Fedora Security Advisories

webkitgtk-2.54.2-1.fc44

Fedora Security Advisories
2 hours 28 minutes ago
FEDORA-2026-60c7186f5a Packages in this update:
  • webkitgtk-2.54.2-1.fc44
Update description:

Update to version 2.54.2.

  • Fix performance when compositing layers with backdrop filters.
  • Fix prewarmed web process leak when they are rejected due to sandboxing.
  • Release suspended pages and idle processes on memory pressure.
  • Bind /dev/dxg in the bubblewrap sandbox.
  • Notify input method about cursor area or surrounding text after a re-focus.
  • Clear input method composition underlines before adding new ones.
  • Do not enable input method for read-only text fields.
  • Update the input method state when readonly changes on the focused element.
  • Add User-Agent quirk for OrangeTV.
  • Fix several crashes and rendering issues.

From the release notes: https://webkitgtk.org/2026/10/23/webkitgtk2.54.2-released.html

webkitgtk-2.54.2-1.fc43

Fedora Security Advisories
2 hours 28 minutes ago
FEDORA-2026-8222d28aa0 Packages in this update:
  • webkitgtk-2.54.2-1.fc43
Update description:

Update to version 2.54.2.

  • Fix performance when compositing layers with backdrop filters.
  • Fix prewarmed web process leak when they are rejected due to sandboxing.
  • Release suspended pages and idle processes on memory pressure.
  • Bind /dev/dxg in the bubblewrap sandbox.
  • Notify input method about cursor area or surrounding text after a re-focus.
  • Clear input method composition underlines before adding new ones.
  • Do not enable input method for read-only text fields.
  • Update the input method state when readonly changes on the focused element.
  • Add User-Agent quirk for OrangeTV.
  • Fix several crashes and rendering issues.

From the release notes: https://webkitgtk.org/2026/10/23/webkitgtk2.54.2-released.html

webkitgtk-2.54.2-1.fc45

Fedora Security Advisories
2 hours 28 minutes ago
FEDORA-2026-e5dca6eef4 Packages in this update:
  • webkitgtk-2.54.2-1.fc45
Update description:

Update to version 2.54.2.

  • Fix performance when compositing layers with backdrop filters.
  • Fix prewarmed web process leak when they are rejected due to sandboxing.
  • Release suspended pages and idle processes on memory pressure.
  • Bind /dev/dxg in the bubblewrap sandbox.
  • Notify input method about cursor area or surrounding text after a re-focus.
  • Clear input method composition underlines before adding new ones.
  • Do not enable input method for read-only text fields.
  • Update the input method state when readonly changes on the focused element.
  • Add User-Agent quirk for OrangeTV.
  • Fix several crashes and rendering issues.

From the release notes: https://webkitgtk.org/2026/10/23/webkitgtk2.54.2-released.html

janus-1.4.3-1.fc43

Fedora Security Advisories
4 hours 35 minutes ago
FEDORA-2026-010f9a18bb Packages in this update:
  • janus-1.4.3-1.fc43
Update description:

Update to v1.4.3 (rhbz#2549665):

Security fixes: - [SEC] Fix potential buffer overflow in Record&Play plugin (PR #3688) - [SEC] Fix master/helper session switch potentially causing a crash in SIP plugin (PR #3689)

Bug fixes & enhancements: - Keep DTLS retransmission timer running after handshake (PR #3687) - Enable TWCC feedback for audio-only connections (PR #3674) - Avoid discarding NACKs with duplicate queue pops (PR #3684) - Add new option to restrict info API when using secrets or tokens (PR #3646) - Add optional AudioBridge audio limiter based on AGC2 (PR #3593) - Add support for outgoing late offers (offerless INVITE) to the SIP plugin (PR #3660) - Fix contact header sometimes missing in REFER messages in the SIP plugin

janus-1.4.3-1.fc45

Fedora Security Advisories
4 hours 35 minutes ago
FEDORA-2026-099de3a670 Packages in this update:
  • janus-1.4.3-1.fc45
Update description:

Update to v1.4.3 (rhbz#2549665):

Security fixes: - [SEC] Fix potential buffer overflow in Record&Play plugin (PR #3688) - [SEC] Fix master/helper session switch potentially causing a crash in SIP plugin (PR #3689)

Bug fixes & enhancements: - Keep DTLS retransmission timer running after handshake (PR #3687) - Enable TWCC feedback for audio-only connections (PR #3674) - Avoid discarding NACKs with duplicate queue pops (PR #3684) - Add new option to restrict info API when using secrets or tokens (PR #3646) - Add optional AudioBridge audio limiter based on AGC2 (PR #3593) - Add support for outgoing late offers (offerless INVITE) to the SIP plugin (PR #3660) - Fix contact header sometimes missing in REFER messages in the SIP plugin

janus-1.4.3-1.fc44

Fedora Security Advisories
4 hours 37 minutes ago
FEDORA-2026-47eb160009 Packages in this update:
  • janus-1.4.3-1.fc44
Update description:

Update to v1.4.3 (rhbz#2549665):

Security fixes: - [SEC] Fix potential buffer overflow in Record&Play plugin (PR #3688) - [SEC] Fix master/helper session switch potentially causing a crash in SIP plugin (PR #3689)

Bug fixes & enhancements: - Keep DTLS retransmission timer running after handshake (PR #3687) - Enable TWCC feedback for audio-only connections (PR #3674) - Avoid discarding NACKs with duplicate queue pops (PR #3684) - Add new option to restrict info API when using secrets or tokens (PR #3646) - Add optional AudioBridge audio limiter based on AGC2 (PR #3593) - Add support for outgoing late offers (offerless INVITE) to the SIP plugin (PR #3660) - Fix contact header sometimes missing in REFER messages in the SIP plugin

python-streamlink-8.6.2-1.fc43

Fedora Security Advisories
8 hours 28 minutes ago
FEDORA-2026-d8cf5f20d7 Packages in this update:
  • python-streamlink-8.6.2-1.fc43
Update description: streamlink 8.6.2 (2026-10-07)
  • SECURITY: fixed arbitrary local file read via file:// URLs in DASH Location tags (CVE-2026-TO-BE-ASSIGNED / GHSA-j7pf-m7gx-jr33) (98781761)
  • Changed: validate.xml_xpath() and validate.xml_xpath_string() to include access to re:test(), re:match() and re:replace() regex functions (#7151)
  • Changed: log format of deprecation warnings (#7141)
  • Fixed: missing deprecation warnings for already deprecated CLI arguments (req. Python 3.13+) (#7141)
  • Fixed: being able to close SegmentedStreamReader streams without opening them first, emitting log records on garbage collection (#7146)
  • Updated plugins:
  • blazetv: fixed live streams (#7147)
  • cinergroup: fixed Bloomberg HT (#7132)
  • dogan: fixed plugin (#7138)
  • facebook: re-introduced plugin with new implementation (#7115)
  • vimeo: rewritten and fixed plugin (#7069)
  • youtvua: added new plugin (#7140)
  • Docs: tightened rules about AI-assisted contributions and security vulnerability reports (#7136, #7152)

Full changelog

streamlink 8.6.1 (2026-09-16)
  • Fixed: compatibility with urllib3 2.8.0 (#7117)

Full changelog

streamlink 8.6.0 (2026-09-13)
  • SECURITY: fixed arbitrary local file read via HTTP(S) redirection to file:// URL (CVE-2026-92164 / GHSA-vf2x-4v53-pm7v) (4b99c64d)
  • SECURITY: fixed insecure cross-scheme redirection (HTTPS -> HTTP) (CVE-2026-92164 / GHSA-vf2x-4v53-pm7v) (4b99c64d)
  • Added: official support for Python 3.15 (#7026)
  • Added: support for HLS packed audio streams (#7083, #7082)
  • Added: HLSSegment.{get,iter}_content() and HLSStreamWriter.{get,iter}_segment_content() for being able to modify segment data (#7059)
  • Added: itsoffset option to FFMPEGMuxer (#7081)
  • Added: nextjs_inline_rsc() to validate API (#7110)
  • Fixed: HTTP server of --player-http/--player-continuous-http binding to all interfaces (#7051)
  • Fixed: zero or negative duration values in HLS dateranges (#7074)
  • Fixed: incorrect t attribute evaluation in DASH SegmentTimeline.S nodes (#7075)
  • Updated plugins:
  • ard_live: removed plugin (#7091)
  • ard_mediathek: rewritten and fixed plugin (#7090)
  • atresplayer: refactored stream retrieval (#7062)
  • bigo: added MPEG-TS packet header decryption due to Bigo's web-protection (#7056, #7059)
  • bigo: worked around account requirements (#7106, #7109)
  • cdnbg: fixed player_url schema (#7036)
  • douyu: fixed API call failures on systems with unsynced clocks (#7065)
  • filmon: updated URL matcher and switched to v2 APIs (#7105)
  • goodgame: fixed stream retrieval (#7086)
  • kick: fixed VODs (#7108)
  • nimotv: fixed access to streams (#7111)
  • okru: fixed metadata schema (#7092)
  • piczel: removed plugin (#7102)
  • pluto: fixed URL matcher, channel ID resolver and VODs (#7048, #7100)
  • tiktok: rewritten and fixed stream data schema for access to origin streams (#7077)
  • twitch: added support for portrait-format streams (#7087)
  • twitch: fixed missing category stream metadata breaking all stream metadata (#7025)
  • vidio: rewritten and fixed plugin (#7063)
  • zdf_mediathek: rewritten and fixed plugin (#7093)
  • Dependencies: bumped min. version requirement of lxml to 5.0.0 (#7029)

Full changelog

streamlink 8.5.0 (2026-08-01)
  • Fixed: named-pipe player inputs not being cleaned up on pre-open failure (#6935)
  • Fixed: stream start offsets being incorrectly cast to int in HLS (#6941)
  • Fixed: hls-playlist-reload-time not accepting floats (#6957)
  • Refactored: HTTPSession and fixed many typing issues (#6924)
  • Refactored: MPDNode in DASH manifest parser to allow attribute namespaces (#6988)
  • Updated plugins:
  • douyin: fixed validation schema (#6930)
  • douyu: re-introduced plugin with new implementation (#6959, #7003)
  • mdstrm: added support for VODs / embedded streams with access tokens (#6994)
  • nos: rewritten and fixed plugin (#6954)
  • radiko: fixed live_url value (#6962)
  • trovo: removed plugin (#6999)
  • tvazteca: added new plugin (#6994)
  • Docs: clarified requirements of Twitch high quality streams (#6992)
  • Tests: fixed test failures since Python 3.15 beta 1 (#6919)
  • Security: made GitHub releases immutable (#6927)
  • Security: pinned all GitHub actions to commit IDs (#6936)
  • Security: switched to uv lockfile for all CI workflows and for building release assets (#6948)
  • Misc: added pre-built FISH shell completions to release tarballs and wheels (#7014)

Full changelog

python-streamlink-8.6.2-1.fc44

Fedora Security Advisories
8 hours 28 minutes ago
FEDORA-2026-6ffee677d1 Packages in this update:
  • python-streamlink-8.6.2-1.fc44
Update description: streamlink 8.6.2 (2026-10-07)
  • SECURITY: fixed arbitrary local file read via file:// URLs in DASH Location tags (CVE-2026-TO-BE-ASSIGNED / GHSA-j7pf-m7gx-jr33) (98781761)
  • Changed: validate.xml_xpath() and validate.xml_xpath_string() to include access to re:test(), re:match() and re:replace() regex functions (#7151)
  • Changed: log format of deprecation warnings (#7141)
  • Fixed: missing deprecation warnings for already deprecated CLI arguments (req. Python 3.13+) (#7141)
  • Fixed: being able to close SegmentedStreamReader streams without opening them first, emitting log records on garbage collection (#7146)
  • Updated plugins:
  • blazetv: fixed live streams (#7147)
  • cinergroup: fixed Bloomberg HT (#7132)
  • dogan: fixed plugin (#7138)
  • facebook: re-introduced plugin with new implementation (#7115)
  • vimeo: rewritten and fixed plugin (#7069)
  • youtvua: added new plugin (#7140)
  • Docs: tightened rules about AI-assisted contributions and security vulnerability reports (#7136, #7152)

Full changelog

streamlink 8.6.1 (2026-09-16)
  • Fixed: compatibility with urllib3 2.8.0 (#7117)

Full changelog

streamlink 8.6.0 (2026-09-13)
  • SECURITY: fixed arbitrary local file read via HTTP(S) redirection to file:// URL (CVE-2026-92164 / GHSA-vf2x-4v53-pm7v) (4b99c64d)
  • SECURITY: fixed insecure cross-scheme redirection (HTTPS -> HTTP) (CVE-2026-92164 / GHSA-vf2x-4v53-pm7v) (4b99c64d)
  • Added: official support for Python 3.15 (#7026)
  • Added: support for HLS packed audio streams (#7083, #7082)
  • Added: HLSSegment.{get,iter}_content() and HLSStreamWriter.{get,iter}_segment_content() for being able to modify segment data (#7059)
  • Added: itsoffset option to FFMPEGMuxer (#7081)
  • Added: nextjs_inline_rsc() to validate API (#7110)
  • Fixed: HTTP server of --player-http/--player-continuous-http binding to all interfaces (#7051)
  • Fixed: zero or negative duration values in HLS dateranges (#7074)
  • Fixed: incorrect t attribute evaluation in DASH SegmentTimeline.S nodes (#7075)
  • Updated plugins:
  • ard_live: removed plugin (#7091)
  • ard_mediathek: rewritten and fixed plugin (#7090)
  • atresplayer: refactored stream retrieval (#7062)
  • bigo: added MPEG-TS packet header decryption due to Bigo's web-protection (#7056, #7059)
  • bigo: worked around account requirements (#7106, #7109)
  • cdnbg: fixed player_url schema (#7036)
  • douyu: fixed API call failures on systems with unsynced clocks (#7065)
  • filmon: updated URL matcher and switched to v2 APIs (#7105)
  • goodgame: fixed stream retrieval (#7086)
  • kick: fixed VODs (#7108)
  • nimotv: fixed access to streams (#7111)
  • okru: fixed metadata schema (#7092)
  • piczel: removed plugin (#7102)
  • pluto: fixed URL matcher, channel ID resolver and VODs (#7048, #7100)
  • tiktok: rewritten and fixed stream data schema for access to origin streams (#7077)
  • twitch: added support for portrait-format streams (#7087)
  • twitch: fixed missing category stream metadata breaking all stream metadata (#7025)
  • vidio: rewritten and fixed plugin (#7063)
  • zdf_mediathek: rewritten and fixed plugin (#7093)
  • Dependencies: bumped min. version requirement of lxml to 5.0.0 (#7029)

Full changelog

streamlink 8.5.0 (2026-08-01)
  • Fixed: named-pipe player inputs not being cleaned up on pre-open failure (#6935)
  • Fixed: stream start offsets being incorrectly cast to int in HLS (#6941)
  • Fixed: hls-playlist-reload-time not accepting floats (#6957)
  • Refactored: HTTPSession and fixed many typing issues (#6924)
  • Refactored: MPDNode in DASH manifest parser to allow attribute namespaces (#6988)
  • Updated plugins:
  • douyin: fixed validation schema (#6930)
  • douyu: re-introduced plugin with new implementation (#6959, #7003)
  • mdstrm: added support for VODs / embedded streams with access tokens (#6994)
  • nos: rewritten and fixed plugin (#6954)
  • radiko: fixed live_url value (#6962)
  • trovo: removed plugin (#6999)
  • tvazteca: added new plugin (#6994)
  • Docs: clarified requirements of Twitch high quality streams (#6992)
  • Tests: fixed test failures since Python 3.15 beta 1 (#6919)
  • Security: made GitHub releases immutable (#6927)
  • Security: pinned all GitHub actions to commit IDs (#6936)
  • Security: switched to uv lockfile for all CI workflows and for building release assets (#6948)
  • Misc: added pre-built FISH shell completions to release tarballs and wheels (#7014)

Full changelog

python-streamlink-8.6.2-1.fc45

Fedora Security Advisories
8 hours 28 minutes ago
FEDORA-2026-73fcc91d16 Packages in this update:
  • python-streamlink-8.6.2-1.fc45
Update description: streamlink 8.6.2 (2026-10-07)
  • SECURITY: fixed arbitrary local file read via file:// URLs in DASH Location tags (CVE-2026-TO-BE-ASSIGNED / GHSA-j7pf-m7gx-jr33) (98781761)
  • Changed: validate.xml_xpath() and validate.xml_xpath_string() to include access to re:test(), re:match() and re:replace() regex functions (#7151)
  • Changed: log format of deprecation warnings (#7141)
  • Fixed: missing deprecation warnings for already deprecated CLI arguments (req. Python 3.13+) (#7141)
  • Fixed: being able to close SegmentedStreamReader streams without opening them first, emitting log records on garbage collection (#7146)
  • Updated plugins:
  • blazetv: fixed live streams (#7147)
  • cinergroup: fixed Bloomberg HT (#7132)
  • dogan: fixed plugin (#7138)
  • facebook: re-introduced plugin with new implementation (#7115)
  • vimeo: rewritten and fixed plugin (#7069)
  • youtvua: added new plugin (#7140)
  • Docs: tightened rules about AI-assisted contributions and security vulnerability reports (#7136, #7152)

Full changelog

streamlink 8.6.1 (2026-09-16)
  • Fixed: compatibility with urllib3 2.8.0 (#7117)

Full changelog

streamlink 8.6.0 (2026-09-13)
  • SECURITY: fixed arbitrary local file read via HTTP(S) redirection to file:// URL (CVE-2026-92164 / GHSA-vf2x-4v53-pm7v) (4b99c64d)
  • SECURITY: fixed insecure cross-scheme redirection (HTTPS -> HTTP) (CVE-2026-92164 / GHSA-vf2x-4v53-pm7v) (4b99c64d)
  • Added: official support for Python 3.15 (#7026)
  • Added: support for HLS packed audio streams (#7083, #7082)
  • Added: HLSSegment.{get,iter}_content() and HLSStreamWriter.{get,iter}_segment_content() for being able to modify segment data (#7059)
  • Added: itsoffset option to FFMPEGMuxer (#7081)
  • Added: nextjs_inline_rsc() to validate API (#7110)
  • Fixed: HTTP server of --player-http/--player-continuous-http binding to all interfaces (#7051)
  • Fixed: zero or negative duration values in HLS dateranges (#7074)
  • Fixed: incorrect t attribute evaluation in DASH SegmentTimeline.S nodes (#7075)
  • Updated plugins:
  • ard_live: removed plugin (#7091)
  • ard_mediathek: rewritten and fixed plugin (#7090)
  • atresplayer: refactored stream retrieval (#7062)
  • bigo: added MPEG-TS packet header decryption due to Bigo's web-protection (#7056, #7059)
  • bigo: worked around account requirements (#7106, #7109)
  • cdnbg: fixed player_url schema (#7036)
  • douyu: fixed API call failures on systems with unsynced clocks (#7065)
  • filmon: updated URL matcher and switched to v2 APIs (#7105)
  • goodgame: fixed stream retrieval (#7086)
  • kick: fixed VODs (#7108)
  • nimotv: fixed access to streams (#7111)
  • okru: fixed metadata schema (#7092)
  • piczel: removed plugin (#7102)
  • pluto: fixed URL matcher, channel ID resolver and VODs (#7048, #7100)
  • tiktok: rewritten and fixed stream data schema for access to origin streams (#7077)
  • twitch: added support for portrait-format streams (#7087)
  • twitch: fixed missing category stream metadata breaking all stream metadata (#7025)
  • vidio: rewritten and fixed plugin (#7063)
  • zdf_mediathek: rewritten and fixed plugin (#7093)
  • Dependencies: bumped min. version requirement of lxml to 5.0.0 (#7029)

Full changelog

streamlink 8.5.0 (2026-08-01)
  • Fixed: named-pipe player inputs not being cleaned up on pre-open failure (#6935)
  • Fixed: stream start offsets being incorrectly cast to int in HLS (#6941)
  • Fixed: hls-playlist-reload-time not accepting floats (#6957)
  • Refactored: HTTPSession and fixed many typing issues (#6924)
  • Refactored: MPDNode in DASH manifest parser to allow attribute namespaces (#6988)
  • Updated plugins:
  • douyin: fixed validation schema (#6930)
  • douyu: re-introduced plugin with new implementation (#6959, #7003)
  • mdstrm: added support for VODs / embedded streams with access tokens (#6994)
  • nos: rewritten and fixed plugin (#6954)
  • radiko: fixed live_url value (#6962)
  • trovo: removed plugin (#6999)
  • tvazteca: added new plugin (#6994)
  • Docs: clarified requirements of Twitch high quality streams (#6992)
  • Tests: fixed test failures since Python 3.15 beta 1 (#6919)
  • Security: made GitHub releases immutable (#6927)
  • Security: pinned all GitHub actions to commit IDs (#6936)
  • Security: switched to uv lockfile for all CI workflows and for building release assets (#6948)
  • Misc: added pre-built FISH shell completions to release tarballs and wheels (#7014)

Full changelog

ruby-4.0.9-40.fc44

Fedora Security Advisories
13 hours 38 minutes ago
FEDORA-2026-3bacbb1eb5 Packages in this update:
  • ruby-4.0.9-40.fc44
Update description:

New version 4.0.9 is released. This new rpm contains several bug fixes in Onigumo regular expression compilation.

ruby-4.0.9-40.fc45

Fedora Security Advisories
13 hours 39 minutes ago
FEDORA-2026-f03a317854 Packages in this update:
  • ruby-4.0.9-40.fc45
Update description:

New version 4.0.9 is released. This new rpm contains several bug fixes in Onigumo regular expression compilation.

vhs-0.11.0-4.fc44

Fedora Security Advisories
14 hours 25 minutes ago
FEDORA-2026-ba39729bff Packages in this update:
  • vhs-0.11.0-4.fc44
Update description:

Update bundled x/net to 0.55.0 and x/crypto to 0.56.0 and rebuild with golang 1.26.10. All together, this fixes 14 different CVEs.

Checked
43 minutes 50 seconds ago
URL
https://bodhi.fedoraproject.org/rss/updates/?type=security