbacks during decoding