Sync Collecting Fix Commits: Sat Aug 8 00:58:20 UTC 2026

Signed-off-by: AboutCode Automation <automation@aboutcode.org>

Author: aboutcode-automation

data/fix-commits/advisory-database-b78f1d41.json

@@ -1,6 +1,15 @@
 {
   "vcs_url": "https://gitweb.gentoo.org/repo/gentoo.git",
   "vulnerabilities": {
+    "CVE-2026-44950": {
+      "14b8bbd54067df58ab67d18c6d975c2d1b31870b": "x11-libs/libXfont2: add 2.0.9\n\n- fixes for CVE-2026-44950, CVE-2026-59679\n- fontserver support now disabled by default (upstream change)\n\nBug: https://bugs.gentoo.org/980377\nPart-of: https://codeberg.org/gentoo/gentoo/pulls/1620\nMerges: https://codeberg.org/gentoo/gentoo/pulls/1620\nSigned-off-by: Brett A C Sheffield <bacs@librecast.net>\nSigned-off-by: Matt Turner <mattst88@gentoo.org>"
+    },
+    "CVE-2026-59679": {
+      "14b8bbd54067df58ab67d18c6d975c2d1b31870b": "x11-libs/libXfont2: add 2.0.9\n\n- fixes for CVE-2026-44950, CVE-2026-59679\n- fontserver support now disabled by default (upstream change)\n\nBug: https://bugs.gentoo.org/980377\nPart-of: https://codeberg.org/gentoo/gentoo/pulls/1620\nMerges: https://codeberg.org/gentoo/gentoo/pulls/1620\nSigned-off-by: Brett A C Sheffield <bacs@librecast.net>\nSigned-off-by: Matt Turner <mattst88@gentoo.org>"
+    },
+    "CVE-2026-13438": {
+      "203631d2478bb6b745b5675fa75b160be8c5bc5b": "www-apps/grafana-bin: bump for CVE-2026-13438\n\nSigned-off-by: Robin H. Johnson <robbat2@gentoo.org>"
+    },
     "CVE-2026-11527": {
       "d4e976ea9401a534cdf7d856133384df31f74e09": "dev-perl/Config-IniFiles: add 3.1.0\n\n- fixes CVE-2026-11527\n- EAPI -> 8\n- fix MissingVersionedVirtualPerlDependency\n\nBug: https://bugs.gentoo.org/979587\nSigned-off-by: Brett A C Sheffield <bacs@librecast.net>\nPart-of: https://codeberg.org/gentoo/gentoo/pulls/1474\nMerges: https://codeberg.org/gentoo/gentoo/pulls/1474\nSigned-off-by: Sam James <sam@gentoo.org>"
     },

data/fix-commits/gentoo.git-f7ec53e2.json

@@ -1,6 +1,9 @@
 {
   "vcs_url": "https://github.com/gnome/glib",
   "vulnerabilities": {
+    "CVE-2026-16118": {
+      "ca75aff83af9875ea2ad2bfbe48a85dfd99c2ce5": "Fix CVE-2026-16118: heap-buffer-overflow in xdgmimemagic.c\n\nFix out-of-bounds write in the byte-swap routine of\n_xdg_mime_magic_parse_magic_line(). On little-endian systems, the\nwrite side of the swap casts the base pointer to a wider type before\nadding the byte offset, causing pointer arithmetic to scale by\nsizeof(type) instead of 1. With value_length=4 and word_size=2, the\nloop writes 2 bytes past the allocated matchlet->value buffer at i=2.\n\nParenthesize (ptr + i) before the cast so both the read and write\nsides use byte offsets.\n\nUpstream: https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41"
+    },
     "CVE-2024-34397": {
       "7c7b4ac5e8f0e52ff01887ca20094131cb633fde": "gdbusconnection: Allow name owners to have the syntax of a well-known name\n\nIn a D-Bus-Specification-compliant message bus, the owner of a well-known\nname is a unique name. However, ibus has its own small implementation\nof a message bus (src/ibusbus.c) in which org.freedesktop.IBus is\nspecial-cased to also have itself as its owner (like org.freedesktop.DBus\non a standard message bus), and connects to that bus with the\nG_DBUS_CONNECTION_FLAGS_MESSAGE_BUS_CONNECTION flag. The ability to do\nthis regressed when CVE-2024-34397 was fixed.\n\nRelax the checks to allow the owner of a well-known name to be any valid\nD-Bus name, even if it is not syntactically a unique name.\n\nFixes: 683b14b9 \"gdbus: Track name owners for signal subscriptions\"\nResolves: https://gitlab.gnome.org/GNOME/glib/-/issues/3353\nBug-Debian: https://bugs.debian.org/1070730\nBug-Debian: https://bugs.debian.org/1070736\nBug-Debian: https://bugs.debian.org/1070743\nBug-Debian: https://bugs.debian.org/1070745\nSigned-off-by: Simon McVittie <smcv@debian.org>",
       "ad49010fbf639d080238e97b89f526098dd9a747": "gdbusconnection: Allow name owners to have the syntax of a well-known name\n\nIn a D-Bus-Specification-compliant message bus, the owner of a well-known\nname is a unique name. However, ibus has its own small implementation\nof a message bus (src/ibusbus.c) in which org.freedesktop.IBus is\nspecial-cased to also have itself as its owner (like org.freedesktop.DBus\non a standard message bus), and connects to that bus with the\nG_DBUS_CONNECTION_FLAGS_MESSAGE_BUS_CONNECTION flag. The ability to do\nthis regressed when CVE-2024-34397 was fixed.\n\nRelax the checks to allow the owner of a well-known name to be any valid\nD-Bus name, even if it is not syntactically a unique name.\n\nFixes: 683b14b9 \"gdbus: Track name owners for signal subscriptions\"\nResolves: https://gitlab.gnome.org/GNOME/glib/-/issues/3353\nBug-Debian: https://bugs.debian.org/1070730\nBug-Debian: https://bugs.debian.org/1070736\nBug-Debian: https://bugs.debian.org/1070743\nBug-Debian: https://bugs.debian.org/1070745\nSigned-off-by: Simon McVittie <smcv@debian.org>",

data/fix-commits/glib-7e8b44c5.json

@@ -1,6 +1,10 @@
 {
   "vcs_url": "https://github.com/vercel/next.js",
   "vulnerabilities": {
+    "GHSA-3QHV-2RGH-X77R": {
+      "665599b0ac81d1a1067aee734c44a6d2137b2c58": "Keep the .npmrc approach for mirror authentication\n\nAn install command writing the token to the user-level pnpm config made vercel deploy fail, so this stays on the repository .npmrc referencing VERCEL_OIDC_TOKEN. The pnpm expansion change (GHSA-3qhv-2rgh-x77r) will need a follow-up once the pinned pnpm moves past 10.33.0.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
+      "1b426866e7fd54f5b89b94c37dd7f65d5993c2f2": "Configure mirror auth via the install command\n\npnpm no longer expands environment variables in repository .npmrc files (GHSA-3qhv-2rgh-x77r), so referencing VERCEL_OIDC_TOKEN from a generated .npmrc would stop working once the pinned pnpm is updated past 10.33.0. Following the pattern used in vercel/front, deploy tests now write a vercel.json whose install command stores the shell-expanded token in the user-level pnpm config before installing, which keeps working on newer pnpm versions and still keeps credentials out of the uploaded deployment source.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>"
+    },
     "GHSA-6G55-P6WH-862Q": {
       "470ec9acf7f1d3d0719b8e2423e7527f91743c8e": "Bump postcss to 8.5.23 (#96107)\n\nNote that https://github.com/advisories/GHSA-6g55-p6wh-862q does not\naffect Next.js users unless they build from untrusted source code (which\nwould have more severe security implications). We're merging this to\nreduce noise from security scanners.\n\n- 8.5.21 is 50h+ old so it can be installed\n- 8.5.22 is still under 48h - valid at 2026-07-24 08:48:15 UTC \n\nCloses: https://github.com/vercel/next.js/issues/96349\n\nCo-authored-by: Joseph <joseph.chamochumbi@vercel.com>",
       "5cdcbbb05be0abc21afcb8d5346cc12d854be537": "Bump postcss to 8.5.23 (#96107)\n\nNote that https://github.com/advisories/GHSA-6g55-p6wh-862q does not\naffect Next.js users unless they build from untrusted source code (which\nwould have more severe security implications). We're merging this to\nreduce noise from security scanners.\n\n- 8.5.21 is 50h+ old so it can be installed\n- 8.5.22 is still under 48h - valid at 2026-07-24 08:48:15 UTC \n\nCloses: https://github.com/vercel/next.js/issues/96349"