Monday 1st June 2026

Fedora Project

• Updated perl-Email-Address-List to 0.07 in Rawhide:

  • Update whitespace removal code to remove all types of unicode whitespace in addition to ASCII

• Updated perl-Perl-Critic (1.156) in Rawhide to run tests with LANG=en_US.UTF-8 to fix pod spelling test on Rawhide (running without the ".UTF-8" resulted in errors being triggered for parts of contractions like "isn" and "doesn")

Local Packages

• Updated perl-Perl-Critic (1.156) as per the Fedora version

Tuesday 2nd June 2026

Fedora Project

• Updated perl-GD to 2.85 in Rawhide:

  • Tolerate runtime TIFF decode failures in autodetect (GH#62)

  • Replace cpm with cpanm in github actions

  • Fixed a minor precedence bug in t/z_manifest.t

• Updated perl-IO-Tty (1.31) with fix for Bug #2463168 (perl-IO-Tty-1.24 or newer break coreutils test-suite) (GH#91, GH#95)

• Updated perl-Sereal-Decoder, perl-Sereal-Encoder and perl-Sereal to 5.006 in EPEL-10.2 to make sure that COPY tags cannot be used to read past end of buffer (CVE-2026-8796)

Local Packages

• Updated curl (rc) to new upstream release candidate 8.21.0~rc1

• Updated perl-IO-Tty (1.31) as per the Fedora version

• Updated perl-Module-CoreList to 5.20260601:

  • Updated for v5.43.11

• Cleaned up and rebuilt perl-Sub-Exporter (0.991)

Wednesday 3rd June 2026

Fedora Project

• Merged PR#2 for perl-IO-Socket-SSL to BR: procps-ng rather than procps for the test suite since procps has been provided by the procps-ng package since Fedora 18

Local Packages

• Updated nmap (7.92) to fix OpenSSL 4.0 compatibility

• Updated perl-Archive-Tar to 3.12:

  • Allow '..' links in secure extract in parent path for symlinks and hardlinks

• Updated perl-IO-Socket-SSL (2.098) as per the Fedora version

Friday 5th June 2026

Local Packages

• Updated perl-DBI to 1.648:

  • Correct sprintf usage for trace_msg (GH#132)

  • Add DBIXS_VERSION and DBIXS_RELEASE to dbixs_rev.h

  • Remove -Wbad-function-cast

  • Fix possible stack overflow (CVE-2026-9698)

  • Do not allow table source locations outside explicit given folders

  • DBD::Sponge PRECISION handling (GH#12)

  • Fix possible buffer overflow in preparse

  • Skip mismatching .so's (GH#81)

  • Fix cast warning in dbi_get_state (GH#182)

Sunday 7th June 2026

Fedora Project

• Updated perl-Cpanel-JSON-XS to 4.42 in Rawhide:

  • Ensure encode with a type spec hashref does not change the hashref argument (GH#240)

  • Fix -e docs: "written" → "read" (GH#239)

  • Fix Boolean eq overload matching undef (GH#207); Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal to false because undef stringifies to "" - added defined() guard

  • Fix error messages showing overloaded stringification for blessed objects (GH#191); error messages now use ClassName=TYPE(addr) format, bypassing any "" overload

  • Fix type_all_string overriding allow_blessed/convert_blessed (GH#175); with type_all_string + allow_blessed, blessed objects are now encoded as null (not stringified as HASH address)

  • Fix infinite recursion when encode is called from a "" overload (GH#128); the recursion guard temporarily clears convert_blessed and allow_stringify flags on the JSON object before calling the overload, preventing re-entrant encode loops

  • Fix $obj->new creating a broken object (GH#93); when new() is called on an existing object (e.g. $json->new->new), the class name is now extracted from the object's stash rather than using the stringified reference

  • Change allow_nonref default to true (GH#241, matching JSON::PP and JSON::XS 4.0+ and the insecure RFC 7159); encode and decode now accept non-reference values by default; decode_json() with an explicit 0/1 second argument still works; allow_nonref(0) to disable scalars-only for secure JSON

  • Fix minor t/12_blessed.t typo

  • Fix GH#112: encode large whole-number NV values without .0 on 32-bit Perl (values exceeding UV_MAX that Perl stores as float)

  • Fix GH#197: prefer IOK over pNOK when encoding values where IV is accurate but NV is imprecise (SvNOK not set)

Local Packages

• Rebuilt bluefish (2.4.1) for Python 3.15 in Rawhide

• Rebuilt libxml2 (2.13.9) for Python 3.15 in Rawhide

• Rebuilt libxslt (1.1.43) for Python 3.15 in Rawhide

• Updated perl-Cpanel-JSON-XS to 4.42 as per the Fedora version

Monday 8th June 2026

Fedora Project

• Updated perl-DBD-CSV (0.62) in Rawhide to fix test failure with DBI 1.648 onwards

• Updated proftpd to 1.3.9b in F-34, F-44, Rawhide, EPEL-10.2 and EPEL-10:

  • Fix SQL Injection in mod_wrap2_sql via reverse DNS hostname (GH#2057, CVE-2026-44331)

  • Additional fix for session management with OpenSSL 3.2.x or later, when using TLSv1.2 or earlier; this complements the fix for GH#1963 (GH#2056)

  • Hard quota limits on uploads did not cause SFTP WRITE requests to fail as expected (GH#2098)

  • Fix SSH payload length underflow calculation for ETM/ChaChaPoly algorithms in mod_sftp (GH#2102)

  • SSH packet with empty payload triggered null pointer dereference in mod_sftp (GH#2104)

  • Bad DSA signatures could lead to out-of-bounds read of heap memory in mod_sftp (GH#2106)

  • Mismatched RSA/DSA algorithm signatures could lead to null dereference in mod_sftp (GH#2108)

  • Fix SFTP request payload length underflow calculation in mod_sftp (GH#2115)

  • Several modules failed to build using OpenSSL 4.0 (GH#2120)

• Updated mod_proxy to 0.9.7:

  • Add a check on the maximum allowed SSH payload (vs. packet) length (GH#291)

  • Set the payload_len field before checking its value (GH#292)

  • Keep the SSH packet reading code in mod_proxy more in line with what is done in mod_sftp, for legibility (GH#294)

  • Implement support for the OpenSSH-specific ChaChaPoly SSH algorithm (GH#295, GH#296)

  • Correct misspellings noted by codespell (GH#297)

  • Use clang-tidy to start polishing the codebase (GH#298)

  • Disable the Nagle algorithm by default on our TCP connections to back-end servers (GH#299)

  • Require OpenSSL for building (GH#249, GH#300)

  • Documentation fixes

  • Implement a limit on the number of EXT_INFO extensions we'll be willing to accept (GH#303)

  • Comparison of expected/provided MAC data should be done in a constant-time manner
  • Support PKCS11-stored private keys

  • Implement the "mlkem768x25519-sha256" and "sntrup761x25519-sha512" post-quantum SSH key exchange mechanisms (GH#306)

  • Add sanity check for SRV record lengths

  • Ensure that the SSH payload length computation, for ETM/ChaChaPoly packets, does not underflow

  • If we detect a bad DSA signature length, properly error out
  • Ensure that RSA/DSA signatures match their expected algorithm types, and avoid null pointer dereferences

  • Update to build against OpenSSL 4.x (GH#313)

• I added a fix for "error: implicit declaration of function 'handle_kex_sntrup761'" with some older OpenSSL versions (GH#2137)

Local Packages

• Updated perl-DBD-CSV (0.62) as per the Fedora version

• Updated perl-Object-HashBase to 0.017:

  • List Role::Tiny (1.003000+) and Class::Method::Modifiers as RuntimeSuggests in dist.ini

  • Skip role tests when Role::Tiny is missing or older than 1.003000 (no is_role), so install is not blocked

  • Move 'around' modifier test to its own file (t/role_modifiers.t) that skips when Class::Method::Modifiers is unavailable; Role::Tiny loads it lazily only for method modifiers (GH#5)

• Updated proftpd to 1.3.9b as per the Fedora version

• Updated proftpd (rc) to 1.3.10rc2:

  • Scoreboard wlock_entry() function used F_UNLCK instead of F_WRLCK (GH#2058)

  • SQL Injection in mod_wrap2_sql via reverse DNS hostname (GH#2057, CVE-2026-44331)

  • FTP sessions could be prematurely closed during updates of system time/date (GH#2047)

  • Additional fix for session management with OpenSSL 3.2.x or later, when using TLSv1.2 or earlier; this complements the fix for GH#1963 (GH#2056)

  • Add support for post-quantum key change algorithms to mod_sftp; the "mlkem768x25519-sha256" and "sntrup761x25519-sha512" algorithms have been implemented (GH#2033)

  • Implement support for PKCS#11 URIs for TLS private keys in mod_tls (GH#2041)

  • <Limit READ> configurations are not honoured by SITE COPY as they should be (GH#2095)

  • Hard quota limits on uploads did not cause SFTP WRITE requests to fail as expected (GH#2098)

  • Support --with-system-libtool configure option for using the host-provided libtool (GH#2032)

  • Fix SSH payload length underflow calculation for ETM/ChaChaPoly algorithms in mod_sftp (GH#2102)

  • SSH packet with empty payload triggered null pointer dereference in mod_sftp (GH#2104)

  • Bad DSA signatures could lead to out-of-bounds read of heap memory in mod_sftp (GH#2106)

  • Mismatched RSA/DSA algorithm signatures could lead to null dereference in mod_sftp (GH#2108)

  • Timestamps included in SFTP read-only OPEN requests should be ignored (GH#2110)

  • Fix SFTP request payload length underflow calculation in mod_sftp (GH#2115)

  • Several modules failed to build using OpenSSL 4.0 (GH#2120)

• Updated mod_proxy to 0.9.7 as per the Fedora package

• I added a fix for "error: implicit declaration of function 'handle_kex_sntrup761'" with some older OpenSSL versions (GH#2137)

Tuesday 9th June 2026

Fedora Project

• Updated perl-GD to 2.86 in F-43, F-44, Rawhide, EPEL-8, EPEL-9, EPEL-10.2 and EPEL-10:

  • Fix command injection via 2-arg open() in _make_filehandle (CVE-2026-11526)

Local Packages

• Updated curl (rc) to new upstream release candidate 8.21.0~rc2

• Rebuilt dovecot (2.4.4) icu 78.3 in Rawhide (not needed as dovecot no longer uses libicu)

• I also dropped a workaround for over-long test directory name, which is no longer needed

• Updated perl-Object-HashBase to 0.018:

  • Fix bogus parent/role croaks losing their message on perl < 5.14: croak now happens outside the local($@) scope, so the exception is no longer clobbered when the local is restored during unwind

  • Replace '//=' (perl 5.10+) with a defined check so the module compiles on perl 5.8.x as declared by MIN_PERL_VERSION 5.008001

Wednesday 10th June 2026

Fedora Project

• Updated perl-Net-SSLeay (1.92) in Rawhide to add support for OpenSSL 4.0.0 (Bug #2458197, GH#553)

Local Packages

• Updated perl-Net-SSLeay (1.92) as per the Fedora version

Thursday 11th June 2026

Fedora Project

• Updated perl-Test-Simple to 1.302220 in Rawhide:

  • Add [PruneCruft] to dist.ini so build artifacts (blib/, pm_to_blib, MYMETA.*) no longer leak into release tarballs

  • Remove Net::BitTorrent from broken list

  • Amend tests to adapt to more accurate line number reporting in core (GH#1080)

Local Packages

• Updated perl-Net-DNS to 1.55:

  • Fix UDP truncation tests that relied on large RSA RRSIGs

  • Fix unhelpful TAINT error (CPAN RT#178183)

  • TCP read loop treated 1-byte recv() of "0" (0x30) as EOF, corrupting AXFRs (CPAN RT#177003)

  • UNIX.pm: Avoid backticks that depend on shell (CPAN RT#176900)

• Updated perl-Test-Simple to 1.302220 as per the Fedora version

Friday 12th June 2026

Fedora Project

• Updated perl-Business-ISBN-Data to 20260611.001 in Rawhide:

  • Data update for 2026-06-11

• Updated perl-Crypt-PBKDF2 to 0.261630 in F-43, F-44, Rawhide, EPEL-9, EPEL-10.2 and EPEL-10:

  • Change the default hash algorithm to HMAC-SHA256, and increase the default number of iterations to 600,000, in line with current OWASP recommendations (CVE-2026-9641)

  • Generate salts using Crypt::URandom (a strong system RNG) instead of perl's builtin rand(), which is not cryptographically secure (CVE-2026-9638)

  • Use a constant-time comparison in 'validate' to avoid timing attacks (CVE-2017-20240)

Local Packages

• Updated perl-BDB (1.92) to rename atfork_child to bdb_atfork_child to avoid collision with perl 5.43.2+

• Updated perl-Crypt-PBKDF2 to 0.261630 as per the Fedora version

• Updated sendmail (8.18.2) to enable support for SMTPUTF8 (RFC 6531) and to use self-signed certificate instead of the CA bundle (Bug #2476449)

Saturday 13th June 2026

Fedora Project

• Updated perl-Business-ISBN-Data to 20260613.001 in Rawhide:

  • Data update for 2026-06-13

• Updated perl-PPIx-QuoteLike to 0.024 in Rawhide:

  • Remove references to the RT bug tracking system

  • Replace wyant@cpan.org with harryfmudd@comcast.net

  • Repackage licenses so that GitHub can find them (maybe)

  • Add SECURITY policy

  • No functional changes

Local Packages

• Updated perl-PPIx-QuoteLike to 0.024 as per the Fedora version

Sunday 14th June 2026

Local Packages

• Updated perl-PPIx-Regexp to 0.092:

  • Remove references to the RT bug tracking system

  • Replace wyant@cpan.org with harryfmudd@comcast.net

  • Correct documentation errors
  • No functional changes

Monday 15th June 2026

Fedora Project

• Updated perl-Crypt-DSA to 1.21 in F-43, F-44, Rawhide, EPEL-10.2 and EPEL-10:

  • Fixed key material reuse for multiple signing events (CVE-2026-12205, CWE-323)

    • sign() reused the DSA nonce k across signatures (r and k^-1 were cached on the key and not regenerated), allowing private-key recovery from two signatures over different messages

    • Now generates a fresh nonce per signature
    • Keys used to sign more than once with an affected version should be considered compromised

• Updated perl-Crypt-DSA (1.17) in EPEL-8 and EPEL-9 to fix key material reuse for multiple signing events

• Updated perl-Test-Simple to 1.302221 in Rawhide:

  • Prevent the new EBCDIC support from breaking 5.6

• Updated python-paramiko to 3.5.1 in EPEL-10:

  • Private key material is now explicitly 'unpadded' during decryption, removing a reliance on some lax OpenSSL behaviour and making us compatible with future Cryptography releases (GH#2490)

• This update was done because the "future Cryptography releases" landed in EL-10

Local Packages

• Updated perl-Test-Simple to 1.302221 as per the Fedora version

Tuesday 16th June 2026

Fedora Project

• Updated perl-IO-Compress to 2.221 in Rawhide:

  • Update zipdetails to version 4.008

  • Update reference for the info-zip extrafld file

  • Add hex values for utf8 encoding as a comment

  • Fix File::GlobMapper wildcard replacement after ordinary letters

  • IO-Compress: generalize for EBCDIC

  • Remove test for filename when not needed, which helps with EBCDIC support (GH#73)

• Updated perl-Test-MockModule to 0.185.3 in Rawhide:

  • Don't require Moose when mocking Moo (GH#93, GH#94)

• Updated perl-Test-Simple to 1.302222 in Rawhide:

  • Add missing Changes entry

  • Fix test that fails on some Windows versions due to path separators

Local Packages

• Updated perl-IO-Compress to 2.221 as per the Fedora version

• Updated perl-Pod-Coverage-TrustMe to 0.002002:

  • Fix passing options to all_pod_coverage_ok

• Updated perl-Test-MockModule to 0.185.3 as per the Fedora version

• Updated perl-Test-Simple to 1.302222 as per the Fedora version

Wednesday 17th June 2026

Local Packages

• Updated curl (rc) to new upstream release candidate 8.21.0~rc3

• Updated libidn to 1.44:

  • Fix read-out-of-bounds error in ToUnicode APIs

  • Fix strcpy buffer overflow in examples

  • Update gnulib files, translations and various maintenance fixes

• Updated perl-HTTP-Tiny to 0.096:

  • Caller-supplied Authorization, Cookie and Proxy-Authorization headers are now stripped on cross-origin redirects by default; use allow_credentialed_redirects to opt out

  • Redirects are no longer automatically followed when going from https to http; use allow_downgrade to revert to the original behaviour

Thursday 18th June 2026

Local Packages

• Updated curl (8.21.0~rc3) to fix multi_fdset must not report only the wakeup socket (Bug #2460719)

Sunday 21st June 2026

Fedora Project

• Updated perl-YAML-LibYAML to 0.908.0 in Rawhide:

  • Fix for OOP interface: improve handling of mapping keys, for example numbers

Local Packages

• Rebuilt curl (8.21.0~rc3) for OpenSSL 4.0 in Rawhide

• Rebuilt dovecot (2.4.4) for OpenSSL 4.0 in Rawhide

• Rebuilt libssh2 (1.11.1) for OpenSSL 4.0 in Rawhide

• Rebuilt nmap (7.92) for OpenSSL 4.0 in Rawhide

• Rebuilt perl-Net-SSLeay (1.92) for OpenSSL 4.0 in Rawhide

• Updated perl-YAML-LibYAML to 0.908.0 as per the Fedora version

• Rebuilt proftpd (1.3.9 and 1.3.10rc2) for OpenSSL 4.0 in Rawhide

• Rebuilt sendmail (8.18.2) for OpenSSL 4.0 in Rawhide

Monday 22nd June 2026

Fedora Project

• Updated perl-DBD-CSV to 0.63 in Rawhide:

  • It's 2026

  • New test for DBI-1.648 CVE fix

  • Minor typo in doc
  • Raise recommended versions for fixed CVE's

• Updated perl-Finance-Quote to 1.70 in F-43, F-44, Rawhide, EPEL-9, EPEL-10.2 and EPEL-10:

  • New module Finnhub.pm: Fetches quotes from https://finnhub.io using a free personal-use API key

  • GoogleWeb.pm: Adapt to the redesigned Google Finance site

  • Tradegate.pm: Remove explicit "our $VERSION" assignment that collided with the dzil-injected version, producing a duplicate declaration and an "our variable $VERSION redeclared" warning; use a bare # VERSION marker like the other modules

  • Tradegate.pm: Trim whitespace before parsing date and time

  • Added CurrencyRates/Frankfurter

  • Removed AEX.pm: Euronext.com added JavaScript based anti-webscraping

  • Added CurrencyRates/UniRate.pm

• Updated perl-GDGraph to 1.56 in EPEL-8 and EPEL-9:

  • Fix failing XBM test resulting from some upstream changes (CPAN RT#140940)

  • Skip samples tests if libgd has gd/gd2 image support disabled, which is the default starting with version 2.3.3 (see https://github.com/libgd/libgd/issues/428)

  • Improve language in documentation

• Updated perl-Module-Extract-VERSION to 1.121 in Rawhide:

  • Support the old qv() syntax from version.pm

• Updated perl-Text-CSV_XS to 1.64 in Rawhide:

  • Check attribute lengths (memory protection)
  • Minor code consistencies (not user-visible)
  • Dropped support for 5.6.x and 5.8.0; minimum perl is now 5.8.1

  • Fix special str setting consistency for types, undef_str and comment_str

  • Characters []:*/\ are not allowed in XLSX sheet names

  • Fix syntax error in csv2xlsx

Local Packages

• Updated perl-DBD-CSV to 0.63 as per the Fedora version

• Updated perl-DBI to 1.649:

  • Extra Cwd::abs_path required for Windows

• Updated perl-List-SomeUtils-XS to 0.59:

  • Fix a heap buffer overflow in the pairwise function when it would return a very large list

• Updated perl-Module-Extract-VERSION to 1.121 as per the Fedora version

• Updated perl-Text-CSV_XS to 1.64 as per the Fedora version

Tuesday 23rd June 2026

Fedora Project

• Updated perl-MetaCPAN-Client to 2.044000 in Rawhide:

  • ResultSet: items return an arrayref (GH#151, GH#152)

  • Documentation updates (GH#150)

Local Packages

• Updated perl-MetaCPAN-Client to 2.044000 as per the Fedora version

Wednesday 24th June 2026

Fedora Project

• Merged libssh2 PR#3 to fix CVE-2026-55200 (transport.c: Additional boundary checks for packet length) and CVE-2026-55199 (packet.c: check _libssh2_get_string() return in EXT_INFO handler) and built (1.11.1) for F-43, F-44, Rawhide, EPEL-9, EPEL-10.2 and EPEL-10

• Branched and built perl-Crypt-PBKDF2 (0.261630) for EPEL-8

• Updated perl-Module-CPANTS-Analyse to 1.03 in F-43, F-44 and Rawhide:

  • Fix tests to work with newer Archive::Tar (GH#51)

  • Check link errors and warnings while extracting an archive

Local Packages

• Updated curl to 8.21.0:

  • curl: Named globs in output file name for upload glob references

  • HTTP/3: Add proxy CONNECT and MASQUE CONNECT-UDP support (ngtcp2 QUIC)

  • http2: Remove stream dependency tracking (CVE-2026-10536)

  • lib: Drop support for CURLAUTH_DIGEST_IE

  • libssh: Add support for SHA256 host public keys

  • tool_urlglob: Add named globs

  • _ENVIRONMENT.md: Windows does case insensitive environment variables

  • _URL.md: Remove the zone-id mention

  • AmigaOS: Avoid explicit_bzero with clib2 in curl_setup.h

  • AmigaOS: Fix build fallouts, re-add to CI

  • asyn-thrdd: Add IPv6 guards

  • asyn-thrdd: Fix result processing without wakeup socketpair

  • autotools: mbedtls detection fixes

  • BINDINGS: Update Hollywood link

  • BUFQ.md: Re-sync with source code

  • build: Enable '-Wlogical-op' picky warning for GCC 4.4+

  • build: Omit zlib pkg-config reference for Android

  • cf-h2-prox: Fix peer leak

  • cf-h2-proxy: Drop interim responses

  • cf-https-connect: Do not engage on proxy origin

  • cf-ip-happy.c: Minor comment typo

  • cf-ip-happy: Update documentation

  • cf-socket: Make Curl_addr2string static

  • cf-socket: Set scope_id for IPv6 link-local addresses

  • cf-socket: Store errno from do_connect in ctx->error

  • cfilters: Fix busy loop on blocked transfers

  • chunked: Reject invalid bytes in trailer

  • CIPHERS.md: Fix the example that uses only TLS 1.3

  • cmake/FindGSS: Drop "MIT Unknown" version value, related tidy ups

  • cmake/FindGSS: Drop CMake <3.16 compatibility logic

  • cmake/FindGSS: Fix comment, adjust custom flavour property name

  • cmake/FindGSS: Prioritize MIT over GNU in pkg-config detection

  • cmake: Auto-select static nghttp2/nghttp3/ngtcp2 Config

  • cmake: Export/forward 'NGTCP2_CRYPTO_BACKEND'

  • cmake: Fix three issues generating lib options in config files

  • cmake: Fix zstd CMake config name

  • cmake: Opt in 'MSVC_VERSION' 1951 to picky warnings

  • cmake: Quote 'COMPONENTS' string in 'curl-config.in.cmake'

  • cmake: Simplify 'LINK_ONLY' imported target extraction

  • config2setopts: Use default protocol properly (CVE-2026-12064)

  • connect: Remove deref of freed pointer in trace call

  • content_encoding: Fix limit failure message

  • content_encoding: Fix non-last chunked rejection

  • content_encoding: Timeout during slow decoding

  • cookie: Check __Secure- and __Host- case-sensitively when read from file

  • cookie: Compare path case-sensitively
  • cookie: Reject control octets in file-loaded cookies

  • cookie: Simplify strstore(), remove outdated comment

  • cookie: Tailmatch the domains for secure override

  • cookie: Trim trailing dots when checking PSL (CVE-2026-8924)

  • creds: Add sasl service name (CVE-2026-8458)

  • creds: Create with empty user+pass
  • creds: Mask OAuth bearer token in trace logs
  • creds: Remove two unused functions

  • curl_easy_pause.md: Rephrase the stream cache when pause clause

  • curl_easy_setopt.md: Change options when no transfer runs

  • curl_formdata: Fix to pass long where missing, document 'CURLFORM_NAMELENGTH'

  • curl_multi_assign.md: Clarify lifetime

  • curl_ntlm_core: Fix nettle 4+ builds in certain MultiSSL combos

  • curl_ntlm_core: Propagate DES 'CryptEncrypt()' error

  • curl_sha512_256: Fix result code on error

  • CURLINFO_CONTENT_LENGTH_UPLOAD_T.md: Expand

  • CURLMOPT_SOCKETFUNCTION.md: This sends all file descriptors

  • CURLOPT_CHUNK_BGN_FUNCTION: Target is there for symlinks only

  • CURLOPT_DISALLOW_USERNAME_IN_URL: Is for CURLOPT_URL only

  • CURLOPT_DOH_URL.md: Does not inherit proxy options

  • CURLOPT_ECH.md: Simplify the description language

  • CURLOPT_HAPROXYPROTOCOL.md: Only sent for newly setup connections

  • CURLOPT_MAXFILESIZE: Clarify this also works for on-going transfers

  • CURLOPT_PINNEDPUBLICKEY.md: Does not apply for other origins

  • CURLOPT_PORT.md: Use stronger language

  • CURLOPT_SHARE: Warn about early remove

  • CURLOPT_SSH_HOSTKEYFUNCTION.md: For new connections only

  • CURLOPT_WRITEFUNCTION.md: Mention redirects

  • CURLOPT_WRITEFUNCTION.md: Remove stray reference to HSTS

  • delta: Harden external command invocations
  • digest: Escape control codes too
  • digest: Flush proxy state on proxy or credential change

  • digest: Flush state on origin or credential change (CVE-2026-11856)

  • dns-httpsrr-lookup: Use origin, not peer

  • dnscache: Remove Curl_dns_entry_link

  • docs/libcurl: Fix the version for curl_multi_socket_action

  • docs: End "...can be used several times..." sentences with period

  • docs: Fix --follow doc typo

  • docs: Fix a couple of typos
  • docs: Fix grammar and wording in FAQ

  • docs: Fix odd wording in CONTRIBUTE.md

  • docs: Note CURLOPT_PINNEDPUBLICKEY has no effect on legacy LDAP backend

  • docs: Returned header size reflects HTTP/1-style format
  • doh: Cap the maximum TTL to 24 hours

  • doh: Drop redundant 'curlx_dyn_free()' call in 'doh_probe_done()'

  • doh: Stricter HTTPS RNAME parsing
  • ECH: Clean-ups
  • event: Fix wakeup consumption

  • ftp: Avoid accessing EPSV response one byte past the NULL

  • ftp: Remove 2 Curl_resolv_blocking() calls

  • ftp: Remove bits.ftp_use_control_ssl

  • ftplistparser: Clear strings.target if not symlink

  • gnutls: Allow building with nettle 4.0
  • gnutls: Fix more nettle 4+ compatibility issues

  • gnutls: Require 3.7.2 for earlydata

  • gsasl: Fix potential double free (CVE-2026-8925)

  • gtls: Fix ignored return and uninitialized status in OCSP check
  • gtls: Fix some typos
  • gtls: Minor fixes and improvements
  • gtls: Use the correct return code in trace output

  • gtls: Verify OCSP response signature in gtls_verify_ocsp_status

  • h3-proxy: Fix callback return values and a typo in tests

  • hostip: Remove unused MAX_HOSTCACHE_LEN and MAX_DNS_CACHE_SIZE

  • hsts.md: Mention multiple curl invokes effect

  • hsts: Duplicate live HSTS data in curl_easy_duphandle

  • http-proxy: Verify CONNECT response headers

  • HTTP3.md: Update quiche build

  • http: Don't pass on set cookies to new origins

  • http: Prefer chunked encoding over Content-Length: 0

  • http: Reject spurious CR bytes in headers

  • http_digest: Return better error

  • idn: Replace header guards with forward declaration

  • INSTALL-CMAKE.md: Document CMake environment variables

  • INTERNALS.md: Document minimum nghttp3 and ngtcp2 versions

  • KNOWN_BUGS.md: Remove fixed GnuTLS <-> OpenSSL incompat bug

  • KNOWN_BUGS: Remove stale Threads::Threads entry

  • krb5_sspi: Fix error message on 'DecryptMessage()' fail

  • ldap: base64 encode binary LDIF values with WinLDAP
  • ldap: Fix minor leak on write callback error

  • ldap: Fix to not leak 'attribute' on OOM (WinLDAP)

  • ldap: Switch off chasing referrals

  • lib678: Fix to not be perma-skipped

  • lib: Make '__STDC_VERSION__' literals 'L' (where missing)

  • lib: Transfer origin and proxy handling
  • lib: Two minor typos

  • libcurl-easy.md: Minor clarifications

  • libssh2: Do not use deprecated macros when unavailable

  • libssh2: Drop stray double-negative from 'strncmp()' result

  • libssh2: Fix to return error code on missing parameter

  • libssh2: Replace macro names with non-misspelled alternatives

  • libssh2: Save non-standard port to 'known_hosts'

  • libssh2: Sync version check with INTERNALS.md

  • libssh2: Use non-deprecated 'libssh2_knownhost_addc()'

  • libssh: Map SSH_KNOWN_HOSTS_OTHER to CURLKHMATCH_MISMATCH (CVE-2026-9547)

  • m4: Drop redundant conditions in TLS library detections

  • Makefile.am: Drop test1190 listed twice

  • managen: Apply minor fixes and improvements

  • mbedtls: Null-terminate the private key blob

  • mk-unity.pl: '#include', and not concatenate input headers

  • mqtt: Return error on truncated Remaining Length

  • mqtt: Validate PINGRESP and DISCONNECT have remaining_length == 0

  • multi: Handle pause in multi socket callback (CVE-2026-9080)

  • multi: Remove a stale comment

  • multi: Silence gcc 16 '-Wnull-dereference', bump CI job to test

  • multi: xfers_really_alive

  • netrc: Remember and check filename loaded

  • netrc: Scanner refactor (CVE-2026-8926)

  • ngtcp2: Fail handshake directly (CVE-2026-9545)

  • openssl: Do not mix OpenSSL int result with 'CURLcode' variable

  • os400sys: Fix theoretical length overflows

  • peer.h: Fix typo in comment

  • pingpong: Reject nul byte in server response line

  • progress: Fix CURLINFO time reporting

  • psl: Require libpsl 0.16.0 (2016-12-10) or greater

  • pytest: Pass '--disable' to curl

  • pytest: Re-enable test test_05_01 and test_05_02 for quiche 0.29.0+

  • pythonlint.sh: Make it fail on error, fix ruff warnings in pytest

  • quic: Count zero length packets against max (CVE-2026-11352)

  • ratelimits: Use minimal burst rate

  • RELEASE-PROCEDURE.md: Update coming release dates

  • resolve: Mention in error that IP address is expected

  • rtsp: Bump buf after rtsp_filter_rtp()

  • runner.pm: Apply minor correctness fix

  • runner.pm: Set 'CURL_TESTNUM' for 'precheck' commands

  • runtests: Fix tests for curl builds with embedded CA bundle

  • rustls: Error on CURLOPT_CRLFILE with native CA store

  • schannel: Check 'schannel_sha256sum()' success, and more

  • schannel: Enforce Extended Key Usage for custom CA roots

  • schannel: Error on TLS 1.3-only with cipher list

  • schannel: Fix https proxy for client cert and certinfo

  • schannel: Fix revoke_best_effort setting for proxy

  • schannel: Use fopen instead of CreateFile

  • schannel_verify: Avoid out of blob access

  • schannel_verify: Simplify CryptQueryObject use

  • scripts: Catch Credits-to contributors

  • SECURITY-ADVISORY.md: Expand

  • setopt: Changing the proxy port is also a proxy change

  • setopt: Clear proxy auth properly on NULL (CVE-2026-9079)

  • setopt: Clear the "custom" CA booleans when set to NULL

  • setopt: CURLOPT_MAXCONNECTS set to 0 restores default value

  • setopt: Deref the old referer when setting a new

  • setopt: Fix to honour 'CURLOPT_PROXY_CAINFO_BLOB' over Native CA

  • setopt: Gate a few proxy TLS options by checking backend support
  • setopt: More careful clean-up of the HSTS cache

  • setopt: Return error if received 'curl_blob->data' is NULL

  • show-headers.md: Mention bold headers and --no-styled-output

  • sigv4: URL encode the user name in the header

  • smb: constify 'strchr()' result variable

  • smb: Integer overflow proof a size check

  • smbserver: Update internal id generation for Python 3

  • socket: Introduce 'SOCK_EAGAIN()' and use it

  • socket: Use name 'sockerr' for socket error variables

  • socks_sspi: Invalid response length is a fatal error

  • socks_sspi: Store socks5_gssapi_enctype

  • spnego_sspi: Honour CURLOPT_GSSAPI_DELEGATION for Windows SSPI

  • spnego_sspi: Preserve distinction btw policy-only and uncond delegation

  • src: Fix comment typos

  • src: Sync nghttp2 versions checks with current requirements

  • ssl native_ca_store: Always reinit (CVE-2026-11564)

  • SSLCERTS: Document 8.19.0 default Native CA builds (Windows)

  • sspi: Clear SSPI credentials on AcquireCredentialsHandle failure

  • sspi: Free libcurl allocated memory with curlx_free

  • telnet: Drop an 'int' cast no longer necessary

  • telnet: Drop redundant interim variables
  • telnet: Fix error message typos
  • telnet: Fix old copy-paste typo in variable name

  • telnet: Honour CURLOPT_TIMEOUT in send_telnet_data()

  • test1588: Use %TESTNUMBER, not hard-coded number

  • test1981: Explicitly set the locale

  • tests: Add 'cookies' feature to some tests
  • tests: Add an assert to avoid IPC blocking

  • tests: Add the "--resolve" keyword to tests that lack it

  • tests: Fix unit1636 with --disable-progress-meter

  • tftp: Avoid the timeout calc if the timeout is crazy
  • tftp: Stricter option name checks
  • tidy-up: Add space around operators, where missing
  • tidy-up: Apply clang-format fixes
  • tidy-up: Drop stray casts for allocated pointers
  • tidy-up: Miscellaneous

  • tls: Fix incomplete mTLS config in conn reuse and session cache (CVE-2026-8932)

  • tls: Wolfssl: fixes for PQC key shares

  • tool: Warn when --ssl and --ftp-ssl-control override each other

  • tool_formparse.c: Fix two minor comment typos

  • tool_formparse: Polish error message + make two functions static

  • tool_formparse: tool2curlparts is no longer recursive

  • tool_help: Rectify a bad assert

  • tool_operhlp: Avoid NULL to %s

  • tool_urlglob: Avoid overflow at end of range

  • tool_urlglob: Better 'Duplicate glob name' position

  • tool_urlglob: Make globbing error reported for correct position

  • tool_writeout: Fix %time{} output for %s

  • transfer: Clear referer when set to NULL (CVE-2026-9546)

  • unit1675: Fix potential memory leak on dynbuf fail path

  • unix-sockets: Ignore proxy settings

  • URL-SYNTAX: Document more URL parsing details

  • url: Compare full origin when setting credentials
  • url: Connection credentials origin
  • url: Connection reuse fixes for starttls

  • url: Detect proxy changes read from environment (CVE-2026-8927)

  • url: Don't log bits.close state

  • url: Fix connection reuse for starttls protocols (CVE-2026-8286)

  • url: Keep the question mark for empty queries
  • url: Remove superfluous check

  • url: url_match_destination fix

  • urlapi: Accept 0X prefix in IPv4 address as well

  • urlapi: Change more lowercase percent-encoded to uppercase

  • urlapi: Compare zone-id in Curl_url_same_origin()

  • urlapi: Consume trailing dots after IPv4 numerical addresses
  • urlapi: Deny hostnames with more than one trailing dot
  • urlapi: Drop base fragment on empty redirect

  • urlapi: Fix an issue parsing file URLs

  • urlapi: Fix memleaks on error in 'parse_hostname_login()'

  • urlapi: Fix redirect handling if CURLU_NO_GUESS_SCHEME is set

  • urlapi: Forbid '|' in host

  • urlapi: Handle redirect without set scheme with default-scheme
  • urlapi: URL decode hostname before IP address normalization

  • user-agent.md: Mention double quotes too

  • var: Use a dedicated pointer for the alloc

  • verify-release: Verify more thoroughly with git

  • vquic: Drop stray casts for 'iovec.iov_len'

  • vquic: Fix '-Wunused-parameter' with proxies disabled

  • vtls: More large buffer support and error checks for SHA-256

  • vtls: Use Curl_safecmp for CRLfile and pinned_key comparison

  • vtls_scache: Include signature_algorithms in the SSL peer cache key

  • vtls_spack: Drop redundant macro fallbacks

  • VULN-DISCLOSURE-POLICY.md: Emphasize comm as a human

  • VULN-DISCLOSURE-POLICY.md: Emphasize the no email thank you part

  • VULN-DISCLOSURE-POLICY.md: Test code is not secure

  • VULN-DISCLOSURE-POLICY: Non-released code

  • websockets: Auto-tunnel through http proxy
  • websockets: Buffer ugprade data at connection level
  • windows: Update MS SDK versions in comments

  • winldap: Avoid NULL pointer deref on 'ldap_get_dn()' fail

  • ws: Make pong sending lazy (CVE-2026-11586)

  • x509asn1: Fix DH public key parameter extraction

  • x509asn1: Fix operator order in do_pubkey

• I adjusted the parallel test jobs cap to 32 (from 64) to avoid overwhelming system resources

• Updated libssh2 (1.11.1) as per the Fedora version

• Updated perl-Module-CPANTS-Analyse to 1.03 as per the Fedora version

Thursday 25th June 2026

Fedora Project

• Updated libssh2 (1.11.1) in F-43, F-44, Rawhide, EPEL-9, EPEL-10.2 and EPEL-10 to fix CVE-2025-15661: Information disclosure and denial of service via crafted SFTP response

• Updated perl-Business-ISBN-Data to 20260624.001 in Rawhide:

  • Data update for 2026-06-24

Local Packages

• Updated libssh2 (1.11.1) as per the Fedora version

Friday 26th June 2026

Fedora Project

• Updated perl-IO-Socket-SSL to 2.099 in Rawhide:

  • Close socket by default on failed SSL handshake when created with new, but keep open when upgrading from existing socket with start_SSL; this restores old behaviour that was accidentally broken

Local Packages

• Updated perl-IO-Socket-SSL to 2.099 as per the Fedora version

Sunday 28th June 2026

Fedora Project

• Updated perl-Tree-DAG_Node to 1.36 in Rawhide:

  • No functional changes
  • Fix typo in the 2nd FAQ: "How to process every node in tree?"

  • Add new version of LICENSE to the distro

  • Add new files LICENSE-Artistic-2.0 and LICENSE-GPL-3 to the distro

  • Add Data::Dumper, Getopt::Long, perl to Makefile.PL

  • Remove open from Makefile.PL

  • Modernize MANIFEST.SKIP

Local Packages

• Updated perl-Tree-DAG_Node to 1.36 as per the Fedora version

Monday 29th June 2026

Fedora Project

• Updated perl-Crypt-PasswdMD5 to 1.44 in Rawhide:

  • Replace the file LICENSE-GPL-3 with the file LICENSE containing what is recommended at https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html

  • Patch the source code reference to refer to this LICENSE file

• Updated perl-Module-CPANTS-Analyse to 1.03 in EPEL-10.2 and EPEL-10:

  • Fix tests to work with newer Archive::Tar (GH#51)

  • Check link errors and warnings while extracting an archive

• Updated perl-Module-CPANTS-Analyse (1.02) in EPEL-9 to use relative symlinks rather than absolute symlinks in test (GH#51), which fixes FTBFS with perl-Archive-Tar 3.08 onwards

• Updated perl-Tree-DAG_Node to 1.37 in Rawhide:

  • No functional changes

  • Replace the body of the LICENSE file with what is recommended at https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html

  • Patch the source code reference to refer to this LICENSE file

  • Remove the excess and confusing files LICENSE-Artistic-2.0 and LICENSE-GPL-3

  • Reset the required version of Data::Dumper back to 0

Local Packages

• New package perl-App-Software-License (0.11)

• Updated perl-Tree-DAG_Node to 1.37 as per the Fedora version

Tuesday 30th June 2026

Fedora Project

• Updated ansible-collection-community-libvirt to 2.3.0 in Rawhide:

  • This is a minor release of the community.libvirt collection

  • inventory: Added option 'alternate_id_groups' (default 'true')

  • inventory: Added option 'filter' (default '.*') to include domains by name or uuid that match regex

  • inventory: Added checks to prevent powered-off hosts from being issued guest agent calls

  • plugins: Replaced deprecated imports from 'ansible.module_utils._text' with 'ansible.module_utils.common.text.converters' to avoid ansible-core deprecation warnings and prepare for removal of the private import path in ansible-core 2.24

  • virt: Add 'get_ifaddresses' function to retrieve domain interface addresses

  • virt_cloud_instance: Add support for compressed base images (gzip, bzip2, xz)

  • virt_cloud_instance: Add passt network support via shared network schema (GH#231)

  • virt_cloud_instance: Added cloud-config header when converting cloud-init user-data from dictionary form

  • virt_cloud_instance: Check if instance exists and not running before calling 'create()'

  • virt_install: Add 'wait_timeout' parameter to wait for multi-phase unattended installs to complete

  • virt_install: Add 'wwn' parameter to disk specifications for setting the World Wide Name of a disk device (GH#271)

  • virt_install: Add passt network support with 'value' shorthand and structured 'type: user' form (GH#231)

  • virt_install: Added cloud-config header when converting cloud-init user-data from dictionary form

  • virt_install: Remove incorrect 'required=True' from 'install.os' parameter to allow 'install.no_install=true' without specifying an OS

• Updated perl-DBD-CSV (0.62) in F-43 and F-44 to fix test failure with DBI 1.648 onwards

Local Packages

• Updated ansible-collection-community-libvirt to 2.3.0 as per the Fedora version