{"id":"CVE-2026-25541","aliases":["AZL-76691","AZL-76703","AZL-76712","AZL-76715","AZL-76718","AZL-76721","AZL-76752","AZL-78615","AZL-85059","DEBIAN-CVE-2026-25541","EUVD-2026-5321","GHSA-434x-w66g-qw3r","RUSTSEC-2026-0007","SUSE-SU-2026:22787-1","SUSE-SU-2026:22827-1","SUSE-SU-2026:22917-1","SUSE-SU-2026:22935-1","SUSE-SU-2026:23071-1","SUSE-SU-2026:23572-1","SUSE-SU-2026:23643-1","SUSE-SU-2026:23659-1","SUSE-SU-2026:23983-1","SUSE-SU-2026:24014-1","SUSE-SU-2026:24236-1","SUSE-SU-2026:2975-1","SUSE-SU-2026:2976-1","SUSE-SU-2026:2977-1","SUSE-SU-2026:3577-1","SUSE-SU-2026:3674-1","SUSE-SU-2026:3992-1","SUSE-SU-2026:5101-1","UBUNTU-CVE-2026-25541","openSUSE-RU-2026:21658-1","openSUSE-SU-2026:11255-1","openSUSE-SU-2026:11280-1","openSUSE-SU-2026:11474-1","openSUSE-SU-2026:11475-1","openSUSE-SU-2026:11482-1","openSUSE-SU-2026:11492-1","openSUSE-SU-2026:11495-1","openSUSE-SU-2026:11512-1","openSUSE-SU-2026:11513-1","openSUSE-SU-2026:11522-1","openSUSE-SU-2026:11525-1","openSUSE-SU-2026:11527-1","openSUSE-SU-2026:11528-1","openSUSE-SU-2026:11529-1","openSUSE-SU-2026:11549-1","openSUSE-SU-2026:11655-1","openSUSE-SU-2026:11656-1","openSUSE-SU-2026:11679-1","openSUSE-SU-2026:11818-1","openSUSE-SU-2026:11835-1","openSUSE-SU-2026:11838-1","openSUSE-SU-2026:11905-1","openSUSE-SU-2026:12205-1","openSUSE-SU-2026:12355-1","openSUSE-SU-2026:21386-1","openSUSE-SU-2026:21428-1","openSUSE-SU-2026:21558-1","openSUSE-SU-2026:21560-1","openSUSE-SU-2026:21584-1","openSUSE-SU-2026:21605-1","openSUSE-SU-2026:21689-1","openSUSE-SU-2026:21782-1","openSUSE-SU-2026:21794-1","openSUSE-SU-2026:21815-1","openSUSE-SU-2026:21982-1","openSUSE-SU-2026:22016-1","openSUSE-SU-2026:22075-1","openSUSE-SU-2026:22189-1"],"status":"published","title":"Bytes is vulnerable to integer overflow in BytesMut::reserve","description":"Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.","severity":{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00601,"percentile":0.49108,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-680"],"published":"2026-02-03T12:00:00Z","modified":"2026-11-05T13:27:13Z","exploits":[{"source":"pocgithub","id":"trajanOx/cve-2026-25541-fuel-analysis","title":"trajanOx/cve-2026-25541-fuel-analysis","date":"2026-06-22","url":"https://github.com/trajanOx/cve-2026-25541-fuel-analysis"}],"fixes":[{"ecosystem":"crates.io","package":"bytes","fixed_in":["1.11.1"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"kata-containers","fixed_in":["3.19.1.kata2-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"netavark","fixed_in":["1.10.3-7"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"azl-compliance","fixed_in":["1.0.2-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rpm-ostree","fixed_in":["2024.4-8"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rust","fixed_in":["1.75.0-27","1.90.0-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"trident","fixed_in":["0.22.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rust-afterburn","fixed_in":["5.8.2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rust-bytes","fixed_in":["1.11.1-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"nm-configurator","fixed_in":["0.3.5-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"sequoia-sq","fixed_in":["1.4.0-bp160.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nm-configurator","fixed_in":["0.3.5-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"wild","fixed_in":["0.10.0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"git-cliff","fixed_in":["2.13.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cargo-audit","fixed_in":["0.22.2~git0.281452c-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cargo-c","fixed_in":["0.10.23-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"obs-service-cargo","fixed_in":["7.2.2-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rustup","fixed_in":["1.29.0~0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"wasm-bindgen","fixed_in":["0.2.100-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"forgejo-cli","fixed_in":["0.6.0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"markdown-oxide","fixed_in":["0.25.12-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tree-sitter","fixed_in":["0.26.8-5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"librepods","fixed_in":["0.1.0+git20260515.672e65a-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tealdeer","fixed_in":["1.8.0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"switcheroo","fixed_in":["2.6.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"nm-configurator","fixed_in":["0.3.5-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"supergfxctl","fixed_in":["1762634235.5d503b1-bp160.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"waylyrics","fixed_in":["0.4.0-bp160.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"bytes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.1"},{"fixed":"1.11.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1.kata2-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"netavark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"azl-compliance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rpm-ostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.4-8"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.0-27"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"fixed":"1.90.0-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.72.0-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"trident","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust-afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.2-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rust-bytes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1-1","1.11.0-1","1.11.1-1","1.12.1-1","1.2.1-1","1.4.0-1","1.5.0-1","1.7.2-1","1.8.0-1","1.9.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"rust-bytes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1-1","1.11.0-1","1.11.1-1","1.12.1-1","1.9.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-bytes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-1"}]}],"versions":["1.10.1-1","1.11.0-1","1.9.0-1"]},{"source":"osv","ecosystem":"crates.io","package":"bytes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.1"},{"fixed":"1.11.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"bytes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.1"},{"fixed":"1.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"nm-configurator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.5-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-slfo.1.1_1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"gstreamer-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.2.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"gstreamer-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.2.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0~2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0~2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1~0-160000.1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1~0-160000.1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"agama","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17+699.92879916c-160000.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"agama","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17+699.92879916c-160000.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-150500.3.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-150400.3.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-150400.3.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"snpguest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2-150600.3.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"snpguest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2-150600.3.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0~1-150600.10.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0~1-150600.10.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0~1-150600.10.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-150600.10.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-150600.10.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"aws-efs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4-150600.17.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"aws-efs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4-150600.17.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rust-bytes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.12-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rust-bytes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.12-1","1.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-bytes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-1","1.5.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-bytes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-bytes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.0-1","1.10.1-1","1.11.0-1","1.11.1-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"sequoia-sq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-bp160.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nm-configurator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.5-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gitoxide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.56.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kak-lsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.0.2-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wild","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"aws-efs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"git-cliff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cargo-audit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.2~git0.281452c-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cargo-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.23-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"obs-service-cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.2-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.0~0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0~1-2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wasm-bindgen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.100-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"forgejo-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"markdown-oxide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.12-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tree-sitter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.8-5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"agama","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24+0.a836cced5-54.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"shadowsocks-rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"librepods","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0+git20260515.672e65a-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pijul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~beta.23-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tealdeer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"switcheroo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"zed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"nm-configurator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.5-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gitoxide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.56.0-bp160.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kak-lsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.0.2-bp160.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"git-cliff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-bp160.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"forgejo-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-bp160.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.2.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"supergfxctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1762634235.5d503b1-bp160.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"waylyrics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-bp160.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0~2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1~0-160000.1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"agama","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17+699.92879916c-160000.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"shadowsocks-libev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.6-bp160.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"shadowsocks-rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-bp160.1.1"}]}],"bundled":6}],"products":[{"vendor":"tokio-rs","product":"bytes"}],"references":[{"url":"https://github.com/tokio-rs/bytes/security/advisories/GHSA-434x-w66g-qw3r","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/tokio-rs/bytes/commit/d0293b0e35838123c51ca5dfdf468ecafee4398f","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/tokio-rs/bytes/releases/tag/v1.11.1","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0007.html","tags":["x_refsource_MISC","Exploit","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25541","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-434x-w66g-qw3r","tags":["report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25541.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-25541","tags":["advisory"]},{"url":"https://github.com/tokio-rs/bytes","tags":["package"]},{"url":"https://crates.io/crates/bytes","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622787-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1270175","tags":["report"]},{"url":"https://bugzilla.suse.com/1270483","tags":["report"]},{"url":"https://bugzilla.suse.com/1270555","tags":["report"]},{"url":"https://bugzilla.suse.com/1270651","tags":["report"]},{"url":"https://bugzilla.suse.com/1270787","tags":["report"]},{"url":"https://bugzilla.suse.com/1270817","tags":["report"]},{"url":"https://bugzilla.suse.com/1270886","tags":["report"]},{"url":"https://bugzilla.suse.com/1270949","tags":["report"]},{"url":"https://bugzilla.suse.com/1271348","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45784","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622827-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622917-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1196972","tags":["report"]},{"url":"https://bugzilla.suse.com/1242665","tags":["report"]},{"url":"https://bugzilla.suse.com/1243850","tags":["report"]},{"url":"https://bugzilla.suse.com/1244199","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5791","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622935-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271392","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623071-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623572-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243178","tags":["report"]},{"url":"https://bugzilla.suse.com/1249015","tags":["report"]},{"url":"https://bugzilla.suse.com/1257914","tags":["report"]},{"url":"https://bugzilla.suse.com/1274306","tags":["report"]},{"url":"https://bugzilla.suse.com/1275209","tags":["report"]},{"url":"https://bugzilla.suse.com/1275210","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72814","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623643-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257933","tags":["report"]},{"url":"https://bugzilla.suse.com/1270202","tags":["report"]},{"url":"https://bugzilla.suse.com/1274300","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623659-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623983-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243868","tags":["report"]},{"url":"https://bugzilla.suse.com/1257923","tags":["report"]},{"url":"https://bugzilla.suse.com/1270206","tags":["report"]},{"url":"https://bugzilla.suse.com/1270512","tags":["report"]},{"url":"https://bugzilla.suse.com/1270559","tags":["report"]},{"url":"https://bugzilla.suse.com/1270693","tags":["report"]},{"url":"https://bugzilla.suse.com/1270736","tags":["report"]},{"url":"https://bugzilla.suse.com/1270869","tags":["report"]},{"url":"https://bugzilla.suse.com/1270938","tags":["report"]},{"url":"https://bugzilla.suse.com/1270948","tags":["report"]},{"url":"https://bugzilla.suse.com/1273881","tags":["report"]},{"url":"https://bugzilla.suse.com/1273884","tags":["report"]},{"url":"https://bugzilla.suse.com/1273886","tags":["report"]},{"url":"https://bugzilla.suse.com/1273888","tags":["report"]},{"url":"https://bugzilla.suse.com/1274146","tags":["report"]},{"url":"https://bugzilla.suse.com/1282211","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93602","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624014-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230032","tags":["report"]},{"url":"https://bugzilla.suse.com/1243862","tags":["report"]},{"url":"https://bugzilla.suse.com/1249008","tags":["report"]},{"url":"https://bugzilla.suse.com/1257902","tags":["report"]},{"url":"https://bugzilla.suse.com/1270186","tags":["report"]},{"url":"https://bugzilla.suse.com/1270521","tags":["report"]},{"url":"https://bugzilla.suse.com/1270619","tags":["report"]},{"url":"https://bugzilla.suse.com/1270644","tags":["report"]},{"url":"https://bugzilla.suse.com/1270795","tags":["report"]},{"url":"https://bugzilla.suse.com/1270870","tags":["report"]},{"url":"https://bugzilla.suse.com/1270874","tags":["report"]},{"url":"https://bugzilla.suse.com/1270989","tags":["report"]},{"url":"https://bugzilla.suse.com/1274144","tags":["report"]},{"url":"https://bugzilla.suse.com/1282217","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624236-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249014","tags":["report"]},{"url":"https://bugzilla.suse.com/1271079","tags":["report"]},{"url":"https://bugzilla.suse.com/1271235","tags":["report"]},{"url":"https://bugzilla.suse.com/1271644","tags":["report"]},{"url":"https://bugzilla.suse.com/1271854","tags":["report"]},{"url":"https://bugzilla.suse.com/1274203","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262975-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262976-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262977-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263577-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1270527","tags":["report"]},{"url":"https://bugzilla.suse.com/1270642","tags":["report"]},{"url":"https://bugzilla.suse.com/1274139","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263674-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263992-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265101-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1263683","tags":["report"]},{"url":"https://bugzilla.suse.com/1272349","tags":["report"]},{"url":"https://bugzilla.suse.com/1272354","tags":["report"]},{"url":"https://bugzilla.suse.com/1274202","tags":["report"]},{"url":"https://bugzilla.suse.com/1275449","tags":["report"]},{"url":"https://bugzilla.suse.com/1275450","tags":["report"]},{"url":"https://bugzilla.suse.com/1281947","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16318","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-25541","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25541","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257934","tags":["report"]},{"url":"https://bugzilla.suse.com/1274437","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-50237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53600","tags":["web"]},{"url":"https://bugzilla.suse.com/1223249","tags":["report"]},{"url":"https://bugzilla.suse.com/1236139","tags":["report"]},{"url":"https://bugzilla.suse.com/1240872","tags":["report"]},{"url":"https://bugzilla.suse.com/1266434","tags":["report"]},{"url":"https://bugzilla.suse.com/1274525","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31130","tags":["web"]},{"url":"https://bugzilla.suse.com/1242654","tags":["report"]},{"url":"https://bugzilla.suse.com/1248048","tags":["report"]},{"url":"https://bugzilla.suse.com/1274502","tags":["report"]},{"url":"https://bugzilla.suse.com/1248065","tags":["report"]},{"url":"https://bugzilla.suse.com/1274523","tags":["report"]},{"url":"https://bugzilla.suse.com/1242683","tags":["report"]},{"url":"https://bugzilla.suse.com/1248047","tags":["report"]},{"url":"https://bugzilla.suse.com/1274529","tags":["report"]},{"url":"https://bugzilla.suse.com/1274336","tags":["report"]},{"url":"https://bugzilla.suse.com/1274106","tags":["report"]},{"url":"https://bugzilla.suse.com/1242615","tags":["report"]},{"url":"https://bugzilla.suse.com/1274441","tags":["report"]},{"url":"https://bugzilla.suse.com/1282208","tags":["report"]},{"url":"https://bugzilla.suse.com/1284025","tags":["report"]},{"url":"https://bugzilla.suse.com/1284975","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-25541","title":"Bytes is vulnerable to integer overflow in BytesMut::reserve","description":"Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.","status":"published","published":"2026-02-04T22:03:53.554Z","modified":"2026-02-05T15:13:34.031Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-680"],"updated_at":"2026-11-02T13:41:19.694734Z"}],"euvd":[{"id":"EUVD-2026-5321","description":"Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.","status":"published","published":"2026-02-04T22:03:53Z","modified":"2026-02-05T15:13:34Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T19:48:43.229255Z"}],"ghsa":[{"id":"GHSA-434x-w66g-qw3r","title":"bytes has integer overflow in BytesMut::reserve","description":"# Details\n\nIn the unique reclaim path of `BytesMut::reserve`, the condition\n```rs\nif v_capacity \u003e= new_cap + offset\n```\nuses an unchecked addition. When `new_cap + offset` overflows `usize` in release builds, this condition may incorrectly pass, causing `self.cap` to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as `spare_capacity_mut()` then trust this corrupted `cap` value and may create out-of-bounds slices, leading to UB.\n\nThis behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks.\n\n## PoC\n\n```rs\nuse bytes::*;\n\nfn main() {\n    let mut a = BytesMut::from(\u0026b\"hello world\"[..]);\n    let mut b = a.split_off(5);\n\n    // Ensure b becomes the unique owner of the backing storage\n    drop(a);\n\n    // Trigger overflow in new_cap + offset inside reserve\n    b.reserve(usize::MAX - 6);\n\n    // This call relies on the corrupted cap and may cause UB \u0026 HBO\n    b.put_u8(b'h');\n}\n```\n\n# Workarounds\n\nUsers of `BytesMut::reserve` are only affected if integer overflow checks are configured to wrap. When integer overflow is configured to panic, this issue does not apply.\n\nThis vulnerability is also known as [RUSTSEC-2026-0007](https://rustsec.org/advisories/RUSTSEC-2026-0007.html).","status":"published","published":"2026-02-03T19:17:46Z","modified":"2026-02-05T00:37:18Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-680"],"updated_at":"2026-11-02T14:39:22.637668Z"}],"nvd":[{"id":"CVE-2026-25541","description":"Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.","status":"published","published":"2026-02-04T22:16:00.383Z","modified":"2026-06-17T10:24:49.41Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-680"],"updated_at":"2026-11-02T14:12:05.149641Z"}],"osv":[{"id":"CVE-2026-25541","title":"Bytes is vulnerable to integer overflow in BytesMut::reserve","description":"Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.","status":"published","published":"2026-02-04T22:03:53.554Z","modified":"2026-11-05T13:27:13.93711644Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-680"],"updated_at":"2026-11-05T16:37:45.64821Z"},{"id":"DEBIAN-CVE-2026-25541","description":"Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.","status":"published","published":"2026-02-04T22:16:00.383Z","modified":"2026-10-01T03:03:21.406029045Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-434x-w66g-qw3r","title":"bytes has integer overflow in BytesMut::reserve","description":"# Details\n\nIn the unique reclaim path of `BytesMut::reserve`, the condition\n```rs\nif v_capacity \u003e= new_cap + offset\n```\nuses an unchecked addition. When `new_cap + offset` overflows `usize` in release builds, this condition may incorrectly pass, causing `self.cap` to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as `spare_capacity_mut()` then trust this corrupted `cap` value and may create out-of-bounds slices, leading to UB.\n\nThis behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks.\n\n## PoC\n\n```rs\nuse bytes::*;\n\nfn main() {\n    let mut a = BytesMut::from(\u0026b\"hello world\"[..]);\n    let mut b = a.split_off(5);\n\n    // Ensure b becomes the unique owner of the backing storage\n    drop(a);\n\n    // Trigger overflow in new_cap + offset inside reserve\n    b.reserve(usize::MAX - 6);\n\n    // This call relies on the corrupted cap and may cause UB \u0026 HBO\n    b.put_u8(b'h');\n}\n```\n\n# Workarounds\n\nUsers of `BytesMut::reserve` are only affected if integer overflow checks are configured to wrap. When integer overflow is configured to panic, this issue does not apply.\n\nThis vulnerability is also known as [RUSTSEC-2026-0007](https://rustsec.org/advisories/RUSTSEC-2026-0007.html).","status":"published","published":"2026-02-03T19:17:46Z","modified":"2026-09-10T03:50:33.995841351Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-680"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"UBUNTU-CVE-2026-25541","description":"Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.","status":"published","published":"2026-02-04T22:16:00Z","modified":"2026-05-20T16:24:46.789533956Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"AZL-76691","title":"CVE-2026-25541 affecting package kata-containers for versions less than 3.19.1.kata2-6","description":"Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.","status":"published","published":"2026-02-04T22:16:00Z","modified":"2026-08-28T17:47:50.889170796Z","updated_at":"2026-11-02T15:28:09.747541Z"},{"id":"AZL-76703","title":"CVE-2026-25541 affecting package netavark for versions less than 1.10.3-7","description":"Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.","status":"published","published":"2026-02-04T22:16:00Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.626116Z"},{"id":"AZL-76712","title":"CVE-2026-25541 affecting package azl-compliance for versions less than 1.0.2-3","description":"Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.","status":"published","published":"2026-02-04T22:16:00Z","modified":"2026-04-21T04:39:05.963068Z","updated_at":"2026-11-02T15:28:09.747541Z"},{"id":"AZL-76715","title":"CVE-2026-25541 affecting package rpm-ostree for versions less than 2024.4-8","description":"Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.","status":"published","published":"2026-02-04T22:16:00Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.626116Z"},{"id":"AZL-76718","title":"CVE-2026-25541 affecting package rust for versions less than 1.75.0-27","description":"Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.","status":"published","published":"2026-02-04T22:16:00Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.626116Z"},{"id":"AZL-76721","title":"CVE-2026-25541 affecting package rust for versions less than 1.90.0-6","description":"Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.","status":"published","published":"2026-02-04T22:16:00Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.626116Z"},{"id":"AZL-76752","title":"CVE-2026-25541 affecting package rust 1.72.0-14","description":"Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.","status":"published","published":"2026-02-04T22:16:00Z","modified":"2026-04-21T04:34:03.753371Z","updated_at":"2026-11-02T15:28:09.747541Z"},{"id":"AZL-78615","title":"CVE-2026-25541 affecting package trident for versions less than 0.22.0-1","description":"Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.","status":"published","published":"2026-02-04T22:16:00Z","modified":"2026-08-28T17:47:51.959474893Z","updated_at":"2026-11-02T15:28:10.017343Z"},{"id":"AZL-85059","title":"CVE-2026-25541 affecting package rust-afterburn for versions less than 5.8.2-2","description":"Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.","status":"published","published":"2026-02-04T22:16:00Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"openSUSE-RU-2026:21658-1","title":"Recommended update for sequoia-sq","description":"This update for sequoia-sq fixes the following issues:\n\nChanges in sequoia-sq:\n\n- Legal review Change main license to LGPL-2.0-or-later from GPL-2.0-only\n  * LICENSE.txt confirms it\n  * Correct Legal-Review-Notice usage\n\n- Update dependencies due to security issues (CVE-2026-25541 bsc#1274437)\n\n- Switch crypto backend from nettle to openssl (bsc#1257934)\n\n- Update to version 1.4.0:\n  * Release v1.4.0.\n  * Update crossbeam-epoch.\n  * Enable optimizations when building rust-crypto crates.\n  * tool: canonicalize Ord and PartialOrd impls for Association\n  * tool: silence clippy error for potentially mutable Map key types\n  * tool: fix formatting to avoid leaking comments into doc strings\n  * clippy: allow two types with interior mutability for BTreeSet keys\n  * lib: avoid potentially panicking integer cast\n  * clippy: add default lint configuration\n  * Update NEWS.\n  * lib: Improve control char escaping\n  * tool: Fix output file's permissions.\n  * Gracefully deal with 404 HTTP result codes\n  * tool: Don't panic if write fails\n  * tool: Restrict file permissions on sensitive output\n  * Improve temporary file handling.\n  * Forward allow-* crypto features.\n  * Relax rusqlite dependency.\n  * tool: Add more cipher suites.\n  * tool: Add sq key generate --{encryption,signing}-algorithm.\n  * Update Cargo.lock.\n  * Relax subplot dependency.\n  * Relax roff dependency.\n  * Relax toml_edit dependency.\n  * Upgrade sequoia-wot.\n  * Relax indicatif dependency.\n  * Relax gethostname dependency.\n  * Relax dirs dependency.\n  * Relax clap_lex dependency.\n  * Update Cargo.lock.\n  * meta: Bump MSRV to 1.85.\n  * Update signing policy.\n\n- Update vendored dependencies due to security and build issues\n\n- Update to version 1.3.1:\n  * Release 1.3.1.\n  * Fix formatting.\n  * Improve documentation of `sq config`.\n  * Emit hints to mark an imported key as authenticated or introducer.\n  * Hedge against importing keys into the cert store.\n  * Improve displaying of preferred user IDs.\n  * Fix typo.\n  * Display backtraces attached to errors.\n  * tests: Avoid DSA key in tests as DSA will be rejected in the future.\n  * tests: Update PKI test vectors to not expire.\n  * Enable backtraces and tracing when running tests.\n  * Make importing Autocrypt certs more robust.\n  * Release 1.3.0.\n  * Make sq config get print to stdout.\n  * Fix early abort in sq keyring filter\n  * Fix test sq_verify_policy_as_of_relative_time\n  * Fix error message.\n  * Prefix matching for --...-self parameters fixed\n  * Fix examples.\n  * Port to sequoia-openpgp 2.\n  * ci: Always build the pages, but only publish when merging to main.\n  * Upgrade sequoia-man.\n  * Split out the man page generation into a new crate.\n  * Update openssl to address RUSTSEC-2025-0004.\n  * Update hickory-proto to address RUSTSEC-2025-0006.\n  * man: Fix NAME section for subcommands.\n\n- Update to version 1.2.0:\n  * Release 1.2.0.\n  * Update Cargo.lock.\n  * Use authenticated identifiers in sq verify.\n  * Improve quoting.\n  * Improve sq download's output.\n  * Add a parameter to the authenticate function to control the output.\n  * Move helper function to common.\n  * Add a mechanism to replace an argument in a hint with a placeholder.\n  * Avoid crash parsing arguments to Strings.\n  * Make sq cert lint less quiet when there are no issues.\n  * Add sq key rotate.\n  * Extend replay to optionally take a signer.\n  * tests: Move utility function to the common module.\n  * Move function to the common module.\n  * Extend replay to allow the caller to limit what is replayed.\n  * Improve output.\n  * Allow the caller to specify an indentation level.\n  * Disable tracing.\n  * Fix test helper function.\n  * Add sq pki vouch replay.\n  * Move certification listing code to the common module.\n  * Move code in common to the sole function that uses it.\n  * Move the sq pki link list implement to its own module.\n  * Extend sq pki vouch list to list certifications of a certificate.\n  * Improve test.\n  * Simplify specifying certificate designators in tests.\n  * Require that certificate designators are authenticated.\n  * Use an explicit type for the trust amount parameter.\n  * Fix sq --cli-version.\n  * Improve sq pki link list's help text.\n  * Improve error messages.\n  * Avoid unnecessary lookups.\n  * Relax sq pki link list's certificate designators.\n  * Fix examples.\n  * Don't export non-exportable sigs and components when exporting keys.\n  * Add missing NEWS entry.\n  * Fix duplicating packets when dumping.\n  * Prevent monomorphization of Sq::resolve_cert.\n  * Prevent monomorphization of Sq::resolve_certs_filter.\n  * Add new command sq pki vouch list.\n  * Move the code for listing certification to common.\n  * Release 1.1.0.\n  * Relax subplot dependency.\n  * Relax rusqlite dependency.\n  * Update Cargo.lock.\n  * Fix output.\n  * Add a lint for uncertified user IDs.\n  * Show certificates without user IDs with --gossip.\n  * Improve sq cert list's documentation.\n  * Improve help text lints.\n  * Fix long help generation for cert designators.\n  * Update NEWS file.\n  * Add option --unusable to sq cert list, etc.\n  * Show hints about unusable bindings when --gossip is provided.\n  * Change how we refer to unusable bindings in sq cert list.\n  * Change sq cert list to not show warnings if --quiet is given.\n  * Distinguish unauthenticated and invalid bindings in sq cert list.\n  * Improve linting for sq cert list.\n  * Don't list revoke user IDs.\n  * Fix listing certificates by fingerprint or key ID.\n  * Remove duplicate code.\n  * Rework sq cert list's human readable output.\n  * Improve UserIDDesignator::argument_value.\n  * Fix UserIDDesignator::argument_value.\n  * Add some helper functions.\n  * tests: Add tests for sq cert list.\n  * Fix sq cert list --gossip.\n  * Fix output.\n  * Release 1.0.0.\n  * Fix NEWS.\n  * Align `sq download` with `sq verify`.\n  * Fix displaying preferred user IDs.\n  * Write to temporary file first, then persist it under the final name.\n  * Avoid using absolute paths in name of scratch files.\n  * Automatically import certificates from GnuPG's certificate store.\n  * Escape user IDs.\n  * Escape preferred keyserver and policy URI.\n  * Escape notation name and data.\n  * Escape literal data file name and data prefix.\n  * Escape all regular expressions.\n  * Escape all reason for revocation messages.\n  * Improve output sanitization.\n  * Use the visual idiom for cert,userid pairs authenticating downloads.\n  * Use the visual idiom for cert, userid pairs when decrypting.\n  * Use the visual idiom for cert, userid pairs when importing revs.\n  * Use the visual idiom for cert, userid pairs when certifying.\n  * Improve argument and value formatting in hints.\n  * Improve help output.\n  * Revert \"Refine sq pki {authenticate,lookup}'s user ID designators.\"\n  * Fix commands embedded in the documentation.\n  * Make verifying detached signatures more efficient.\n  * Require sequoia-openpgp 1.22.\n  * Fix hint.\n  * Refine sq key userid revoke's user ID designators.\n  * Refine sq pki vouch {add,authorize}'s user ID designators.\n  * Refine sq pki {authenticate,lookup}'s user ID designators.\n  * Refine sq pki link retract's user ID designators.\n  * Refine sq pki link {add,authorize}'s user ID designators.\n  * Add sq pki path --userid-by-email.\n  * Gracefully handle unencrypted Autocrypt messages.\n  * Align output emitted when importing certificates.\n  * Don't unconditionally show provenance messages.\n  * Fix importing unencrypted Autocrypt messages.\n  * Improve error handling opening the cert store.\n  * Do not hide errors from keyrings in verify.\n  * Refactor packet and keyring files in /cli to new example framework.\n  * Refactor files in /cli/network to new example framework.\n  * Refactor files in /cli/pki to new example framework.\n  * Refactor files in /cli to new example framework.\n  * Remove the unstable CLI warning.\n  * Don't make impossible recommendations.\n  * Remove useless code.\n  * Disable the --name and --add-name arguments.\n  * Rename --userid-or-add to --add-userid, etc.\n  * Extend and adjust the set of user ID designators.\n  * Refactor the user ID designators.\n  * Update all dependencies.\n  * Fix test.\n  * Trim unused features on sequoia-cert-store.\n  * Update sequoia-net and reqwest.\n  * Add argument `sq network search --iterations`.\n  * Add argument `sq network search --use-dane`.\n  * Add argument `sq network search --use-wkd`.\n  * Better handle user ID's matched by --all.\n  * Make --all conflict with other user ID designators.\n  * Fix test for sq pki link retract.\n  * Make `sq cert list` display certificates without user IDs.\n  * Prepare for userid-less certificates in common::pki::authenticate.\n  * Split OutputFormat::add_paths into two functions.\n  * Fix listing certificates without authenticated bindings.\n  * Apply the input lints to all certs.\n  * Only show hints about an empty cert store if it is indeed empty.\n  * Change `sq config inspect policy` to explain the policy.\n  * Fix warnings about elided lifetimes that have a name.\n  * Add tests for sq key approvals update.\n  * tests: Improve sq key approvals update help functions.\n  * Add tests for sq key approvals list.\n  * Add tests for sq key userid revoke.\n  * Add tests for sq pki lookup.\n  * Add tests for sq pki authenticate.\n  * Add tests for sq pki vouch {add,authorize}.\n  * tests: Rename Sq::pki_vouch_authorize_p.\n  * tests: Simplify Sq::try_pki_vouch_add and Sq::pki_vouch_authorize_p.\n  * Add tests for sq pki link retract.\n  * Add tests for sq pki link authorize.\n  * Add tests for sq pki link add.\n  * Simplify comments.\n  * Lint CLI help texts.\n  * Align CLI help texts with our UI guidelines.\n  * Make long help texts configurable for cert designators.\n  * Deduplicate and rework the signature notation argument handling.\n  * Require explicit opt-out for encrypting without signing.\n  * Use cert designators for `sq cert list`.\n  * Add examples for `sq cert list`\n  * Refactor files in /cli/cert to new example framework\n  * Modify examples\n  * Refactor files under .../cli/key to use example framework\n  * Fix generation of user ID-less keys.\n  * Upgrade hickory-proto to avoid vulnerable idna 0.4.0.\n  * Gracefully handle missing ui section in config file.\n  * Add `sq encrypt --profile` in preparation for RFC9580.\n  * Add `sq key generate --profile` in preparation for RFC9580.\n  * Parse key.generate.cipher-suite case sensitively.\n  * Mention the configuration key in the augmented help texts.\n  * Make `sq network dane generate` require cert designators or `--all`.\n  * Make `sq pki link list` fail if a designated cert has no link.\n  * Refactor user ID matching when resolving certificates.\n  * Generalize the filter for `Sq::resolve_certs_filter.\n  * Align `sq sign --detached-file` with `sq verify --detached-file`.\n  * Make the default third-party certification expiration configurable.\n  * Introduce a specialization for third-party certifications.\n  * Make ExpirationArg configurable.\n  * Manually implement clap::Args for ExpirationArg.\n  * Add tests for sq pki link list.\n  * Add tests for sq key list.\n  * Listing an empty certificate store should not be an error.\n  * Fix hint.\n  * Hide --without-password from the sq key generate examples.\n  * Make it possible to hide parts of an example.\n  * Change the default third-party certification expiration to 10y.\n  * Implement `sq pki vouch {add,authorize} --certifier-self`.\n  * Improve the `--self-signer` help texts and add to the template.\n  * Add a pattern argument to `sq pki link list`.\n  * Add missing conflict for `sq key list`.\n  * Change sq config inspect network to use stdout.\n  * Change sq config inspect paths to use stdout.\n  * Change sq cert import and sq key import to use stdout.\n  * Improve sq network wkd publish's output.\n  * Change sq network wkd publish to use stdout.\n  * Convert a hint to a warning.\n  * Change sq network keyserver publish to use stdout.\n  * Change sq pki link add, etc. to use stdout.\n  * Generalize make_qprintln to write to a different stream.\n  * Change sq pki link list to use stdout.\n  * Before printing a hint, flush stdout.\n  * Change sq cert list, sq pki authenticate, etc. to use stdout.\n  * Generalize the authentication output routines to use any stream.\n  * Change sq key approvals list to use stdout.\n  * Change sq key list to use stdout.\n  * Add new macro wwrintln.\n  * Generalize weprintln and iweprintln to write to any stream.\n  * Rename wprintln to weprintln.\n  * Clean up sq key list's output.\n  * Implement `sq config inspect network`.\n  * Implement `sq config inspect paths`.\n  * Implement `sq config inspect policy`.\n  * Make `sq key list` fail without key store, align error messages.\n  * Align error messages when listing certs.\n  * Import the secret key so that the example has something to list.\n  * Change sq inspect to show the cert associated with a recipient.\n  * policy: Update certificates.\n  * Simplify code.\n  * Remove unreachable code.\n  * Fix resolving `--signer-self`.\n  * Improve formatting of message.\n  * Implement `sq sign --signer-self` and `sq encrypt --signer-self`.\n  * Make the number of iterations configurable for `sq network search`.\n  * Make use of DANE configurable when doing `sq network search`.\n  * Make use of WKD configurable when doing `sq network search`.\n  * Make the path to the backend servers configurable.\n  * Fix displaying effective configuration.\n  * Make hints configurable.\n  * Generalize function.\n  * Make verbosity configurable.\n  * Introduce accessors for sq.quiet and sq.verbose.\n  * Use platform-specific prompt in hints.\n  * Indent hints so that they look different from shell prompts.\n  * Improve the `--for-self` encryption hint.\n  * Don't show hint if a recipient is listed in encrypt.for-self.\n  * Don't explicitly create `Recipient`s.\n  * Show the configuration file's location in sq config --help.\n  * Fix message.\n  * Display a hint if encrypting a message that one can not decrypt.\n  * Implement `sq encrypt --for-self`.\n  * When encrypting a message, list signers.\n  * When encrypting a message, list recipients and passwords.\n  * Use BufferedReader::copy to avoid an extra copy.\n  * Rework encryption subkey selection.\n  * Fix handling of `--home=default` and `--home=none`.\n  * Drop superfluous mut.\n  * Align user ID designators in `sq pki link retract`.\n  * Add support for addressing shadow CAs by symbolic names.\n  * Make `sq config get policy.path` reflect SEQUOIA_CONFIG_POLICY.\n","status":"published","published":"2026-08-25T18:07:43Z","modified":"2026-08-27T18:23:12.278447922Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2026:11255-1","title":"afterburn-5.10.0.git73.b97f772-1.1 on GA media","description":"These are all security issues fixed in the afterburn-5.10.0.git73.b97f772-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-12T00:00:00Z","modified":"2026-07-13T09:00:09.551657076Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11280-1","title":"nm-configurator-0.3.5-2.1 on GA media","description":"These are all security issues fixed in the nm-configurator-0.3.5-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-15T00:00:00Z","modified":"2026-07-16T10:00:17.638817827Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11474-1","title":"gitoxide-0.56.0-1.1 on GA media","description":"These are all security issues fixed in the gitoxide-0.56.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-09T00:00:00Z","modified":"2026-08-10T08:15:09.376532122Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11475-1","title":"kak-lsp-21.0.2-1.1 on GA media","description":"These are all security issues fixed in the kak-lsp-21.0.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-09T00:00:00Z","modified":"2026-08-10T08:15:09.341957382Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11482-1","title":"wild-0.10.0-2.1 on GA media","description":"These are all security issues fixed in the wild-0.10.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-09T00:00:00Z","modified":"2026-08-10T08:15:10.618808749Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11492-1","title":"aws-efs-utils-3.2.0-1.1 on GA media","description":"These are all security issues fixed in the aws-efs-utils-3.2.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-11T00:00:00Z","modified":"2026-08-12T10:45:07.13203099Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11495-1","title":"git-cliff-2.13.1-1.1 on GA media","description":"These are all security issues fixed in the git-cliff-2.13.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-11T00:00:00Z","modified":"2026-08-12T10:45:07.566332248Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11512-1","title":"cargo-audit-0.22.2~git0.281452c-2.1 on GA media","description":"These are all security issues fixed in the cargo-audit-0.22.2~git0.281452c-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-15T00:00:00Z","modified":"2026-08-16T11:45:04.262605Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11513-1","title":"cargo-c-0.10.23-2.1 on GA media","description":"These are all security issues fixed in the cargo-c-0.10.23-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-15T00:00:00Z","modified":"2026-08-16T11:45:05.605536497Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11522-1","title":"obs-service-cargo-7.2.2-2.1 on GA media","description":"These are all security issues fixed in the obs-service-cargo-7.2.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-15T00:00:00Z","modified":"2026-08-16T11:45:05.554428628Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11525-1","title":"rustup-1.29.0~0-1.1 on GA media","description":"These are all security issues fixed in the rustup-1.29.0~0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-15T00:00:00Z","modified":"2026-08-16T11:45:05.554416231Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11527-1","title":"sccache-0.17.0~1-2.1 on GA media","description":"These are all security issues fixed in the sccache-0.17.0~1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-15T00:00:00Z","modified":"2026-08-16T11:45:04.266929578Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11528-1","title":"wasm-bindgen-0.2.100-2.1 on GA media","description":"These are all security issues fixed in the wasm-bindgen-0.2.100-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-15T00:00:00Z","modified":"2026-08-16T11:45:04.263764645Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11529-1","title":"forgejo-cli-0.6.0-2.1 on GA media","description":"These are all security issues fixed in the forgejo-cli-0.6.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-08-18T09:30:04.680306672Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11549-1","title":"markdown-oxide-0.25.12-1.1 on GA media","description":"These are all security issues fixed in the markdown-oxide-0.25.12-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-19T00:00:00Z","modified":"2026-08-21T09:15:31.989789647Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11655-1","title":"libtree-sitter0_26-0.26.8-5.1 on GA media","description":"These are all security issues fixed in the libtree-sitter0_26-0.26.8-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-09-01T09:30:03.651348036Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11656-1","title":"aws-nitro-enclaves-binaryblobs-upstream-1.5.0~git0.2950b36-1.1 on GA media","description":"These are all security issues fixed in the aws-nitro-enclaves-binaryblobs-upstream-1.5.0~git0.2950b36-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-01T00:00:00Z","modified":"2026-09-02T11:15:03.856852178Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11679-1","title":"agama-24+0.a836cced5-54.1 on GA media","description":"These are all security issues fixed in the agama-24+0.a836cced5-54.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:03.947352255Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11818-1","title":"shadowsocks-rust-1.25.0-1.1 on GA media","description":"These are all security issues fixed in the shadowsocks-rust-1.25.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-18T00:00:00Z","modified":"2026-09-19T18:23:08.222452077Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11835-1","title":"librepods-0.1.0+git20260515.672e65a-1.1 on GA media","description":"These are all security issues fixed in the librepods-0.1.0+git20260515.672e65a-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-09-22T18:23:09.517193388Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11838-1","title":"pijul-1.0.0~beta.23-1.1 on GA media","description":"These are all security issues fixed in the pijul-1.0.0~beta.23-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-09-22T18:23:09.516374248Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11905-1","title":"tealdeer-1.8.0-2.1 on GA media","description":"These are all security issues fixed in the tealdeer-1.8.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-28T00:00:00Z","modified":"2026-09-29T18:23:14.509384154Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12205-1","title":"switcheroo-2.6.0-1.1 on GA media","description":"These are all security issues fixed in the switcheroo-2.6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-21T17:23:14.15564229Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12355-1","title":"zed-1.24.2-1.1 on GA media","description":"These are all security issues fixed in the zed-1.24.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-31T18:00:05.930167365Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:21386-1","title":"Security update for afterburn","description":"This update for afterburn fixes the following issues:\n\nUpdate to version 5.10.0.git73.b97f772.\n\nSecurity issues fixed:\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n  (bsc#1270175).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n  (bsc#1270555).\n- CVE-2026-41678: openssl: incorrect bounds assertion in `aes::unwrap_key()` can lead to OOB write (bsc#1270651).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270787).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n  memory to network peers (bsc#1270817).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates with non-UTF-8\n  OCSP URLs (bsc#1270483).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers\n  (bsc#1270949).\n- CVE-2026-25541: bytes: integer overflow in `BytesMut:reserve` can lead to undefined behavior and crashes\n  (bsc#1271348).\n\nOther updates and bugfixes:\n\n- Version 5.10.0.git73.b97f772:\n  * build(deps): bump anyhow from 1.0.99 to 1.0.103\n    https://github.com/coreos/afterburn/pull/1284\n  * build(deps): bump libflate from 2.1.0 to 2.2.2\n    https://github.com/coreos/afterburn/pull/1283\n  * build(deps): bump openssl from 0.10.79 to 0.10.80\n    https://github.com/coreos/afterburn/pull/1277\n- Version 5.10.0.git70.9cc2a7b:\n  * build(deps): bump openssl from 0.10.78 to 0.10.79\n  * providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute\n  * providers/hetzner: Add support for network configuration\n  * build(deps): bump rustls-webpki from 0.103.10 to 0.103.13\n  * build(deps): bump openssl from 0.10.73 to 0.10.78\n  * docs: Add AGENTS.md and CLAUDE.md for AI coding assistants\n  * build(deps): bump rand from 0.9.2 to 0.9.4\n  * opencode: add skills for provider scaffolding and release automation\n  * ibmcloud-classic: Add missing network_id to fixture\n  * kubevirt: Support static gateway and DNS with DHCP\n  * build(deps): bump rustls-webpki from 0.103.6 to 0.103.10\n  * fix(proxmoxve): Define DNS entries for every interface\n  * Makefile: download `90-afterburn-authorized-keys-file.conf` for rpm building\n  * Sync repo templates ⚙\n  * build(deps): bump bytes from 1.10.1 to 1.11.1\n  * util/dhcp: Fix clippy lints\n  * build(deps): bump actions/checkout from 4 to 6\n  * build(deps): bump actions/upload-artifact from 4 to 5\n  * kubevirt: modprobe for virtio_blk; remove dracut preload\n  * kubevirt: Add NoCloud network configuration support\n  * kubevirt: Support config drive network data\n  * kubevirt: Refactor the provider to follow the proxmoxve structure\n  * dracut: Add virtio_blk module preload to afterburn-network-kargs service\n  * docs: Add release notes\n  * cargo: Afterburn release 5.10.0\n- Version 5.10.0:\n  * docs/release-notes: update for release 5.10.0\n  * cargo: update dependencies\n  * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat\n  * docs/release-notes: Add entry for Azure SharedConfig XML parsing fix\n  * microsoft/azure: Fix SharedConfig parsing of XML attributes\n  * microsoft/azure: Mock goalstate.SharedConfig output in tests\n  * providers/azure: switch SSH key retrieval from certs endpoint to IMDS\n  * build(deps): bump the build group with 8 updates\n  * build(deps): bump slab from 0.4.10 to 0.4.11\n  * build(deps): bump actions/checkout from 4 to 5\n  * upcloud: implement UpCloud provider\n  * build(deps): bump the build group with 4 updates\n","status":"published","published":"2026-07-20T09:31:31Z","modified":"2026-07-24T18:24:21.743334542Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21428-1","title":"Security update for nm-configurator","description":"This update for nm-configurator fixes the following issue\n\nUpdate to version 0.3.5.\n\nSecurity issue fixed:\n\n- CVE-2026-25541: bytes: integer overflow in `BytesMut:reserve` can lead to undefined behavior and crashes\n  (bsc#1271392).\n\nOther updates and bugfixes:\n\n- Version 0.3.5:\n  * Bump `version` to v0.3.5 (#206)\n  * Bump `clap` 4.5.53 (#205)\n  * Bump `actions/checkout` to 6 (#204)\n  * Bump `nmstate` to 2.2.55 (#203)\n  * Fix for issue #198 VLAN interface renaming (#201)\n  * Bump `serde` to 1.0.228 (#196)\n  * Bump `anyhow` to 1.0.100 (#194)\n","status":"published","published":"2026-07-22T19:26:32Z","modified":"2026-07-24T17:16:07.630872332Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21558-1","title":"Security update for gitoxide","description":"This update for gitoxide fixes the following issues:\n\nChanges in gitoxide:\n\n- Update to 0.56.0:\n  * Fixes CVE-2026-40034 (boo#1266434): the CommandForbiddenInModules\n    trust check could be bypassed in gix_submodule::File::update(),\n    which allowed arbitrary command execution from a crafted\n    .gitmodules file\n  * Fixes a submodule name validation bypass that allowed traversal\n    out of .git/modules and disclosure of credentials\n  * Fixes symlinked .gitmodules files being followed and parsed from\n    outside the repository\n  * Fixes several denial-of-service vectors in gix-pack: unchecked\n    indexing panics and uncapped allocations from crafted pack data\n  * Fixes HTTP credentials being leaked to the redirected host by the\n    curl transport backend\n  * Add the gix config show, gix config list, gix config fmt,\n    gix free remote refs, gix free trust, gix dirwalk and gix tix\n    subcommands\n  * Add a gix status --untracked flag and gix merge tree --message\n    for creating commits\n  * gix exclude query is now index-aware and no longer reports ignore\n    matches for tracked files, matching git check-ignore\n  * Preserve all configured remote URLs rather than only the last one\n  * Fix fetching and cloning with tag refspecs in shallow clones,\n    relative worktree linking files and loose ref path-prefix\n    collisions\n  * Update the crates to the Rust 2024 edition\n- Refresh the vendored dependencies. Recording the state of the\n  remaining open CVE bugs against this version, none of which it is\n  affected by:\n  * CVE-2026-25541 (boo#1274525): the vendored bytes is now 1.12.1,\n    above the 1.11.1 fix\n  * CVE-2025-22620 (boo#1236139): gix-worktree-state is 0.33.0, far\n    above the 0.17.0 that fixed the world-writable checkout of\n    executable files\n\n- update to 0.50.0:\n  see https://github.com/GitoxideLabs/gitoxide/compare/v0.42.0...v0.50.0\n\n- update to 0.42.0:\n  * add first 'debug' version of gix diff file\n  * use revspecs for revision and path\n  * CVE-2025-31130: use collision-detecting SHA-1 hash boo#1240872\n\n- Update to version 0.41.0:\n  * add gix blame -L start,end\n  * add gix env to print paths relevant to the Git installation.\n  * Document the remaining subcommands\n  * Add support for statistics and additional performance\n    information.\n  * add gix blame to the CLI. That way it's possible to see the\n    blame result of any file in the repository.\n\n- Updates from version 0.40.0:\n  * add first 'debug' version of gix log. It's primarily meant to\n    better understand gix blame.\n  * add --tree-favor to gix merge tree|commit. With it one can\n    decide which side to favor in case of irreconcilable\n    tree-conflicts.\n  * CVE-2025-22620: gix-worktree-state specifies 0777 permissions\n    when checking out executable files (boo#1236139)\n\n- Update to version 0.39.0:\n  New Features\n  * add gix merge commit --debug\n  * add gix merge commits\n  * add gix merge tree to merge trees similarly to git merge-tree.\n\n- Update to version 0.38.0:\n  New Features\n  * support for listing worktrees with gix worktree list\n  * add first 'debug' version of gix diff tree.\n  * add new gix cat command.\n  * add gix merge-file with similar features as git merge-file\n  * gix merge-base for the CLI\n  Bug Fixes\n  * Adjust gix clean warning and help for worktree fix\n  * Clarify -r/--repositories and --skip-hidden-repositories\n  Other\n  * switch from time to jiff\n  * Unify style in config support info\n","status":"published","published":"2026-08-10T13:10:07Z","modified":"2026-08-12T18:23:42.677607455Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21560-1","title":"Security update for kak-lsp","description":"This update for kak-lsp fixes the following issues:\n\nChanges in kak-lsp:\n\n- Update to version 21.0.2:\n  * Fix a regression that broke compatibility with Kakoune versions\n    older than 2026.05.21\n  * Add a default configuration for Hare, using hare-lsp\n  * Fix hangs after editing a file without a trailing newline, such\n    as an empty file\n  * Use nixd instead of nil as the default language server for nix\n  * Fix buffer-sync corruption when .editorconfig sets\n    insert_final_newline = false\n- Refresh the vendored registry. Recording the state of the open\n  vendored-crate CVEs against it, none of which this package is\n  affected by:\n  * CVE-2026-25541 (boo#1274502): bytes is 1.12.1, above the 1.11.1\n    fix\n  * CVE-2025-3416 (boo#1242654): the openssl crate is 0.10.81, above\n    the 0.10.72 fix; it was already 0.10.80 before this update\n  * CVE-2025-55159 (boo#1248048): slab is 0.4.12, above the 0.4.11\n    fix; only 0.4.10 was ever affected and this package never\n    shipped it\n\n- Update to version 20.0.0:\n  * v20.0.0\n  * Update changelog\n  * Fix tinymist documentation URL\n  * Fix tinymist preview config key. `previewFeature` only works for the vscode plugin\n  * Encode brackets for file paths\n  * feat: swift/sourcekit-lsp support\n  * Paal �ye-Str�mme Copyright Waiver\n  * Make sure buffer synchronization works even when finaleol is missing\n  * workspace/executeCommand: don't panic on invalid args JSON\n  * servers.kak: update markdown-oxide root markers\n  * Inline lsp-initial-goto-position\n  * Fix function_casts_as_integer warning\n  * lsp-capabilities: remove stale default mappings\n  * changelog new erlang default server\n  * fix(ci/commit-new-release.sh): interpolate version number\n  * Change default language server for erlang\n  * lsp-inlay-hint-apply-*: fix crash when no hints avail\n  * Add inlay hint textedit support\n  * start new cycle\n\n- Update to version 19.0.1:\n  * v19.0.1\n  * Don't print Hover: prefix if there are no diagnostics\n  * Changelog for regression fix\n  * Fix lsp-find-error incorrectly handling --previous flag\n  * ci/commit-new-release.sh: support jj\n  * start new cycle\n\n- Update to version 18.2.0:\n  * v18.2.0\n  * Update changelog\n  * Remove misleading debug log in SessionRenamed hook\n  * Make *diagnostics* buffer one-line-per diagnostics\n  * test/gopls-dynamic-settings.sh: fix for recent gopls\n  * clippy\n  * controller: consume entire request before checking for user errors\n  * Add support vuejs\n  * Fix crash on invalid text edit ranges\n  * Send initializationOptions and workspace/didChangeConfiguration as expected by jdtls\n  * cargo update\n  * Fix type inference errors with deranged 0.4.1\n  * Fix symbol name prefix for breadcrumbs\n  * Work around breaking change in deranged crate\n  * Simplify recursive breadcrumbs calculation\n  * Language-specific SymbolKind rendering\n  * lsp-goto-document-symbol: remove symbol kind suffix\n  * start new cycle\n\n- Update to version 18.1.3:\n  * v18.1.3\n  * Use the right language ID when [language.foo] is in effect\n  * Remove unused line-specs option\n  * Better variable name for code lens line-specs value\n  * lsp-object: don't send documentSymbol to servers that don't support it\n  * Include language server name in stderr logs\n  * Use rust-analyzer from PATH\n  * Work around lsp-rename didChange failing when using window scope\n  * Send texlab-specific requests only to servers that support them\n  * Fix dart language server command\n  * Add kak-lsp server PID to the closing log message\n  * Report more diagnostics information, in multiple lines\n  * Fix regression causing spurious/missing server name in hover\n  * Address clippy lints\n  * Config knob to override magic single-instance setting\n  * Back out \"Add curly underline to DiagnosticError face\"\n  * start new cycle\n\n\n- Update to version 18.1.2:\n  * Silence errors from non-default hooks\n  * Fix languageId for JSX/TSX files\n  * Silence deprecation warning\n  * Add curly underline to DiagnosticError face\n\n- Update to version 18.1.1:\n  * Make crash reporting optional for now\n  * Touch up installation instructions in readme\n  * Make force-exit code paths safer\n  * Extract function\n  * Rework \"Prevent buffer content logic from reading to much\"\n  * Don't send debug log about excessive progress reports to editor\n  * Make test/clangd-invalid-utf8.sh compatible with older clangd\n  * Fix crash when legacy \"language\" config option uses language IDs\n  * Set LAST_CLIENT earlier\n  * test/clangd-invalid-utf8.sh: fix for modern clang\n  * Add biome to CSS and GraphQL\n  * On crash, disable LSP hooks in current buffer\n  * Simplify sentry integration\n  * Work around crash on unsaved files after server restart\n  * Add context to crash report message\n  * Include formatted panic info and backtrace in crash report\n  * Crash reporting via sentry.io\n  * Make the default panic message a little less intimidating\n  * Generalize option change hook parsing code\n  * Back out \"Fix fake textDocument/didOpen for unsaved files\"\n  * Back out \"Make sure to call textDocument/didOpen when lsp_servers is set after BufCreate\"\n  * Prevent buffer content logic from reading to much\n  * Fix crash on \u003cc-c\u003e during -sync command\n  * Make sure to call textDocument/didOpen when lsp_servers is set after BufCreate\n  * Add commented config for tailwindcss-language-server\n  * Fix fake textDocument/didOpen for unsaved files\n  * Stop logging the lsp-show-error call\n  * Fix garbage languageId being sent on lsp-workspace-symbol\n  * Clean up editor command dispatch code\n  * Rename command sender type\n  * Fix corruption applying text edits to non-buffer, non-ASCII files\n  * Separate out function for applying text edits to in-memory data structure\n  * Apply clippy lints\n  * Update unit tests\n  * Consolidate error reporting\n  * Work around missing error on missing code lens after server restart\n  * Type for client name\n  * Rework editor-command sending\n  * Remove most uses of EditorMeta::session\n  * Remove vestiges of multi-session code\n  * Bravely remove obsolete command_fifo, make response_fifo handling more robust\n  * Fix flaky test/gopls-goto-definition.sh\n  * Remove unused function\n  * Add more details to fifo log\n  * Remove unused parameter\n  * Use a separate field for requests pending initialization resp. textDocument/didChange\n  * Fix hang when sync request is used in hook when LSP is disabled\n  * Fix lsp-did-change not being sent for lsp-code-actions-sync\n  * Fix lingering sync state when lsp is disabled\n  * Remove unused lsp-with-option command\n  * Stop printing panic backtrace twice\n  * Add badges for latest release and chat networks\n  * Fix stacktrace being printed on EPIPE, remove redundant error output\n  * Call out feedback/support channels a bit more\n  * Stop linking to the Wiki page for installing servers\n  * Only set javascriptreact/typescriptreact language ID for jsx/tsx files\n\n- Update to version 18.1.0:\n  * Fix mixed-up order in tailwindcss example\n  * Fix bell in modeline not being cleared on ShowMessage notifications\n  * Fix patttern typo\n  * Add markdown-oxide language-server\n  * Add ruby-lsp language-server\n  * Fix stale quoting in lsp-do-send-sync\n  * Add log statements for raw request, handle EWOULDBLOCK/EAGAIN\n  * Use write instead of %val{selection} to send buffer contents\n  * Use a nonblocking fifo instead of pykak-style alternating fifos\n  * Address clippy lint\n  * Extend macOS workarounds to buffer synchronization\n  * Fail early again on missing language.foo.command field\n  * Also use elixir-ls on eex files\n  * Fail startup if session state files already exists\n  * Don't create session state if session is already running\n  * Escalate failure if kak-lsp daemon fails to start\n  * Don't clean up parent of session directories\n  * Do not briefly start kak-lsp on KakEnd if lsp-enable has never been called\n  * Fix typo in lsp-exit\n  * Rectify inconsistent quoting in recommended mappings\n  * Don't block when language servers are slow to exit\n  * Work around hang due to lost fifo on macOS\n  * Restyle --help output\n  * Fix test/clangd-diagnostic-gutter.sh flakiness\n  * Fix test/run not finding python on macOS\n  * Remove bad text edit assertion\n  * Braces in commented out code must match too\n  * The correct validation setting for CSS is `css.validate = true`\n  * Add CSS, HTML and JSON options, add Haskell's static-ls\n  * Workaround macOS waitid() not zeroing si_signo\n  * Fix waitid() being called unnecessarily\n  * Fix formatting spuriously moving cursor with vscode-html-language-server\n  * Fix Rust version\n  * Workaround HTML/CSS language servers not enabling formatting\n  * Workaround HTML/CSS language server crashing due to missing validProperties\n  * Fix crash interpreting text edit without trailing newline\n  * Clean up a debug log\n  * Remove dependency on Rust 1.80\n  * Fix regression causing crash when language server command fails exec()\n  * Don't send SIGTERM to language server, remove obsolete wait()\n  * Simplify sending of initialization options\n  * Fix regression causing hangs on restart\n  * Fix regression causing server configuration to be sent as initialization option\n  * Fix regression causing \"kak -p\" to become a zombie\n  * Remove \"set-option -add\" from most commented default configs\n  * Back out \"lsp-start to wait until existing server has exited\"\n  * Fix race conditions reading kak-lsp PID file\n  * Send SIGTERM, not SIGKILL to shut down inert language server\n  * Speed up language server shutdown\n  * lsp-exit to wait until the session directory is removed\n  * Remove shell calls from async request sending\n  * Drain fifo on exit to unblock Kakoune\n  * Remove unnecssary environment variable\n  * Refactor temporary directory cleanup logic\n  * lsp-start to wait until existing server has exited\n  * Wait for PID file creation after start\n  * Move fifo into a per-session directory\n  * Remove errant semicolon\n  * Remove shell calls for code-actions and highlight-references hooks\n  * Move hook definition out of the way\n  * Stop using temporary file also for textDocument/didChange and textDocument/didOpen\n  * typst: add default configuration\n  * Mohamad Makki Copyright Waiver\n  * Update manual installation instructions for ARM macOS\n\n- Update to version 18.0.3:\n  * Update changelog for release\n  * Disable CI runs for a special \"docs\" branch\n  * Scala Metals: turn off Unicode icons until Kakoune can handle emoji width\n  * Simply use stdout instead of fd 3 for request sending\n  * Remove redundant fifo re-creation\n  * Elide temporary file when writing to fifo\n  * Fix escaping if session name starts with a dash\n  * Move loop-invariant set-option out of the loop\n  * Fix window/showMessageRequest ID deserialization\n  * lsp-disable: unset LSP modeline\n  * Fix eslint workaround\n  * Fix crash when \"language\" key is used in legacy kak-lsp.toml\n  * julia lsp configuration: move root_globs\n  * minor: fix typo in julia lsp config\n  * cargo update\n  * cargo clippy\n  * Fix crash in lsp-selection-range\n  * Show error instead of crashing if lsp_servers root is not an absolute path\n  * Block LSP requests after KakEnd to work around delay on bad config\n  * lsp-do-send: also block SIGINT once we have acquired the fifo\n  * README: update \"Pre-built binaries\" section\n  * Fix state transition when lsp-enable{,-window} are accidentally mixed\n  * Remove shell call from lsp-if-no-servers\n  * Remove misleading \"set-option -add lsp_server\" from default hooks\n  * lsp-object: fix crash on invalid param, improve docs\n\n- Update to version 18.0.2:\n  * v18.0.2\n  * README: link to troubleshooting section\n  * Fix stale comment in test\n  * Update changelog\n  * Show panics in an info box\n  * Generate a core dump when crashing via a Rust panic\n  * lsp-definition: explain fallback in error message\n  * Fix crash in lsp-highlight-references\n  * Log kak-lsp daemon PID on startup\n  * Removed redundant error check\n","status":"published","published":"2026-08-10T16:06:46Z","modified":"2026-08-12T18:23:42.677936968Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21584-1","title":"Security update for git-cliff","description":"This update for git-cliff fixes the following issues:\n\nChanges in git-cliff:\n\n- Update to version 2.13.1:\n  * Support more configuration file locations\n  * Add per-commit statistics\n  * Expose determined bump type in release context\n  * Add configurable commit processing order\n  * Add environment variable for offline execution\n  * Migrate logging to tracing\n  * Add caching where applicable\n- CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can\n  lead to undefined behavior and crashes (boo#1274523)\n\n- Update to version 2.12.0:\n  * Add offline flag\n  * Add --skip-tags cli argument\n  * Implement commit processing summary\n  * Bug Fixes\n- includes changes from 2.11.0:\n  * Support failing on unmatched commits\n  * Add support for azure devops\n  * Improve repository/directory path resolution\n  * Add split_regex, replace_regex, find_regex filters\n  * Bug Fixes\n- includes changes from 2.10.1:\n  * Add 'integrations' feature flag for enabling all integrations\n  * Bug Fixes\n  * CVE-2025-55159: lab: incorrect bounds check in get_disjoint_mut\n    function can lead to undefined behavior or potential crash due\n    to out-of-bounds access (boo#1248065)\n\n- Update to version 2.10.0:\n  * (config) Support using include and exclude paths in the config (#1173) - (7c2f922)\n  * (parser) Support regex matching on JSON arrays with scalar elements (#1163) - (dc458ea)\n  * (template) Support adding commit statistics to the changelog (#1151) - (05a50d7)\n  * (config) [breaking] Use empty header and footer as default (#1161) (#1172) - (3e9311e)\n  * (config) Check if commit.footers is defined in detailed example (#1170) - (078545f)\n  * (fixtures) Update expected.md after config change (#1176) - (76d3e81)\n  * (generation) Ensure skip_tags condition is evaluated first (#1190) - (318be66)\n  * (repo) Use the correct order while diffing paths (#1188) - (ff6c310)\n  * (ci) Apply security best practices (#1180) - (a32deca)\n  * (config) Implement FromStr instead of Config::parse_from_str() (#1185) - (692345e)\n  * (test) Standardize unit tests for commit module (#1147) - (0446d6a)\n  * (context) Add example usage for statistics (#1162) - (4f7379a)\n  * (quickstart) Remove repetitive words (#1200) - (434f9ee)\n  * (readme) Fix twitter badge (#1164) - (68bd85e)\n  * (readme) Polish badges (#1159) - (941cc2b)\n  * (remote) Fix inconsistency in remote integration documentation (#1165) - (deb29dc)\n  * (website) Add highlights for 2.10.0 (#1225) - (a3fe8c9)\n  * (website) Add installation instructions for gentoo-linux (#1203) - (07fe6bf)\n  * (formatting) Use spaces instead of tabs (#1184) - (0027300)\n  * (fixture) Add test fixture for overriding the conventional scope (#1166) - (cb84a08)\n  * (build) Bump MSRV to 1.85.1 - (d8279d4)\n  * (cd) Use macos-15 runner - (c156fc5)\n  * (cd) Re-enable sccache for maturin - (871c3c9)\n  * (crate) Remove Rust nightly requirement - (4f3e5af)\n  * (fixture) Update test-regex-json-array fixture (#1178) - (95f4056)\n  * (format) Format module imports for readability (#1183) - (6db7d49)\n  * (git) Add .git-blame-ignore-revs - (5b64131)\n  * (npm) Bump git-cliff to 2.9.1 (#1156) - (e13b158)\n  * (website) Update the node version - (566c2a1)\n  * Check if commit.footers is defined in detailed example (#1170) (078545f)\n  * (breaking) Use empty header and footer as default (#1161) (#1172) (3e9311e)\n  * Update expected.md after config change (#1176) (76d3e81)\n  * Use the correct order while diffing paths (#1188) (ff6c310)\n  * Ensure skip_tags condition is evaluated first (#1190) (318be66)\n  * Polish badges (#1159) (941cc2b)\n  * Fix twitter badge (#1164) (68bd85e)\n  * Fix inconsistency in remote integration documentation (#1165) (deb29dc)\n  * Add example usage for statistics (#1162) (4f7379a)\n  * Remove repetitive words (#1200) (434f9ee)\n  * Add installation instructions for gentoo-linux (#1203) (07fe6bf)\n  * Add highlights for 2.10.0 (#1225) (a3fe8c9)\n  * Support regex matching on JSON arrays with scalar elements (#1163) (dc458ea)\n  * Support using include and exclude paths in the config (#1173) (7c2f922)\n  * Support adding commit statistics to the changelog (#1151) (05a50d7)\n  * Bump git-cliff to 2.9.1 (#1156) (e13b158)\n  * Re-enable sccache for maturin (871c3c9)\n  * Update test-regex-json-array fixture (#1178) (95f4056)\n  * Format module imports for readability (#1183) (6db7d49)\n  * Use macos-15 runner (c156fc5)\n  * Update the node version (566c2a1)\n  * Remove Rust nightly requirement (4f3e5af)\n  * Bump MSRV to 1.85.1 (d8279d4)\n  * Add .git-blame-ignore-revs (5b64131)\n  * Standardize unit tests for commit module (#1147) (0446d6a)\n  * Resolve mismatched lifetime syntax warnings (#1167) (9970402)\n  * Implement FromStr instead of Config::parse_from_str() (#1185) (692345e)\n  * Apply security best practices (#1180) (a32deca)\n  * Use spaces instead of tabs (#1184) (0027300)\n  * Add test fixture for overriding the conventional scope (#1166) (cb84a08)\n\n- Update to version 2.9.1:\n  * CI/CD fixes only\n\n- Update to version 2.9.0:\n  * chore(release): prepare for v2.9.0\n  * docs(website): add highlights for 2.9.0 (#1153)\n  * chore(deps-dev): bump typescript in /website in the patch group (#1139)\n  * chore(docs): fix some typos (#1149)\n  * fix(template): correctly serialize JSON for the commit fields (#1145)\n  * docs(security): extend security policy (#1142)\n  * chore(deps): bump the minor group in /website with 2 updates (#1116)\n  * refactor(lint): apply clippy suggestions\n  * feat(context): add release commit range (#1138)\n  * fix(submodules): fix submodules handling when using custom range (#1136)\n  * docs(config): fix typo on commit.links (#1132)\n  * chore(deps): upgrade dependencies (#1129)\n  * chore(project): migrate to Rust 2024 edition (#1128)\n  * feat(changelog): support recursing into submodules (#1082)\n  * feat(remote): fetch commits from non-default branches using remotes (#1086)\n  * feat(git): support disabling sorting commits topologically (#804) (#1121)\n  * refactor(config): initialize config structs with default values (#1090)\n  * chore(dependabot): make dependency updates less noisy\n  * chore(dependabot): check dependency updates weekly\n  * fix(bump): check the next version against tag_pattern regex (#1070)\n  * feat(config): support configuring with a remote URL (#1083)\n  * fix(fixtures): evaluate the rc of git-cliff correctly (#1104)\n  * fix(bump): accept lowercase values for bump_type config (#1101)\n  * docs(readme): add blog posts from the community (#1102)\n  * fix(fixtures): use the correct syntax while checking fixture results (#1099)\n  * docs(website): remove references of tj-actions (#1097)\n  * feat(config): add `require_conventional` option (#1061)\n  * docs(release): fix Docker Hub URL\n  * refactor(lint): use IOError::other (#1074)\n  * doc(config): update comments for all configuration options (#1057)\n  * docs(quickstart): clarify git-cliff command (#1051)\n  * fix(git): handle worktrees while retrieving the path of repository (#1054)\n  * chore(npm): update yarn.lock\n  * fix(remote): fix detection of GitLab merge request sha if commits were squashed (#1043)\n  * fix(deps): make glob dependency mandatory (#1035)\n\n- Update to version 2.8.0:\n  * cli: Support initializing config with a custom filename\n  * config: Discover the configuration file when run in a sub directory\n  * git: Improve the set commit range error\n  * monorepo: Automatically set include-path for current directory\n  * remote: Support enabling native TLS\n  * repo: Allow running from sub directories\n  * config: Allow environment overwrites when using builtin config\n  * fixtures: Update the arguments for custom GitLab API fixture test\n  * monorepo: Do not set include-path if workdir is set\n  * remote: Fix detection of GitLab merge request sha\n  * lib: Add changelog modifier callback to run function\n  * lint: Use a shared lint config for the workspace\n  * lint: Apply clippy suggestions\n  * docker: Fix typo in comment\n  * highlights: Add link to the Nix flake\n  * jujutsu: Update links to the upstream documentation\n  * lib: Allow doc lint\n  * license: Update copyright years\n  * tips: Extend the merge commit filter example\n  * website: Add highlights for 2.8.0\n  * fixture: Add fixture for include-path\n  * build: Bump MSRV to 1.83.0\n  * lint: Allow false positive lint\n\n- Update to version 2.7.0:\n  * refactor(clippy): apply clippy suggestions\n  * chore(deps): bump dependencies\n  * chore(integration): remove experimental feature disclaimer\n  * feat(config): allow overriding the remote API URL via config\n  * docs(git): improve docs for commit_preprocessors and commit_parsers\n  * feat(jujutsu): add jujustu support\n  * perf(test): don't create regex inside a loop\n  * chore(log): add trace log about which command is being run\n  * fix(remote): preserve first time contributors\n  * test(git): find upstream remote when using ssh\n  * docs(readme): add blog post about git-cliff\n  * chore(config): add the 'other' parser to the default config\n  * fix(changelog): fix missing commit fields in context\n  * refactor(clippy): apply clippy suggestions\n  * test(repo): expand unit tests of the repo module\n  * fix(changelog): include the root commit when `--latest` is used with one tag\n  * chore(deps): bump clap from 4.5.18 to 4.5.19\n  * feat(args): add color to the help text\n  * chore(release): prepare for v2.6.1\n  * refactor(clippy): apply doc_markdown and ignored_unit_patterns lint\n  * chore(fixtures): build binaries using dev profile\n  * refactor(clippy): apply if_not_else lint\n  * fix(remote): avoid setting multiple remotes\n  * chore(deps): bump thiserror from 1.0.63 to 1.0.64\n  * refactor(clippy): apply assigning_clones lint\n  * refactor(clippy): apply single_match_else lint\n  * refactor(clippy): apply needless_pass_by_value lint\n  * chore(release): prepare for v2.6.0\n  * feat(config): add changelog.render_always option\n  * chore(deps): bump dependencies\n  * fix(changelog): do not change the tag date if tag already exists\n  * feat(config): allow configuring output file from config\n  * docs(args): fix copy-paste mistake where gitea mentioned gitlab\n  * fix(commit): trim the trailing newline for git2 commits\n  * fix(bump): suppress template warning when `--bumped-version` is used\n  * refactor(clippy): apply explicit_iter_loop lint\n  * refactor(clippy): apply manual_is_variant_and lint\n  * chore(deps): bump clap_complete from 4.5.23 to 4.5.28\n  * chore(deps-dev): bump typescript from 5.5.4 to 5.6.2 in /website in the minor group\n  * chore(deps): bump pretty_assertions from 1.4.0 to 1.4.1\n  * fix(changelog): correctly set the tag message for the latest release\n  * refactor(clippy): apply case_sensitive_file_extension_comparisons lint\n  * refactor(clippy): apply clippy suggestions\n  * refactor(clippy): apply option_as_ref_cloned lint\n  * refactor(template)!: add name parameter to the constructor\n  * fix(core): avoid the unnecessary loop when no remote feature is activated\n  * feat(core): add `remote` to commit and deprecate fields\n  * refactor(clippy): apply semicolon_if_nothing_returned clippy lint\n  * refactor(clippy): apply unnested_or_patterns clippy lint\n  * docs(contributing): mention fetching the tags for running tests successfully\n  * fix(args): support using use_branch_tags from both config and args\n  * feat(changelog): support generating changelog for different branches\n  * chore(examples): improve example templates\n  * chore(lib): fix typos in code comments\n  * chore(deps): bump prism-react-renderer from 2.3.1 to 2.4.0 in /website in the minor group\n  * fix(template): resolve parsing issues with `raw`/`endraw` in Jinja\n  * fix(changelog): don't change the context when provided via `--from-context`\n","status":"published","published":"2026-08-14T15:43:56Z","modified":"2026-08-16T18:23:36.810533351Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21605-1","title":"Security update for forgejo-cli","description":"This update for forgejo-cli fixes the following issues:\n\nChanges in forgejo-cli:\n\n- Update vendored bytes crate to 1.12.1\n  * CVE-2026-25541: Fixed an integer overflow in BytesMut::reserve that could\n    corrupt the tracked capacity and lead to out-of-bounds slices (boo#1274529).\n\n- update to 0.6.0:\n  * Localization!\n    - forgejo-cli has gained localization support!\n      You can now use it in your preferred language, just like\n      Forgejo itself.\n      Currently de-DE and zh-Hans are included, with several more\n      being in-progress.\n      See the project on Codeberg Translate if you want to help out\n      with any languages you know!\n      https://translate.codeberg.org/projects/forgejo-cli/forgejo-cli/\n  * Additions\n    - (!586) fj issue/pr view assignees to see who is assigned to\n      an issue or pull request\n    - (!582) --avatar/--unset-avatar options on fj repo edit\n    - (!554) fj repo star-status to check if you've starred a repo\n    - (!547) --cwd option to set the working directory a command is\n      run in\n    - (!533, !561) Commands to watch and unwatch repos\n    - (!462) Resolve SSH host names from SSH config\n    - (!279, !464, !472, !489, !491, !513, !594) Localization\n    - Added fj auth login support for the following instances:\n      - v16.next.forgejo.org\n      - v17.next.forgejo.org\n    - Removed fj auth login support for the following instances\n      that have shut down:\n      - v7.next.forgejo.org\n      - v12.next.forgejo.org\n  * Changes\n    - (!535) Added an error message when fj auth login fails to\n      open the browser\n    - (!523) fj auth add-key was renamed to fj auth add-token. An\n      alias still exists to add-key, so this isn't a breaking\n      change.\n    - (!514) The --host flag can now be anywhere in the command,\n      instead of only the beginning\n    - (!504) fj auth add-token no longer takes a username argument.\n  * Fixes\n    - (!579) Fixed fj issue unassign incorrectly unassigning\n      everyone except the intended users\n    - (!569) Fixed display of labels failing when a label is marked\n      as exclusive but does not contain a slash\n    - (!542) Fixed parsing of SSH shorthand urls\n    - (!510) Fixed fj pr checkout failing when the instance URL\n      contained a port\n    - (!437) Fixed incorrect parsing of activity info\n  * Other\n    - (!573) Use rust 2024 edition\n    - (!560) Simplify determining repo owner\n    - (!531) Fix clippy warnings\n    - (!527) Remove unused dependencies, narrow tokio features\n    - (!526) Replace crossterm with terminal_size\n    - (!520) Optimize cargo release profile\n    - (!469) Fix typo\n    - (!449) Restricted file permissions at creation time\n    - (!443) Add oneline helptext to 'repo migrate' command\n\n- update to 0.5.0:\n  * Additions\n    - (!334) Support for managing labels on issues and repos.\n    - (!349) repo edit and repo units for modifying settings on a\n      repo and repo units.\n    - (!373) Use the needed CLI flags for more editors when opening\n      them.\n    - (!385) Use the editor defined in git's core.editor config\n      option by default (falling back to $EDITOR if it is not set).\n    - (!414) Add commands to assign and unassign users to issues\n      and PRs.\n    - (!415) Support all README files in fj repo readme, regardless\n      of case or extension.\n    - (!416) Add the option to choose what repo to own the new repo\n      to fj repo migrate.\n    - (!419) Show a warning when viewing an archived repo.\n    - (!420) Add a notice about git push --force not being\n      supported on AGit PRs.\n    - Added fj auth login support for the following instances:\n      - v15.next.forgejo.org\n      - codefloe.com\n  * Fixes\n    - (!393) Don't include pull requests in fj issues search.\n    - (!407) Guarantee opening the browser in fj auth login doesn't\n      block.\n    - (!417) Prevent incorrectly reusing the refresh token when\n      refreshing OAuth tokens.\n  * Other\n    - (!278) Improved \"no repo info\" error message.\n    - (!403) Build aarch64 artifacts for new releases.\n\n- update to 0.4.1:\n  * Fixes\n    - (!368) Generate the correct PKCE challenge verifier. This was\n      preventing fj auth login from succeeding.\n\n- Update to version 0.4.0:\n  * Support for issue \u0026 pull request templates with fj issue/pr create\n    --template\n  * fj pr create --autofill, which will automatically populate the PR's title\n    and body from the commit(s)\n  * fj user key and fj user gpg commands for managing uploaded SSH and GPG keys\n  * fj user repos --page, to select the page of results to view\n  * fj issue/pr create/comment --body-from-file to use the contents of a file\n    as the body\n  * --identity-file/-I flag for selecting the SSH identity to use\n  * fj tag to manage git tags\n  * fj issue search --state all\n  * --remote \u0026 --repo flags can now be at the end of the command with the rest\n    of the flags\n\n- update to 0.3.0:\n  * Additions\n    - Added fj completion to generate completion scripts for various\n      shells\n    - Added fj org for Organization commands.\n    - Added fj actions for Forgejo Actions-related commands (thank\n      you, @LordMZTE !)\n    - OAuth client IDs for fj auth login can now be customized.\n    See the wiki for more on the new features.\n\thttps://codeberg.org/Cyborus/forgejo-cli/wiki/Organizations\n  * Fixes\n    - Keys file now has proper file permissions\n    - Fixed incorrect help commands (thank you, @0ko !)\n    - Always set user agent in requests\n\n- update to 0.2.0:\n  * Additions\n    - pr create and issue create now have a --web flag that opens\n      the creation page in your browser instead of creating it on\n      the terminal.\n    - pr --agit will create a pull request with agit flow, so you\n      don't need to fork the repository.\n    - pr status --wait will only exits once all PR checks finish.\n    - repo migrate to migrate/mirror repositories from other hosts.\n    - repo readme to print a repository's readme to the terminal.\n    - version --verbose prints extra info useful for debugging\n  * Fixes\n    - Public endpoints can now be accessed without authenticating\n    - The API will be accessed via the http url even when it\n      differs from the ssh url and the local remote points to the\n      ssh url.\n    - browse commands will no long hang the terminal\n    - Local repos will now be found even when in a subdirectory\n    - SSH urls in repo remotes will now be parsed correctly\n    - Improved pull request detection\n","status":"published","published":"2026-08-18T16:51:08Z","modified":"2026-08-21T09:15:09.047143705Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21689-1","title":"Security update for gstreamer-devtools","description":"This update for gstreamer-devtools fixes the following issues:\n\n- CVE-2025-4574: crossbeam-channel: internal `Channel` type's `Drop` method has a race condition that can lead to a\n  double-free and memory corruption (bsc#1243178).\n- CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into\n  terminal output when logged and lead to terminal manipulation (bsc#1249015).\n- CVE-2026-25541: bytes: integer overflow in `BytesMut:reserve` can lead to undefined behavior and crashes\n  (bsc#1274306).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257914).\n- CVE-2026-72813: actix-files: empty `Range` header in GET requests for static files can lead to a process crash\n  (bsc#1275210).\n- CVE-2026-72814: actix-files: non-existing folders passed as an argument to the `actix_files::Files::new()` method can\n  lead to information disclosure (bsc#1275209).\n","status":"published","published":"2026-08-30T14:39:29Z","modified":"2026-08-31T18:15:04.209335775Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21782-1","title":"Security update for aws-nitro-enclaves-cli","description":"This update for aws-nitro-enclaves-cli fixes the following issues:\n\n- CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes\n  (bsc#1274300).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257933).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n  (bsc#1270202).\n\nChanges for aws-nitro-enclaves-cli:\n\n- Update to version 1.5.0\n","status":"published","published":"2026-09-07T10:17:39Z","modified":"2026-09-09T10:00:05.697108577Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21794-1","title":"Security update for supergfxctl","description":"This update for supergfxctl fixes the following issues:\n\nChanges in supergfxctl:\n\n- Fixed security issue in embedded dependency 'bytes' (CVE-2026-25541 boo#1274336)\n\n- Update to version 1762634235.5d503b1:\n  * Added GfxMode::Integrated, GfxMode::Hybrid to the AsusGpuMuxMode::Discreet vec\n","status":"published","published":"2026-09-03T12:50:35Z","modified":"2026-09-09T18:23:15.869916531Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21815-1","title":"Security update for waylyrics","description":"This update for waylyrics fixes the following issues:\n\nChanges in waylyrics:\n\n- Update to version 0.4.0 (CVE-2026-25541 bsc#1274106)\n  * Added plugin architecture and SakuraLLM translation plugin\n  * Added OpenCC support for Simplified/Traditional Chinese\n  * Added support for custom CSS themes and style presets\n  * Added auto theme switching based on light/dark mode\n  * Added shortcut keys for decoration, passthrough, and search\n  * Improved MPRIS and SMTC audio player integration\n  * Improved TOML config handling and automatic comment updates\n  * Optimized lyric search, fetch speed, and UI responsiveness\n  * Fixed window passthrough state and click-through toggles\n  * Updated dependencies and bumped MSRV requirement\n\n- Update to version 0.3.21:\n  * docs: update changelog [ci skip]\n  * chore: bump version to v0.3.21\n  * build: bump dependencies\n  * build(deps): bump tokio from 1.43.0 to 1.43.1\n  * build(deps): bump openssl from 0.10.71 to 0.10.72\n  * build(deps): bump rust_decimal from 1.36.0 to 1.37.1\n  * build(deps): bump async-trait from 0.1.86 to 0.1.88\n  * build(deps): bump reqwest from 0.12.12 to 0.12.15\n  * build(deps): bump rust_decimal_macros from 1.36.0 to 1.37.1\n  * build(deps): bump the serde group with 2 updates\n  * fix:.一个错误\n  * fix: 手动刷新歌词时清空歌词标签缓存\n  * style: :lipstick: cargo fmt\n  * perf: DashMap 作为歌词标签存在性缓存\n  * feat: 添加对从音乐文件元数据读取歌词的支持\n  * build(deps): bump ring from 0.17.11 to 0.17.13 (#303)\n  * chore: add script to export dup deps [ci skip]\n  * fix(CI): remove outdated test of qqmusic api initialization [ci skip]\n  * build: bump dependencies\n  * docs(readme): HotLyric, alternative on windows [ci skip]\n  * docs(readme): note on project status\n  * build(deps): bump openssl from 0.10.68 to 0.10.70 (#301)\n  * build(deps): bump serde_json from 1.0.134 to 1.0.138 in the serde group (#296)\n  * build(deps): bump thiserror from 2.0.9 to 2.0.11 (#297)\n  * build(deps): bump tokio from 1.42.0 to 1.43.0 (#298)\n  * build(deps): bump futures-lite from 2.5.0 to 2.6.0 (#299)\n  * build(deps): bump windows from 0.58.0 to 0.59.0 (#300)\n  * build(deps): bump dark-light to 2.0.0\n  * build(deps): bump reqwest from 0.12.9 to 0.12.12 (#291)\n  * build(deps): bump the serde group with 2 updates (#290)\n  * build(deps): bump gdk4-win32 from 0.9.3 to 0.9.5 (#292)\n  * build(deps): bump thiserror from 2.0.6 to 2.0.9 (#293)\n  * build(deps): bump glib-macros from 0.20.5 to 0.20.7 (#294)\n  * rust version problem (#289)\n  * enhance: switch to better tray-icon implementation for windows [ci skip]\n  * build: migrate to ksni 0.3\n  * chore: dedup code\n  * chore: fix deepsource lints\n  * refactor: extract set_by_mode\n  * ci: add .deepsource.toml\n  * docs(readme): add introduction [ci skip]\n  * docs(readme): add alternative `lyric-for-musixfox` [ci skip]\n  * docs(readme): add preview images [ci skip]\n  * docs(readme): replace text with logos\n  * docs: update changelog \u0026 metainfo\n  * chore: release v0.3.20\n  * enhance: comment for sub table in config\n  * log: capture panics\n  * fix: check if instance name used\n  * docs: update metainfo \u0026 changelog\n  * hotfix: build on windows\n  * chore: release v0.3.19\n  * chore(deps): bump dependencies\n  * build(deps): bump the serde group with 2 updates (#280)\n  * build(deps): bump tracing from 0.1.40 to 0.1.41 (#281)\n  * build(deps): bump tray-icon from 0.19.1 to 0.19.2 (#282)\n  * build(deps): bump rfd from 0.15.0 to 0.15.1 (#284)\n  * build(deps): bump url from 2.5.3 to 2.5.4 (#283)\n  * docs(build): check MSRV\n  * chore(clippy): fix clippy warnings\n  * chore: update lock file\n  * fix: setCookies for QQMusicApi\n  * fix: instance format\n  * feat: support multi-monitor setup (#278)\n  * feat: Implement color-scheme autoswitch (light/dark mode) (#277)\n  * enhance: unregister latest theme\n  * build(deps): bump rustls from 0.23.16 to 0.23.18 (#276)\n  * fix: LazyLock is not stable yet in 1.73 rustc\n  * chore: fix details URL in metainfo\n  * chore: bump version to 0.3.18\n  * test: search/query via lrclib\n  * feat: support LRCLib provider\n  * chore: apply clippy fix\n  * fix: `login_qqmusic` call was not awaited\n  * chore(deps): bump dependencies\n  * feat: show errors from providers in search_window\n  * fix: search failure dialog cannot be spawned outside GTK thread\n  * docs: fix typo in filename\n  * docs(i18n): translation for contribution.md and build guide ubuntu (#272)\n  * fix: add artists to QQMusic keyword\n  * fix(test): initialize QQMusic\n  * feat: set cookies for QQMusicApi in config\n  * chore: migrate to qqmusic-rs 0.2.0\n  * enhance: init lyric provider with any struct\n  * build(deps): bump the serde group with 2 updates (#266)\n  * build(deps): bump glib-macros from 0.20.4 to 0.20.5 (#267)\n  * build(deps): bump thiserror from 1.0.64 to 1.0.66 (#268)\n  * build(deps): bump regex from 1.11.0 to 1.11.1 (#269)\n  * build(deps): bump tray-icon from 0.19.0 to 0.19.1 (#270)\n  * chore: support nix flake (#264)\n  * fix: set text wrap to show very-long lyric\n  * docs(readme): add alternative `lyrica`\n  * chore(deps): bump once_cell to `1.20.2`\n  * chore: release v0.3.17\n  * fix(tray/unix): Avoid calling list_players() from tray thread (#262)\n  * fix(tray): export translated lyrics\n  * build(deps): bump reqwest from 0.12.7 to 0.12.8 (#261)\n  * fix(win32): crash with Motrix runnig\n  * i18n: Create Italian Translation  it_IT (#260)\n  * chore: release v0.3.16\n  * build(fix): \"\"desktop\n  * docs(build): fix i18n part (#259)\n  * chore(deps): bump dependencies\n  * docs(readme): intro SPlayer [ci skip]\n  * docs(readme): desktop support of desktop_lyric, #258\n  * fix: build error on linux\n  * refactor: dedup function signature\n  * docs(readme): add alternative\n  * i18n: translate tips\n  * test: add test for make_lrc_line\n  * build(fix): fix build with MSVC\n  * feat: show error dialog if search failed\n  * enhance: TrackMeta from Metadata will not fail now\n  * chore: release v0.3.15\n  * enhance: select output file after generation\n  * fix: sec field in exported lyric\n  * enhance: make import/export pormpt different\n  * chore: release v0.3.14\n  * i18n: update locale for 0.3.14\n  * build: enable export-lyric for win build [ci skip]\n  * chore(dep): bump dependencies\n  * chore: disable unused warn\n  * fix: build with export-lyric/import-lyric disabled\n  * feat: export-lyric\n  * refactor: dedup import-*-lyric\n  * enhance: dedup import-lyric\n  * build(deps): bump the serde group with 2 updates (#252)\n  * build(deps): bump opencc-rust from 1.1.18 to 1.1.19 (#253)\n  * build(deps): bump gettext-rs from 0.7.0 to 0.7.1 (#254)\n  * build(deps): bump reqwest from 0.12.5 to 0.12.7 (#255)\n  * build(deps): bump rust_decimal from 1.35.0 to 1.36.0 (#256)\n  * build(deps): bump orhun/git-cliff-action from 3 to 4 (#257)\n  * fix: build with `opencc` disabled\n  * refactor: unify naming of same component in different mod\n  * refactor: prefer lazy-binding rather than multiple `cfg` flag\n  * docs(readme): fix broken link for DeaDBeeF plugin [ci skip]\n  * build(deps): bump tokio from 1.39.1 to 1.39.2 (#248)\n  * build(deps): bump serde_json from 1.0.120 to 1.0.121 in the serde group (#247)\n  * docs: mark issue/workaround for Better Comments\n  * fix: support new type of HWND inner\n  * docs(readme): intro DeaDBeeF close #245\n  * fix: migrate to window-rs 0.58\n  * build(deps): bump openssl from 0.10.64 to 0.10.66 (#246)\n  * refactor: migrate to new-style clone!\n  * refactor: migrate to gtk4-rs clone! new style\n  * chore: bump dependencies\n  * build(deps): bump serde_json from 1.0.118 to 1.0.119 in the serde group (#244)\n","status":"published","published":"2026-09-08T10:00:08Z","modified":"2026-09-10T18:23:18.962429558Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21982-1","title":"Security update for sccache","description":"This update for sccache fixes the following issues:\n\n- CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868).\n- CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes\n  (bsc#1274146).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257923).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n  (bsc#1270206).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-\n  openssl crate (bsc#1270559).\n- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).\n- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate\n  (bsc#1270736).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n  memory in rust-openssl crate (bsc#1270869).\n- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate\n  (bsc#1270512).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate\n  (bsc#1270938).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust-\n  openssl crate (bsc#1270948).\n- CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).\n- CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by\n  sending a crafted percent-encoded URL (bsc#1273884).\n- CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).\n- CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).\n- CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).\n- CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).\n- CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).\n- CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).\n\nChanges for sccache:\n\nUpdate to version 0.18.0~2:\n * Add experimental concurrent cache support\n * chore: Remove dependency status badge (#2856)\n * Don't hand the jobserver to children that can't use it\n * dist: refuse to trim rlibs from crates that also emit a cdylib\n * fix(cache): avoid duplicate multilevel reads\n * Strip basedirs from the compiler arguments too\n * tests/integration: replace MinIO with Silo\n * ci: dump sccache logs on integration failures\n * multilevel: a chain with any writable level is writable\n * Fix parsing of #line directives\n * Release 0.18.0\n * daemonize: use an allow-list approach to inherited FDs\n * gcc, clang: make the assembler part of the cache key\n * support cl.exe /openmp:llvm\n * support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args\n * support MSVC /feature argument\n * msvc: support lots of flags (#2832)\n * Update shlex dependency to version 2 (#2836)\n * gcc: mark flags as TooHard if need to cache something else (#2833)\n * clang: support more CLI options (#2834)\n * msvc: support arm64EC and fastfail flags (#2830)\n * chore: fix typo in comment (#2829)\n * nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)\n * cache: allow skipping capability checks (#2822)\n * Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)\n * nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)\n * Add an agent (#2812)\n * Add support for d20bforceinline. (#2807)\n * feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)\n * Bump MSRV to 1.91.0 (#2793)\n * Fix `nvcc` dryrun parsing for CUDA 13.3 (#2722)\n * test: Fixed hardcoded binary path in test\n * Release 0.17.0\n * tests: pin libc in the dist test crate\n * doc: clarify server-side outputs and drop 'recommended mode' claim\n * doc: document SCCACHE_CLIENT_SIDE env var\n * doc: document client-side and direct modes in Architecture.md\n * Fix description of Unix socket-based Redis connection\n * server: remove redundant async block in start_compile_task\n * server: simplify bind() request loops with ? instead of manual match arms\n * Add support for arg files in Rust (#2782)\n * feat: support S3 SSE-KMS with AWS-managed and customer-managed keys (#2770)\n * abort compile tasks and associated subprocesses when a client disconnects\n * treat -ivfsoverlay as a preprocessor-only argument\n * gcc: refine response-file tokenizer visibility and whitespace handling\n * integration: convert cmake 4.x modules XFAIL test to a passing test\n * gcc/clang: cache and distribute builds using quoted @response files\n * fix: Fix ToolchainPackager cfg gate to build on ppc64le/s390x\n * fix: make gcc diagnostics color output work the same as for rustc\n * implement client-side mode\n * split handle_compile_response so that the compilation result can be handled separately\n * implement IpcStorage -- Storage backend over IPC\n * extend wire protocol with storage RPCs\n * implement AddAssign for ServerStats and related types\n * add Storage::get_path for direct file access\n * implement get_raw/put_raw on MultiLevelStorage\n * add client_side_mode config flag (SCCACHE_CLIENT_SIDE)\n * Extract new_client_runtime() helper to DRY up client runtime creation\n * Clarify single-threaded runtime rationale comment (grammar)\n * fix: use single-threaded tokio runtime in sccache dist-client\n * fix: use single-threaded tokio runtime in sccache client\n * fix: handle disabled cache backend features in multilevel chain\n * Fix ldd output parsing: remove .exists() check that failed on systems where the symlink source path does not exist locally (e.g. aarch64)\n * Fix cfg guard for PanicToolchainPackager to also cover non-x86_64 Linux architectures (e.g. aarch64)\n * Release 0.16.0\n * fix: strip SCCACHE_BASEDIRS from escaped-backslash paths on Windows (#2736)\n * Ignore empty-set environment values (#2639)\n * feat: all backends support making them as read-only (#2705)\n * Enable RE on Linux-aarch64 (#2668)\n * Slightly improve logging (#2734)\n * chore: encode jwt key and cert digest with base64 in logs (#2712)\n * chore: make clippy happy (#2727)\n * feat: avoid sccache wrapper when resolving compiler (#2720)\n * Fall back to direct cache write if tempfile creation on the same fs fails (#2369)\n * remove too noisy bench\n * feat(nvcc): support argument: `--dependency-output` (#2708)\n * fix: add newline when printing dist-status to stdout\n * Revert \"Classify .s files as AssemblerToPreprocess so #include/#ifdef are hon...\"\n * Don't wait depfiles for gcc/clang preprocessed inputs\n * Classify .s files as AssemblerToPreprocess so #include/#ifdef are honored\n * prepare release 0.15.0\n * Add cargo-binstall metadata for prebuilt binary installation\n * Fix coverage\n * fix: handle directories in dep-info source file hashing\n * docs(Rust.md): Add caveats from README\n * Add retry for dists docker image build\n * ci: set crt-static for riscv64 musl targets\n * feat: Add loongarch64 support\n * feat: Implement multi-tier caching with fallback and backfilling (#2581)\n * msvc: add support for Y-, YI, Zf flags\n * Group tests logging in CI\n * Add failing test for cmake-modules + cmake 4 version\n * Unfold ninja output in the test\n * Add a comment for maintaining integration tests\n * Move cmake-modules to integration tests\n * fix: exclude CARGO_ENCODED_RUSTFLAGS from env var hash (#2651)\n * chore(deps): update rust crate quinn-proto to v0.11.14\n * Fix sync GCS initialization\n * clippy: fix from_iter_instead_of_collect lint\n * fix: add Win32_Security feature to windows-sys dependency\n * build(deps): bump actions/download-artifact from 5 to 8\n * msvc: Append the default .pdb extension for the /Fd argument (#2621)\n * build(deps): bump actions/upload-artifact from 4 to 7\n * clippy: fix ref_option lint\n * ci: install grcov from prebuilt binary instead of cargo install\n * ci: use default toolchain to install grcov\n * ci: fix artifact_failure action when target dir does not exist\n * Remove benchmark normalize_win_path_utf8 (#2634)\n * Revert \"actions: add security audit workflow (#2594)\" (#2603)\n * partial c++20 module support (#2516)\n * clippy: fix ptr_as_ptr lint (#2611)\n * Add support for `d1nodatetime` \u0026 `await:strict` MSVC flags (#2617)\n * chore: switch thirtyfour_sync to thirtyfour (#2613)\n * clippy: fix manual_string_new lint (#2609)\n * clippy: fix unnecessary_semicolon lint (#2615)\n * clippy: fix explicit_into_iter_loop lint (#2616)\n * Avoid double-caching when ccache is installed in PATH (#2524)\n * clippy: fix cloned_instead_of_copied lint (#2605)\n * clippy: fix semicolon_if_nothing_returned lint (#2601)\n * Move PreprocessorCacheModeConfig to src/config.rs (#2604)\n * clippy: fix cloned_ref_to_slice_refs lint (#2602)\n * prepare the new release (#2600)\n * chore: update to toml 0.9 (#2599)\n * ci: Add coverage to integration tests, report it to Codecov.io (#2598)\n * Preparation for multilevel caching (#2597)\n * Add sccache-dist to flake.nix (#2579)\n * fixup! cargo fmt\n * fixup! rustfmt update\n * Extract FileObjectSource, CacheRead and CacheWrite to cache_io.rs\n * chore: update to nix 0.30\n * Add a helper method to get a correct backend name\n * Add cos feature gate to RemoteStorage\n * Simplify profiles for integration tests\n * clippy: fix implicit_clone lint (#2584)\n * actions: add security audit workflow (#2594)\n * docs: fix examples showing an xz-compress toolchain archive (#2587)\n * add benches for normalize_win_path strip_basedirs (#2588)\n * snap: update to core24 (#2570)\n * Add .rustfmt.toml for consistent style between `rustfmt` and `cargo fmt` (#2582)\n * add comments about auth token requirements (#2583)\n * chore: update to tokio-serde 0.9 (#2585)\n * ci: update freebsd to 15.0 (#2586)\n * distributed compilation support for asm \u0026 preprocessor outputs (#2557)\n * remove unused declaration (#2577)\n * Extract LazyDiskCache to a separated file (#2573)\n * Revert \"ci: show diff for toml_format\" (#2578)\n * Open Add SCCACHE_BASEDIRS support\n * ci: show diff for toml_format\n * chore: update to syslog 7\n * refactor: use matrix to reduce deduplication\n * fix: remove outdated `analysis` mode\n * Unbreak the s390x CI\n * ci: add macos-15-intel for prebuilt binary (#2555)\n * Integration tests (#2564)\n * Fix code review.\n * Impl for COS.\n * build(deps): bump opendal from 0.54.0 to 0.55.0\n * Move integration tests related stuff to subdir\n * Add Objective C Header for consistency\n * github action: fix the syntax - fails in the ci\n * sccache: prepare a new release\n * msvc: add msbuild support test\n * msvc: fix detect_showincludes_prefix with MSBuild\n * chore: update to gzp 2\n * build(deps): bump rsa from 0.9.6 to 0.9.10\n * codspeed: evaluate the memory benchmarking\n * remove too quick benchmarks\n * codspeed: move to simulation mode\n * Add realistic LRU cache access pattern benchmarks\n * Add compression characteristics benchmarks\n * Add build workflow simulation benchmarks\n * Add hash computation scenario benchmarks\n * Add batch cache entry benchmarks\n * Add cache artifact serialization benchmarks\n * Add /etc/ld.so.conf.d (if present) to compiler package\n * Assembly language support\n * fix(ci): pin serde_json to avoid zmij dependency\n * fix(ci): update zmij to fix s390x cross-compilation\n * Fix the run of the CI\n * run the benchmark in the ci\n * add benchmarks\n * dedup some code\n * Fix hash logging prefix\n * Add support for C preprocessor output\n * Add GCC pipe flag support\n * Improve save-temps gcc flags detection\n * MSVC: support forward slash as an output dir marker\n * add clang -fplugin=x regression test\n * canbeconcatenated is not accounted for in cmp\n * Reversed the order for looking `rustc`, added comment\n * Fix failing test_rlib_dep_reader_call for omit CARGO_HOME\n * fix: don't hash -parallel-jobs in Clang\n * docs: add installation steps for nix (#2523)\n * Support clang -fexperimental-assignment-tracking option (#2517)\n * add a nix flake (#2518)\n * Switch from the unmaintained daemonize crate to a maintained fork\n * chore: update to fs-err 3\n * Fix grammar of error message\n * Add server name info to stderr of remote jobs that ran, but failed\n * Remove another pointless destructuring\n * try to unbreak the ci\n * fix s390x build error\n * Add riscv64 support\n * fix: make aarch64-pc-windows-msvc also zip not tar.gz\n * Free up disk space in CI\n * MSVC on Windows only\n * Avoid 'No space left on device' errors in CI\n * GitHub dropped macos-13 runners\n * Proper function pointer to int cast\n * Avoid unused structs with dist-server disabled\n * no check cfg (#2507)\n * chore: switch once_cell crate to standard library (#2499)\n * Avoid unreliable assert_cmd::cargo::cargo_bin (#2489)\n * Fix build on macOS which doesn't have separate 32-bit dirent (#2492)\n * Fix Clippy warnings (#2490)\n * docs: bump MSRV to 1.85.0\n * msvc: handle '/FoRelease\\' command-line argument\n * chore: drop tower dependency\n * chore: update to itertools 0.14\n * Use generator in CMAKE_MSVC_DEBUG_INFORMATION_FORMAT in README\n * Update directories to 6.0\n * Configuration.md - note logging env variables\n * chore: update to env_logger 0.11\n * deps: update blake3\n * prepare version 0.12.0\n * Update README with winget installation instructions\n * Skip CARGO_BUILD_JOBS in hash keys\n * build(deps): bump object from 0.36.7 to 0.37.1\n * Adjust tests after the rust update\n * Fix CI by adding cargo-features and updating coverage test to use modern -Cinstrument-coverage\n * Fix more clippy warnings\n * bump rustc in the ci too\n * Fix rustc 1.85 clippy warnings\n * bump to rustc 1.85 / edition 2024. mandatory for reqsign-core and run rustfmt with the version\n * fix clippy warnings\n * bump opendal to 0.54.0 \u0026 reqsign to 0.18.0\n * github action: when creating a release, make it as draft before (#2458)\n * prepare version 0.11.0 (#2457)\n * document SCCACHE_LOG_MILLIS (#2456)\n * logging: add a option to log milliseconds (Closes: #2454) (#2455)\n * feat: handle human size prefixes (#2405)\n * fix: in stats, Compare values AND keys to have a fully deterministic order (#2403)\n * Add --diagnostic-width to test for args ignored in hash\n * Ignore --diagnostic-width argument when computing hash\n * build(deps): bump actions/checkout from 4 to 5\n * build(deps): bump actions/download-artifact from 4 to 5\n * build(deps): bump actions/github-script from 7 to 8\n * Fix rustfmt\n * Fix comments on request\n * Fix clippy and rustfmt\n * Add test for count toolchain and use Determenistic for create tar archive\n * Fix mtime for reproducable toolchains\n * build(deps): bump chrono from 0.4.41 to 0.4.42\n * fix typo in an environment variable name\n * Fix documentation of azure configuration\n * Account for clippy-driver having extra prefix `rustc`\n * Fix build on Android (in Termux)\n * add support for s390x build\n * chore: replace retry crate with backon\n * Remove or replace \"Windows 2019\" CI config\n * Needs another result unwrapping, it seems\n * Test: invoking symlink \"compiler\" to \"sccache\" invokes \"compiler\"\n * Add a comment about the problem with symlinks and current_exe()\n * Fix symbolic links to sccache on linux\n * Allow the CI configuration to disable clang++ for CUDA testing\n * Don't run tests using clang++ as CUDA compiler on Windows\n * add description to sccache-dist commands\n * Display a more user-friendly error when compiling on Linux/arm64\n * Clarify documentation about \"the hash\" (aka cache key)\n * Remove stray ')'\n * Remove documentation for removed limitations of preprocessor cache mode\n * Fix preprocessor cache mode when the compiler outputs a dep file\n * Partially revert \"Don't cache dep file (#2322)\"\n * Do not disable preprocessor cache mode if there is a dep file\n * Fix preprocessor cache mode with distributed builds (#2173)\n * Change self of generate_hash_key() from Box\u003cSelf\u003e to \u0026mut Self\n * Remove a few IMO pointless indirections / aliases\n * Remove workaround for #2173\n * Add test for bug #2173\n * chore: fix some minor issues in comments\n * build(deps): bump chrono from 0.4.40 to 0.4.41\n * build(deps): bump memchr from 2.7.1 to 2.7.5\n * check if we can use a specific version of rust to build grcov\n * Move comment that hadn't moved with its corresponding code\n * Rework direct mode documentation some more\n * Explain what preprocessor cache mode really does\n * Reword and correct the preprocessor cache mode documentation\n * chore: Remove not working mozilla code\n * Add support for -fsanitize-ignorelist\n * github storage: adjust the doc\n * github storage: ACTIONS_CACHE_URL =\u003e ACTIONS_RESULTS_URL\n * github storage: force version 2\n * Update codecov badge in README.md\n * Expand tests for dist-server\n * ci: Consolidate testing, coverage\n * ci: Update ubuntu-20.04 runners to ubuntu-22.04\n * chore: fix some comments\n * Give the --dist-status user some information about when a retry will happen.\n * Add support for Xclang flag '-mrelax-all'\n * Add support for Xclang flag '-mconstructor-aliases'\n * feat(utils): Add support for object \u003e= 0.33\n * fix(tests): Remove executable bit from oauth.rs\n * build(deps): bump openssl from 0.10.64 to 0.10.72\n * build(deps): bump tokio from 1.41.0 to 1.43.1\n * Improve the CARGO_INCREMENTAL checking (#2364)\n * build(deps): bump chrono from 0.4.38 to 0.4.40\n * build(deps): bump clap from 4.4.18 to 4.5.13\n * build(deps): bump ring from 0.17.7 to 0.17.13\n * Bail on `nvcc -time` and `nvcc -fdevice-time-trace` flags\n * test hip with librandomize_readdir\n * Add randomize_readdir test utility\n * fix non-strict HIP device lib order\n * Create config during testing to collect coverage data\n * Extend coverage to distributed tests\n * chore: replace num_cpus crate with available_parallelism in standard library (#2342)\n * Update CI coverage: grcov/codecov\n","status":"published","published":"2026-09-30T17:58:26Z","modified":"2026-10-01T17:30:06.785984892Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22016-1","title":"Security update for rustup","description":"This update for rustup fixes the following issues:\n\n- CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).\n- CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).\n- CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes\n  (bsc#1274144).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257902).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n  (bsc#1270186).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-\n  openssl crate (bsc#1270619).\n- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).\n- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate\n  (bsc#1270795).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n  memory in rust-openssl crate (bsc#1270870).\n- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate\n  (bsc#1270521).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate\n  (bsc#1270874).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust-\n  openssl crate (bsc#1270989).\n- CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282217).\n- CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282217).\n- CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282217).\n- CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282217).\n- rust-shlex: Multiple issues involving quote API (RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).\n\nChanges for rustup:\n\n- Update to version 1.29.1~0:\n * dist(rustup-init/sh): update commit shasum in help string\n * style(bin/rustup-init): reformat code\n * docs(changelog): update for v1.29.1 stable release\n * warn how to switch away from the deprecated complete profile\n * fix(cli/help): fix wording in `rustup run --help`\n * ci(docker/android): stop building OpenSSL\n * refactor(cli/docs): use tracing for docs opening status messages\n * refactor(self-update): rename Windows uninstall registry helpers\n * feat(test): isolate Windows registry state per test\n * docs(dev-guide): mention how to support new compilation targets\n * Fix funding link\n * chore(deps): lock file maintenance\n * refactor(cli/self-update): move `current_install_opts()` to `InstallOpts::display()`\n * refactor(cli/self-update): move `process` out of `InstallOpts`\n * fix(cli/self-update): postpone initialization of `Cfg` in `setup_mode`\n * refactor(cli/self-update): take `Process` in `check_existence_of_settings_file()`\n * fix(settings): prevent creating new file with `SettingsFile::read_settings()`\n * test(cli-inst-interactive): test file creation on cancelled installation\n * refactor(toolchain/names): inline `validate()` aliases into `FromStr`\n * refactor(toolchain/names): rename `validate()` to `normalize_name()`\n * fix minor typos\n * www: align copy icon\n * refactor(toolchain/names)!: remove `try_from_str!()`\n * refactor(toolchain/names)!: remove `from_variant!()`\n * Add `rustup doc --serve` to serve docs over local HTTP\n * Move doc() and man() into a new docs module\n * chore(github): comment out instructions in PR template\n * docs(dev-guide): reapply abandoned changes from #4970\n * Add riscv64 unknown linux musl support\n * fix(deps): update rust crate enum-map to v3\n * refactor(cli/self-update)!: rename `install()` to `InstallOpts::install()`\n * refactor(cli/self-update)!: rename `maybe_install_rust()` to `InstallOpts::install_rust()`\n * refactor(cli/self-update)!: rename `InstallOpts::install()` to `InstallOpts::select_toolchain()`\n * refactor(toolchain/names)!: make more clones during conversions explicit\n * refactor(cli/self-update): move message templates to `mod msg`\n * style(cli/self-update): reorganize imports\n * Add pull request template linking to the dev guide\n * doc: add AI policy to the dev guide\n * ci(dist): ensure pushing to `dev-static` on `stable` update\n * test(toolchain): add a test case for `rustup toolchain install --override`\n * feat(toolchain): add `--default` flag to `rustup toolchain install`\n * fix(toolchain): inline use of `set_override`\n * Add Enzyme to the list of rustup components\n * fix: repair toolchains without an installed manifest\n * refactor: expose the installed manifest path\n * Docs: Remove i686 `set default-host` example\n * fix(self-update): only remove complete profile lines\n * chore(deps): bump `platforms` to 4.1.0\n * chore(deps): remove pinned `openssl-src`\n * refactor: replace `cfg_if!{}` with `cfg_select!{}`\n * fix: Lock state file updates\n * Fix Rust 1.97 clippy warnings\n * uninstalls toolchains prior to deleting the rustup home folder\n * Take semver-compatible dependency updates\n * Upgrade platforms to 4\n * docs: update `CHANGELOG` for v1.29.1\n * Lock file maintenance\n * Remove Windows special case from `can_run`\n * diskio: drop unnecessary constructor wrapper\n * diskio: rename _IncrementalFileState to FileState\n * diskio: inline IncrementalFileState type alias\n * Minimize API visibility\n * toolchain: streamline validate() implementations\n * toolchain: avoid internal cloning\n * dist: drop unused conversion impl\n * dist: keep impls with type definitions\n * Don't hide allocations inside From impls\n * toolchain: drop impls for \u0026String\n * Warn on clippy::or_fun_call\n * Warn on clippy::needless_by_ref_mut\n * Warn on clippy::redundant_clone\n * Warn on clippy::manual_let_else\n * Warn on clippy::use_self\n * errors: box ToolchainDesc in RustupError variants\n * errors: box Manifest in RequestedComponentsUnavailable variant\n * No (more) need to allow clippy::arc_with_non_send_sync\n * Replace use of FnMut trait objects with custom trait\n * test(cli/self-upd): use direct arg0 override for `as_rustup_setup()`\n * chore(deps): update actions/cache action to v6\n * ci(windows): add support for aarch64-pc-windows-gnullvm target\n * ci(windows): refine MSVC/MINGW job step predicates\n * chore(deps): update actions/checkout action to v7\n * fix(deps): update rust crate itertools to 0.15\n * fix(progress): use the `prefix` placeholder instead of `msg` for component name\n * rustup: warn when no toolchain or default is configured\n * errors: extract default stable hint\n * feat(toolchain): make the \"installed\" text of a toolchain install green\n * Add aarch64-unknown-freebsd\n * chore: address linter warnings\n * chore(deps): bump to semver-compatible versions\n * Add funding links\n * ci(docker/freebsd): bump `clang` version to `freebsd14`\n * ci(freebsd): use FreeBSD 14.0 for full CI\n * chore(deps): update `curl`\n * feat(cli/rustup-mode): warn about auto-installation in some subcommands\n * refactor(config): accept `Cfg` in `EnsureInstalled::warn_auto_install()`\n * test(cli/rustup-mode): test auto-installation on to-be-deprecated subcommand\n * dist: move display_name() before other methods that it calls\n * chore(gitignore): add .cargo/config.windows-cross.toml to gitignore\n * docs(dev-guide): update platform-specific code guidance\n * docs(dev-guide): mention rust-analyzer support for Windows-specific code on Unix\n * docs(dev-guide): mention how to lint Windows-specific code on Unix\n * chore(config): add example config for cross checking and rust-analyzer\n * chore: add rust-analyzer example config\n * Display the full names of targets not matching the host target tuple\n * docs(dev-guide/tips-and-tricks): mention the `RUSTUP_FORCE_ARG0='rustup'` cargo alias\n * build(cargo): add `cargo` alias for `RUSTUP_FORCE_ARG0='rustup'`\n * docs: rename the repath helper variable\n * Remove double buffering when extracting archives\n * refactor(toolchain/distributable): return `EnsureInstalled\u003c\u003e` from `DistributableToolchain::install()`\n * docs(dev-guide/coding-standards): adapt style guide from rustls\n * fix(deps): update opentelemetry\n * feat(config): warn user if auto-install is enabled\n * refactor(config): return `EnsureInstalled\u003c\u003e` from more functions\n * refactor(config): extract `EnsureInstalled\u003c\u003e` wrapper type\n * test: make tests agnostic to external `RUSTUP_AUTO_INSTALL` and `RUST_RECURSION_COUNT`\n * test(dist): fail v2 manifest update when manifest disagrees with .sha256\n * fix(dist): propagate v2 manifest checksum failure instead of reporting \"unchanged\"\n * Align shell setup comments in install message\n * feat(cli/self-update): refine wording of \"already installed Rust\" warning\n * chore(settings): rename default_host_triple to default_host_tuple and alias old name\n * chore(settings): add test to parse default_host_triple in toml\n * test(download): also scrub `HTTP_PROXY` in `scrub_env()`\n * chore: document legacy default host setting\n * chore: rename internal tuple constants\n * chore: rename partially \"Triple\" to \"Tuple\" to reflect the new terminology\n * fix(cli/rustup-mode)!: complete `rustup show` if active toolchain is not installed\n * refactor(cli/rustup-mode): postpone eval of `active_toolchain_targets` in `show()`\n * refactor(cli/rustup-mode): postpone eval of `active_toolchain` in `show()`\n * refactor(cli/rustup-mode): reduce rightward drift in `show()`\n * refactor(cli/rustup-mode): refine usage of `stdout` term and locks in `show()`\n * feat(config): add `Cfg` field to force-disable auto-installation\n * Provide --yes alias for -y flag consistently\n * refactor(tests): rename triple to tuple\n * refactor: bulk rename triple to ruple\n * refactor: rename get_default_host_triple to default_host_tuple\n * test(download): support more feature flag combinations\n * docs: fix the FileBuffer::clear doc comment wording\n * docs: fix plural of VM in coding standards\n * fix(dist): bulk rename triple to tuple for variables and messages\n * refactor(dist): rename PartialTargetTriple to PartialTargetTuple\n * refactor(dist): rename triple module to target_tuple\n * refactor: remove PartialToochainDesc::has_triple() in favor to PartialTargetTriple::is_empty()\n * refactor(dist): rename TargetTriple to TargetTuple\n * fix(self-update): rename triple to tuple in self_update\n * dist: bump `rustup` version to v1.29.1\n * ci(linux/x64-musl): install missing libc dependencies\n * fix(tests): rename HOST_TRIPLE placeholder to HOST_TUPLE\n * fix(tests): rename this_host_triple() to this_host_tuple()\n * fix(init): rename triple to tuple to reflect the new terminology\n * fix(docs): rename triple to tuple to reflect the new terminology\n * chore(deps): update ubuntu docker tag to v26\n * Improve error message for incomplete toolchains\n * chore(deps): update bwoodsend/setup-winlibs-action action to v1.16\n * test(dist/manifest): use the reordered fixture in `manifest_serialized_with_sorted_keys`\n * docs: fix \"initial\" spelling in stylesheet variable\n * ci: powerpc64-unknown-linux-musl is now stable\n * style(cli/rustup-mode): address clippy warnings\n * docs(dev-guide): update release process with new backporting flow\n * docs: fix actions template README typo\n * Only show post-install instructions for currently installed shells\n * docs: fix Windows MSVC guide typo\n * Upgrade to rustls-platform-verifier 0.7\n * Make component removal best-effort and preserve single-error behavior\n * Use `cc-rs` to detect the default linker, instead of assuming `cc`\n * ci(test): add `workflow_dispatch` trigger on par with `schedule`\n * ci: fix incorrect `contains()` predicate\n * fix(dist/manifestation): fix log format when installing exactly 2 components\n * Allow rustup component add to install multiple components in one update #4787\n * fix(docs): correct link to `no-self-update` feature\n * ci: enable on all PR target branches\n * ci(backport): rename backport branches to `release/*`\n * feat(toolchain): run a pre-check before updating all toolchains\n * feat(install): accept an optional pre-fetched manifest when installing\n * fix(toolchain): extract manifest fetching out of `show_dist_version()`\n * fix(manifest): aggregate a manifest and its hash in a `ManifestWithHash` struct\n * fix: Reduce flickering by using `set_move_cursor`\n * ci(backport): add support for backporting\n * fix: install message misalignment.\n * refactor: extracted `progress_style` method for DownloadStatus\n * fix(deps): update rust crate sha2 to 0.11\n * chore(doc): Added comments for clarify the usage of `Component::name` `Manifest::name` and the `short_name` funcc accordingly.\n * refactor: Rename `Component`'s `name_in_manifest` to `name` and `short_name` accordingly\n * self_update: show path to executable in case of updater failure\n * Revert \"fix(ci/freebsd): install ca certs to prevent certificate-related issues\"\n * ci: don't install protoc\n * Update to mdbook 0.5\n * ci(all-features): bump protoc version\n * fix(dist/manifestation): use full toolchain name in `Update::unavailable_components()`\n * style(dist/manifestation): merge imports\n * Fix zsh completion showing all PATH entries for +toolchain arg\n * fix(cli/proxy-mode): stop enforcing `quiet: true`\n * chore(deps/freebsd): downgrade `libz-sys` to v1.1.24\n * fix(ci/freebsd): install ca certs to prevent certificate-related issues\n * fix(rustup-init/sh): prevent passing `--default-host` twice\n * Avoid warning about the existence of a `settings.toml` on a fresh install\n * use tuple instead of triple for env overrides\n * Take platforms 3.9.0\n * Unpin tracing-subcriber\n * chore(deps): update `aws-lc-rs` and `aws-lc-sys`\n * docs(changelog): update release date for v1.29.0\n * docs(dev-guide/release-process): mention the CfT blog post\n * docs(changelog): update for v1.29.0 stable release\n * fix(cli): Style CLI errors in init mode\n * test: Add unknown arg init test\n * chore(deps): update actions/upload-artifact action to v7\n * refactor(www): simplify instruction css selector\n * feat(www): make copy button dark mode-aware\n * feat(www): move feedback text out of copy button\n * fix(www): apply filter to rust logo\n * feat(www): add dark mode\n * refactor(www): extract css variables\n * fix(cli/self-update): enforce a newline after `check_updates()`\n * refactor(cli/self-update): extract `has_progress_bars` in `check_updates()`\n * fix(cli/self-update): unify `check_*update*()`'s message formats\n * docs(downloads): fix the default number of `RUSTUP_CONCURRENT_DOWNLOADS`\n * feat(toolchain): add `--override` to override toolchain as soon as installed\n * fix(toolchain): improve logs when recovering from an interrupted installation\n * chore(deps): downgrade `openssl-src` to 300.5.4+3.5.4\n * style(download): clean up imports\n * fix(diskio): fall back to single-threaded unpacking when `ram_budget` \u003c 512MB to avoid OOM on memory-constrained systems\n * test(downloads): check if an error is thrown if the server does not honor range\n * fix(downloads): check correct response when resuming from partial (reqwest)\n * fix(downloads): check correct response when resuming from partial (curl)\n * fix(deps): update rust crate toml to v1\n * fix(dist/manifest): sort keys when serializing `Manifest`\n * hack(ci/linux): disable BuildKit when building local images\n * chore(ci): use more distinctive local image names\n * Upgrade rand to 0.10\n * Upgrade snapbox to 1\n * Upgrade to anstream 1\n * fix(downloads): adjust error message for partial files in network failures\n * test(downloads): ensure that partial files are not removed when network fails\n * feat(downloads): do not delete partial download when network fails\n * fix(downloads): substitute `DEK` alias for `DownloadError`\n * chore(deps): update aws-actions/configure-aws-credentials action to v6\n * cli: introduce semantic exit code constants for rustup check\n * Add missing Windows SDK instructions\n * Add winget instructions to MSVC install page\n * Remove nu-string-interpolation `$`\n * Replace $nu.home-path with ~\n * feat(cli/rustup-mode): add \"Exit status\" section to `rustup check --help`\n * Add common commands section in help text\n * fix(cli/rustup-mode): improve exit code of `rustup check`\n * refactor(test)!: pass status code directly to `SanitizedOutput`\n * Add powerpc64-unknown-linux-musl support\n * fix: add copy_file_symlink_to_source for self-installation\n * fix: preserve symlinks in copy_dir instead of following them\n * feat(cli/rustup-mode): add `doc --rustc-docs` to open rustdoc for Rust internals\n * Remove the mixed singular/plural phrasing as \"component(s)\" instead, use \"components\" or \"component\".\n   In the singular case also add the name of the component for more consistent messaging style with\n   other info! outputs about single components.\n * fix(cli/rustup-mode): `check` for self updates for `SelfUpdateMode::CheckOnly`\n * test: Add test for sequential multi-toolchain uninstall\n * fix: directory removal race condition in toolchain uninstall\n * test(cli_v2): test error when missing many components on install\n * fix(dist): adjust printed newlines in `components_missing_msg()`\n * unified nightly disclaimer wording/styling; preserved distinct messages per scenario\n * Upgrade to reqwest 0.13\n * change test name to match new terminology\n * rename file to match new terminology\n * change 'target triple' to 'target tuple'\n * fix(toolchain): forbid toolchain names starting with +\n * cli: add `doc --releases` to open release notes\n * chore(deps): update actions/upload-artifact action to v6\n * chore(deps): update actions/cache action to v5\n * dist: use more concise API in helper function\n * dist: inline more logic into helper function\n * dist: give helper function a more meaningful name\n * dist: move helper function closer to usage site\n * docs(dev-guide): mention snapshot updating in release process\n * fix(toolchain): avoid unwrapping when parsing a toolchain name\n * fix(toolchain): change regex to reject leading zeros in toolchain name\n * docs(changelog): update for v1.29.0 beta release\n * dist: bump `rustup` version to v1.29.0\n * docs(changelog): add missing link references\n * test(static-roots): use a more compact syntax for raw binaries\n * test(static-roots): return `Result` from `store_static_roots()`\n * download: statically bundle relevant trust anchors\n * Added xonsh support\n * refactor(dist/manifestation): remove redundant redeclarations\n * docs(dist/download): remove outdated note on concurrent download progress reporting\n * fix(dist/download): align `total_bytes` fields in progress reporting UI\n * fix: default to GNU host in Cygwin/MSYS/MinGW environments (#4221)\n * chore(config): remove redundant imports\n * fix(dist/manifestation): print \"downloading component\" only on `InstallEvents`\n * fix(utils): downgrade panic to warning in `delete_dir_contents_following_links()`\n * chore(deps): update actions/checkout action to v6\n * Prepare for mdbook 0.5 migration\n * dist: make installation asynchronous\n * dist: make installations 'static\n * dist: take ownership of Manifestation\n * dist: store owned temp::Context in Transaction\n * dist: store temp::Context in DownloadCfg\n * dist: align progress bar elements\n * dist: track progress during unpacking\n * utils: drop unused reader tracking\n * process: fix refresh rate for progress bars\n * process: reduce duplication in ProgressDrawTarget setup\n * Yield references from Manifest::short_name()\n * Move Component name helpers to Manifest\n * dist: simplify ComponentBinary construction\n * dist: hoist creation of io_executor some more\n * Move unpack_ram() from dist to diskio\n * dist: hoist Executor creation up\n * dist: inline effective RAM limit calculation\n * dist: hoist environment variable extraction\n * dist: use logging for missing parent warnings\n * dist: clarify dependency on unpack RAM budget\n * diskio: clarify dependency on I/O thread count\n * dist: transfer ownership of component values\n * dist: take ownership of existing Components\n * dist: take ownership of toolchain name in update()\n * dist: take ownership of manifest in update()\n * dist: derive trivial initialization for Update\n * dist: rename Update::build_update() to new()\n * dist: linearize for-loop in Update::build_update()\n * dist: inline single-use function\n * dist: inline trivial helper function\n * dist: inline single-use tranaction change helpers\n * dist: store specific config bit in Transaction\n * chore(config): migrate config .github/renovate.json\n * dist: attach manifest download functions to DownloadCfg\n * rustup: unhide top-level install/uninstall commands\n * dist: move update_from_dist() to DistOptions::install_into()\n * Be more consistent about aliases for different subcommands\n * test: add test for `rustup toolchain install --no-update`\n * feat(rustup-mode): add `no_update` flag to `rustup toolchain install`\n * cli: prepare DistOptions in advance\n * dist: inline trivial wrapper function\n * cli: inline single-use update_all_channels() helper\n * config: simplify update_all_channels()\n * dist: deduplicate DistOptions initialization\n * dist: avoid recomputing dist root URL\n * dist: simplify tracing instrumentation\n * install: take ownership in InstallMethod::install()\n * dist: move DistributableToolchain::install() up\n * dist: clarify when update_hash is available\n * cli: avoid dropped temporary\n * Take semver-compatible dependencies\n * dist: install while downloading\n * dist: store more context in ComponentBinary\n * dist: yield self when download is complete\n * dist: move URL alteration logic into DownloadCfg method\n * Apply suggestions from clippy 1.91\n * refactor(check): Consolidate use_colors checks\n * fix(check): Use Cargo's colors\n * refactor(check): Make calls more consistent\n * dist: drop another layer of abstraction\n * dist: store package directory once\n * dist: inline short single-use function\n * dist: discard unnecessary abstraction layer\n * chore(deps): update actions/upload-artifact action to v5\n * fix(cli/rustup-mode): add missing self-update in `rustup toolchain install`\n * refactor(cli/self-update): move `self_update()` to `SelfUpdateMode::update()`\n * refactor(cli/rustup-mode): pass self-update predicates into `self_update()`\n * refactor(cli/self-update): import `utils::ExitCode`\n * rustup: tweak update check output style\n * fix(list): Match show command's styling\n * test(list): Add UI test\n * fix(toolchain): Have 'list' match 'show's styling\n * refactor(toolchain): Order logic by display order\n * refactor(toolchain): Use string interpolation\n * test(toolchain): Show list's behavior\n * fix(update): Match 'cargo update's colors\n * refactor(update): Centralize style knowledge\n * test: Cover different show_channel_update cases\n * fix(check): Subject check to RUSTUP_TERM_COLOR\n * test(check): Show current style\n * fix: Use HEADER styling in 'rustup show'\n * chore: Update clap-cargo\n * test: Demonstrate show's behavior\n * test(process): Allow forcing color on\n * test(process): Ensure non-locked writes are stripped of ANSI escape codes\n * cli: update `uninstall_removes_source_from_rcs` to mirror `uninstall_doesnt_modify_rcs_with_no_modify_path`\n * cli: add tests for `rustup self uninstall --no-modify-path`\n * cli: add `rustup self uninstall --no-modify-path`\n * cli: add help text for `rustup self uninstall -y`\n * fix(cli/help): change indentation of discussions to 2 spaces\n * fix(cli/help): adjust help text for `rustup install`\n * feat(cli/help): add toolchain install tips to `rustup update`'s discussion\n * feat(cli/help): discuss `rustup toolchain install`\n * style: Remove wildcard imports\n * progress: modify progress bar's states to be column-aligned\n * installations: handle installation of components through progress bars\n * feat(cli): Add a sub-heading style for 'completion' Help Discussion\n * feat(cli): Have Help Discussions match rest of CLI Help\n * feat(cli): Add color to clap help/errors\n * refactor(cli): Switch help text to functions\n * cli: propagate ActiveSource from the top\n * cli: upgrade error events to ERROR level\n * cli: inline Cfg::active_rustc_version()\n * cli: extract display_version() from rustup main()\n * cli: inline Cfg::resolve_local_toolchain()\n * cli: inline Cfg::resolve_toolchain()\n * config: extract setting of toolchain override in rustup help mode\n * cli: avoid Cfg construction indirection\n * config: privatize some Cfg fields\n * config: drop trivial Cfg setters\n * Expand `RUSTUP_TOOLCHAIN_SOURCE`'s documentation\n * refactor(installation): extract installation of a component into a separate function\n * bin: clean up imports\n * cli: rename CLIError to CliError\n * config: rename OverrideDB to OverrideDb\n * dist: clean up unnecessary qualification\n * test: Replace trycmd with snapbox\n * chore: Update snapbox\n * Update the default Windows SDK version\n * refactor(log): Single source RUSTUP_TERM_COLOR\n * style: Encourage using existing imports\n * process: avoid fine-grained locking for logs\n * process: discard unnecessary layer of synchronization\n * process: inline TerminalInnerLocked\n * process: replace unsafe code with safe equivalent\n * process: extract color_choice() method\n * process: extract is_a_tty value\n * process: inline StreamSelector::is_a_tty()\n * process: inline TestWriterLock\n * Implement `RUSTUP_TOOLCHAIN_SOURCE` with new `Display` impl\n * Move `Display` impl to `to_reason()`\n * Rename `ActiveReason` to `ActiveSource`\n * dist: simplify DownloadStatus setup\n * dist: decentralize download status\n * dist: postpone creation of ComponentBinary values\n * dist: extract DownloadStatus type\n * dist: call DownloadTracker methods directly\n * dist: drop unnecessary Notifier layer\n * dist: replace PackageContext with DownloadCfg\n * refactor: Directly apply styling\n * refactor: Don't bother grabbing lock for tests\n * refactor: Replace termcolor with anstream\n * refactor: Move style building out of ColorableTerminal\n * refactor: Migrate to anstyle for color definitions\n * fix(www): removes www subdomain from all rust-lang.org urls\n * dist: move Notification into dist::download\n * notifications: remove unused Display impl\n * dist: move Notifier into DownloadCfg\n * cli: build Cfg earlier in setup mode\n * dist: reuse existing DownloadCfg in update_v1()\n * dist: move dist_root out of DownloadCfg\n * dist: drop unused Clone derives\n * dist: drop Copy derive from DownloadCfg\n * dist: move Notifier and DownloadTracker into dist::download\n * dist: inline DownloadCfg test setup\n * download: move File items down\n * download: extract DownloadCfg initialization from Cfg\n * config: discard pointless method argument\n * cli: rename DownloadTracker::new_with_display_progress() to new()\n * notifications: log directly from DownloadTracker\n * notifications: log directly on bad download checksums\n * notifications: log directly when reusing downloaded files\n * notifications: log directly on buffer size changes\n * Update platforms to 3.7.0\n * notifications: log directly on duplicate toolchain files\n * notifications: log directly on metadata upgrades that remove toolchains\n * notifications: log directly when reading metadata version\n * notifications: log directly when metadata upgrade is not needed\n * notifications: log directly when upgrading metadata version\n * notifications: log directly when uninstalling toolchains\n * notifications: log directly when toolchain is up to date\n * notifications: log directly when toolchain has been installed\n * notifications: log directly when installing toolchains\n * notifications: log the toolchain directory directly\n * notifications: log directly when using existing toolchains\n * notifications: log directly when looking for toolchains\n * notifications: log directly when setting auto-self-update mode\n * notifications: log directly when setting profile\n * notifications: log directly when setting overrides\n * notifications: use human-friendly log format for temp file deletions\n * notifications: use human-friendly log format for directory deletions\n * notifications: use human-friendly log format for retrying renames\n * notifications: use human-friendly log format for path canonicalization\n * cli: drop unnecessary generics\n * process: import instead of qualifying ColorableTerminal\n * process: hide internal structure\n * process: don't re-export external items\n * process: rename terminalsource to terminal_source\n * process: rename filesource to file_source\n * process: re-order items in terminalsource module\n * feat(cli/self-update): add support for PowerShell on Unix systems\n * refactor: Remove unused traits\n * refactor: Directly use ColorableTerminal\n * refactor: Simplify working with ColorableTerminal\n * fix(process): Ensure stdout/stderr lock is held across calls\n * refactor(process): Centralize Write bookkeeping\n * docs(changelog): describe default profile change during auto-install\n * Fix typo in clitools.rs comment\n * ci(docs): fix local doc branch name\n * Move the default branch from `master` to `main`\n * Upgrade opentelemetry dependencies\n * ci: use macOS Intel runners\n * notifications: log directly when setting the default toolchain\n * notifications: log directly when setting auto install mode\n * notifications: log directly when resuming partial downloads\n * notifications: log directly when downloading files\n * notifications: log directly when removing stray hash files\n * notifications: log directly when skipping components\n * notifications: log directly on missing components\n * notifications: log directly when downloading legacy manifests\n * notifications: log directly for downloaded manifests\n * notifications: log directly for manifest downloads\n * notifications: log directly when removing components\n * notifications: log directly when installing components\n * notifications: log directly after failing to determine memory limit\n * notifications: log directly when hash file not found\n * notifications: log directly when failing to update hash file\n * notifications: log directly when component is already installed\n * notifications: log directly for valid checksums\n * notifications: log directly when using download backends\n * chore: avoid trailing whitespace in error message\n * refactor: Switch logging to anstyle\n * refactor: Remove unused ColorableTerminal::carriage_return\n * notifications: privatize Notification type\n * notifications: log directly on creating temp files\n * notifications: log directly on temp root creation\n * notifications: log directly on file deletions\n * notifications: log directly on directory deletions\n * notifications: log directly about non-fatal errors\n * notifications: log directly about rolling back changes\n * notifications: log directly for retrying renames\n * notifications: log directly when removing directories\n * notifications: log directly when copying directories\n * notifications: log directly when linking directories\n * notifications: log directly when path canonicalization fails\n * notifications: log directly when creating directories\n * tests: use DistContext for dist::components tests\n * tests: move DistContext into library\n * tests: deduplicate distribution installation tests\n * notifications: tweak style\n * Inline utils Notification variants into top-level Notification\n * Inline dist Notification variants into top-level Notification\n * Inline dist::temp::Notification variants into top-level Notification\n * dist: remove temp::Notification variant from dist::Notification\n * dist: extract URL alteration from download() method\n * dist: detach download_component() from Manifestation\n * dist: introduce ComponentBinary type\n * dist: avoid passing through arguments\n * dist: avoid unnecessary type annotations\n * dist: avoid cloning components Vec\n * refactor: remove redundant references\n * dist: simpify casting to trait object\n * dist: deduplicate decompression setup code\n * cli: move more self update logic into self_update module\n * refactor(dist/manifestation): remove redundant `.to_string()`\n * Remove unneeded paranthesees\n * Fix link in the bug reporting template\n * ci(all-features/windows): update `OPENSSL_LIB_DIR` for OpenSSL v3 compatibility\n * docs(dev-guide): improve suggestion for overriding arg0\n * docs(dev-guide): mention the arg0 override trick on welcome page\n * docs(README): link CI status badge to GitHub Actions panel\n * feat(dist/manifestation): adjust default concurrent downloads when installing toolchains\n * feat(cli/rustup-mode): check updates for all channels unless `RUSTUP_CONCURRENT_DOWNLOADS` is set to 1\n * refactor: rename `num_channels` to `concurrent_downloads`\n * fix: fix hang by preventing `stream.buffered(0)` in concurrent downloads\n * test(dist/manifestation): extract `TestContext::*with_env()`\n * refactor(download): use `NonZero` instead of `NonZeroU64`\n * refactor(process): remove redundant `.context()` in `Process::concurrent_downloads()`\n * chore(deps/renovate): group version bumps for `windows-rs` crates\n * Upgrade windows crates\n * fix(cli/rustup_mode): use ASCII-compatible spinner\n * chore(deps): update aws-actions/configure-aws-credentials action to v5\n * feat(install): warn if default linker (cc) is missing; add respective test case\n * Remove hardcoded dependency to the master branch\n * feat(downloads): delay the reappearance of the progress bar when retrying a download\n * fix(downloads): correct faulty behavior when a download fails\n * fix(downloads): correct faulty output when retrying a download\n * feat(self_update): add tcsh shell support to cli #3413\n * Replace non_empty_env_var() with Process::var_opt()\n * fix(downloads): report real elapsed time of a component downloads instead of cumulative\n * Treat empty environment variables as unset\n * fix(downloads): honor the RUSTUP_CONCURRENT_DOWNLOADS by always having \"n\" concurrent downloads\n * chore(deps): disable default features for zstd\n * feat(downloads): introduce `RUSTUP_CONCURRENT_DOWNLOADS` to control concurrency\n * ci(check): make installation of `taplo-cli` faster\n * fix(notifications): delete unnecessary Download(Pop/Push)Unit notifications\n * fix(downloads): extract closure for downloading a component into a separate function\n * feat(downloads): concurrently download components\n * fix(downloads): add a comment to justify the unwrap on `.get()` of `OnceLock`\n * chore(deps): update actions/checkout action to v5\n * fix(download_timeout): introduce RUSTUP_DOWNLOAD_TIMEOUT for overriding download timeout\n * fix(downloads): substitute the LazyLock for a OnceLock\n * feat(rustup_mode): revise help message\n * feat: improve error message for `rustup which`\n * test: detach snapshots from component installation order\n * feat(download_tracker): refactor in favor of `indicatif`\n * feat(process): create a `ProgressDrawTarget` (for `indicatif`) inside the `Process`\n * fix(rustup-init/sh): avoid `hw.optional.*: 1` stdout in macOS arch check\n * hack(cli/common): suppress host emulation warnings in rustup's own CI\n * fix(test/clitools): pass `RUSTUP_CI` to in-process tests\n * ci(macos): run x64 workflows with Rosetta 2\n * docs(user-guide/environment-variables): clarify the unit of `RUSTUP_UNPACK_RAM`\n * docs(user-guide/environment-variables): unify description style\n * docs(user-guide/environment-variables): update description of `RUSTUP_IO_THREADS`\n * Limit Tokio worker threads to I/O thread count\n * Use manual Tokio runtime setup\n * Attach io_thread_count() to Process\n * Always consider RUSTUP_IO_THREADS as input for thread count\n * utils: express io_thread_count() in a simpler way\n * opt(err): show renaming file error source\n * Set a maximum thread limit for remove_dir_all\n * fix(toolchain/distributable): refine handling of known targets with no prebuilt artifacts\n * fix(ci/fetch-rust-docker): update comments\n * fix(ci/docker): update `CC` name for `powerpc64le-unknown-linux-gnu`\n * Extract self_update() from update_all_channels()\n * Show channel updates even if self update is not permitted\n * Remove Cargo feature indirection\n * Move Cfg::get_self_update_mode() to SelfUpdateMode::from_cfg()\n * Replace trivial enum with bool\n * feat(updates): introduce `RUSTUP_TERM_WIDTH` to override terminal width\n * feat(updates): introduce `RUSTUP_TERM_PROGRESS_WHEN` to toggle the progress bars\n * Limit the default number of I/O threads\n * Bump `toml` to 0.9\n * feat(updates): check for updates concurrently\n * feat(terminal): implement the `TermLike` trait for `ColorableTerminal`\n * chore: use match ergonomics in favor of explicit `ref`s\n * refactor(download/curl): use early returns in `download()`\n * chore(cli/rustup_mode): merge `std` imports\n * chore(cli/rustup-mode): import `std::io`\n * chore: fix new `clippy` warnings\n * fix(ci/run): specify target triple for `bindgen-cli` installation\n * feat(www): improve \"copy\" button style compatibility with Chromium\n * ci(run): install `codegen-cli` with `cargo-binstall`\n * docs: replace Discord links\n * Block broken snap curl\n * Upgrade to windows-sys 0.60\n * Emphasize that `llvm-tools` dist component is not subject to compiler stability guarantees\n * docs(README): update CI status badge\n * Fix rustup-init.sh cputype check for sparcv9\n * add Solaris support\n * test(clitools)!: remove all deprecated `.expect_*()` APIs\n * test(clitools)!: privatize `Config::run()`\n * test: migrate remaining uses of `.run()` to `.expect()` APIs\n * test(clitools): extract `Assert::redact()`\n * test: simplify `.display().to_string()` in `.extend_redactions()`\n * test(cli_misc): bring back missing assertions\n * Update help.rs: bash completions instructions (#1)\n * docs(user-guide): fix typo\n * docs(dev-guide): update the section on `clippy` lints\n * docs(dev-guide): mention test helpers and `Assert`\n * docs(test/clitools): add docs for `Assert`\n * Upgrade to rustls-platform-verifier 0.6\n * test(cli-v2): migrate to `.expect()` APIs\n * test(cli-misc): migrate to `.expect()` APIs\n * fix(toolchain): fix proxy fallback notification format on Windows\n * test(cli-v1): migrate to `.expect()` APIs\n * test(download): serialize tests with proxy-sensitive URLs\n * test(cli-rustup): migrate to `.expect()` APIs\n * test(clitool): add `Assert::remove_redactions()`\n * test(clitools): allow `OsStr`-like args in `Config::expect*()`\n * Fix CI image names for downloading ARM and PowerPC artifacts\n * Update platforms to 3.6\n * test(cli-exact): migrate to `.expect()` APIs\n * Avoid swallowing errors in show()\n * Simplify target processing logic\n * Inline returned bindings\n * Increase Windows main thread stack size to 2mb\n * test(cli-inst-interactive): migrate to `.expect()` APIs\n * Unset RUSTUP_AUTO_INSTALL for tests\n * test(cli-paths): migrate to `.expect()` APIs\n * test(cli-exact): use the new `[CURRENT_VERSION]` redaction\n * test(cli-self-upd): migrate to `.expect()` APIs\n * Tweak list_items() docstring\n * Leverage bool::then_some() to simplify some code\n * Avoid intermediate allocation in listing\n * test(custom-toolchains): `target list` now can display the installed targets\n * feat(custom-toolchains): `target` and `component list` working on custom toolchains\n * Skip manifest loading if there are no components/targets to check\n * fix(deps): update rust crate opener to 0.8.0\n * rustup check: set exit status based on available updates\n * rustup check: adopt no-self-update logic\n * feat(self_update): add proxy sanity checks\n * style(test): qualify uses of `snapbox::str![]`\n * refactor(test): migrate some tests to `.expect()` APIs\n * chore(test): deprecated old APIs overlapping with the new ones\n * refactor(test): add new `.expect()`-based testing APIs\n * test(custom-toolchains): using `show` on a custom toolchain without a `components` file\n * test(custom-toolchains): add test to showcase that the issue was solved\n * feat(custom-toolchains): `rustup show` now reporting installed targets\n * tests: print diffs on test failures\n * Log versions during self updates\n * Fix cargo lints on Windows\n * toolchain: hoist binary name conditionals out of fallback functions\n * refactor(test): replace `TempDir::into_path()` with `TempDir::keep()`\n * refactor(test/clitools): use globally-defined `tempdir_in_with_prefix()`\n * feat(toolchain): notify the user when proxy fallback is activated\n * feat(toolchain): consider external `rust-analyzer` when calling a proxy\n * refactor(toolchain): move predicates into `Toolchain::maybe_do_cargo_fallback()`\n * refactor(toolchain): privatize `Toolchain::maybe_do_cargo_fallback()`\n * deps: update aws-lc-rs to 1.13.1\n * docs(changelog): mirror changes from the release announcement, take 2\n * Deprecate native-tls as well\n * Enable HTTP/2 support for reqwest download backend\n * Emit tracing events from log facade calls\n * download: show Debug representation for errors\n * Avoid repeated globals in tracing events\n * Log original download errors immediately\n * feat(cli/rustup-mode): add aliases to `rustup component remove`\n * Switch flate2 to use the zlib-rs backend\n * Hardlink proxies if symlinks aren't reachable\n * Add powerpc64le-unknown-linux-musl support\n * Add toolchain_name to not installed bail msg\n * Warn about using curl\n * Drop workspace indirection\n * Fold download crate back into rustup\n * download: merge integration test files\n * Test CARGO environment replacement\n * Update CARGO env var if it is a rustup proxy\n * Tweak toolchain subcommand help text\n * Move toolchain and default commands first\n * show toolchain paths in rustup show -v output\n * refactor(cli/self-update): save allocations in `Nu::rcfiles()`\n * fix(cli/self-update)!: stop appending to `env.nu` due to deprecation\n * fix(cli/self-update): consider Windows paths in Nushell suggestions\n * refactor(cli/self-update): use `path add` in `env.nu` template\n * fix(cli/self-update): use interpolated string in `env.nu` template\n * Upgrade dependencies\n * docs(user-guide/environment-variables): document `RUSTUP_VERSION`\n * feat(rustup-init/sh): allow setting `RUSTUP_VERSION` during installation\n * feat(cli/self-update): allow setting `RUSTUP_VERSION` for arbitrary\n downgrades\n * feat(test/clitools): add `Config::expect_ok_ex_env()`\n * fix(errors)!: improve error messages for `RustupError::ToolchainNotInstalled`\n * Add set auto-install disable\n * Use `cursor: pointer` for copy button on website\n * fix(dist): refine suggestions about missing targets\n * Append Windows bin directory to PATH by default\n * Remove validation for custom toolchains when reading rust-toolchain.toml\n * document RUSTUP_AUTO_INSTALL\n * Fix build script `cargo` instructions\n","status":"published","published":"2026-10-02T19:31:21Z","modified":"2026-10-03T17:00:03.791677441Z","updated_at":"2026-11-02T16:58:42.426393Z"}]},"sources_more":{"osv":21}}