Import OpenSSH 10.5 (previous was OpenSSH 10.3)
OpenSSH 10.5/10.5p1 (2026-08-11)
OpenSSH 10.5 was released on 2026-08-11. It is available from the
mirrors listed at https://www.openssh.com/.
OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support.
Recently the OpenSSH team have received a large number of security
bug reports, many of which are findings from AI models or made with
AI assistance. While many AI reports are determined not to have
security impact when considered in the context of a realistic
threat model, we very much welcome these reports, especially when
combined with human triage, analysis, test-cases and particularly
when accompanied by proposed fixes.
We have seen a number of cases where a security bug identified by
AI tools is subsequently independently discovered by a different
researcher. This suggests that adversaries who do not report bugs
[383 lines not shown]
Update nagstamon to 3.18.2. This fixes runtime failure caused by some
API change in a python module.
CHANGES since 3.16.2:
added experimental web login via cookies
added LibreNMS support
improved Alertmanager support for multiple alerts
improved Centreon token validation
improved Zabbix support in contect menu
improved macOS support
fixed sound files
fixes for Checkmk
fixes for Alertmanager
fixes for IcingaDBWeb
fixes for IcingaWeb2
fixes for Zabbix
updated Qt6
code cleanup
libidn2: updated to 2.3.8
Noteworthy changes in release 2.3.8 (2025-03-08) [stable]
* Unicode 15.1.0 table updates.
Now U+19DA is DISALLOWED again (see version 2.3.4 release notes).
sccache: updated to 0.18.0
sccache 0.18.0 is a broad correctness and coverage release: a lot of compiler flags that used to
force a cache miss are now understood, several cache-key and multi-level storage bugs are fixed,
and the Azure backend gained passwordless authentication.
Highlights:
Cache-key correctness: the assembler gcc/clang would actually invoke is now part of the cache
key, so two toolchains with different binutils can no longer hand each other the wrong object
file. SCCACHE_BASEDIRS now also strips base directories from the compiler arguments,
so flags like -ffile-prefix-map=/home/user/project=. stop tying an entry to one checkout.
MSVC/clang flag coverage: support for /openmp:llvm, the /fsanitize*, /fsanitize-coverage*
and /fno-sanitize* families, /feature, arm64EC and fastfail, /d20bforceinline, and a large
batch of other flags, plus more clang CLI options. gcc now
marks flags as TooHard when they would require caching something else.
CUDA: nvcc dryrun parsing works with CUDA 13.3, escaped quotes in Windows dryrun
lines are protected before backslash flattening, and the
--diag-error/--diag-suppress/--diag-warn family is accepted.
[10 lines not shown]
p5-Email-Sender: update to 2.602.
Security fix release.
2.602 2026-09-21 11:09:22-04:00 America/New_York
- SECURITY: the Sendmail transport built a shell command line on Win32,
so an envelope address containing shell metacharacters -- which can
come from the To, Cc, or From header of a message sent with
Email::Sender::Simple -- could execute arbitrary commands. On Win32,
envelope addresses are now checked against a conservative pattern, and
anything else is now rejected with a permanent failure.
This is CVE-2026-84344.
crush: Update to 0.96.1
Changelog
Other stuff
56abdfa: themes: prefix diff theme keys with diff_ (@meowgorithm)
a88b573: themes: small adjustments to the key names in the theme API (@meowgorithm)
