CVE-2026-25541

Details

In the unique reclaim path of BytesMut::reserve, the condition

if v_capacity >= new_cap + offset

uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB.

This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks.

PoC

use bytes::*;

fn main() {
    let mut a = BytesMut::from(&b"hello world"[..]);
    let mut b = a.split_off(5);

    // Ensure b becomes the unique owner of the backing storage
    drop(a);

    // Trigger overflow in new_cap + offset inside reserve
    b.reserve(usize::MAX - 6);

    // This call relies on the corrupted cap and may cause UB & HBO
    b.put_u8(b'h');
}

Workarounds

Users of BytesMut::reserve are only affected if integer overflow checks are configured to wrap. When integer overflow is configured to panic, this issue does not apply.

This vulnerability is also known as RUSTSEC-2026-0007.

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

This update for sequoia-sq fixes the following issues:

Changes in sequoia-sq:

• Legal review Change main license to LGPL-2.0-or-later from GPL-2.0-only

  • LICENSE.txt confirms it
  • Correct Legal-Review-Notice usage

• Update dependencies due to security issues (CVE-2026-25541 bsc#1274437)

• Switch crypto backend from nettle to openssl (bsc#1257934)

• Update to version 1.4.0:

  • Release v1.4.0.
  • Update crossbeam-epoch.
  • Enable optimizations when building rust-crypto crates.
  • tool: canonicalize Ord and PartialOrd impls for Association
  • tool: silence clippy error for potentially mutable Map key types
  • tool: fix formatting to avoid leaking comments into doc strings
  • clippy: allow two types with interior mutability for BTreeSet keys
  • lib: avoid potentially panicking integer cast
  • clippy: add default lint configuration
  • Update NEWS.
  • lib: Improve control char escaping
  • tool: Fix output file's permissions.
  • Gracefully deal with 404 HTTP result codes
  • tool: Don't panic if write fails
  • tool: Restrict file permissions on sensitive output
  • Improve temporary file handling.
  • Forward allow-* crypto features.
  • Relax rusqlite dependency.
  • tool: Add more cipher suites.
  • tool: Add sq key generate --{encryption,signing}-algorithm.
  • Update Cargo.lock.
  • Relax subplot dependency.
  • Relax roff dependency.
  • Relax toml_edit dependency.
  • Upgrade sequoia-wot.
  • Relax indicatif dependency.
  • Relax gethostname dependency.
  • Relax dirs dependency.
  • Relax clap_lex dependency.
  • Update Cargo.lock.
  • meta: Bump MSRV to 1.85.
  • Update signing policy.

• Update vendored dependencies due to security and build issues

• Update to version 1.3.1:

  • Release 1.3.1.
  • Fix formatting.
  • Improve documentation of sq config.
  • Emit hints to mark an imported key as authenticated or introducer.
  • Hedge against importing keys into the cert store.
  • Improve displaying of preferred user IDs.
  • Fix typo.
  • Display backtraces attached to errors.
  • tests: Avoid DSA key in tests as DSA will be rejected in the future.
  • tests: Update PKI test vectors to not expire.
  • Enable backtraces and tracing when running tests.
  • Make importing Autocrypt certs more robust.
  • Release 1.3.0.
  • Make sq config get print to stdout.
  • Fix early abort in sq keyring filter
  • Fix test sq_verify_policy_as_of_relative_time
  • Fix error message.
  • Prefix matching for --...-self parameters fixed
  • Fix examples.
  • Port to sequoia-openpgp 2.
  • ci: Always build the pages, but only publish when merging to main.
  • Upgrade sequoia-man.
  • Split out the man page generation into a new crate.
  • Update openssl to address RUSTSEC-2025-0004.
  • Update hickory-proto to address RUSTSEC-2025-0006.
  • man: Fix NAME section for subcommands.

• Update to version 1.2.0:

  • Release 1.2.0.
  • Update Cargo.lock.
  • Use authenticated identifiers in sq verify.
  • Improve quoting.
  • Improve sq download's output.
  • Add a parameter to the authenticate function to control the output.
  • Move helper function to common.
  • Add a mechanism to replace an argument in a hint with a placeholder.
  • Avoid crash parsing arguments to Strings.
  • Make sq cert lint less quiet when there are no issues.
  • Add sq key rotate.
  • Extend replay to optionally take a signer.
  • tests: Move utility function to the common module.
  • Move function to the common module.
  • Extend replay to allow the caller to limit what is replayed.
  • Improve output.
  • Allow the caller to specify an indentation level.
  • Disable tracing.
  • Fix test helper function.
  • Add sq pki vouch replay.
  • Move certification listing code to the common module.
  • Move code in common to the sole function that uses it.
  • Move the sq pki link list implement to its own module.
  • Extend sq pki vouch list to list certifications of a certificate.
  • Improve test.
  • Simplify specifying certificate designators in…

These are all security issues fixed in the afterburn-5.10.0.git73.b97f772-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the nm-configurator-0.3.5-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gitoxide-0.56.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kak-lsp-21.0.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the wild-0.10.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the aws-efs-utils-3.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the git-cliff-2.13.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo-audit-0.22.2~git0.281452c-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo-c-0.10.23-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the obs-service-cargo-7.2.2-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rustup-1.29.0~0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the sccache-0.17.0~1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the wasm-bindgen-0.2.100-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the forgejo-cli-0.6.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the markdown-oxide-0.25.12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libtree-sitter0_26-0.26.8-5.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the aws-nitro-enclaves-binaryblobs-upstream-1.5.0~git0.2950b36-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the agama-24+0.a836cced5-54.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the shadowsocks-rust-1.25.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the librepods-0.1.0+git20260515.672e65a-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the pijul-1.0.0~beta.23-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the tealdeer-1.8.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the switcheroo-2.6.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the zed-1.24.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for afterburn fixes the following issues:

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS
  • build(deps): bump the build group with 8 updates
  • build(deps): bump slab from 0.4.10 to 0.4.11
  • build(deps): bump actions/checkout from 4 to 5
  • upcloud: implement UpCloud provider
  • build(deps): bump the build group with 4 updates

This update for nm-configurator fixes the following issue

Update to version 0.3.5.

Security issue fixed:

• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271392).

Other updates and bugfixes:

• Version 0.3.5:
  • Bump version to v0.3.5 (#206)
  • Bump clap 4.5.53 (#205)
  • Bump actions/checkout to 6 (#204)
  • Bump nmstate to 2.2.55 (#203)
  • Fix for issue #198 VLAN interface renaming (#201)
  • Bump serde to 1.0.228 (#196)
  • Bump anyhow to 1.0.100 (#194)

This update for gitoxide fixes the following issues:

Changes in gitoxide:

• Update to 0.56.0:

  • Fixes CVE-2026-40034 (boo#1266434): the CommandForbiddenInModules trust check could be bypassed in gix_submodule::File::update(), which allowed arbitrary command execution from a crafted .gitmodules file
  • Fixes a submodule name validation bypass that allowed traversal out of .git/modules and disclosure of credentials
  • Fixes symlinked .gitmodules files being followed and parsed from outside the repository
  • Fixes several denial-of-service vectors in gix-pack: unchecked indexing panics and uncapped allocations from crafted pack data
  • Fixes HTTP credentials being leaked to the redirected host by the curl transport backend
  • Add the gix config show, gix config list, gix config fmt, gix free remote refs, gix free trust, gix dirwalk and gix tix subcommands
  • Add a gix status --untracked flag and gix merge tree --message for creating commits
  • gix exclude query is now index-aware and no longer reports ignore matches for tracked files, matching git check-ignore
  • Preserve all configured remote URLs rather than only the last one
  • Fix fetching and cloning with tag refspecs in shallow clones, relative worktree linking files and loose ref path-prefix collisions
  • Update the crates to the Rust 2024 edition

• Refresh the vendored dependencies. Recording the state of the remaining open CVE bugs against this version, none of which it is affected by:

  • CVE-2026-25541 (boo#1274525): the vendored bytes is now 1.12.1, above the 1.11.1 fix
  • CVE-2025-22620 (boo#1236139): gix-worktree-state is 0.33.0, far above the 0.17.0 that fixed the world-writable checkout of executable files

• update to 0.50.0: see https://github.com/GitoxideLabs/gitoxide/compare/v0.42.0...v0.50.0

• update to 0.42.0:

  • add first 'debug' version of gix diff file
  • use revspecs for revision and path
  • CVE-2025-31130: use collision-detecting SHA-1 hash boo#1240872

• Update to version 0.41.0:

  • add gix blame -L start,end
  • add gix env to print paths relevant to the Git installation.
  • Document the remaining subcommands
  • Add support for statistics and additional performance information.
  • add gix blame to the CLI. That way it's possible to see the blame result of any file in the repository.

• Updates from version 0.40.0:

  • add first 'debug' version of gix log. It's primarily meant to better understand gix blame.
  • add --tree-favor to gix merge tree|commit. With it one can decide which side to favor in case of irreconcilable tree-conflicts.
  • CVE-2025-22620: gix-worktree-state specifies 0777 permissions when checking out executable files (boo#1236139)

• Update to version 0.39.0: New Features

  • add gix merge commit --debug
  • add gix merge commits
  • add gix merge tree to merge trees similarly to git merge-tree.

• Update to version 0.38.0: New Features

  • support for listing worktrees with gix worktree list
  • add first 'debug' version of gix diff tree.
  • add new gix cat command.
  • add gix merge-file with similar features as git merge-file
  • gix merge-base for the CLI Bug Fixes
  • Adjust gix clean warning and help for worktree fix
  • Clarify -r/--repositories and --skip-hidden-repositories Other
  • switch from time to jiff
  • Unify style in config support info

This update for kak-lsp fixes the following issues:

Changes in kak-lsp:

• Update to version 21.0.2:

  • Fix a regression that broke compatibility with Kakoune versions older than 2026.05.21
  • Add a default configuration for Hare, using hare-lsp
  • Fix hangs after editing a file without a trailing newline, such as an empty file
  • Use nixd instead of nil as the default language server for nix
  • Fix buffer-sync corruption when .editorconfig sets insert_final_newline = false

• Refresh the vendored registry. Recording the state of the open vendored-crate CVEs against it, none of which this package is affected by:

  • CVE-2026-25541 (boo#1274502): bytes is 1.12.1, above the 1.11.1 fix
  • CVE-2025-3416 (boo#1242654): the openssl crate is 0.10.81, above the 0.10.72 fix; it was already 0.10.80 before this update
  • CVE-2025-55159 (boo#1248048): slab is 0.4.12, above the 0.4.11 fix; only 0.4.10 was ever affected and this package never shipped it

• Update to version 20.0.0:

  • v20.0.0
  • Update changelog
  • Fix tinymist documentation URL
  • Fix tinymist preview config key. previewFeature only works for the vscode plugin
  • Encode brackets for file paths
  • feat: swift/sourcekit-lsp support
  • Paal �ye-Str�mme Copyright Waiver
  • Make sure buffer synchronization works even when finaleol is missing
  • workspace/executeCommand: don't panic on invalid args JSON
  • servers.kak: update markdown-oxide root markers
  • Inline lsp-initial-goto-position
  • Fix function_casts_as_integer warning
  • lsp-capabilities: remove stale default mappings
  • changelog new erlang default server
  • fix(ci/commit-new-release.sh): interpolate version number
  • Change default language server for erlang
  • lsp-inlay-hint-apply-*: fix crash when no hints avail
  • Add inlay hint textedit support
  • start new cycle

• Update to version 19.0.1:

  • v19.0.1
  • Don't print Hover: prefix if there are no diagnostics
  • Changelog for regression fix
  • Fix lsp-find-error incorrectly handling --previous flag
  • ci/commit-new-release.sh: support jj
  • start new cycle

• Update to version 18.2.0:

  • v18.2.0
  • Update changelog
  • Remove misleading debug log in SessionRenamed hook
  • Make diagnostics buffer one-line-per diagnostics
  • test/gopls-dynamic-settings.sh: fix for recent gopls
  • clippy
  • controller: consume entire request before checking for user errors
  • Add support vuejs
  • Fix crash on invalid text edit ranges
  • Send initializationOptions and workspace/didChangeConfiguration as expected by jdtls
  • cargo update
  • Fix type inference errors with deranged 0.4.1
  • Fix symbol name prefix for breadcrumbs
  • Work around breaking change in deranged crate
  • Simplify recursive breadcrumbs calculation
  • Language-specific SymbolKind rendering
  • lsp-goto-document-symbol: remove symbol kind suffix
  • start new cycle

• Update to version 18.1.3:

  • v18.1.3
  • Use the right language ID when [language.foo] is in effect
  • Remove unused line-specs option
  • Better variable name for code lens line-specs value
  • lsp-object: don't send documentSymbol to servers that don't support it
  • Include language server name in stderr logs
  • Use rust-analyzer from PATH
  • Work around lsp-rename didChange failing when using window scope
  • Send texlab-specific requests only to servers that support them
  • Fix dart language server command
  • Add kak-lsp server PID to the closing log message
  • Report more diagnostics information, in multiple lines
  • Fix regression causing spurious/missing server name in hover
  • Address clippy lints
  • Config knob to override magic single-instance setting
  • Back out "Add curly underline to DiagnosticError face"
  • start new cycle

• Update to version 18.1.2:

  • Silence errors from non-default hooks
  • Fix languageId for JSX/TSX files
  • Silence deprecation warning
  • Add curly underline to DiagnosticError face

• Update to version 18.1.1: …

This update for git-cliff fixes the following issues:

Changes in git-cliff:

• Update to version 2.13.1:

  • Support more configuration file locations
  • Add per-commit statistics
  • Expose determined bump type in release context
  • Add configurable commit processing order
  • Add environment variable for offline execution
  • Migrate logging to tracing
  • Add caching where applicable

• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (boo#1274523)

• Update to version 2.12.0:

  • Add offline flag
  • Add --skip-tags cli argument
  • Implement commit processing summary
  • Bug Fixes

• includes changes from 2.11.0:

  • Support failing on unmatched commits
  • Add support for azure devops
  • Improve repository/directory path resolution
  • Add split_regex, replace_regex, find_regex filters
  • Bug Fixes

• includes changes from 2.10.1:

  • Add 'integrations' feature flag for enabling all integrations
  • Bug Fixes
  • CVE-2025-55159: lab: incorrect bounds check in get_disjoint_mut function can lead to undefined behavior or potential crash due to out-of-bounds access (boo#1248065)

• Update to version 2.10.0:

  • (config) Support using include and exclude paths in the config (#1173) - (7c2f922)
  • (parser) Support regex matching on JSON arrays with scalar elements (#1163) - (dc458ea)
  • (template) Support adding commit statistics to the changelog (#1151) - (05a50d7)
  • (config) [breaking] Use empty header and footer as default (#1161) (#1172) - (3e9311e)
  • (config) Check if commit.footers is defined in detailed example (#1170) - (078545f)
  • (fixtures) Update expected.md after config change (#1176) - (76d3e81)
  • (generation) Ensure skip_tags condition is evaluated first (#1190) - (318be66)
  • (repo) Use the correct order while diffing paths (#1188) - (ff6c310)
  • (ci) Apply security best practices (#1180) - (a32deca)
  • (config) Implement FromStr instead of Config::parse_from_str() (#1185) - (692345e)
  • (test) Standardize unit tests for commit module (#1147) - (0446d6a)
  • (context) Add example usage for statistics (#1162) - (4f7379a)
  • (quickstart) Remove repetitive words (#1200) - (434f9ee)
  • (readme) Fix twitter badge (#1164) - (68bd85e)
  • (readme) Polish badges (#1159) - (941cc2b)
  • (remote) Fix inconsistency in remote integration documentation (#1165) - (deb29dc)
  • (website) Add highlights for 2.10.0 (#1225) - (a3fe8c9)
  • (website) Add installation instructions for gentoo-linux (#1203) - (07fe6bf)
  • (formatting) Use spaces instead of tabs (#1184) - (0027300)
  • (fixture) Add test fixture for overriding the conventional scope (#1166) - (cb84a08)
  • (build) Bump MSRV to 1.85.1 - (d8279d4)
  • (cd) Use macos-15 runner - (c156fc5)
  • (cd) Re-enable sccache for maturin - (871c3c9)
  • (crate) Remove Rust nightly requirement - (4f3e5af)
  • (fixture) Update test-regex-json-array fixture (#1178) - (95f4056)
  • (format) Format module imports for readability (#1183) - (6db7d49)
  • (git) Add .git-blame-ignore-revs - (5b64131)
  • (npm) Bump git-cliff to 2.9.1 (#1156) - (e13b158)
  • (website) Update the node version - (566c2a1)
  • Check if commit.footers is defined in detailed example (#1170) (078545f)
  • (breaking) Use empty header and footer as default (#1161) (#1172) (3e9311e)
  • Update expected.md after config change (#1176) (76d3e81)
  • Use the correct order while diffing paths (#1188) (ff6c310)
  • Ensure skip_tags condition is evaluated first (#1190) (318be66)
  • Polish badges (#1159) (941cc2b)
  • Fix twitter badge (#1164) (68bd85e)
  • Fix inconsistency in remote integration documentation (#1165) (deb29dc)
  • Add example usage for statistics (#1162) (4f7379a)
  • Remove repetitive words (#1200) (434f9ee)
  • Add installation instructions for gentoo-linux (#1203) (07fe6bf)
  • Add highlights for 2.10.0 (#1225) (a3fe8c9)
  • Support regex matching on JSON arrays with scalar elements (#1163) (dc458ea)
  • Support using…

This update for forgejo-cli fixes the following issues:

Changes in forgejo-cli:

• Update vendored bytes crate to 1.12.1

  • CVE-2026-25541: Fixed an integer overflow in BytesMut::reserve that could corrupt the tracked capacity and lead to out-of-bounds slices (boo#1274529).

• update to 0.6.0:

  • Localization!
    • forgejo-cli has gained localization support! You can now use it in your preferred language, just like Forgejo itself. Currently de-DE and zh-Hans are included, with several more being in-progress. See the project on Codeberg Translate if you want to help out with any languages you know! https://translate.codeberg.org/projects/forgejo-cli/forgejo-cli/
  • Additions
    • (!586) fj issue/pr view assignees to see who is assigned to an issue or pull request
    • (!582) --avatar/--unset-avatar options on fj repo edit
    • (!554) fj repo star-status to check if you've starred a repo
    • (!547) --cwd option to set the working directory a command is run in
    • (!533, !561) Commands to watch and unwatch repos
    • (!462) Resolve SSH host names from SSH config
    • (!279, !464, !472, !489, !491, !513, !594) Localization
    • Added fj auth login support for the following instances:
      • v16.next.forgejo.org
      • v17.next.forgejo.org
    • Removed fj auth login support for the following instances that have shut down:
      • v7.next.forgejo.org
      • v12.next.forgejo.org
  • Changes
    • (!535) Added an error message when fj auth login fails to open the browser
    • (!523) fj auth add-key was renamed to fj auth add-token. An alias still exists to add-key, so this isn't a breaking change.
    • (!514) The --host flag can now be anywhere in the command, instead of only the beginning
    • (!504) fj auth add-token no longer takes a username argument.
  • Fixes
    • (!579) Fixed fj issue unassign incorrectly unassigning everyone except the intended users
    • (!569) Fixed display of labels failing when a label is marked as exclusive but does not contain a slash
    • (!542) Fixed parsing of SSH shorthand urls
    • (!510) Fixed fj pr checkout failing when the instance URL contained a port
    • (!437) Fixed incorrect parsing of activity info
  • Other
    • (!573) Use rust 2024 edition
    • (!560) Simplify determining repo owner
    • (!531) Fix clippy warnings
    • (!527) Remove unused dependencies, narrow tokio features
    • (!526) Replace crossterm with terminal_size
    • (!520) Optimize cargo release profile
    • (!469) Fix typo
    • (!449) Restricted file permissions at creation time
    • (!443) Add oneline helptext to 'repo migrate' command

• update to 0.5.0:

  • Additions
    • (!334) Support for managing labels on issues and repos.
    • (!349) repo edit and repo units for modifying settings on a repo and repo units.
    • (!373) Use the needed CLI flags for more editors when opening them.
    • (!385) Use the editor defined in git's core.editor config option by default (falling back to $EDITOR if it is not set).
    • (!414) Add commands to assign and unassign users to issues and PRs.
    • (!415) Support all README files in fj repo readme, regardless of case or extension.
    • (!416) Add the option to choose what repo to own the new repo to fj repo migrate.
    • (!419) Show a warning when viewing an archived repo.
    • (!420) Add a notice about git push --force not being supported on AGit PRs.
    • Added fj auth login support for the following instances:
      • v15.next.forgejo.org
      • codefloe.com
  • Fixes
    • (!393) Don't include pull requests in fj issues search.
    • (!407) Guarantee opening the browser in fj auth login doesn't block.
    • (!417) Prevent incorrectly reusing the refresh token when refreshing OAuth tokens.
  • Other
    • (!278) Improved "no repo info" error message.
    • (!403) Build aarch64…

This update for gstreamer-devtools fixes the following issues:

• CVE-2025-4574: crossbeam-channel: internal Channel type's Drop method has a race condition that can lead to a double-free and memory corruption (bsc#1243178).
• CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into terminal output when logged and lead to terminal manipulation (bsc#1249015).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1274306).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257914).
• CVE-2026-72813: actix-files: empty Range header in GET requests for static files can lead to a process crash (bsc#1275210).
• CVE-2026-72814: actix-files: non-existing folders passed as an argument to the actix_files::Files::new() method can lead to information disclosure (bsc#1275209).

This update for aws-nitro-enclaves-cli fixes the following issues:

• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274300).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257933).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270202).

Changes for aws-nitro-enclaves-cli:

• Update to version 1.5.0

This update for supergfxctl fixes the following issues:

Changes in supergfxctl:

• Fixed security issue in embedded dependency 'bytes' (CVE-2026-25541 boo#1274336)

• Update to version 1762634235.5d503b1:

  • Added GfxMode::Integrated, GfxMode::Hybrid to the AsusGpuMuxMode::Discreet vec

This update for waylyrics fixes the following issues:

Changes in waylyrics:

• Update to version 0.4.0 (CVE-2026-25541 bsc#1274106)

  • Added plugin architecture and SakuraLLM translation plugin
  • Added OpenCC support for Simplified/Traditional Chinese
  • Added support for custom CSS themes and style presets
  • Added auto theme switching based on light/dark mode
  • Added shortcut keys for decoration, passthrough, and search
  • Improved MPRIS and SMTC audio player integration
  • Improved TOML config handling and automatic comment updates
  • Optimized lyric search, fetch speed, and UI responsiveness
  • Fixed window passthrough state and click-through toggles
  • Updated dependencies and bumped MSRV requirement

• Update to version 0.3.21:

  • docs: update changelog [ci skip]
  • chore: bump version to v0.3.21
  • build: bump dependencies
  • build(deps): bump tokio from 1.43.0 to 1.43.1
  • build(deps): bump openssl from 0.10.71 to 0.10.72
  • build(deps): bump rust_decimal from 1.36.0 to 1.37.1
  • build(deps): bump async-trait from 0.1.86 to 0.1.88
  • build(deps): bump reqwest from 0.12.12 to 0.12.15
  • build(deps): bump rust_decimal_macros from 1.36.0 to 1.37.1
  • build(deps): bump the serde group with 2 updates
  • fix:.一个错误
  • fix: 手动刷新歌词时清空歌词标签缓存
  • style: :lipstick: cargo fmt
  • perf: DashMap 作为歌词标签存在性缓存
  • feat: 添加对从音乐文件元数据读取歌词的支持
  • build(deps): bump ring from 0.17.11 to 0.17.13 (#303)
  • chore: add script to export dup deps [ci skip]
  • fix(CI): remove outdated test of qqmusic api initialization [ci skip]
  • build: bump dependencies
  • docs(readme): HotLyric, alternative on windows [ci skip]
  • docs(readme): note on project status
  • build(deps): bump openssl from 0.10.68 to 0.10.70 (#301)
  • build(deps): bump serde_json from 1.0.134 to 1.0.138 in the serde group (#296)
  • build(deps): bump thiserror from 2.0.9 to 2.0.11 (#297)
  • build(deps): bump tokio from 1.42.0 to 1.43.0 (#298)
  • build(deps): bump futures-lite from 2.5.0 to 2.6.0 (#299)
  • build(deps): bump windows from 0.58.0 to 0.59.0 (#300)
  • build(deps): bump dark-light to 2.0.0
  • build(deps): bump reqwest from 0.12.9 to 0.12.12 (#291)
  • build(deps): bump the serde group with 2 updates (#290)
  • build(deps): bump gdk4-win32 from 0.9.3 to 0.9.5 (#292)
  • build(deps): bump thiserror from 2.0.6 to 2.0.9 (#293)
  • build(deps): bump glib-macros from 0.20.5 to 0.20.7 (#294)
  • rust version problem (#289)
  • enhance: switch to better tray-icon implementation for windows [ci skip]
  • build: migrate to ksni 0.3
  • chore: dedup code
  • chore: fix deepsource lints
  • refactor: extract set_by_mode
  • ci: add .deepsource.toml
  • docs(readme): add introduction [ci skip]
  • docs(readme): add alternative lyric-for-musixfox [ci skip]
  • docs(readme): add preview images [ci skip]
  • docs(readme): replace text with logos
  • docs: update changelog & metainfo
  • chore: release v0.3.20
  • enhance: comment for sub table in config
  • log: capture panics
  • fix: check if instance name used
  • docs: update metainfo & changelog
  • hotfix: build on windows
  • chore: release v0.3.19
  • chore(deps): bump dependencies
  • build(deps): bump the serde group with 2 updates (#280)
  • build(deps): bump tracing from 0.1.40 to 0.1.41 (#281)
  • build(deps): bump tray-icon from 0.19.1 to 0.19.2 (#282)
  • build(deps): bump rfd from 0.15.0 to 0.15.1 (#284)
  • build(deps): bump url from 2.5.3 to 2.5.4 (#283)
  • docs(build): check MSRV
  • chore(clippy): fix clippy warnings
  • chore: update lock file
  • fix: setCookies for QQMusicApi
  • fix: instance format
  • feat: support multi-monitor setup (#278)
  • feat: Implement color-scheme autoswitch (light/dark mode) (#277)
  • enhance: unregister latest theme
  • build(deps): bump rustls from 0.23.16 to 0.23.18 (#276)
  • fix: LazyLock is not stable yet in 1.73 rustc
  • chore: fix details URL…

This update for sccache fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274146).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257923).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270206).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270559).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270736).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270869).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270512).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270938).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270948).
• CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).
• CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL (bsc#1273884).
• CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).
• CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).

Changes for sccache:

Update to version 0.18.0~2:

• Add experimental concurrent cache support
• chore: Remove dependency status badge (#2856)
• Don't hand the jobserver to children that can't use it
• dist: refuse to trim rlibs from crates that also emit a cdylib
• fix(cache): avoid duplicate multilevel reads
• Strip basedirs from the compiler arguments too
• tests/integration: replace MinIO with Silo
• ci: dump sccache logs on integration failures
• multilevel: a chain with any writable level is writable
• Fix parsing of #line directives
• Release 0.18.0
• daemonize: use an allow-list approach to inherited FDs
• gcc, clang: make the assembler part of the cache key
• support cl.exe /openmp:llvm
• support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args
• support MSVC /feature argument
• msvc: support lots of flags (#2832)
• Update shlex dependency to version 2 (#2836)
• gcc: mark flags as TooHard if need to cache something else (#2833)
• clang: support more CLI options (#2834)
• msvc: support arm64EC and fastfail flags (#2830)
• chore: fix typo in comment (#2829)
• nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)
• cache: allow skipping capability checks (#2822)
• Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)
• nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)
• Add an agent (#2812)
• Add support for d20bforceinline. (#2807)
• feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)
• Bump MSRV to 1.91.0 (#2793)
• Fix nvcc dryrun parsing for CUDA 13.3 (#2722)
• test: Fixed…

This update for rustup fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274144).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257902).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270186).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270619).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270795).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270870).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270521).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270874).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270989).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282217).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282217).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282217).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282217).
• rust-shlex: Multiple issues involving quote API (RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).

Changes for rustup:

• Update to version 1.29.1~0:

• dist(rustup-init/sh): update commit shasum in help string
• style(bin/rustup-init): reformat code
• docs(changelog): update for v1.29.1 stable release
• warn how to switch away from the deprecated complete profile
• fix(cli/help): fix wording in rustup run --help
• ci(docker/android): stop building OpenSSL
• refactor(cli/docs): use tracing for docs opening status messages
• refactor(self-update): rename Windows uninstall registry helpers
• feat(test): isolate Windows registry state per test
• docs(dev-guide): mention how to support new compilation targets
• Fix funding link
• chore(deps): lock file maintenance
• refactor(cli/self-update): move current_install_opts() to InstallOpts::display()
• refactor(cli/self-update): move process out of InstallOpts
• fix(cli/self-update): postpone initialization of Cfg in setup_mode
• refactor(cli/self-update): take Process in check_existence_of_settings_file()
• fix(settings): prevent creating new file with SettingsFile::read_settings()
• test(cli-inst-interactive): test file creation on cancelled installation
• refactor(toolchain/names): inline validate() aliases into FromStr
• refactor(toolchain/names): rename validate() to normalize_name()
• fix minor typos
• www: align copy icon
• refactor(toolchain/names)!: remove try_from_str!()
• refactor(toolchain/names)!: remove from_variant!()
• Add rustup doc --serve to serve docs over local HTTP
• Move doc() and man() into a new docs module
• chore(github): comment out instructions in PR template
• docs(dev-guide): reapply abandoned changes from #4970
• Add riscv64 unknown linux musl support
• fix(deps): update rust crate enum-map to v3
• refactor(cli/self-update)!: rename install() to InstallOpts::install()
• refactor(cli/self-update)!: rename maybe_install_rust() to InstallOpts::install_rust()
• refactor(cli/self-update)!: rename…