Skip to content

[dependabot]: Bump pulp-rpm from 3.39.0 to 3.39.1 in /automation - #3208

Merged
Odilhao merged 1 commit into
rpm/developfrom
dependabot/pip/automation/pulp-rpm-3.39.1
Oct 16, 2026
Merged

Odilhao merged 1 commit into
rpm/developfrom
dependabot/pip/automation/pulp-rpm-3.39.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026 •

Copy link
Copy Markdown
Contributor

Bumps pulp-rpm from 3.39.0 to 3.39.1.

Changelog

Sourced from pulp-rpm's changelog.

3.39.1 (2026-10-08) {: #3.39.1 }

Bugfixes {: #3.39.1-bugfix }

  • Strip control characters (illegal in XML) from changelogs so that it cannot cause errors / crashes during XML writing. #4394
  • Fixed a possible path traversal issue when publishing distribution tree subrepositories (CVE-2026-103870).
  • Prevent malformed RPM changelogs from crashing package uploads or producing invalid repository metadata.

Commits
  • f02a693 Release 3.39.1
  • 5422fe1 Fix a possible path traversal issue
  • f27e2f6 Prevent decoding errors/control characters in changelogs from crashing
  • 13fbc73 Bump pulpcore lowerbounds to supported branch
  • db5d9da Update CI files
  • f73751d Update CI files
  • c149e5a Bump version: 3.39.0 → 3.39.1.dev
  • See full diff in compare view

@dependabot dependabot Bot added the dependabot Dependabot automated PR label Oct 12, 2026
@theforeman-bot

Copy link
Copy Markdown
Member

Can one of the admins verify this patch?

@dependabot
dependabot Bot force-pushed the dependabot/pip/automation/pulp-rpm-3.39.1 branch from 0902da3 to 7faa751 Compare October 16, 2026 13:12
Bumps [pulp-rpm](https://github.com/pulp/pulp_rpm) from 3.39.0 to 3.39.1.
- [Release notes](https://github.com/pulp/pulp_rpm/releases)
- [Changelog](https://github.com/pulp/pulp_rpm/blob/main/CHANGES.md)
- [Commits](pulp/pulp_rpm@3.39.0...3.39.1)

---
updated-dependencies:
- dependency-name: pulp-rpm
  dependency-version: 3.39.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/automation/pulp-rpm-3.39.1 branch from 7faa751 to 17b17ad Compare October 16, 2026 13:21
@Odilhao
Odilhao merged commit 24045f7 into rpm/develop Oct 16, 2026
3 checks passed
@Odilhao
Odilhao deleted the dependabot/pip/automation/pulp-rpm-3.39.1 branch October 16, 2026 13:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependabot Dependabot automated PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants