chore(deps): rpm updates [security]

[red-hat-konflux]

This PR contains the following updates:

Package	Update	Change
xz	patch	5.2.4-3.el8 -> 5.2.4-4.el8_6

---

xz: XZ has a heap-use-after-free bug in threaded .xz decoder

CVE-2025-31115

More information

Details

A flaw was found in the XZ Utils library. In affected versions, the multithreaded .xz decoder in liblzma has a bug where invalid input can trigger a heap use-after-free condition, allowing writes to an address based on the null pointer plus an offset. This issue may result in a crash or other undefined behavior. Applications and libraries that use the lzma_stream_decoder_mt function are affected.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2025-31115
• https://bugzilla.redhat.com/show_bug.cgi?id=2357249
• https://www.cve.org/CVERecord?id=CVE-2025-31115
• https://nvd.nist.gov/vuln/detail/CVE-2025-31115
• https://github.com/tukaani-project/xz/commit/d5a2ffe41bb77b918a8c96084885d4dbe4bf6480
• https://github.com/tukaani-project/xz/security/advisories/GHSA-6cc8-p5mm-29w2
• https://tukaani.org/xz/xz-cve-2025-31115.patch

---

Configuration

📅 Schedule: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

This PR has been generated by MintMaker (powered by Renovate Bot).

[msugakov]

/retest scanner-slim-on-push

[openshift-ci]

@msugakov: The /retest command does not accept any targets.
The following commands are available to trigger optional jobs:

/test e2e-tests

/test slim-e2e-tests

Use /test all to run all jobs.

In response to this:

/retest scanner-slim-on-push

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@red-hat-konflux[bot]: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-tests	653885e	link	false	/test e2e-tests

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[msugakov]

Related thread https://redhat-internal.slack.com/archives/C081BAM590Q/p1746778354000039