fesco/tickets
13
2
Fork 1
Code Issues 19 Pull requests Activity

(Slightly) incompatible update request (one-off) for rust-routinator #3635

New issue
Closed
opened 2026-07-08 09:32:41 +00:00 by salimma · 10 comments
salimma commented 2026-07-08 09:32:41 +00:00
Owner
Copy link

Incompatible update request - the breaking change in 0.15.0 drops an off-by-default option that kept introducing CVEs over a few releases, but the update we really are concerned is 0.15.2 which patches 4 CVEs that upstream considers high-severity (CVSS-B between 8.2 and 8.7)

Discussion in https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/IRWQV62AYDIX2JUWO4HQMC4V6POP5UJK/

Incompatible update request - the breaking change in 0.15.0 drops an off-by-default option that kept introducing CVEs over a few releases, but the update we really are concerned is 0.15.2 which patches 4 CVEs that upstream considers high-severity (CVSS-B between 8.2 and 8.7) Discussion in https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/IRWQV62AYDIX2JUWO4HQMC4V6POP5UJK/
gotmax23 commented 2026-07-08 15:38:45 +00:00
Owner
Copy link

+1

+1
kevin commented 2026-07-09 17:45:29 +00:00
Owner
Copy link

I assume this is a one-time request? if so, +1

I assume this is a one-time request? if so, +1
zbyszek commented 2026-07-11 13:03:42 +00:00
Owner
Copy link

+1

+1
decathorpe commented 2026-07-11 17:43:20 +00:00
Owner
Copy link

+1

+1
ngompa commented 2026-07-14 11:43:56 +00:00
Owner
Copy link

+1

+1
zbyszek commented 2026-07-15 21:35:47 +00:00
Owner
Copy link

After a week: APPROVED (+5, 0, 0)

EDIT(decathorpe): Corrected count from +4 to +5.

After a week: APPROVED (+5, 0, 0) EDIT(decathorpe): Corrected count from +4 to +5.
salimma commented 2026-07-21 19:49:42 +00:00
Author
Owner
Copy link

Thanks! I did not see this announced in the meeting agenda, so I'll reply to my proposal in devel@ once the updates are stable

Thanks! I did not see this announced in the meeting agenda, so I'll reply to my proposal in devel@ once the updates are stable
zbyszek commented 2026-07-22 10:18:31 +00:00
Owner
Copy link

Oh, indeed, I missed this and it wasn't added to the agenda announcement. Let's leave it tagged so it is announced next week. Either way, it is approved once the vote has ended.

Oh, indeed, I missed this and it wasn't added to the agenda announcement. Let's leave it tagged so it is announced next week. Either way, it is approved once the vote has ended.
salimma commented 2026-07-27 20:40:58 +00:00
Author
Owner
Copy link

Yeah, I'll announce it in a bit, thanks

Also posted an update to the devel thread https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/K4RZFKNUON5OU567UWWLYCEB3BE667YY/

Yeah, I'll announce it in a bit, thanks Also posted an update to the devel thread https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/K4RZFKNUON5OU567UWWLYCEB3BE667YY/
salimma commented 2026-07-27 21:47:53 +00:00
Author
Owner
Copy link

Announced in https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/VITMVS5FIC5DWASVG42T2AZ6KWV2DKYZ/

Announced in https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/VITMVS5FIC5DWASVG42T2AZ6KWV2DKYZ/
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
document it
A new policy/recommendation needs to be documented

  
fast track
A swift resolution is critical, +7,-0 immediately approves the ticket

  
meeting
This ticket will be on the meting agenda

  
next release
The Change was postponed to next release

  
nonresponsive maintainer
Tickets about nonresponsive maintainers

  
packager revocation
Tickets about revoking packager privileges

  
pending announcement
Approved/rejected tickets to be announced alongside the next meeting agenda

  
provenpackager
A request to become a provenpackager

  
python 2 exception
An exception request to continue to use Python 2 in Fedora 32+

  
self contained change
Tickets with Self Contained Change proposals

  
stalled
Tickets that are stalled, FESCo won't regularly triage them

  
Status
Accepted
 Ticket contains a proposal that was accepted

  
Status
Duplicate
 Ticket rejected for being a duplicate

  
Status
Insufficient data
 Ticket rejected due to insufficient information being available

  
Status
Invalid
 Ticket rejected due to being invalid or misfiled

  
Status
Rejected
 Ticket contains a proposal that was rejected

  
system wide change
Tickets with System Wide Change proposals

  
updates policy exception
Tickets for exceptions from the Updates Policy

  
vote-in-progress
Vote is currently in progress in the ticket

No labels
document it
fast track
meeting
next release
nonresponsive maintainer
packager revocation
pending announcement
provenpackager
python 2 exception
self contained change
stalled
Status
Accepted
Status
Duplicate
Status
Insufficient data
Status
Invalid
Status
Rejected
system wide change
updates policy exception
vote-in-progress
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
6 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
fesco/tickets#3635
No description provided.