Changelog:
===========
- CVE-2026-35328 - Fixed a vulnerability in libtls related to the processing of
the supported_versions extension in TLS that can result in an infinite loop.
- CVE-2026-35329 - Fixed a vulnerability in libstrongswan and the pkcs7 plugin
related to the processing of encrypted PKCS#7 containers that can result in
a crash.
- CVE-2026-35330 - Fixed a vulnerability in in libsimaka related to the
processing of certain EAP-SIM/AKA attributes that can result in an infinite
loop or a heap-based buffer overflow and potentially remote code execution.
- CVE-2026-35331 - Fixed a vulnerability in the constraints plugin related to
the processing of X.509 name constraints that can allow authentication with
certificates that violate the constraints.
- CVE-2026-35332 - Fixed a vulnerability in libtls related to the processing of
ECDH public values in TLS < 1.3 that can result in a crash.
- CVE-2026-35333 - Fixed a vulnerability in libradius related to the processing
of RADIUS attributes that can result in an infinite loop or an out-of-bounds
read that may cause a crash.
- CVE-2026-35334 - Fixed a vulnerability in the gmp plugin related to RSA
decryption that can result in a crash.
- Made the Botan RNG types used/provided by the botan plugin configurable.
- The fix for the vulnerability in the constraints plugin now causes all
certificates that contain excluded name constraints of type directoryName (DN)
to get rejected.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- fix: fix segfault caused by multiple activate_stack_trampoline
- fix: Exclude setup time from benchmark in walltime mode
- feat: collect Python toolchain information via instrument hooks environment API
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
=============
- dhcp: call UNBOUND hook upon NAK
- ndb: support replacement policies for routes
- ndb: support localns setup and fix object cache
- iproute: fix set_netnsid() to be a coroutine
- ci: drop support for Python < 3.10
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
============
- Fixed snapshot comparison for dicts where keys are dataclass instances (or
other custom objects used as dict keys), which previously caused corrupted
snapshots - either collapsing multiple entries into one or appending duplicate
keys on subsequent runs
- Fixed tuple snapshot updates to compare elements positionally rather than
using sequence alignment, so existing expressions (e.g. 3 + 3) are preserved
when elements are removed from or added to a tuple.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
==========
- pre-commit autoupdate
- remove slsa provenance
- Support for Python 3.14
- Try not to read uploaded files into memory
- Migrate the project to uv
- ReCaptcha field testing mode documentation
- Allow nonce in reCaptcha
- CSRF meta tag helper
- widget support the kwargs to add custom html attributes
- Respect exempts in CSRFProtect.protect()
- Adding RECAPTCHA_ENABLE to disable recaptcha
- Improve CSRF Documentation
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
* Remote jobs are spawned via pipe to perl, so environment can be bigger.
* --pipe-part -a supports -L/-N if zextract is installed.
* --pipe-part -a supports .gz, .bz2, .zst-files if zextract is installed.
* Comments in code is redone.
* Bug fixes and man page updates.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
0001-unistr.c-Fix-use-after-free-in-ntfs_uppercase_mbs.patch
removed since it's included in 2026.2.25
Changes:
===========
- Fix bashism in configure script causing errors in non-bash shells.
- (mkntfs) Enable microsecond-level volume creation time.
- Fix two instances of an invalid errno state when encountering NULL in strings.
- Fix a crash when a reparse tag could not be found in the index.
- Fix incorrect MFT free records value when bitmap is expanded.
- Fix 'extras' manpages being installed when extras are disabled.
- Fix various instances of use-after-free conditions in the library and tools.
- Fix typo in NTFS hibernation message. Thanks to Anil Kumar for the report/fix.
- Escape commas in the fsname when libfuse 2.8 or higher is used.
- (ntfsclone) Allow adjusting the sector size in the NTFS boot sector for the target device when restoring images.
- Remove libdl dependency when building without external plugins.
- (ntfsinfo) Show information about the logfile state when dumping metadata.
- (ntfsinfo) Fix displaying crowded directories or indexes.
- (ntfsinfo) Fix displaying the security descriptor list in ntfsinfo.
- Fix heap buffer overflow when POSIX ACLs were enabled (CVE-2026-40706). Thanks to Andrea Bocchetti for the report.
- (ntfsusermap) Fix overflow when constructing backup filename.
- Fix two time-of-check-time-of-use conditions.
- Fix missing malloc/sscanf return value checks.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- Add a new addressing mode "mscc": Used to access PHYs from Microchip that
uses C22 register 31 as a page register
- Fix VPATH builds and various other build related warnings
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changes:
==========
- Avoid repeated prefix language- in code block language specification if the
input already explicitly includes the prefix.
- Permissive autolink extensions (MD_FLAG_PERMISSIVExxxAUTOLINKS) are now tiny
bit more permissive, allowing + and - characters to be anywhere in the path
portion of the URL. This also improves compatibility with GFM.
- Make Unicode-specific code compliant to Unicode 18.0.
Fixes: ===========
- #236: Fix quadratic time behavior caused by one-by-one walking over block
lines instead of calling md_lookup_line().
- #238: Fix quadratic time and output size behavior caused by malicious misuse
of link reference definitions.
- #242: The strike-through extension (with flag MD_FLAG_STRIKETHROUGH) now
follows same logic as other emphasis spans in respect to punctuation
character and word boundaries.
- #248: Fix handling tab when removing trailing whitespace, especially in
connection with ATX headers.
- #266: We now correctly abort the parser when a callback returns non-zero.
(Previously it worked correctly only for negative values, values greater than
zero were causing strange and inconsistent behavior.)
- #271: Fix handling a code span whose closer is on the next line and yet
another text follows. In the case we erroneously outputted the closer code
span mark as part of the text.
- #275: Fix md_decode_utf16le_before__(). (Only affected MD4C builds built with
-MD4C_USE_UTF16 on Windows.)
- #278, #294: Do not try to interpret characters in a link URL as Markdown
syntax characters.
- #292: Fix detection of closing code block fence if it has a trailing
tabulator.
- #299: Fix invalid free() in an error path.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
Fix possible failures when extracting metadata from EPUB, ODF and OOXML documents
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
=============
- Support for terminal bell and keyboard LEDs
- Fix build musl
- test/vte: fix memory leak in vte tests
- Refactor scrollback and selection
- screen: Fix wrong attribute for new cells when resizing
- Fix remove from sb
- Fix get next line
- Fix scrollback position
- test: robustness, make the test faster.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
License-Update: Copyright year updated to 2026
Changelog:
=============
- Added CTAP 2.3 support.
- Restrict webauthn.dll search paths; YSA-2026-01.
- Support application-managed PIN/UV Auth tokens; gh#806.
- Support 64-byte hmac-secret salts when using windows://hello.
- Fixed a U2F transaction handling bug when a timeout had been set; gh#917.
- Fixed a bug where stdin was closed on fido_nl_new failure; gh#923.
- fido2-token: new -G -t mode to to retrieve a PPUAT.
- fido2-token: new -I -t mode for deciphering encrypted fields.
- fido2-cred -M: support the -t toggle argument
- Improved documentation and examples.
- Removed tools from SDK packaging on Windows.
- New API calls
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
CVE-2026-41254_1.patch
CVE-2026-41254_2.patch
removed since they're included in 2.19
Changes:
========
- CMake build system. Thanks to Vlad Erium for the initial implementation and
kmilos for improvements.
- Large files support to use profiles up to 4Gb
- Black point compensation works on multi-channel profiles
- Added more test platforms/architectures in GitHub tests, Cygwin and MSYS are
now fully checked.
- jpgicc banner is not shown on normal operation, only when help is requested.
- Added a way to access internal transform pipelines. For read only.
- Add a way to retrieve the CMM signature
- Added extra checks on postscript undocumented functions
- Added guard on integer overflow when reading .cube files
- Added unneeded checks as a try to get rid of spam reports about
"vulnerabilities" that are not real.
- Utility program names generated by Visual Studio 2026 are now same as all
other platforms.
- Creating an output profile by cmsTransform2DeviceLink does not propagate
correctly the colorant table. Fixed.
- Added some profile class definitions from iccMAX
- Deprecated uint16 and uint32 types removed from tifdiff
- fixed generation of tifdiff on Cmake and meson
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Wang Mingyu