koji: recent builds

building: firefox-128.13.0-1.oc9.ap.2, target: dist-oc9

complete: postgresql16-16.16-1.oc9, target: dist-oc9-epol

Fri, 13 Nov 2026 17:14:22 CST

* Fri Nov 13 2026 PkgAgent Robot  - 16.16-1
- [Type] security
- [DESC] Update to 16.16 (fixes CVE-2026-116303, CVE-2026-116304, CVE-2026-116306, CVE-2026-116307, CVE-2026-116308, CVE-2026-116309, CVE-2026-116311, CVE-2026-116312, CVE-2026-116314, CVE-2026-116315, CVE-2026-116316, CVE-2026-116317, CVE-2026-116319, CVE-2026-116320, CVE-2026-116321, CVE-2026-116323, CVE-2026-116326, CVE-2026-116327, CVE-2026-116328, CVE-2026-116330, CVE-2026-116331, CVE-2026-116332, CVE-2026-116335, CVE-2026-116336, CVE-2026-120139, CVE-2026-120141, CVE-2026-120143, CVE-2026-120145, CVE-2026-120146, CVE-2026-120147, CVE-2026-120148, CVE-2026-120149, CVE-2026-120150, CVE-2026-120151, CVE-2026-120152, CVE-2026-120153, CVE-2026-120154, CVE-2026-14661, CVE-2026-16237, CVE-2026-16240, CVE-2026-18447, CVE-2026-6460, CVE-2026-6464, CVE-2026-6467)

* Mon Aug 17 2026 PkgAgent Robot  - 16.15-1
- [Type] security
- [DESC] Update to 16.15 (fixes CVE-2026-14668, CVE-2026-14666, CVE-2026-14664, CVE-2026-14662, CVE-2026-15742, CVE-2026-14671, CVE-2026-6471, CVE-2026-19385, CVE-2026-16239, CVE-2026-15741, CVE-2026-14680, CVE-2026-14677, CVE-2026-14670, CVE-2026-14669)

* Wed Feb 25 2026 Wang Guodong  - 16.12-1
- Upgrade to version 16.12
- fix CVE-2026-2003, CVE-2026-2004, CVE-2026-2005, CVE-2026-2006

complete: libgxps-0.3.2-8.oc9, target: dist-oc9

Fri, 13 Nov 2026 17:14:13 CST

* Fri Nov 13 2026 PkgAgent Robot  - 0.3.2-8
- [Type] security
- [DESC] Fix CVE-2026-111132: heap OOB read in PolyBezier/PolyQuadratic Points parsing

* Thu Sep 26 2024 OpenCloudOS Release Engineering  - 0.3.2-7
- Rebuilt for clarifying the packages requirement in BaseOS and AppStream

* Fri Aug 16 2024 OpenCloudOS Release Engineering  - 0.3.2-6
- Rebuilt for loongarch release

complete: podman-5.8.4-4.oc9, target: dist-oc9-epol

Fri, 13 Nov 2026 17:11:59 CST

* Wed Nov 11 2026 PkgAgent Robot  - 5.8.4-4
- [Type] security
- [DESC] Fix CVE-2026-123876: mask upper bits in seccomp socket deny rules

* Mon Nov 02 2026 clarehkli  - 5.8.4-3
- [Type] security
- [DESC] bundle klauspost/compress 1.20.2 to fix CVE-2026-116591

* Tue Oct 27 2026 PkgAgent Robot  - 5.8.4-2
- [Type] security
- [DESC] rebuild for CVE-2026-111943

complete: cri-o-1.33.0-4.oc9, target: dist-oc9-epol

Fri, 13 Nov 2026 17:09:42 CST

* Wed Nov 11 2026 PkgAgent Robot  - 1.33.0-4
- [Type] security
- [DESC] Backport seccomp socket deny rule masking to fix CVE-2026-123876

* Tue Nov 03 2026 clarehkli  - 1.33.0-3
- [Type] security
- [DESC] bundled klauspost/compress 1.20.2 and go-jose/go-jose/v4 4.1.6 
         to fix CVE-2026-116591 and CVE-2026-116587

* Wed Jun 04 2025 bbrucezhang  - 1.33.0-2
- Rebuilt for loongarch64

complete: java-1.8.0-openjdk-portable-1.8.0.512.b09-1.0.el8, target: dist-oc8-dependency

Fri, 13 Nov 2026 17:06:50 CST

* Thu Nov 12 2026 Release Engineering  - 1.8.0.512.b09-1.0
- Build for Rocky Linux %{rocky}

* Wed Nov 04 2026 Thomas Fitzsimmons  - 1:1.8.0.512.b09-1.0
- Add check for compromised eMudhra certificates in cacerts
- Resolves: OPENJDK-5273

* Wed Nov 04 2026 Andrew Hughes  - 1:1.8.0.512.b09-1.0
- Update to 8u512-b09 (GA).
- Update release notes for 8u512-b09.
- Drop JDK-8186464/RH1433262 patch which is now finally upstream.
- Sync NEWS file with vanilla branch
- Resolves: OPENJDK-5170

complete: libva-2.20.0-4.oc9, target: dist-oc9

Fri, 13 Nov 2026 17:01:07 CST

* Fri Nov 13 2026 PkgAgent Robot  - 2.20.0-4
- [Type] security
- [DESC] Fix CVE-2026-56438: use secure_getenv instead of getenv in va_x11.c

* Thu Sep 26 2024 OpenCloudOS Release Engineering  - 2.20.0-3
- Rebuilt for clarifying the packages requirement in BaseOS and AppStream

* Fri Aug 16 2024 OpenCloudOS Release Engineering  - 2.20.0-2
- Rebuilt for loongarch release

complete: dotnet8.0-8.0.134-1.oc8, target: dist-oc8-dotnet

Fri, 13 Nov 2026 16:58:50 CST

* Sat Nov 07 2026 Tom Deseyn  - 8.0.134-1
- Update to .NET SDK 8.0.134 and Runtime 8.0.34
- Resolves: RHEL-302533

* Mon Oct 26 2026 Omair Majid  - 8.0.133-1
- Update to .NET SDK 8.0.133 and Runtime 8.0.33
- Resolves: -RHEL-291714

* Wed Oct 14 2026 Tom Deseyn  - 8.0.132-2
- Update to .NET SDK 8.0.132 and Runtime 8.0.32
- Resolves: RHEL-277790

complete: dotnet9.0-9.0.124-1.oc8, target: dist-oc8

Fri, 13 Nov 2026 16:01:07 CST

* Fri Nov 06 2026 Tom Deseyn  - 9.0.124-1
- Update to .NET SDK 9.0.124 and Runtime 9.0.23
- Resolves: RHEL-302540

* Mon Oct 26 2026 Omair Majid  - 9.0.123-1
- Update to .NET SDK 9.0.123 and Runtime 9.0.22
- Resolves: RHEL-291723

* Wed Oct 14 2026 Tom Deseyn  - 9.0.122-2
- Update to .NET SDK 9.0.122 and Runtime 9.0.21
- Resolves: RHEL-277797

complete: mingw-libpng-1.6.34-3.oc8, target: dist-oc8

Fri, 13 Nov 2026 15:55:19 CST

* Tue Jul 07 2026 RHEL Packaging Agent  - 1.6.34-3
- Fix CVE-2026-33416: use-after-free on png_ptr->trans_alpha and
  png_ptr->palette
- Resolves: RHEL-161347

* Tue Mar 10 2026 Lili Zhu  - 1.6.34-2
- Fix the following CVEs
  CVE-2026-22695 CVE-2026-22801 CVE-2026-25646
- Resolves: RHEL-148855
- Resolves: RHEL-146662
- Resolves: RHEL-148341

* Sat Dec 27 2025 Lili Zhu  - 1.6.34-1
- Rebase to version 1.6.34
- Fix the following CVEs
  CVE-2025-64720 CVE-2025-65018 CVE-2025-66293
- Resolves: RHEL-131458
- Resolves: RHEL-131471
- Resolves: RHEL-133229

complete: dotnet11.0-11.0.100-1.oc8, target: dist-oc8

Fri, 13 Nov 2026 15:53:49 CST

* Fri Nov 06 2026 Tom Deseyn  - 11.0.100-1
- Update to .NET SDK 11.0.100 and Runtime 11.0.0
- Resolves: RHEL-302526

* Tue Oct 27 2026 Omair Majid  - 11.0.100~rc.3.26522.148-0.12
- Update to .NET SDK 11.0.100-rc.3.26522.148 and Runtime 11.0.0-rc.3.26522.148
- Resolves: RHEL-292372

* Wed Oct 14 2026 Omair Majid  - 11.0.100~rc.2.26504.105-0.11
- Update to .NET SDK 11.0.100-rc.2.26504.105 and Runtime 11.0.0-rc.2.26504.105
- Resolves: RHEL-276919

complete: perl-DBI-1.641-5.oc8, target: dist-oc8

Fri, 13 Nov 2026 15:51:49 CST

* Mon Nov 02 2026 RHEL Packaging Agent  - 1.641-5
- CVE-2026-78030 perl-DBI: DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM
  Resolves: RHEL-277689

* Mon Sep 28 2026 RHEL Packaging Agent  - 1.641-4
- CVE-2026-88815 perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting
  Resolves: RHEL-271960

* Wed Sep 09 2026 RHEL Packaging Agent  - 1.641-3
- Force placeholder limit on :N and :pN placeholders (CVE-2026-73194)
  Resolves: RHEL-247320

complete: json-glib-1.8.0-4.oc9, target: dist-oc9

Fri, 13 Nov 2026 15:09:18 CST

* Thu Nov 12 2026 PkgAgent Robot  - 1.8.0-4
- [Type] security
- [DESC] Fix CVE-2026-120194: infinite loop in json_path_query() with negative JSONPath slice step

* Thu Sep 26 2024 OpenCloudOS Release Engineering  - 1.8.0-3
- Rebuilt for clarifying the packages requirement in BaseOS and AppStream

* Fri Aug 16 2024 OpenCloudOS Release Engineering  - 1.8.0-2
- Rebuilt for loongarch release

complete: gstreamer1-1.16.1-3.oc8, target: dist-oc8

Fri, 13 Nov 2026 14:31:28 CST

* Tue Nov 10 2026 RHEL Packaging Agent  - 1.16.1-3
- CVE-2026-125704 gstreamer1: gstreamer: Use-after-free in GStreamer core buffer value deserialization
- Resolves: RHEL-304207

* Mon Nov 18 2019 Tomas Pelka  - 1.16.1-2
- Update to 1.16.2 for correctly pick up for side gating
- Resolves: rhbz#1756299

* Tue Nov 12 2019 Wim Taymans  - 1.16.1-1
- Update to 1.16.1
- Enable libcap for the ptp helper permissions
- Resolves: rhbz#1756299

complete: grafana-9.2.10-38.oc8, target: dist-oc8

Fri, 13 Nov 2026 13:34:27 CST

* Sun Nov 01 2026 RHEL Packaging Agent  - 9.2.10-38
- CVE-2026-17183 grafana: Grafana: Information disclosure vulnerability in Unified Alerting
- Resolves RHEL-291857

* Sun Nov 01 2026 RHEL Packaging Agent  - 9.2.10-37
- CVE-2026-116591 grafana: klauspost/compress: Denial of Service via crafted zstd compressed input
- Resolves RHEL-298352

* Wed Oct 21 2026 RHEL Packaging Agent  - 9.2.10-36
- Rebuild against updated golang
- Resolves RHEL-287629
- Resolves RHEL-279255
- Resolves RHEL-278945
- Resolves RHEL-278602

complete: grafana-pcp-5.1.1-20.oc8, target: dist-oc8

Fri, 13 Nov 2026 13:15:45 CST

* Sun Nov 01 2026 RHEL Packaging Agent  - 5.1.1-20
- CVE-2026-116591 grafana-pcp: klauspost/compress: Denial of Service via crafted zstd compressed input
- Resolves RHEL-298346

* Wed Oct 21 2026 RHEL Packaging Agent  - 5.1.1-19
- Rebuild against updated golang
- Resolves RHEL-287631
- Resolves RHEL-279256
- Resolves RHEL-278603

* Wed Sep 02 2026 RHEL Packaging Agent  - 5.1.1-18
- Rebuild against updated golang
- Resolves RHEL-241670
- Resolves RHEL-242385
- Resolves RHEL-242345
- Resolves RHEL-242223

complete: graphite2-1.3.14-7.oc9, target: dist-oc9

Fri, 13 Nov 2026 12:43:49 CST

* Tue Nov 10 2026 PkgAgent Robot  - 1.3.14-7
- [Type] security
- [DESC] Fix CVE-2026-124896 by backporting Mozilla SlotMap end-sentinel fix

* Thu Sep 26 2024 OpenCloudOS Release Engineering  - 1.3.14-6
- Rebuilt for clarifying the packages requirement in BaseOS and AppStream

* Fri Aug 16 2024 OpenCloudOS Release Engineering  - 1.3.14-5
- Rebuilt for loongarch release

complete: buildah-1.43.2-4.oc9, target: dist-oc9

Fri, 13 Nov 2026 12:03:29 CST

* Thu Nov 12 2026 PkgAgent Robot  - 1.43.2-4
- [Type] security
- [DESC] Fix CVE-2026-123876: mask upper bits in vendored common socket deny rules

* Mon Nov 02 2026 PkgAgent Robot  - 1.43.2-3
- [Type] security
- [DESC] Fix CVE-2026-116591 (bundled klauspost/compress 1.18.0 -> 1.20.2)

* Tue Oct 27 2026 PkgAgent Robot  - 1.43.2-2
- [Type] security
- [DESC] Rebuild for CVE-2026-111943

complete: gstreamer1-plugins-base-1.16.1-8.oc8, target: dist-oc8

Fri, 13 Nov 2026 11:40:38 CST

* Tue Nov 10 2026 RHEL Packaging Agent  - 1.16.1-8
- CVE-2026-125712 gstreamer1-plugins-base: gst-plugins-base: Missing bounds checks in RTCP SDES packet parsing
  Resolves: RHEL-304269

* Wed Sep 09 2026 RHEL Packaging Agent  - 1.16.1-7
- Add patch for CVE-2026-85150
  Resolves: RHEL-253741

* Tue Aug 25 2026 RHEL Packaging Agent  - 1.16.1-6.1
- Add patch for CVE-2026-18297
  Resolves: RHEL-246576

complete: containers-common-1-8.oc9, target: dist-oc9

Fri, 13 Nov 2026 11:26:58 CST

* Thu Nov 12 2026 PkgAgent Robot  - 1-8
- [Type] security
- [DESC] Fix CVE-2026-123876: mask upper bits in socket deny rules for NETLINK_AUDIT in shipped seccomp.json

* Thu Sep 26 2024 OpenCloudOS Release Engineering  - 1-7
- Rebuilt for clarifying the packages requirement in BaseOS and AppStream

* Fri Aug 16 2024 OpenCloudOS Release Engineering  - 1-6
- Rebuilt for loongarch release