{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "kbd", "libproc2-0", "procps", "python3-idna", "snapd" ] } }, "diff": { "deb": [ { "name": "kbd", "from_version": { "source_package_name": "kbd", "source_package_version": "2.7.1-2ubuntu1", "version": "2.7.1-2ubuntu1" }, "to_version": { "source_package_name": "kbd", "source_package_version": "2.7.1-2ubuntu2", "version": "2.7.1-2ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2076009 ], "changes": [ { "cves": [], "log": [ "", " * d/kbd.initramfs-hook: use /usr/bin as path for executable (LP: #2076009)", "" ], "package": "kbd", "version": "2.7.1-2ubuntu2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2076009 ], "author": "Benjamin Drung ", "date": "Mon, 01 Dec 2025 15:58:30 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libproc2-0", "from_version": { "source_package_name": "procps", "source_package_version": "2:4.0.4-8ubuntu3", "version": "2:4.0.4-8ubuntu3" }, "to_version": { "source_package_name": "procps", "source_package_version": "2:4.0.4-9ubuntu1", "version": "2:4.0.4-9ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2130066, 2108979 ], "changes": [ { "cves": [], "log": [ "", " * Merge from Debian unstable (LP: #2130066). Remaining changes:", " - d/p/0010-testsuite-ps-etime-ELAPSED-doesn-t-match-full-format.patch:", " Fix test failure (FTBFS) in testsuite/ps.test/ps_output.exp due to", " invalid regex match inside LXD containers.", " - debian/sysctl.d (Ubuntu-specific):", " + 10-console-messages.conf: stop low-level kernel messages on console.", " + 10-kernel-hardening.conf: add the kptr_restrict setting", " + 10-ipv6-privacy.conf: add a file to sysctl.d to apply the defaults", " for IPv6 privacy extensions for interfaces. (LP#176125, LP#841353)", " + 10-magic-sysrq.conf: Disable most magic sysrq by default, allowing", " critical sync, remount, reboot functions. (LP#194676, LP#1025467)", " + 10-network-security.conf: enable rp_filter.", " + 10-ptrace.conf: describe new PTRACE setting.", " + 10-zeropage.conf: safe mmap_min_addr value for graceful fall-back.", " for armhf, and arm64.", " + 10-qemu.conf.s390x for qemu.", " + 10-bufferbloat.conf: set default qdisc to fq_codel", " + 10-map-count.conf: Increase vm.max_map_count to 1048576", " + ship configs in /usr, with higher priority", " This ensures that Ubuntu's defaults take precedence over", " 50-default.conf from linux-sysctl-defaults. (LP: #2108979)", " - ignore_erofs.patch: Same as ignore_eaccess but for the case", " where part of /proc is read/only.", " - Adjust logic due to rc no longer being propagated (LP#1903351)", " - ignore_eaccess.patch: If we get eaccess when opening a sysctl", " file for writing, don't error out. Otherwise package upgrades", " can fail, especially in containers.", " - Adjust logic due to rc no longer being propagated (LP#1903351)", " - Add basic autopkgtest to validate sysctl-defaults (LP#1962038)", " - d/t/stack-limit: add basic autopkgtest to validate limits", " - d/t/stack-limit: call 'pgrep systemd' instead of 'pgrep bash'", " The autopkgtest currently fails because there is no bash session, and", " pgrep returns non-zero. Use systemd because that will match for pid1.", " - d/tests: make sysctl-defaults test comprehensive", " - d/t/test_sysctyl_defaults.py: skip test if sysctl key invalid (LP#2115346)", " - d/t/control show all sysctl.d configs and make sysctl-defaults test", " Restrictions: isolation-machine (LP#2115346)", " - d/p/lp2120904-openat.patch: utilize file descriptors and openat (LP#2120904)", " - d/p/lp2120904-nullpointer.patch: fix a race when 'status' is unavailable", " in /proc/ resuting in NULL pointer (LP#2120904)", "" ], "package": "procps", "version": "2:4.0.4-9ubuntu1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2130066, 2108979 ], "author": "John Chittum ", "date": "Mon, 01 Dec 2025 14:50:23 -0500" }, { "cves": [], "log": [ "", " [ Craig Small ]", " * d/changelog: Fix number for skill bug", "", " [ Andrew Bower ]", " * Initialise sessions variable in w. (Closes: #1108549)", " * d/patches: get sessions even if !sd_booted()", "" ], "package": "procps", "version": "2:4.0.4-9", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Craig Small ", "date": "Wed, 30 Jul 2025 21:58:40 +1000" } ], "notes": null, "is_version_downgrade": false }, { "name": "procps", "from_version": { "source_package_name": "procps", "source_package_version": "2:4.0.4-8ubuntu3", "version": "2:4.0.4-8ubuntu3" }, "to_version": { "source_package_name": "procps", "source_package_version": "2:4.0.4-9ubuntu1", "version": "2:4.0.4-9ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2130066, 2108979 ], "changes": [ { "cves": [], "log": [ "", " * Merge from Debian unstable (LP: #2130066). Remaining changes:", " - d/p/0010-testsuite-ps-etime-ELAPSED-doesn-t-match-full-format.patch:", " Fix test failure (FTBFS) in testsuite/ps.test/ps_output.exp due to", " invalid regex match inside LXD containers.", " - debian/sysctl.d (Ubuntu-specific):", " + 10-console-messages.conf: stop low-level kernel messages on console.", " + 10-kernel-hardening.conf: add the kptr_restrict setting", " + 10-ipv6-privacy.conf: add a file to sysctl.d to apply the defaults", " for IPv6 privacy extensions for interfaces. (LP#176125, LP#841353)", " + 10-magic-sysrq.conf: Disable most magic sysrq by default, allowing", " critical sync, remount, reboot functions. (LP#194676, LP#1025467)", " + 10-network-security.conf: enable rp_filter.", " + 10-ptrace.conf: describe new PTRACE setting.", " + 10-zeropage.conf: safe mmap_min_addr value for graceful fall-back.", " for armhf, and arm64.", " + 10-qemu.conf.s390x for qemu.", " + 10-bufferbloat.conf: set default qdisc to fq_codel", " + 10-map-count.conf: Increase vm.max_map_count to 1048576", " + ship configs in /usr, with higher priority", " This ensures that Ubuntu's defaults take precedence over", " 50-default.conf from linux-sysctl-defaults. (LP: #2108979)", " - ignore_erofs.patch: Same as ignore_eaccess but for the case", " where part of /proc is read/only.", " - Adjust logic due to rc no longer being propagated (LP#1903351)", " - ignore_eaccess.patch: If we get eaccess when opening a sysctl", " file for writing, don't error out. Otherwise package upgrades", " can fail, especially in containers.", " - Adjust logic due to rc no longer being propagated (LP#1903351)", " - Add basic autopkgtest to validate sysctl-defaults (LP#1962038)", " - d/t/stack-limit: add basic autopkgtest to validate limits", " - d/t/stack-limit: call 'pgrep systemd' instead of 'pgrep bash'", " The autopkgtest currently fails because there is no bash session, and", " pgrep returns non-zero. Use systemd because that will match for pid1.", " - d/tests: make sysctl-defaults test comprehensive", " - d/t/test_sysctyl_defaults.py: skip test if sysctl key invalid (LP#2115346)", " - d/t/control show all sysctl.d configs and make sysctl-defaults test", " Restrictions: isolation-machine (LP#2115346)", " - d/p/lp2120904-openat.patch: utilize file descriptors and openat (LP#2120904)", " - d/p/lp2120904-nullpointer.patch: fix a race when 'status' is unavailable", " in /proc/ resuting in NULL pointer (LP#2120904)", "" ], "package": "procps", "version": "2:4.0.4-9ubuntu1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2130066, 2108979 ], "author": "John Chittum ", "date": "Mon, 01 Dec 2025 14:50:23 -0500" }, { "cves": [], "log": [ "", " [ Craig Small ]", " * d/changelog: Fix number for skill bug", "", " [ Andrew Bower ]", " * Initialise sessions variable in w. (Closes: #1108549)", " * d/patches: get sessions even if !sd_booted()", "" ], "package": "procps", "version": "2:4.0.4-9", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Craig Small ", "date": "Wed, 30 Jul 2025 21:58:40 +1000" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-idna", "from_version": { "source_package_name": "python-idna", "source_package_version": "3.10-1", "version": "3.10-1" }, "to_version": { "source_package_name": "python-idna", "source_package_version": "3.10-1build1", "version": "3.10-1build1" }, "cves": [], "launchpad_bugs_fixed": [ 2132257 ], "changes": [ { "cves": [], "log": [ "", " * No-change mass rebuild for Ubuntu 26.04 (LP: #2132257)", "" ], "package": "python-idna", "version": "3.10-1build1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2132257 ], "author": "Sebastien Bacher ", "date": "Sat, 06 Dec 2025 11:53:05 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "snapd", "from_version": { "source_package_name": "snapd", "source_package_version": "2.72+ubuntu26.04.1", "version": "2.72+ubuntu26.04.1" }, "to_version": { "source_package_name": "snapd", "source_package_version": "2.73+ubuntu26.04.1", "version": "2.73+ubuntu26.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2132084, 2127189, 1851490, 2121853, 2127214, 2127244, 2127766, 2118396, 2114923, 2112551, 2114779, 2112544, 2112332, 1952500, 1849346, 2098780, 2033883 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release, LP: #2132084", " - FDE: do not save incomplete FDE state when resealing was skipped", " - FDE: warn of inconsistent primary or policy counter", " - Confdb: document confdb in snapctl help messages", " - Confdb: only confdb hooks wait if snaps are disabled", " - Confdb: relax confdb change conflict checks", " - Confdb: remove empty parent when removing last leaf", " - Confdb: support parsing field filters", " - Confdb: wrap confdb write values under \"values\" key", " - dm-verity for essential snaps: add new naming convention for", " verity files", " - dm-verity for essential snaps: add snap integrity discovery", " - dm-verity for essential snaps: fix verity salt calculation", " - Assertions: add hardware identity assertion", " - Assertions: add integrity stanza in snap resources revisions", " - Assertions: add request message assertion required for remote", " device management", " - Assertions: add response-message assertion for secure remote", " device management", " - Assertions: expose WithStackedBackstore in RODatabase", " - Packaging: cross-distro | install upstream NEWS file into relevant", " snapd package doc directory", " - Packaging: cross-distro | tweak how the blocks injecting", " $SNAP_MOUNT_DIR/bin are generated as required for openSUSE", " - Packaging: remove deprecated snap-gdb-shim and all references now", " that snap run --gdb is unsupported and replaced by --gdbserver", " - Preseed: call systemd-tmpfiles instead handle-writable-paths on", " uc26", " - Preseed: do not remove the /snap dir but rather all its contents", " during reset", " - snap-confine: attach name derived from security tag to BPF maps", " and programs", " - snap-confine: ensure permitted capabilities match expectation", " - snap-confine: fix cached snap-confine profile cleanup to report", " the correct error instead of masking backend setup failures", " - snap-confine: Improve validation of user controlled paths", " - snap-confine: tighten snap cgroup checks to ensure a snap cannot", " start another snap in the same cgroup, preventing incorrect", " device-filter installation", " - core-initrd: add 26.04 ubuntu-core-initramfs package", " - core-initrd: add missing order dependency for setting default", " system files", " - core-initrd: avoid scanning loop and mmc boot partitions as the", " boot disk won't be any of these", " - core-initrd: make cpio a Depends and remove from Build-Depends", " - core-initrd: start plymouth sooner and reload when gadget is", " available", " - Cross-distro: modify syscheck to account for differences in", " openSUSE 16.0+", " - Validation sets: use in-flight validation sets when calling", " 'snapctl install' from hook", " - Prompting: enable prompting for the camera interface", " - Prompting: remove polkit authentication when modifying/deleting", " prompting rules", " - LP: #2127189 Prompting: do not record notices for unchanged rules", " on snapd startup", " - AppArmor: add free and pidof to the template", " - AppArmor: adjust interfaces/profiles to cope with coreutils paths", " - Interfaces: add support for compatibility expressions", " - Interfaces: checkbox-support | complete overhaul", " - Interfaces: define vulkan-driver-libs, cuda-driver-libs, egl-", " driver-libs, gbm-driver-libs, opengl-driver-libs, and opengles-", " driver-libs", " - Interfaces: allow snaps on classic access to nvidia graphics", " libraries exported by *-driver-libs interfaces", " - Interfaces: fwupd | broaden access to /boot/efi/EFI", " - Interfaces: gsettings | set dconf-service as profile for", " ca.desrt.dconf.Writer", " - Interfaces: iscsi-initiator, dm-multipath, nvme-control | add new", " interfaces", " - Interfaces: opengl | grant read/write permission to /run/nvidia-", " persistenced/socket", " - interfaces: ros-snapd-support | add access to /v2/changes/", " - Interfaces: system-observe | read access to btrfs/ext4/zfs", " filesystem information", " - Interfaces: system-trace | allow /sys/kernel/tracing/** rw", " - Interfaces: usb-gadget | add support for ffs mounts in attributes", " - Add autocompletion to run command", " - Introduce option for disallowing auto-connection of a specific", " interface", " - Only log errors for user service operations performed as a part of", " snap removal", " - Patch snap names in service requests for parallel installed snaps", " - Simplify traits for eMMC special partitions", " - Strip apparmor_parser from debug symbols shrinking snapd size by", " ~3MB", " - Fix InstallPathMany skipping refresh control", " - Fix waiting for GDB helper to stop before attaching gdbserver", " - Protect the per-snap tmp directory against being reaped by age", " - Prevent disabling base snaps to ensure dependent snaps can be", " removed", " - Modify API endpoint /v2/logs to reject n <= 0 (except for special", " case -1 meaning all)", " - Avoid potential deadlock when task is injected after the change", " was aborted", " - Avoid race between store download stream and cache cleanup", " executing in parallel when invoked by snap download task", " - LP: #1851490 Use \"current\" instead of revision number for icons", " - LP: #2121853 Add snapctl version command", " - LP: #2127214 Ensure no more than one partition on disk can match a", " gadget partition", " - LP: #2127244 snap-confine: update AppArmor profile to allow", " read/write to journal as workaround for snap-confine fd", " inheritance prevented by newer AppArmor", " - LP: #2127766 Add new tracing mechanism with independently running", " strace and shim synchronization", "" ], "package": "snapd", "version": "2.73+ubuntu26.04.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2132084, 2127189, 1851490, 2121853, 2127214, 2127244, 2127766 ], "author": "Ernest Lotter ", "date": "Fri, 21 Nov 2025 09:08:02 +0200" }, { "cves": [], "log": [ "", " * New upstream release, LP: #2118396", " - FDE: auto-repair when recovery key is used", " - FDE: revoke keys on shim update", " - FDE: revoke old TPM keys when dbx has been updated", " - FDE: do not reseal FDE hook keys every time", " - FDE: store keys in the kernel keyring when installing from initrd", " - FDE: allow disabled DMA on Core", " - FDE: snap-bootstrap: do not check for partition in scan-disk on", " CVM", " - FDE: support secboot preinstall check for 25.10+ hybrid installs", " via the /v2/system/{label} endpoint", " - FDE: support generating recovery key at install time via the", " /v2/systems/{label} endpoint", " - FDE: update passphrase quality check at install time via the", " /v2/systems/{label} endpoint", " - FDE: support replacing recovery key at runtime via the new", " /v2/system-volumes endpoint", " - FDE: support checking recovery keys at runtime via the /v2/system-", " volumes endpoint", " - FDE: support enumerating keyslots at runtime via the /v2/system-", " volumes endpoint", " - FDE: support changing passphrase at runtime via the /v2/system-", " volumes endpoint", " - FDE: support passphrase quality check at runtime via the", " /v2/system-volumes endpoint", " - FDE: update secboot to revision 3e181c8edf0f", " - Confdb: support lists and indexed paths on read and write", " - Confdb: alias references must be wrapped in brackets", " - Confdb: support indexed paths in confdb-schema assertion", " - Confdb: make API errors consistent with options", " - Confdb: fetch confdb-schema assertion on access", " - Confdb: prevent --previous from being used in read-side hooks", " - Components: fix snap command with multiple components", " - Components: set revision of seed components to x1", " - Components: unmount extra kernel-modules components mounts", " - AppArmor Prompting: add lifespan \"session\" for prompting rules", " - AppArmor Prompting: support restoring prompts after snapd restart", " - AppArmor Prompting: limit the extra information included in probed", " AppArmor features and system key", " - Notices: refactor notice state internals", " - SELinux: look for restorecon/matchpathcon at all known locations", " rather than current PATH", " - SELinux: update policy to allow watching cgroups (for RAA), and", " talking to user session agents (service mgmt/refresh)", " - Refresh App Awareness: Fix unexpected inotify file descriptor", " cleanup", " - snap-confine: workaround for glibc fchmodat() fallback and handle", " ENOSYS", " - snap-confine: add support for host policy for limiting users able", " to run snaps", " - LP: #2114923 Reject system key mismatch advise when not yet seeded", " - Use separate lanes for essential and non-essential snaps during", " seeding and allow non-essential installs to retry", " - Fix bug preventing remodel from core18 to core18 when snapd snap", " is unchanged", " - LP: #2112551 Make removal of last active revision of a snap equal", " to snap remove", " - LP: #2114779 Allow non-gpt in fallback mode to support RPi", " - Switch from using systemd LogNamespace to manually controlled", " journal quotas", " - Change snap command trace logging to only log the command names", " - Grant desktop-launch access to /v2/snaps", " - Update code for creating the snap journal stream", " - Switch from using core to snapd snap for snap debug connectivity", " - LP: #2112544 Fix offline remodel case where we switched to a", " channel without an actual refresh", " - LP: #2112332 Exclude snap/snapd/preseeding when generating preseed", " tarball", " - LP: #1952500 Fix snap command progress reporting", " - LP: #1849346 Interfaces: kerberos-tickets | add new interface", " - Interfaces: u2f | add support for Thetis Pro", " - Interfaces: u2f | add OneSpan device and fix older device", " - Interfaces: pipewire, audio-playback | support pipewire as system", " daemon", " - Interfaces: gpg-keys | allow access to GPG agent sockets", " - Interfaces: usb-gadget | add new interface", " - Interfaces: snap-fde-control, firmware-updater-support | add new", " interfaces to support FDE", " - Interfaces: timezone-control | extend to support timedatectl", " varlink", " - Interfaces: cpu-control | fix rules for accessing IRQ sysfs and", " procfs directories", " - Interfaces: microstack-support | allow SR-IOV attachments", " - Interfaces: modify AppArmor template to allow snaps to read their", " own systemd credentials", " - Interfaces: posix-mq | allow stat on /dev/mqueue", " - LP: #2098780 Interfaces: log-observe | add capability", " dac_read_search", " - Interfaces: block-devices | allow access to ZFS pools and datasets", " - LP: #2033883 Interfaces: block-devices | opt-in access to", " individual partitions", " - Interfaces: accel | add new interface to support accel kernel", " subsystem", " - Interfaces: shutdown | allow client to bind on its side of dbus", " socket", " - Interfaces: modify seccomp template to allow pwritev2", " - Interfaces: modify AppArmor template to allow reading", " /proc/sys/fs/nr_open", " - Packaging: drop snap.failure service for openSUSE", " - Packaging: add SELinux support for openSUSE", " - Packaging: disable optee when using nooptee build tag", " - Packaging: add support for static PIE builds in snapd.mk, drop", " pie.patch from openSUSE", " - Packaging: add libcap2-bin runtime dependency for ubuntu-16.04", " - Packaging: use snapd.mk for packaging on Fedora", " - Packaging: exclude .git directory", " - Packaging: fix DPKG_PARSECHANGELOG assignment", " - Packaging: fix building on Fedora with dpkg installed", "" ], "package": "snapd", "version": "2.71", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [ 2118396, 2114923, 2112551, 2114779, 2112544, 2112332, 1952500, 1849346, 2098780, 2033883 ], "author": "Ernest Lotter ", "date": "Fri, 25 Jul 2025 13:18:47 +0200" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 26.04 resolute image from daily image serial 20251214 to 20251215", "from_series": "resolute", "to_series": "resolute", "from_serial": "20251214", "to_serial": "20251215", "from_manifest_filename": "daily_manifest.previous", "to_manifest_filename": "manifest.current" }