Description of the patch:
This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues:
Security issues fixed:
- CVE-2025-13465: lodash: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from
global prototypes (bsc#1257325).
- CVE-2026-4631: SSH command-line argument injection can lead to unauthenticated remote code execution (bsc#1261829).
- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and
may crash a Node.js process (bsc#1257836 bsc#1257838 bsc#1257840).
- CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character
that doesn't appear in the test string (bsc#1258637 bsc#1258640 bsc#1258641).
- CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking
complexity and a ReDoS (bsc#1259010 bsc#1259013 bsc#1259015).
Non security issues fixed:
- cockpit webUI - 'Software updates - install all updates' got an unexpected internal error (bsc#1259210).
- cockpit-machines does not work out of the box, missing libvirt daemon (bsc#1236149).
Changes for cockpit:
- Remove all "Mount" actions in Anaconda mode
- Dependency updates
- ws: be more explicit when handling hostnames on cli bsc#1261829/CVE-2026-4631
- ws: support loading a custom login page
- Networking: Add Wi-Fi support
- Cockpit Client updated to GTK 4
- Bugfixes and translation updates
- lib: Use browser context menu on shift
- bridge: support Python 3.14 on old kernels (RHEL 8)
- systemd: Allow editing timers created by Cockpit
- Convert license headers to SPDX format
- ws: Remove obsolete pam_cockpit_cert module
- shell: add...