# changelog

author: Satoe Imaishi <simaishi@redhat.com> - 1:2.15.9-1
changelog:
  - ansible-core 2.15.9 release
  - Fix CVE-2024-0690 (possible information leak in tasks that ignore
    ANSIBLE_NO_LOG configuration)


author: Dimitri Savineau <dsavinea@redhat.com> - 1:2.16.13-1
changelog:
  - ansible-core 2.16.13 release
  - Fix CVE-2024-8775 (Exposure of Sensitive Information in Ansible
    Vault Files Due to Improper Logging)
  - Fix CVE-2024-9902 (Ansible-core user may read/write unauthorized
    content)


author: Dimitri Savineau <dsavinea@redhat.com> - 1:2.16.14-1
changelog:
  - ansible-core 2.16.14 release
  - Fix license and manpages macros usage
  - Fix CVE-2024-11079 (Unsafe Tagging Bypass via hostvars Object in
    Ansible-Core)


author: Satoe Imaishi <simaishi@redhat.com> - 1.1.4-2
changelog:
  - Update to 1.1.4
  - Fix CVE-2025-2877 (exposure inventory passwords in plain text when starting a rulebook activation
    with verbosity set to debug in EDA)


author: Satoe Imaishi <simaishi@redhat.com> - 4.6.10-1
changelog:
  - Update to 4.6.10
  - Fix CVE-2025-27516 (Jinja sandbox breakout through attr filter selecting format method)


author: Satoe Imaishi <simaishi@redhat.com> - 4.6.12-1
changelog:
  - Update to 4.6.12
  - Fix CVE-2025-26699 (Django: Potential denial-of-service vulnerability in django.utils.text.wrap())


author: Satoe Imaishi <simaishi@redhat.com> - 4.6.19-1
changelog:
  - Update to 4.6.19
  - Fix CVE-2025-47273 (setuptools: Path Traversal Vulnerability in setuptools PackageIndex)


author: James Marshall <jamarsha@redhat.com> - 1.0-4
changelog:
  - Add uwsgi executions to allowed for awx
  - Specify awx languages for allowed operations
  - Choose the correct python version on install for awx_python


author: James Marshall <jamarsha@redhat.com> 1.2.0-1
changelog:
  - PRERELEASE
  - Add distro and insights-analytics-collector dependencies
  - Add EDA user to systemd-journal group
  - Move postgresql dependency from base to application dependency


author: Satoe Imaishi <simaishi@redhat.com> - 1.1.11-1
changelog:
  - Update to 1.1.11
  - Fix CVE-2025-49521 (Template Injection via Git Branch and Refspec in EDA Projects)
  - Fix CVE-2025-49520 (Authenticated Argument Injection in Git URL in EDA Project Creation)


author: Satoe Imaishi <simaishi@redhat.com> - 2.5.20250312-1
changelog:
  - Update to 2.5.20250312
  - Fix CVE-2025-26791 (Mutation XSS in DOMPurify Due to Improper Template Literal Handling)


author: Satoe Imaishi <simaishi@redhat.com> - 1.3.2-2
changelog:
  - Rebuild for multiple architectures
  - Rebuild for RHEL 9.0 support
  - Use python macro to set pulpcore rpm name


author: Satoe Imaishi <simaishi@redhat.com> - 42.0.5-1
changelog:
  - Update to 42.0.5
  - Fix CVE-2023-49083 (NULL-dereference when loading PKCS7 certificates)
  - Fix CVE-2024-26130 (NULL pointer dereference with pkcs12.serialize_key_and_certificates
    when called with a non-matching certificate and private key and an hmac_hash override)


author: Satoe Imaishi <simaishi@redhat.com> - 3.9.1-1
changelog:
  - Update to 3.9.1
  - Fix CVE-2023-49082 (CRLF injection if user controls the HTTP method using
    aiohttp client)
  - Fix CVE-2023-49081 (request modification)
  - Fix CVE-2023-47627 (numerous issues in HTTP parser with header parsing)


author: Satoe Imaishi <simaishi@redhat.com> - 3.9.3-1
changelog:
  - Update to 3.9.3
  - Fix CVE-2024-23334 (follow_symlinks directory traversal vulnerability)
  - Fix CVE-2024-23829 (http request smuggling)


author: Satoe Imaishi <simaishi@redhat.com> - 3.10.11-1
changelog:
  - Update to 3.10.11
  - Fix CVE-2024-52304 (aiohttp vulnerable to request smuggling due to incorrect
    parsing of chunk extensions)


author: Satoe Imaishi <simaishi@redhat.com> - 23.6.2-2
changelog:
  - Update to 23.6.2
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Dimitri Savineau <dsavinea@redhat.com> 22.12.0-2
changelog:
  - Update to 22.12.0
  - Fix CVE-2024-21503 (fix catastrophic performance in
    lines_with_leading_tabs_expanded())
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 3.2.22-1
changelog:
  - Update to 3.2.22
  - Fix CVE-2023-43665 (Denial-of-service possibility in django.utils.text.Truncator)


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.11-1
changelog:
  - Update to 4.2.11
  - Fix CVE-2024-27351 (Potential regular expression denial-of-service in
    django.utils.text.Truncator.words())


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.16-1
changelog:
  - Update to 4.2.16
  - Fix CVE-2024-45230 (Potential denial-of-service vulnerability in django.utils.html.urlize())
  - Fix CVE-2024-42005 (Potential SQL injection in QuerySet.values() and values_list())
  - Fix CVE-2024-41991 (Potential denial-of-service vulnerability in django.utils.html.urlize()
    and AdminURLFieldWidget)
  - Fix CVE-2024-41990 (Potential denial-of-service vulnerability in django.utils.html.urlize())
  - Fix CVE-2024-41989 (Memory exhaustion in django.utils.numberformat.floatformat())
  - Fix CVE-2024-39614 (Potential denial-of-service in django.utils.translation.get_supported_language_variant())
  - Fix CVE-2024-39330 (Potential directory-traversal in django.core.files.storage.Storage.save())
  - Fix CVE-2024-39329 (Username enumeration through timing difference for users with
    unusable passwords)
  - Fix CVE-2024-38875 (Potential denial-of-service in django.utils.html.urlize())


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.18-1
changelog:
  - Update to 4.2.18
  - Fix CVE-2024-56374 (potential denial-of-service vulnerability in IPv6 validation)
  - Fix CVE-2024-53907 (Potential denial-of-service in django.utils.html.strip_tags())


author: Satoe Imaishi <simaishi@redhat.com> - 2.5.20250730-1
changelog:
  - Update to 2.5.20250730
  - Fixes CVE-2025-7738 (Sensitive Authenticator Secrets Returned in Clear Text via API in AAP)


author: Satoe Imaishi <simaishi@redhat.com> - 0.20.1-2
changelog:
  - Update to 0.20.1
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 3.2.6-1
changelog:
  - Update to 3.2.6
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 3.1.32-1
changelog:
  - Update to 3.1.32
  - Fix CVE-2023-40267 (Insecure non-multi options in clone and clone_from is not blocked)


author: Satoe Imaishi <simaishi@redhat.com> - 1.58.3-1
changelog:
  - Update to 1.58.3
  - Fix CVE-2024-7246 (client communicating with a HTTP/2 proxy can poison the
    HPACK table between the proxy and the backend)


author: Satoe Imaishi <simaishi@redhat.com> - 3.1.3-1
changelog:
  - Update to 3.1.3
  - Fix CVE-2024-22195 (HTML attribute injection when passing user input as keys
    to xmlattr filter)


author: Satoe Imaishi <simaishi@redhat.com> - 3.1.5-1
changelog:
  - Update to 3.1.5
  - Fix CVE-2024-56326 (Jinja has a sandbox breakout through indirect reference to format method)
  - Fix CVE-2024-56201 (Jinja has a sandbox breakout through malicious filenames)


author: Satoe Imaishi <simaishi@redhat.com> - 3.1.6-1
changelog:
  - Update to 3.1.6
  - Fix CVE-2025-27516 (Jinja sandbox breakout through attr filter selecting format method)


author: Satoe Imaishi <simaishi@redhat.com> - 1.0.1-2
changelog:
  - Update to 1.0.1
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 6.0.0-2
changelog:
  - Update to 6.0.0
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 10.0.1-1
changelog:
  - Update to 10.0.1
  - Fix CVE-2023-44271 (uncontrolled resource consumption when textlength in an
    ImageDraw instance operates on a long text argument)


author: Satoe Imaishi <simaishi@redhat.com> - 0.3.0-1
changelog:
  - Update to 0.3.0
  - Split from python-pyasn1 and use package version as rpm version
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 1.13.0-3
changelog:
  - Update to 1.13.0
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 4.9-2
changelog:
  - Update to 4.9
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 24.7.0-1
changelog:
  - Update to 24.7.0
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 1.26.18-1
changelog:
  - Update to 1.26.18
  - Fix CVE-2023-43804 (Cookie request header isn't stripped during cross-origin
    redirects)


author: Satoe Imaishi <simaishi@redhat.com> - 1.26.20-1
changelog:
  - Update to 1.26.20
  - Fix CVE-2024-37891 (proxy-authorization request header is not stripped during
    cross-origin redirects)


author: Satoe Imaishi <simaishi@redhat.com> - 5.0.2-1
changelog:
  - Update to 5.0.2
  - Remove obsoletes and rename files in bin dir
  - Add watchmedo extra
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 1.7.0-2
changelog:
  - Update to 1.7.0
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Charalampos Stratakis <cstratak@redhat.com> - 0.38.4-1
changelog:
  - Initial package
  - Fedora contributions by:
        Charalampos Stratakis <cstratak@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Haikel Guemar <hguemar@fedoraproject.org>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Karolina Surma <ksurma@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Matej Stuchlik <mstuchli@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Robert Kuska <rkuska@redhat.com>
        Slavek Kabrda <bkabrda@redhat.com>
        Tomas Hrnciar <thrnciar@redhat.com>
        Tomas Orsava <torsava@redhat.com>


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.4-1
changelog:
  - Update to 1.4.4
  - Fix CVE-2023-49295 (quic-go: memory exhaustion attack against QUIC's path
    validation mechanism)


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.5-1
changelog:
  - Update to 1.4.5
  - Fix CVE-2024-1394 (golang-fips/openssl: Memory leaks in code encrypting and
    decrypting RSA payloads)
  - Fix CVE-2023-39326 (golang: net/http/internal: Denial of Service (DoS) via
    Resource Consumption via HTTP requests)


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.8-1
changelog:
  - Update to 1.4.8
  - Fix CVE-2024-24783 (golang: crypto/x509: Verify panics on certificates with an
    unknown public key algorithm)
  - Fix CVE-2023-45290 (golang: net/http: memory exhaustion in Request.ParseMultipartForm)
  - Fix CVE-2023-45288 (golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS)


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.8-1.1
changelog:
  - Fix CVE-2024-24790 (golang: net/netip: Unexpected behavior from Is methods
    for IPv4-mapped IPv6 addresses)
  - Fix CVE-2024-24788 (golang: net: malformed DNS message can cause infinite loop)


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.8-3
changelog:
  - Rebuild for python 3.11
  - Fix CVE-2024-34158 (Calling Parse on a "// +build" build tag line with deeply nested expressions
    can cause a panic due to stack exhaustion)
  - Fix CVE-2024-34155 (Calling any of the Parse functions containing deeply nested literals can
    cause a panic/stack exhaustion
  - Fix CVE-2024-24791 (net/http: Denial of service due to improper 100-continue
    handling in net/http)


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.9-2
changelog:
  - Update to 1.4.9
  - Fix CVE-2024-22189 (quic-go: memory exhaustion attack against QUIC's connection ID mechanism)
  - Add debug package


author: Satoe Imaishi <simaishi@redhat.com> - 1.5.7-2
changelog:
  - Update to 1.5.7
  - Fix CVE-2025-22871 (Request smuggling due to acceptance of invalid chunked data in net/http)


author: Satoe Imaishi <simaishi@redhat.com> - 1.2.1-1
changelog:
  - Update to 1.2.1
  - Fix CVE-2025-9908 (Sensitive Internal Headers Disclosure in AAP EDA Event Streams)
  - Fix CVE-2025-9907 (Event Stream Test Mode Exposes Sensitive Headers in AAP EDA)


author: Satoe Imaishi <simaishi@redhat.com> - 2.6.2-1
changelog:
  - Update to 2.6.2
  - Fix CVE-2025-59343 (tar-fs symlink validation bypass)
  - Fix CVE-2025-58754 (Axios DoS via lack of data size check)


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.25-1
changelog:
  - Update to 4.2.25
  - Fix CVE-2025-59682 (Potential partial directory-traversal via archive.extract())


author: Satoe Imaishi <simaishi@redhat.com> - 2.6.20251119-1
changelog:
  - Update to 2.6.20251119
  - Fix CVE-2025-9909 (Improper Path Validation in Gateway Allows Credential Exfiltration)
  - Set owner/permission for log dir


author: Satoe Imaishi <simaishi@redhat.com> - 2.6.20260106-1
changelog:
  - Update to 2.6.20260106
  - Fix CVE-2025-14025 (Read-only Personal Access Token (PAT) bypasses write restrictions)


author: Satoe Imaishi <simaishi@redhat.com> - 4.7.8-1
changelog:
  - Update to 4.7.8
  - Fix CVE-2025-69223 (AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb)
  - Fix CVE-2025-66471 (urllib3 Streaming API improperly handles highly compressed data)
  - Fix CVE-2025-64460 (Django: Algorithmic complexity in XML Deserializer leads to denial of service)
  - Fix CVE-2025-53643 (AIOHTTP HTTP Request/Response Smuggling)


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.27-2
changelog:
  - Update to 4.2.27
  - Fix CVE-2025-64460 (Algorithmic complexity in XML Deserializer leads to denial of service)


author: Satoe Imaishi <simaishi@redhat.com> - 4.25.8-1
changelog:
  - Update to 4.25.8
  - Fix CVE-2025-4565 (Unbounded recursion in Python Protobuf)
  - Switch to upb backend


author: Satoe Imaishi <simaishi@redhat.com> - 2.6.3-1
changelog:
  - Update to 2.6.3
  - Fix CVE-2025-66471 (urllib3 Streaming API improperly handles highly compressed data)


author: Satoe Imaishi <simaishi@redhat.com> - 1.6.3-2
changelog:
  - Update to 1.6.3
  - Fix CVE-2025-61729 (Excessive resource consumption when printing error string for host certificate
    validation in crypto/x509)


author: Satoe Imaishi <simaishi@redhat.com> - 4.7.9-1
changelog:
  - Update to 4.7.9
  - Python 3.12 build
  - Fix CVE-2026-24049 (wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking)
  - Fix CVE-2026-23490 (pyasn1 has a DoS vulnerability in decoder)


author: Satoe Imaishi <simaishi@redhat.com> - 2.6.6-1
changelog:
  - Update to 2.6.6
  - Fix CVE-2025-13465 (prototype pollution in _.unset and _.omit functions)
  - Fix CVE-2025-59057 (React Router has XSS Vulnerability)
  - Fix CVE-2026-21884 (React Router SSR XSS in ScrollRestoration)
  - Fix CVE-2026-22029 (React Router vulnerable to XSS via Open Redirects)


author: Nickolos Monk <nmonk@redhat.com> - 3.13.3-2
changelog:
  - Update to 3.13.3
  - Fix CVE-2025-69223 (AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb)


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.28-1
changelog:
  - Update to 4.2.28
  - Python 3.12 build
  - Fix CVE-2025-14550 (Django: Denial of Service via crafted request with duplicate headers)
  - Fix CVE-2026-1207 (Django: SQL Injection via RasterField band index parameter)
  - Fix CVE-2026-1285 (Django: Denial of Service via crafted HTML inputs)
  - Fix CVE-2026-1287 (Django: SQL Injection via crafted column aliases)
  - Fix CVE-2026-1312 (Django: SQL injection via crafted column aliases in QuerySet.order_by())


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 23.2-1
changelog:
  - Initial package
  - Fedora contributions by:
        Charalampos Stratakis <cstratak@redhat.com>
        Iryna Shcherbina <shcherbina.iryna@gmail.com>
        Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com>
        Karolina Surma <ksurma@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Yaakov Selkowitz <yselkowi@redhat.com>
        Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 68.2.2-1
changelog:
  - Initial package
  - Fedora contributions by:
        Bill Nottingham <notting@fedoraproject.org>
        Charalampos Stratakis <cstratak@redhat.com>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Haikel Guemar <hguemar@fedoraproject.org>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Jesse Keating <jkeating@fedoraproject.org>
        Karolina Surma <ksurma@redhat.com>
        Kevin Fenzi <kevin@scrye.com>
        Konstantin Ryabitsev <icon@fedoraproject.org>
        Lumir Balhar <lbalhar@redhat.com>
        Matej Stuchlik <mstuchli@redhat.com>
        Michal Cyprian <mcyprian@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Nils Philippsen <nils@redhat.com>
        Orion Poplawski <orion@cora.nwra.com>
        Petr Viktorin <pviktori@redhat.com>
        Pierre-Yves Chibon <pingou@pingoured.fr>
        Ralph Bean <rbean@redhat.com>
        Randy Barlow <randy@electronsweatshop.com>
        Robert Kuska <rkuska@redhat.com>
        Thomas Spura <thomas.spura@gmail.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Tomas Orsava <torsava@redhat.com>
        Tomas Radej <tradej@redhat.com>
        Toshio Kuratomi <toshio@fedoraproject.org>
        Troy Dawson <tdawson@redhat.com>
        Ville Skyttä <scop@fedoraproject.org>


author: Satoe Imaishi <simaishi@redhat.com> - 2.6.7-1
changelog:
  - Update to 2.6.7
  - Fix CVE-2025-69873 (ReDoS via $data reference)
  - Fix CVE-2026-25639 (Axios affected by Denial of Service via __proto__ Key in mergeConfig)
  - Fix CVE-2026-27904 (Minimatch: Denial of Service via catastrophic backtracking in glob expressions)
  - Fix CVE-2026-29074 (SVGO: Denial of Service via XML entity expansion)


author: Satoe Imaishi <simaishi@redhat.com> - 4.7.11-2
changelog:
  - Update to 4.7.11
  - Fix CVE-2026-32597 (PyJWT accepts unknown 'crit' header extensions (RFC 7515 §4.1.11 MUST violation))
  - Fix CVE-2026-27459 (DTLS cookie callback buffer overflow)
  - Fix CVE-2025-69534 (denial of service via malformed HTML-like sequences)
  - Fix CVE-2025-14550 (Django: Denial of Service via crafted request with duplicate headers)
  - Fix CVE-2026-6266 (Account hijacking and unauthorized access via unverified email linking)


author: Satoe Imaishi <simaishi@redhat.com> - 2.6.20260422-1
changelog:
  - Update to 2.6.20260422
  - Fix CVE-2026-6266 (Account hijacking and unauthorized access via unverified email linking)


author: Satoe Imaishi <simaishi@redhat.com> - 2.6.8-1
changelog:
  - Update to 2.6.8
  - Fix CVE-2026-27606 (Rollup: Remote Code Execution via Path Traversal Vulnerability)
  - Fix CVE-2026-26996 (minimatch: Denial of Service via specially crafted glob patterns)


author: Satoe Imaishi <simaishi@redhat.com> - 26.3.1-1
changelog:
  - Update to 26.3.1
  - Fix CVE-2026-32274 (Arbitrary file writes from unsanitized user input in cache file name)


author: Satoe Imaishi <simaishi@redhat.com> - 3.2.13-1
changelog:
  - Update to 3.2.13
  - Fix CVE-2026-33154 (Arbitrary code execution via Server-Side Template Injection)


author: Satoe Imaishi <simaishi@redhat.com> - 0.6.3-1
changelog:
  - Update to 0.6.3
  - Fix CVE-2026-30922 (pyasn1 Vulnerable to Denial of Service via Unbounded Recursion)


author: Satoe Imaishi <simaishi@redhat.com> - 2.12.1-1
changelog:
  - Update to 2.12.1
  - Fix CVE-2026-32597 (PyJWT accepts unknown 'crit' header extensions (RFC 7515 §4.1.11 MUST violation))


author: Satoe Imaishi <simaishi@redhat.com> - 4.7.12-1
changelog:
  - Update to 4.7.12
  - Fix CVE-2026-39892 (Cryptography: Buffer overflow via non-contiguous buffer in API)
  - Fix CVE-2026-30922 (pyasn1 Vulnerable to Denial of Service via Unbounded Recursion)


author: Satoe Imaishi <simaishi@redhat.com> - 2.6.14-3
changelog:
  - Fix CVE-2026-32283 (Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages)
  - Fix CVE-2026-32280 (Go: Denial of Service vulnerability in certificate chain building)


author: Satoe Imaishi <simaishi@redhat.com> - 2.6.9-1
changelog:
  - Update to 2.6.9
  - Fix CVE-2026-40175 (Axios: Remote Code Execution via Prototype Pollution escalation)
  - Fix CVE-2026-39363 (Vite: Information disclosure via WebSocket connection bypasses access control)
  - Fix CVE-2026-33891 (node-forge: Denial of Service via infinite loop in BigInteger.modInverse())
  - Fix CVE-2026-4926 (path-to-regexp: Denial of Service via crafted regular expressions)
  - Fix CVE-2026-4800 (lodash: Arbitrary code execution via untrusted input in template imports)


author: Satoe Imaishi <simaishi@redhat.com> - 8.3.3-1
changelog:
  - Update to 8.3.3
  - Fix CVE-2026-7246 (Arbitrary command execution via command injection in click.edit())


author: Satoe Imaishi <simaishi@redhat.com> - 12.2.0-1
changelog:
  - Update to 12.2.0
  - Fix CVE-2026-40192 (Denial of Service via decompression bomb in FITS image processing)


author: Satoe Imaishi <simaishi@redhat.com> - 1.6.5-1
changelog:
  - Update to 1.6.5
  - Fix CVE-2026-32283 (Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages)
  - Fix CVE-2026-32282 (Root.Chmod can follow symlinks out of the root)
  - Fix CVE-2026-32280 (Go: Denial of Service vulnerability in certificate chain building)


author: Nickolos Monk <nmonk@redhat.com> - 1.2.9-2
changelog:
  - Update to 1.2.9
  - Fix CVE-2026-11807 (Websocket missing authorization allows credential theft via activation_id spoofing)


author: Nickolos Monk <nmonk@redhat.com> - 4.7.13-2
changelog:
  - Update to 4.7.13
  - Fix CVE-2026-33154 (Dynaconf: Arbitrary code execution via Server-Side Template Injection)


author: Nickolos Monk <nmonk@redhat.com> - 2.6.10-1
changelog:
  - Update to 2.6.10
  - Fix CVE-2026-44495 (Axios: Information disclosure due to prototype pollution vulnerability)
  - Fix CVE-2026-44488 (Axios: Denial of Service due to unenforced request and response size limits)
  - Fix CVE-2026-44293 (protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors)
  - Fix CVE-2026-42035 (Axios: Arbitrary HTTP header injection via prototype pollution)
  - Fix CVE-2026-41240 (DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization)
  - Fix CVE-2026-6322 (fast-uri: URI authority bypass due to improper delimiter handling)


author: Satoe Imaishi <simaishi@redhat.com> - 2.7.0-1
changelog:
  - Update to 2.7.0
  - Fix CVE-2026-44431 (Information disclosure via cross-origin redirects forwarding sensitive headers)
  - Fix CVE-2026-44432 (Denial of Service due to excessive HTTP response decompression)


author: Satoe Imaishi <simaishi@redhat.com> - 1:2.16.19-1
changelog:
  - Update to 2.16.19
  - Fix CVE-2026-11332 (argument injection in ansible-galaxy role install leads to arbitrary code execution)


author: Nickolos Monk <nmonk@redhat.com> - 4.7.14-3
changelog:
  - Update to 4.7.14
  - Fix CVE-2026-8643 (Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite)
  - Fix CVE-2026-44432 (urllib3: Denial of Service due to excessive HTTP response decompression)


author: Satoe Imaishi <simaishi@redhat.com> - 2.6.17-1
changelog:
  - Fix CVE-2026-32281 (Go crypto/x509: Denial of Service via inefficient certificate chain validation)


author: Nickolos Monk <nmonk@redhat.com> - 2.6.10-1
changelog:
  - Update to 2.6.10
  - Fix CVE-2026-44496 (Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name)
  - Fix CVE-2026-44495 (Axios: Information disclosure due to prototype pollution vulnerability)
  - Fix CVE-2026-44494 (Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution)
  - Fix CVE-2026-44492 (Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization)
  - Fix CVE-2026-44488 (Axios: Denial of Service due to unenforced request and response size limits)
  - Fix CVE-2026-44487 (Axios: Information disclosure of proxy credentials via redirect flows)
  - Fix CVE-2026-44486 (Axios: Information disclosure of proxy credentials via HTTP redirects)
  - Fix CVE-2026-44293 (protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors)
  - Fix CVE-2026-42044 (Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget)
  - Fix CVE-2026-42035 (Axios: Arbitrary HTTP header injection via prototype pollution)
  - Fix CVE-2026-41240 (DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization)
  - Fix CVE-2026-6322 (fast-uri: URI authority bypass due to improper delimiter handling)
  - Fix CVE-2026-6321 (fast-uri: Path traversal vulnerability allows bypass of security policies)


author: Satoe Imaishi <simaishi@redhat.com> - 3.1.50-1
changelog:
  - Update to 3.1.50
  - Fix CVE-2026-44244 (Arbitrary code execution via injected newlines in Git configuration)


author: Satoe Imaishi <simaishi@redhat.com> - 1.6.6-1
changelog:
  - Update to 1.6.6
  - Fix CVE-2026-39821 (golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing)


