Threats affecting pkg:brew/snakemake

urllib3, when used in a Pyodide runtime environment such as browsers or Node.js, does not enforce its redirect control parameters (`retries` and `redirect`). This is because the runtime itself controls redirect behavior, ignoring urllib3's settings. This can lead to applications relying on urllib3 for redirect control remaining vulnerable to SSRF or open redirect attacks if they depend on disabling redirects. A patched version of urllib3 is available for Node.js usage, but browsers inherently lack mechanisms to control redirects via XMLHttpRequest or the Fetch API, resulting in default redirect behavior.

This update includes the following RPMs: llvm21: * clang21-21.1.8-8.hum1 (aarch64, x86_64) * clang21-analyzer-21.1.8-8.hum1 (aarch64, x86_64) * clang21-devel-21.1.8-8.hum1 (aarch64, x86_64) * clang21-libs-21.1.8-8.hum1 (aarch64, x86_64) * clang21-resource-filesystem-21.1.8-8.hum1 (aarch64, x86_64) * clang21-tools-extra-21.1.8-8.hum1 (aarch64, x86_64) * clang21-tools-extra-devel-21.1.8-8.hum1 (aarch64, x86_64) * compiler-rt21-21.1.8-8.hum1 (aarch64, x86_64) * git-clang-format21-21.1.8-8.hum1 (aarch64, x86_64) * libomp21-21.1.8-8.hum1 (aarch64, x86_64) * libomp21-devel-21.1.8-8.hum1 (aarch64, x86_64) * lld21-21.1.8-8.hum1 (aarch64, x86_64) * lld21-devel-21.1.8-8.hum1 (aarch64, x86_64) * lld21-libs-21.1.8-8.hum1 (aarch64, x86_64) * lldb21-21.1.8-8.hum1 (aarch64, x86_64) * lldb21-devel-21.1.8-8.hum1 (aarch64, x86_64) * llvm21-21.1.8-8.hum1 (aarch64, x86_64) * llvm21-cmake-utils-21.1.8-8.hum1 (aarch64, x86_64) * llvm21-devel-21.1.8-8.hum1 (aarch64, x86_64) * llvm21-doc-21.1.8-8.hum1 (noarch) * llvm21-filesystem-21.1.8-8.hum1 (aarch64, x86_64) * llvm21-googletest-21.1.8-8.hum1 (aarch64, x86_64) * llvm21-libs-21.1.8-8.hum1 (aarch64, x86_64) * llvm21-static-21.1.8-8.hum1 (aarch64, x86_64) * llvm21-test-21.1.8-8.hum1 (aarch64, x86_64) * python3-clang21-21.1.8-8.hum1 (aarch64, x86_64) * llvm21-21.1.8-8.hum1.src (src)

This update includes the following RPMs: llvm: * clang-22.1.8-4.1.hum1 (aarch64, x86_64) * clang-analyzer-22.1.8-4.1.hum1 (aarch64, x86_64) * clang-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * clang-libs-22.1.8-4.1.hum1 (aarch64, x86_64) * clang-resource-filesystem-22.1.8-4.1.hum1 (aarch64, x86_64) * clang-tools-extra-22.1.8-4.1.hum1 (aarch64, x86_64) * clang-tools-extra-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * compiler-rt-22.1.8-4.1.hum1 (aarch64, x86_64) * git-clang-format-22.1.8-4.1.hum1 (aarch64, x86_64) * libcxx-22.1.8-4.1.hum1 (aarch64, x86_64) * libcxx-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * libcxx-static-22.1.8-4.1.hum1 (aarch64, x86_64) * libcxxabi-22.1.8-4.1.hum1 (aarch64, x86_64) * libcxxabi-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * libcxxabi-static-22.1.8-4.1.hum1 (aarch64, x86_64) * libomp-22.1.8-4.1.hum1 (aarch64, x86_64) * libomp-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * lld-22.1.8-4.1.hum1 (aarch64, x86_64) * lld-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * lld-libs-22.1.8-4.1.hum1 (aarch64, x86_64) * lldb-22.1.8-4.1.hum1 (aarch64, x86_64) * lldb-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-bolt-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-cmake-utils-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-doc-22.1.8-4.1.hum1 (noarch) * llvm-filesystem-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-googletest-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-libs-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-libunwind-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-libunwind-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-libunwind-static-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-static-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-test-22.1.8-4.1.hum1 (aarch64, x86_64) * polly-22.1.8-4.1.hum1 (aarch64, x86_64) * polly-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * python3-clang-22.1.8-4.1.hum1 (aarch64, x86_64) * python3-lit-22.1.8-4.1.hum1 (noarch) * python3-lldb-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-22.1.8-4.1.hum1.src (src)

This update for python-urllib3 fixes the following issue - CVE-2026-44431: sensitive information disclosure due to sensitive headers being forwarded across origins in proxied low-level redirects (bsc#1265267).

This update for python-GitPython fixes the following issues - CVE-2026-42215: command injection via Git options bypass (bsc#1264604). - CVE-2026-42284: unsafe option check validates multi_options before shlex.split transforms it (bsc#1264605). - CVE-2026-44243: path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository (bsc#1264606). - CVE-2026-44244: newline injection in config_writer().set_value() enables RCE via core.hooksPath (bsc#1264608).

Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services.

The RHTAS Operator can be used with OpenShift Container Platform 4.15, 4.16, 4.17, 4.18 and 4.19

Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments. Security Fix(es): * rubygem-graphql: Remote code execution when loading a crafted GraphQL schema (CVE-2025-27407) * rubygem-rack: Local File Inclusion in Rack::Static (CVE-2025-27610) * python-jinja2: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201) Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.