Fedora Security Advisories

• pie-1.4.1-1.fc42

Version 1.4.1

• Update bundled Composer to 2.9.7

New features!

• Prompt to install missing system dependencies
• Prompt to install build toolchain
• Support pre-packaged-binary for download-url-method
• Support INSTALL_ROOT environment variable to override destination

For more information, see Upstream annoucenement

• pie-1.4.1-1.el10_3

Version 1.4.1

• Update bundled Composer to 2.9.7

New features!

• Prompt to install missing system dependencies
• Prompt to install build toolchain
• Support pre-packaged-binary for download-url-method
• Support INSTALL_ROOT environment variable to override destination

For more information, see Upstream annoucenement

• pie-1.4.1-1.el10_1

Version 1.4.1

• Update bundled Composer to 2.9.7

New features!

• Prompt to install missing system dependencies
• Prompt to install build toolchain
• Support pre-packaged-binary for download-url-method
• Support INSTALL_ROOT environment variable to override destination

For more information, see Upstream annoucenement

• pie-1.4.1-1.el10_2

Version 1.4.1

• Update bundled Composer to 2.9.7

New features!

• Prompt to install missing system dependencies
• Prompt to install build toolchain
• Support pre-packaged-binary for download-url-method
• Support INSTALL_ROOT environment variable to override destination

For more information, see Upstream annoucenement

• pie-1.4.1-1.fc44

Version 1.4.1

• Update bundled Composer to 2.9.7

New features!

• Prompt to install missing system dependencies
• Prompt to install build toolchain
• Support pre-packaged-binary for download-url-method
• Support INSTALL_ROOT environment variable to override destination

For more information, see Upstream annoucenement

• pie-1.4.1-1.fc43

Version 1.4.1

• Update bundled Composer to 2.9.7

New features!

• Prompt to install missing system dependencies
• Prompt to install build toolchain
• Support pre-packaged-binary for download-url-method
• Support INSTALL_ROOT environment variable to override destination

For more information, see Upstream annoucenement

• curl-8.11.1-8.fc42

• fix bad reuse of HTTP Negotiate connection (CVE-2026-1965)
• fix token leak with redirect and netrc (CVE-2026-3783)
• fix wrong proxy connection reuse with credentials (CVE-2026-3784)
• fix use after free in SMB connection reuse (CVE-2026-3805)

• composer-2.9.7-1.el10_3

• Fixes regression calling custom script command aliases that are called a substring of a composer command (#12802)

• Security: Fixed command injection via malicious Perforce reference (GHSA-gqw4-4w2p-838q / CVE-2026-40261)
• Security: Fixed command injection via malicious Perforce repository definition (GHSA-wg36-wvj6-r67p / CVE-2026-40176)
• Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed (2bcbfc3d)
• Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
• Security: Fixed Perforce unescaped user input in queryP4User shell command (ef3fc088)
• Security: Hardened git/hg/perforce/fossil identifier validation to ensure branch names starting with - do not cause issues (6621d45, d836b90, 5e08c764)
• Fixed inconsistent treatment of SingleCommandApplication script commands wrt autoloading (#12758)
• Fixed GitHub API authentication errors not being visible to the user (#12737)
• Fixed some platform package parsing failing when Composer runs in web SAPIs (#12735)
• Fixed error reporting for clarity when a constraint cannot be parsed (#12743)

• composer-2.9.7-1.el9

• Fixes regression calling custom script command aliases that are called a substring of a composer command (#12802)

• Security: Fixed command injection via malicious Perforce reference (GHSA-gqw4-4w2p-838q / CVE-2026-40261)
• Security: Fixed command injection via malicious Perforce repository definition (GHSA-wg36-wvj6-r67p / CVE-2026-40176)
• Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed (2bcbfc3d)
• Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
• Security: Fixed Perforce unescaped user input in queryP4User shell command (ef3fc088)
• Security: Hardened git/hg/perforce/fossil identifier validation to ensure branch names starting with - do not cause issues (6621d45, d836b90, 5e08c764)
• Fixed inconsistent treatment of SingleCommandApplication script commands wrt autoloading (#12758)
• Fixed GitHub API authentication errors not being visible to the user (#12737)
• Fixed some platform package parsing failing when Composer runs in web SAPIs (#12735)
• Fixed error reporting for clarity when a constraint cannot be parsed (#12743)

• composer-2.9.7-1.fc44

• Fixes regression calling custom script command aliases that are called a substring of a composer command (#12802)

• Security: Fixed command injection via malicious Perforce reference (GHSA-gqw4-4w2p-838q / CVE-2026-40261)
• Security: Fixed command injection via malicious Perforce repository definition (GHSA-wg36-wvj6-r67p / CVE-2026-40176)
• Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed (2bcbfc3d)
• Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
• Security: Fixed Perforce unescaped user input in queryP4User shell command (ef3fc088)
• Security: Hardened git/hg/perforce/fossil identifier validation to ensure branch names starting with - do not cause issues (6621d45, d836b90, 5e08c764)
• Fixed inconsistent treatment of SingleCommandApplication script commands wrt autoloading (#12758)
• Fixed GitHub API authentication errors not being visible to the user (#12737)
• Fixed some platform package parsing failing when Composer runs in web SAPIs (#12735)
• Fixed error reporting for clarity when a constraint cannot be parsed (#12743)

• composer-2.9.7-1.el10_2

• Fixes regression calling custom script command aliases that are called a substring of a composer command (#12802)

• Security: Fixed command injection via malicious Perforce reference (GHSA-gqw4-4w2p-838q / CVE-2026-40261)
• Security: Fixed command injection via malicious Perforce repository definition (GHSA-wg36-wvj6-r67p / CVE-2026-40176)
• Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed (2bcbfc3d)
• Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
• Security: Fixed Perforce unescaped user input in queryP4User shell command (ef3fc088)
• Security: Hardened git/hg/perforce/fossil identifier validation to ensure branch names starting with - do not cause issues (6621d45, d836b90, 5e08c764)
• Fixed inconsistent treatment of SingleCommandApplication script commands wrt autoloading (#12758)
• Fixed GitHub API authentication errors not being visible to the user (#12737)
• Fixed some platform package parsing failing when Composer runs in web SAPIs (#12735)
• Fixed error reporting for clarity when a constraint cannot be parsed (#12743)

• composer-2.9.7-1.fc42

• Fixes regression calling custom script command aliases that are called a substring of a composer command (#12802)

• Security: Fixed command injection via malicious Perforce reference (GHSA-gqw4-4w2p-838q / CVE-2026-40261)
• Security: Fixed command injection via malicious Perforce repository definition (GHSA-wg36-wvj6-r67p / CVE-2026-40176)
• Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed (2bcbfc3d)
• Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
• Security: Fixed Perforce unescaped user input in queryP4User shell command (ef3fc088)
• Security: Hardened git/hg/perforce/fossil identifier validation to ensure branch names starting with - do not cause issues (6621d45, d836b90, 5e08c764)
• Fixed inconsistent treatment of SingleCommandApplication script commands wrt autoloading (#12758)
• Fixed GitHub API authentication errors not being visible to the user (#12737)
• Fixed some platform package parsing failing when Composer runs in web SAPIs (#12735)
• Fixed error reporting for clarity when a constraint cannot be parsed (#12743)

• composer-2.9.7-1.fc43

• Fixes regression calling custom script command aliases that are called a substring of a composer command (#12802)

• Security: Fixed command injection via malicious Perforce reference (GHSA-gqw4-4w2p-838q / CVE-2026-40261)
• Security: Fixed command injection via malicious Perforce repository definition (GHSA-wg36-wvj6-r67p / CVE-2026-40176)
• Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed (2bcbfc3d)
• Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
• Security: Fixed Perforce unescaped user input in queryP4User shell command (ef3fc088)
• Security: Hardened git/hg/perforce/fossil identifier validation to ensure branch names starting with - do not cause issues (6621d45, d836b90, 5e08c764)
• Fixed inconsistent treatment of SingleCommandApplication script commands wrt autoloading (#12758)
• Fixed GitHub API authentication errors not being visible to the user (#12737)
• Fixed some platform package parsing failing when Composer runs in web SAPIs (#12735)
• Fixed error reporting for clarity when a constraint cannot be parsed (#12743)

• composer-2.9.7-1.el10_1

• Fixes regression calling custom script command aliases that are called a substring of a composer command (#12802)

• Security: Fixed command injection via malicious Perforce reference (GHSA-gqw4-4w2p-838q / CVE-2026-40261)
• Security: Fixed command injection via malicious Perforce repository definition (GHSA-wg36-wvj6-r67p / CVE-2026-40176)
• Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed (2bcbfc3d)
• Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
• Security: Fixed Perforce unescaped user input in queryP4User shell command (ef3fc088)
• Security: Hardened git/hg/perforce/fossil identifier validation to ensure branch names starting with - do not cause issues (6621d45, d836b90, 5e08c764)
• Fixed inconsistent treatment of SingleCommandApplication script commands wrt autoloading (#12758)
• Fixed GitHub API authentication errors not being visible to the user (#12737)
• Fixed some platform package parsing failing when Composer runs in web SAPIs (#12735)
• Fixed error reporting for clarity when a constraint cannot be parsed (#12743)

• mingw-python3-3.11.15-3.fc42

Backport fixes for CVE-2026-6100, CVE-2026-3479, CVE-2026-1502

• mingw-python3-3.11.15-3.fc43

Backport fixes for CVE-2026-6100, CVE-2026-3479, CVE-2026-1502

• mingw-python3-3.11.15-3.fc44

Backport fixes for CVE-2026-6100, CVE-2026-3479, CVE-2026-1502

• pgadmin4-9.14-3.fc44

Update axios to 1.15.0, fixes CVE-2026-40175 and CVE-2025-62718.

Update to pgadmin4-9.14.

• pgadmin4-9.14-3.fc43

Update axios to 1.15.0, fixes CVE-2026-40175 and CVE-2025-62718.

Update to pgadmin4-9.14.

• pgadmin4-9.14-3.fc42

Update axios to 1.15.0, fixes CVE-2026-40175 and CVE-2025-62718.

Update to pgadmin4-9.14.