All pull requests

Pull requests

• SECURITY: openssl 4.1.0 + openssl-3.5 compat (OpenSSL 3.6 support ends 2026-11-01)

  #1140·bryan-minimal opened Oct 28, 2026Member·

  ·
  1

• Update icu to 79.1

  #1139·bryan-minimal opened Oct 28, 2026Member·

  ·
  1

• Update jdk-25 to 25.0.5

  #1138·bryan-minimal opened Oct 27, 2026Member·

  ·
  1

• Update jdk-21 to 21.0.13

  #1137·bryan-minimal opened Oct 27, 2026Member·

  ·
  1

• node-24: the Node.js 24 line as a versioned package (maintenance until 2028-04-30)

  #1136·bryan-minimal opened Oct 27, 2026Member·

  ·
  1

• httpie: trust the system CA store by default (certifi.where)

  #1135·bryan-minimal opened Oct 27, 2026Member·

  ·
  1

• bun: trust the system CA store instead of the compiled-in roots

  #1134·bryan-minimal opened Oct 27, 2026Member·

  ·
  3

• node, node-lts: trust the system CA store by default (--openssl-use-def-ca-store)

  #1133·bryan-minimal opened Oct 27, 2026Member·

  ·
  1

• charon: fail the build if a TLS stack is compiled in (CVE-2026-111943)

  #1132·bryan-minimal opened Oct 27, 2026Member·

  ·
  1

• prek, tealdeer: trust the system CA store by default

  #1131·bryan-minimal opened Oct 27, 2026Member·

  ·
  1

• uv: ship /etc/uv/uv.toml with system-certs = true (trust the system CA store)

  #1130·bryan-minimal opened Oct 27, 2026Member·

  ·
  1

• async-profiler: pkgscan allowlist for upstream's committed JfrSync.class (4.6)

  #1129·bryan-minimal opened Oct 27, 2026Member·

  ·
  1

• atuin: pkgscan allowlist for its launchd service backend (18.24.2)

  #1128·bryan-minimal opened Oct 27, 2026Member·

  ·
  3

• SECURITY: varlock: distrust emSign G3 (CVE-2026-111943)

  #1117·bryan-minimal opened Oct 26, 2026Member·

  ·
  1

• SECURITY: dotenvx: distrust emSign G3 (CVE-2026-111943)

  #1116·bryan-minimal opened Oct 26, 2026Member·

  ·
  1

• SECURITY: actions-runner: distrust emSign G3 (CVE-2026-111943)

  #1115·bryan-minimal opened Oct 26, 2026Member·

  ·
  1

• SECURITY: agent-browser, mermaid-cli: distrust emSign G3 (CVE-2026-111943)

  #1114·bryan-minimal opened Oct 26, 2026Member·

  ·
  1

• CODEOWNERS: pkgscan-allow.toml entries need the security owner

  #1113·bryan-minimal opened Oct 26, 2026Member·

  ·
  1

• patchelf: move from master snapshot b49de1b to the 0.19.2 tag

  #1112·bryan-minimal opened Oct 26, 2026Member·

  ·
  1

• AGENTS.md: call each CA distrust a response

  #1111·bryan-minimal opened Oct 26, 2026Member·

  ·
  1

• ffmpeg: drop libfdk-aac/nonfree (redistributable GPL build); edgedelta closed_source; cite terms

  #1110·bryan-minimal opened Oct 26, 2026Member·

  ·
  1

• ci: source-hash-guard fails a Source url that moved while its sha256 stayed (#1003)

  #1106·bryan-minimal opened Oct 26, 2026Member·

  ·
  5

• SECURITY: uv: zstd RUSTSEC-2026-0391/0398/0403/0410 lock floors

  #1105·bryan-minimal opened Oct 26, 2026Member·

  ·
  3

• SECURITY: cloud-hypervisor: zstd RUSTSEC-2026-0391/0398/0403/0410 lock floors

  #1104·bryan-minimal opened Oct 26, 2026Member·

  ·
  1

• ci: llvm-collision guard (no closure holds two unprefixed LLVMs)

  #1062·bryan-minimal opened Oct 25, 2026Member·

  ·
  1