Hi,

I'm happy to announce that I've just released ptxdist-2026.10.0.

This release contains some SPDX SBoM fixes and several CPE identifier
corrections to ensure that they match what the CVE database is using.
That way CVEs are properly matched, when using the SBoM generated by
PTXdist.

The rest are mostly version bumps and a few other fixes.

Thanks to all contributors and - as always - the shortlog below.

Enjoy,
Michael Olbrich


Alexander Dahl (26):
      libnftnl: version bump 1.3.1 -> 1.3.2
      nftables: version bump 1.1.6 -> 1.1.7
      report: spdx_sbom: Fixed "created" field format
      report: spdx_sbom: Fix externalPackageRef type in category SECURITY
      report: spdx_sbom: Convert pkg_name into valid idstring
      tz: version bump 2026c -> 2026d
      at91bootstrap2: Add matching CPE identifiers
      bzip2: Add matching CPE identifiers
      coreutils: Add matching CPE identifiers
      ethtool: Add matching CPE identifiers
      fcgi: Add matching CPE identifiers
      flex: Add matching CPE identifiers
      iperf3: Add matching CPE identifiers
      libarchive: Add matching CPE identifiers
      libgmp: Add matching CPE identifiers
      libmodbus: Add CPE identifiers
      libnl3: Reorder variables and re-add section header comment
      libnl3: Add matching CPE identifiers
      libpopt: Add matching CPE identifiers
      ncurses: Add matching CPE identifiers
      nlohmann-json: Add matching CPE identifiers
      openssl: Pin down CPE vendor
      sudo: Add matching CPE identifiers
      u-boot: Add matching CPE identities
      u-boot-tools: Add matching CPE identifiers
      zlib: Pin down CPE vendor

Bruno Thomsen (2):
      host-system-python3: add dtschema
      kernel: validate device trees against the DT schema

Christian Melki (19):
      qemu: Version bump. 11.1.0 -> 11.1.1
      orc: Version bump. 0.4.42 -> 0.4.43
      libslirp: Version bump. 4.9.3 -> 4.9.4
      iproute2: Version bump. 7.1.0 -> 7.2.0
      expat: Version bump. 2.8.3 -> 2.8.4
      pcre2: Version bump. 10.47 -> 10.48.
      libcurl: Version bump. 8.21.0 -> 8.22.0
      host-libcurl: Follow target libcurl bump 8.21.0 -> 8.22.0
      util-linux: Version bump. 2.42.2 -> 2.42.3
      libxml2: Version bump 2.15.3 -> 2.15.4
      libpcap: Version bump. 1.10.6 -> 1.10.7
      chrony: Version bump. 4.8 -> 4.9
      glib: Version bump. 2.88.3 -> 2.90.0
      orc: Version bump. 0.4.43 -> 0.4.44
      libcap-ng: Version bump. 0.9.5 -> 0.9.6
      linux-firmware: Version bump. 20260810 -> 20260910
      libtirpc: Version bump. 1.3.7 -> 1.3.8
      libpcap: Version bump. 1.10.7 -> 1.11.0
      libinput: Version bump. 1.31.3 -> 1.32.0

Michael Olbrich (12):
      gstreamer1: version bump 1.28.2 -> 1.28.7
      gst-plugins-base1: version bump 1.28.2 -> 1.28.7
      gst-plugins-good1: version bump 1.28.2 -> 1.28.7
      gst-plugins-bad1: version bump 1.28.2 -> 1.28.7
      gst-devtools1: version bump 1.28.2 -> 1.28.7
      gst-libav1: version bump 1.28.2 -> 1.28.7
      gst-plugins-ugly1: version bump 1.28.2 -> 1.28.7
      gst-python1: version bump 1.28.2 -> 1.28.7
      gst-rtsp-server1: version bump 1.28.2 -> 1.28.7
      gst-plugins-rs: version bump 0.15.1 -> 1.28.7
      expat: disable xml-attr-info
      glibmm: version bump 2.78.1 -> 2.90.0

Sven Püschel (3):
      wpa_supplicant: version bump 2.11 -> 2.12
      wireplumber: version bump 0.5.14 -> 0.5.17
      valgrind: version bump 3.26.0 -> 3.27.1


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |