FEDORA-2026-3017b1bec1 — security update for composer

stable

FEDORA-2026-3017b1bec1 created by remi a month ago for Fedora 43

Security: Validate package names (GHSA-499r-g7pc-vmp9)
Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
Security: Only follow HTTP redirects from HTTP responses (#12948)
Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
Added warning output in self-update command when using a soon-to-be EOL version (#12920)
Added download retry when a GitHub codeload URL returns a 400 (#12962)
Fixed audit command to output the audit result to stdout (#12904)
Fixed backspace characters being output to non-decorated output (#12925)
Fixed security advisory blocking causing issues with xdebug enabled (#12935)
Fixed provider packages hiding suggestions for the package they provide themselves (#12933)
Fixed security advisory blocking causing issues with xdebug enabled (#12935)

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2026-3017b1bec1

This update has been submitted for testing by remi.

This update's test gating status has been changed to 'ignored'.

This update has been pushed to testing.

This update has been submitted for stable by bodhi.

This update has been pushed to stable.

Please log in to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

a month ago

in testing

a month ago

in stable

a month ago

approved

a month ago

Builds

ignored