chore: update dependencies

[renovate]

Update Request | Renovate Bot

This PR contains the following updates:

Package	Type	Update	Change
actions/stale	action	digest	9971854 → b5d41d4
git://repo.or.cz/socat.git		patch	1.8.0.3 → 1.8.1.1
hailo-ai/hailort-drivers		major	4.23.0 → 5.2.0
https://github.com/a13xp0p0v/kernel-hardening-checker.git		digest	93746f4 → e354f6a
https://github.com/ipxe/ipxe.git		digest	1b6d88d → 1fbc3bc
https://github.com/portworx/px-fuse.git		digest	95261b1 → 4b7ade7
https://gitlab.gnome.org/GNOME/glib.git		patch	2.87.2 → 2.87.3
openzfs/zfs		patch	2.4.0 → 2.4.1
seccomp/libseccomp		minor	2.5.6 → 2.6.0
systemd/systemd		minor	259.1 → 259.2

---

Release Notes

hailo-ai/hailort-drivers (hailo-ai/hailort-drivers)

v5.2.0

Compare Source

v5.1.1

Compare Source

v5.1.0

Compare Source

v5.0.1

Compare Source

v5.0.0

Compare Source

GNOME/glib (https://gitlab.gnome.org/GNOME/glib.git)

v2.87.3

Compare Source

Overview of changes in GLib 2.87.3, 2026-02-25

• Improved support for GNotification on Windows (#​3867, #​3869, work by
  Oscar Pernia Moreno)

• Fix module lookups via GModule on Cygwin (#​3741, work by Ailin Nemui)

• Fix local timezone lookup with nested symlinks in /etc/localtime (#​3816,
  work by Alessandro Astone)

• Fix ordering and sequential consistency of gatomic memory barriers on MSVC
  and fallback GCC code paths (#​3829, #​3852, work by Luca Bacci)

• Fix various integer overflow bugs (#​3870, #​3871, #​3872, CVE-2026-1484,
  CVE-2026-1485, CVE-2026-1489, work by Marco Trevisan)

• Add GSocketControlMessage subclasses for receiving IP_TOS and
  IPV6_TCLASS (!4846, work by Jakub Adam)

• Support polling more than 1024 FDs on macOS (!4953, work by Ihar Hrachyshka)

• Remove platform-specific backward compatibility from GLib-2.0 as it’s
  impossible to support (#​3839, !4881, work by Marco Trevisan)

• Improve introspection annotations for delimiters on g_strsplit_set() (this
  may require changes in introspection bindings)

• Basic support for building and running some functionality on tvOS and watchOS
  (!4992, work by Nirbheek Chauhan)

• Add g_get_monotonic_time() variant with nanosecond precision (!5004, work
  by Benjamin Otte)

• Bugs fixed:

  • #​3628 Add test suite for gdbus tool (Philip Withnall)
  • #​3741 GModule incorrectly searches for cyg....so instead of cyg....dll on
    Cygwin (Ailin Nemui)
  • #​3816 Local timezone wrongly considered to be UTC if timezone file in
    /usr/share/zoneinfo is a symlink (Alessandro Astone)
  • #​3829 [RFC] gatomic: Memory barriers should be reversed (Luca Bacci)
  • #​3839 Broken Unix/Win32 specific GIRs
  • #​3852 MSVC and GCC-fallback atomics are not sequentially consistent (Luca
    Bacci)
  • #​3863 Iterating over a short (preallocated) GVariant bytestring invalidly
    refs a NULL GBytes (Christian Hergert)
  • #​3865 callable-info/native-address test fails on big endian (Alessandro
    Astone)
  • #​3867 win32: Notifications without body won't show up
  • #​3869 gnotification-win32: Re-initialize tray icon if explorer.exe got
    restarted
  • #​3870 (CVE-2026-1484) (YWH-PGM9867-168) Integer Overflow -> Buffer Underflow
    on Glib through glib/gbase64.c via g_base64_encode_close() leads to OOB
    Write (Marco Trevisan (Treviño))
  • #​3871 (CVE-2026-1485) (#YWH-PGM9867-169) Buffer underflow on Glib through
    gio/gcontenttype-fdo.c via parse_header() lead to OOB Read/Write (Marco
    Trevisan (Treviño))
  • #​3872 (CVE-2026-1489) (#YWH-PGM9867-171) Integer Overflow on Glib through
    glib/guniprop.c via output_marks() lead to OOB Write in
    glib/gutf8.c:g_unichar_to_utf8() (Marco Trevisan (Treviño))
  • #​3877 hash test failing randomly on MSYS2 (Luca Bacci)
  • #​3880 Integer overflow in gio-launch-desktop from over-long environment
    variables (Philip Withnall)
  • #​3881 Integer overflow in g_resource_find_overlay() from over-long
    environment variables (Philip Withnall)
  • #​3883 Integer overflow in g_path_get_basename() when passed an extremely
    long path (length ≈SSIZE_MAX) (Philip Withnall)
  • #​3886 Crash in gdbus-tool on invalid --method argument format (Philip
    Withnall)
  • #​3895 date_time_lookup_era unsafely caches setlocale pointer (Philip
    Withnall)
  • !4846 gio: Add GSocketControlMessage subclasses for receiving IP_TOS and
    IPV6_TCLASS
  • !4953 darwin: Support g_poll:maxfd >= FD_SETSIZE
  • !4957 gstrfuncs: Annotate g_strsplit_set() as taking a byte array of
    delimiters
  • !4966 gio-tool-{copy,move}: Fix incorrect transfer rate calculation and
    improve visualization
  • !4968 markup: Better error reporting
  • !4970 gutf8: Clarify docs about negative return values
  • !4971 gutf8: Use size_t internally for some length calculations
  • !4976 docs: Fix a typo and specify a codeblock is C
  • !4977 gobject: Add nullable annotation to g_weak_ref_get return value
  • !4982 markup: Initialize tag positions
  • !4985 ci/fedora, glib/casemap: Add tests for the Azerbaijani cases
  • !4987 giomodule: Simplify macro usage for getting the giomodule dir, don't
    use it on iOS
  • !4991 gio/gdatainputstream: Mark bytes as potentially unused
  • !4992 Disable or stub out fork/execv* usage when targeting tvOS and watchOS
  • !4993 Windows: Add test-profile
  • !4996 Fix some small regressions in the iOS build
  • !4997 meson: Add guesses for compute_int to speed up cross-compile setup
  • !5002 Update Lithuanian translation
  • !5004 Add g_get_monotonic_time() variant with nanosecond precision
  • !5006 gfileutils: Fix a regression in g_path_get_basename() for plain
    files
  • !5008 Update Swedish translation
  • !5009 Update Kazakh translation
  • !5011 Update Romanian translation
  • !5012 Compilation fixes for CLangCL and older MSVC
  • !5013 Update Czech translation
  • !5014 Update Russian translation
  • !5015 GApplication: make send_notification / withdraw_notification thread-
    safe
  • !5018 Update Ukrainian translation
  • !5020 Update Romanian translation
  • !5021 Update Lithuanian translation
  • !5023 Update Greek translation
  • !5024 Update Chinese (China) translation
  • !5025 Update Slovenian translation
  • !5026 Update Brazilian Portuguese translation
  • !5027 Update Basque translation
  • !5028 gvalue: Update default terminology to initial
  • !5029 Update Bulgarian translation
  • !5031 Update Galician translation
  • !5032 Update Hungarian translation
  • !5034 Fix const qualifiers where discarded
  • !5036 Address more size types issues
  • !5038 Update Kazakh translation
  • !5039 Update Catalan translation
  • !5040 gsettings-tool: Fix leaks when running set commands
  • !5041 gsettings-tool: Fix leaks when specifying invalid schemas
  • !5042 Update Spanish translation

• Translation updates:

  • Basque (Asier Saratsua Garmendia)
  • Bulgarian (Alexander Alexandrov Shopov)
  • Catalan (Victor Dargallo)
  • Chinese (China) (luming zh)
  • Czech (Daniel Rusek)
  • Galician (Fran Diéguez)
  • Greek, Modern (1453-) (Efstathios Iosifidis)
  • Hungarian (Balázs Úr)
  • Kazakh (Baurzhan Muftakhidinov)
  • Lithuanian (Aurimas Aurimas Černius)
  • Portuguese (Brazil) (Juliano de Souza Camargo)
  • Romanian (Antonio Marin)
  • Russian (Artur S0)
  • Slovenian (Martin)
  • Spanish (Daniel Mustieles)
  • Swedish (Anders Jonsson)
  • Ukrainian (Yuri Chornoivan)

openzfs/zfs (openzfs/zfs)

v2.4.1

Compare Source

Supported Platforms

• Linux: compatible with 4.18 - 6.19 kernels
• FreeBSD: compatible with releases starting from 13.3+, 14.0+, 15.0+

Changes

• Fix available space accounting for special/dedup (#​18222) #​18190 #​18222
• CI: Test & fix Linux ZFS built-in build #​18234
• Linux 6.19 compat: in-tree build: fix duplicate GCM assembly functions #​18204 #​18224
• zfs_vnops_os.c: Move a vput() to after zfs_setattr_dir()
• Fix activating large_microzap on receive #​18143 #​18144
• Improve caching for dbuf prefetches #​18160
• Flush RRD only when TXGs contain data #​18082 #​18138
• Fix send:raw permission for send -w -I #​18198 #​18193
• ZTS: Fix zed_synchronous_zedlet #​18192 #​18196
• Linux 6.19 compat: META #​18197
• CI: Test build Lustre against ZFS #​18161
• Include missing newline in 'man' error #​18183
• ZTS: update the relevant mmp test cases
• zhack: add "action idle" subcommand
• zhack: add -G option to dump debug buffer
• mmp: claim sequence id before final import
• mmp: add spa_load_name() for tryimport
• mmp: move "Starting import" log message
• mmp: further restrict mmp exported pool check
• Fix build for Linux 6.18 with PowerPC/RISC-V kernels. (#​18145)
• Linux 6.19: handle --werror with CONFIG_OBJTOOL_WERROR=y #​18152
• CI: Add Alpine Linux 3.23 runner to the pipeline (#​18087)
• cmd/ztest: avoid PATH_MAX stack allocation in ztest_get_zdb_bin() (#​18085)
• zed.d, contrib: fix shellcheck errors in scripts
• zfs_main: cosmetic: add missing flag to the comment for create
• CI: Test 2.4.x in qemu-test-repo-vm.sh, quick mode #​18070
• Change shellcheck and checkbashism triggers. #​18000
• Replace bashisms in ZFS shell function stub. #​18000
• Make lines stay within 80 char limit. #​18000
• Add some comments to clarify the mounting of filesystems. #​18000
• Standardise if/then/else and for/do/done lines. #​18000
• Add missing initrd config variables. #​18000
• Remove unnecessary sourcing of variables. #​18000
• Fix issue with finding degraded pool(s). #​18000
• Prefix all variables that are local with underscore. #​18000
• Shell script good practices changes. #​18000
• Fix potential global variable overwrite. #​18000
• zpool: fix conflict with -v and -o options
• CI: Fix qemu-1-setup failure, remove debug stuff #​18166
• CI: Use Ubuntu mirrors instead of azure (#​18057) #​18057
• nvpair: chase FreeBSD xdrproc_t definition #​18154
• Make sure we can still write data to txg #​18139
• Lock db_mtx around arc_release() in couple places #​18146
• remove thread unsafe debug code causing FreeBSD double free panic #​18140
• FreeBSD: Remove references to DEBUG_VFS_LOCKS #​18136
• FreeBSD: unbreak compilation on i386 #​18096
• Fix --enable-invariants on FreeBSD #​18131
• Fix history logging for zpool create -t #​18118 #​18102
• DDT: Add locking for table ZAP destruction #​18115
• Add fh_to_parent export definition #​18099
• spl: remove a _KERNEL check #​18117
• spl: unexport kstat_proc_entry functions #​18117
• spl: lift 64-bit math compat out to separate file #​18117
• spl: remove old atomic lock #​18117
• icp: emit .note.GNU-stack section for all ELF targets #​18119
• When receiving a stream with the large block flag, activate feature #​18105
• Fix zfs_open() to skip zil_async_to_sync() for the snapshot #​18091
• ZTS: add regression test for #​17180 #​18109
• Rename several printf attributes declarations to printf #​18095
• Add handling for STATX_CHANGE_COOKIE #​18097
• kmem: don't add __GFP_RECLAIMABLE for KM_VMEM allocations #​18107
• cmd/zfs: clone: accept -u to not mount newly created datasets #​18080
• kmem: don't add __GFP_COMP for KM_VMEM allocations #​18053
• kmem: don't pass __GFP_HIGHMEM to __vmalloc #​18053
• Linux 6.19: replace i_state access with inode_state_read_once() #​18053
• Use reduced precision for scan times #​18061
• Reduce minimal scrub/resilver times #​18060
• zdb: Add -O option for -r to specify object-id #​16307
• Fix rangelock test for growing block size #​18064
• Bypass snprintf() in quota checks if no quotas set #​18063
• RAIDZ: Remove some excessive logging #​18059
• Remove the obsolete FreeBSD 14.2-RELEASE from CI #​18013
• DDT: Fix compressed entry buffer size #​18055
• DDT: Add/use zap_lookup_length_uint64_by_dnode() #​18048
• DDT: Switch to using ZAP _by_dnode() interfaces #​18047
• DDT: Move logs searches out of the lock #​18044
• Improve async destroy processing timing #​18043
• Defer async destroys on pool import #​18033
• ZTS: Fix zvol_misc_fua SLOG writes check #​18033
• ZIO: ZIO_STAGE_DDT_WRITE is a blocking stage #​17981
• ARC: Increase parallel eviction batching #​17970
• ARC: Pre-convert zfs_arc_min_prefetch_ms #​17965
• Reduce dataset buffers re-dirtying #​18028
• CI: Increase setup timeout to 20min, add timestamps #​17714

seccomp/libseccomp (seccomp/libseccomp)

v2.6.0: libseccomp v2.6.0

Compare Source

ChangeLog

• Version 2.6.0 - January 23, 2025
  • New features
    • Add support for new architectures
      • SuperH little endian
      • SuperH big endian
      • LoongArch
      • 32-bit Motorola 68000
    • Add multiplexed syscall support for more architectures
      • MIPS
      • SuperH
      • PPC
    • Consolidate and simplify handling of multiplexed syscalls
    • Add support for the SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV flag
    • Add support for transactions with the seccomp_transaction_start(), seccomp_transaction_commit(), and seccomp_transaction_reject() APIs
    • Improved tooling to help track syscall table updates in the Linux kernel
    • Update the syscall table for Linux v6.13
  • Performance improvements
    • Add a seccomp_precompute() API to generate the seccomp BPF filter prior to seccomp_load() or seccomp_export_bpf_mem()
  • Bug fixes
    • Handle EINVAL error from the kernel when the WAIT_KILLABLE_RECV flag is erroneously provided to the kernel
    • Add support for binary tree filters without syscalls
    • Add support for the kernel’s implementation change of SECCOMP_IOCTL_NOTIF_ID_VALID
    • Fix a seccomp userspace notification issue where the file descriptor was being requested more than once
    • Fix a bug where the internal filter state could be corrupted when a filter rule addition fails
    • Fix potential memory leak in the internal management of filter snapshots
  • Python bindings
    • Add support for retrieving the notification file descriptor
    • Utilize Cython rather than distutils, due to distutils’ deprecation
  • Many test and CI improvements and fixes
  • Many documentation improvements and updates

Checksum

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

83b6085232d1588c379dc9b9cae47bb37407cf262e6e74993c61ba72d2a784dc  libseccomp-2.6.0.tar.gz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmeS4dkACgkQ6iDy2pc3
iXNA2g/+KfaAHm8Uc+HAxHXcDUhw2XB4KQVZvRzLboiBcJu1N0N3ZM9NAtBlB/3Y
b/tOv3PfrTxij4a93Tgt81rOFNha9Ditq3CI/2wDeunNJR2hSZEELyg+S+7x2eyl
6oixUbpWw3nSgaoYyAjqXy7GBCL0k1PibNzVFlHp2SOWZp979nhhhTdNUZAs6hjQ
sMFrEo7lU5HSqDCEJU88K2pKSSCwNMIDJrg9qmd47JOfmSHXTbhMzUPwGyBpVfgB
LYcw4auZUSpYxEBJj97NaXtuW2Bqqu0zBsVBC9bAOF5BbokXCV2jaKzMv6X1e5jI
CpHMBKjLHu8pZKjtSdLagNN6u6Y16tsQQ0TdvBkK5h2WWGVdagB3kj/pcIUqd/gC
po6w5HP0y3MPmy3I7ZbVMYMTTJFCli/d3zEEnKyktfAbhqDZ45zspg/7+LXlh1/x
zNc1CjwRj9ceouU2dvXFmVyEB645abLarDDqizzxnZYANozLJ3acJoBp1I7msaxy
1kmzyoRYroiuZeIlIEht+fnthesE5/x5ZPaugcAIT/oPxtxU1n/08C6rXYZWIL5N
u+NBUfqgsDMEN16bNv4On5siATWes5VVLbvFeOnM2pDdbfBlK2cRgP+1+aCAtokV
i6cl9bjvPqqWgJ518CYraHiLeH5gqqAtzhFy9rDtCJAF7sFZM0k=
=pDHk
-----END PGP SIGNATURE-----

systemd/systemd (systemd/systemd)

v259.2: systemd-stable v259.2

Compare Source

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.