[rpms/glib2] cve-2026-58016-f44: Update to 2.87.0

[Debarshi Ray <rishi@fedoraproject.org>]

            A new commit has been pushed.

            Repo   : rpms/glib2
            Branch : cve-2026-58016-f44
            Commit : 16bddfb147bb353d3619024ec3e44abe047a1ab2
            Author : Debarshi Ray <rishi@fedoraproject.org>
            Date   : 2025-11-10T22:38:21+01:00
            Stats  : +36/-109 in 5 file(s)
            URL    : https://src.fedoraproject.org/rpms/glib2/c/16bddfb147bb353d3619024ec3e44abe047a1ab2?branch=cve-2026-58016-f44

            Log:
            Update to 2.87.0

https://bugzilla.redhat.com/show_bug.cgi?id=2404963

---
diff --git a/default-terminal.patch b/default-terminal.patch
index 99ed6e6..d5517e0 100644
--- a/default-terminal.patch
+++ b/default-terminal.patch
@@ -1,8 +1,8 @@
 diff --git a/gio/gdesktopappinfo.c b/gio/gdesktopappinfo.c
-index 343f30949..48467d189 100644
+index e020230986f4..cfb732695a2b 100644
 --- a/gio/gdesktopappinfo.c
 +++ b/gio/gdesktopappinfo.c
-@@ -2700,6 +2700,7 @@ prepend_terminal_to_vector (int          *argc,
+@@ -2754,6 +2754,7 @@ prepend_terminal_to_vector (int          *argc,
      const char *exec_arg;
    } known_terminals[] = {
      { "xdg-terminal-exec", NULL },
@@ -11,10 +11,10 @@ index 343f30949..48467d189 100644
      { "gnome-terminal", "--" },
      { "mate-terminal", "-x" },
 diff --git a/gio/tests/desktop-app-info.c b/gio/tests/desktop-app-info.c
-index c16e15a71..e9bd06031 100644
+index f880a3dc89ec..e0b1b6da1878 100644
 --- a/gio/tests/desktop-app-info.c
 +++ b/gio/tests/desktop-app-info.c
-@@ -1401,6 +1401,8 @@ get_terminal_divider (const char *terminal_name)
+@@ -1522,6 +1522,8 @@ get_terminal_divider (const char *terminal_name)
  {
    if (g_str_equal (terminal_name, "xdg-terminal-exec"))
      return NULL;
@@ -23,7 +23,7 @@ index c16e15a71..e9bd06031 100644
    if (g_str_equal (terminal_name, "kgx"))
      return "-e";
    if (g_str_equal (terminal_name, "gnome-terminal"))
-@@ -1923,6 +1925,7 @@ main (int   argc,
+@@ -2094,6 +2096,7 @@ main (int   argc,
    guint i;
    const gchar *supported_terminals[] = {
      "xdg-terminal-exec",

diff --git a/glib2.spec b/glib2.spec
index e6fd0fa..3a138dc 100644
--- a/glib2.spec
+++ b/glib2.spec
@@ -1,11 +1,11 @@
 Name:           glib2
-Version:        2.86.1
+Version:        2.87.0
 Release:        %autorelease
 Summary:        A library of handy utility functions
 
 License:        LGPL-2.1-or-later
 URL:            https://www.gtk.org
-Source:         https://download.gnome.org/sources/glib/2.86/glib-%{version}.tar.xz
+Source:         https://download.gnome.org/sources/glib/2.87/glib-%{version}.tar.xz
 
 # Required for RHEL core crypto components policy. Good for Fedora too.
 # https://bugzilla.redhat.com/show_bug.cgi?id=1630260
@@ -15,10 +15,6 @@ Patch:          gnutls-hmac.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2192204
 Patch:          default-terminal.patch
 
-# https://gitlab.gnome.org/GNOME/glib/-/issues/3811
-# https://gitlab.gnome.org/GNOME/nautilus/-/issues/4014
-Patch:          strip-trailing-slashes.patch
-
 BuildRequires:  gcc
 BuildRequires:  gcc-c++
 BuildRequires:  gettext

diff --git a/gnutls-hmac.patch b/gnutls-hmac.patch
index 7ab7473..2bd2e1a 100644
--- a/gnutls-hmac.patch
+++ b/gnutls-hmac.patch
@@ -1,4 +1,4 @@
-From 1e3a9d9d4e68c950647e0fbab548cdf7d28d506c Mon Sep 17 00:00:00 2001
+From d9d12c6724afa90025a633ff24bbe065c3c43920 Mon Sep 17 00:00:00 2001
 From: Colin Walters <walters@verbum.org>
 Date: Fri, 7 Jun 2019 18:44:43 +0000
 Subject: [PATCH 1/4] ghmac: Split off wrapper functions into ghmac-utils.c
@@ -14,7 +14,7 @@ utility functions that call the "core" API.
 
 diff --git a/glib/ghmac-utils.c b/glib/ghmac-utils.c
 new file mode 100644
-index 000000000..a17359ff1
+index 000000000000..a17359ff1505
 --- /dev/null
 +++ b/glib/ghmac-utils.c
 @@ -0,0 +1,145 @@
@@ -164,7 +164,7 @@ index 000000000..a17359ff1
 +                                  (const guchar *) str, length);
 +}
 diff --git a/glib/ghmac.c b/glib/ghmac.c
-index 97e2fff90..de89d826d 100644
+index 97e2fff90994..de89d826d548 100644
 --- a/glib/ghmac.c
 +++ b/glib/ghmac.c
 @@ -356,115 +356,3 @@ g_hmac_get_digest (GHmac  *hmac,
@@ -284,7 +284,7 @@ index 97e2fff90..de89d826d 100644
 -                                  (const guchar *) str, length);
 -}
 diff --git a/glib/meson.build b/glib/meson.build
-index 2522356ee..9704b5eb2 100644
+index 209bcbfd119b..98e4533e3fb8 100644
 --- a/glib/meson.build
 +++ b/glib/meson.build
 @@ -285,6 +285,7 @@ glib_sources += files(
@@ -296,10 +296,10 @@ index 2522356ee..9704b5eb2 100644
    'ghostutils.c',
    'giochannel.c',
 -- 
-2.48.1
+2.51.1
 
 
-From ec546a232253926c8ea03fcb6dd7456fae1d6c42 Mon Sep 17 00:00:00 2001
+From 1faf5c657a0cb73b148cd766f1ad8dcb93dad504 Mon Sep 17 00:00:00 2001
 From: Colin Walters <walters@verbum.org>
 Date: Fri, 7 Jun 2019 19:36:54 +0000
 Subject: [PATCH 2/4] Add a gnutls backend for GHmac
@@ -361,7 +361,7 @@ https://gitlab.gnome.org/GNOME/glib/-/merge_requests/903
  create mode 100644 glib/ghmac-gnutls.c
 
 diff --git a/glib/gchecksum.c b/glib/gchecksum.c
-index 28de99d68..d38c6b069 100644
+index 196fda24a58b..fb9d4ff33777 100644
 --- a/glib/gchecksum.c
 +++ b/glib/gchecksum.c
 @@ -22,7 +22,7 @@
@@ -396,7 +396,7 @@ index 28de99d68..d38c6b069 100644
   * MD5 Checksum
 diff --git a/glib/gchecksumprivate.h b/glib/gchecksumprivate.h
 new file mode 100644
-index 000000000..86c7a3b61
+index 000000000000..86c7a3b61a18
 --- /dev/null
 +++ b/glib/gchecksumprivate.h
 @@ -0,0 +1,32 @@
@@ -435,7 +435,7 @@ index 000000000..86c7a3b61
 \ No newline at end of file
 diff --git a/glib/ghmac-gnutls.c b/glib/ghmac-gnutls.c
 new file mode 100644
-index 000000000..9fb775f89
+index 000000000000..9fb775f89aaf
 --- /dev/null
 +++ b/glib/ghmac-gnutls.c
 @@ -0,0 +1,187 @@
@@ -627,7 +627,7 @@ index 000000000..9fb775f89
 +  *digest_len = g_checksum_type_get_length (hmac->digest_type);
 +}
 diff --git a/glib/ghmac.c b/glib/ghmac.c
-index de89d826d..616e167e7 100644
+index de89d826d548..616e167e7ff2 100644
 --- a/glib/ghmac.c
 +++ b/glib/ghmac.c
 @@ -35,6 +35,9 @@
@@ -660,7 +660,7 @@ index de89d826d..616e167e7 100644
   *   Use g_hmac_unref() to free the memory allocated by it.
   *
 diff --git a/glib/meson.build b/glib/meson.build
-index 9704b5eb2..56b4615b0 100644
+index 98e4533e3fb8..39b37310e810 100644
 --- a/glib/meson.build
 +++ b/glib/meson.build
 @@ -284,7 +284,6 @@ glib_sources += files(
@@ -680,7 +680,7 @@ index 9704b5eb2..56b4615b0 100644
    'guuid.c',
    'gvariant.c',
    'gvariant-core.c',
-@@ -396,6 +397,12 @@ else
+@@ -397,6 +398,12 @@ else
    glib_dtrace_hdr = []
  endif
  
@@ -693,7 +693,7 @@ index 9704b5eb2..56b4615b0 100644
  pcre2_static_args = []
  
  if use_pcre2_static_flag
-@@ -417,6 +424,7 @@ libglib = library('glib-2.0',
+@@ -418,6 +425,7 @@ libglib = library('glib-2.0',
    dependencies : [
      atomic_dep,
      gnulib_libm_dependency,
@@ -702,10 +702,10 @@ index 9704b5eb2..56b4615b0 100644
      libintl_deps,
      libm,
 diff --git a/meson.build b/meson.build
-index bfacf7eeb..7229ea8ef 100644
+index f30ca5806695..74c27c42487f 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2336,6 +2336,13 @@ if host_system == 'linux'
+@@ -2367,6 +2367,13 @@ if host_system == 'linux'
    endif
  endif
  
@@ -720,7 +720,7 @@ index bfacf7eeb..7229ea8ef 100644
    winsock2 = cc.find_library('ws2_32')
    # Used for g_win32_clear_com() tests...
 diff --git a/meson.options b/meson.options
-index 37dc9911d..a15cac10e 100644
+index 5ebbe4d87bbe..b6faedd3f606 100644
 --- a/meson.options
 +++ b/meson.options
 @@ -37,6 +37,11 @@ option('libmount',
@@ -736,10 +736,10 @@ index 37dc9911d..a15cac10e 100644
         type : 'boolean',
         value : false,
 -- 
-2.48.1
+2.51.1
 
 
-From 62ce381188942059bbdd6bab2aa55c7bb176ce46 Mon Sep 17 00:00:00 2001
+From 4460e94cc06279e903dc27670db1733200d8d458 Mon Sep 17 00:00:00 2001
 From: Michael Catanzaro <mcatanzaro@redhat.com>
 Date: Wed, 16 Jun 2021 20:35:00 -0500
 Subject: [PATCH 3/4] dlopen GnuTLS instead of linking directly
@@ -767,7 +767,7 @@ for our purposes.
  4 files changed, 103 insertions(+), 11 deletions(-)
 
 diff --git a/glib/ghmac-gnutls.c b/glib/ghmac-gnutls.c
-index 9fb775f89..1800fc2e0 100644
+index 9fb775f89aaf..1800fc2e059e 100644
 --- a/glib/ghmac-gnutls.c
 +++ b/glib/ghmac-gnutls.c
 @@ -19,8 +19,8 @@
@@ -908,7 +908,7 @@ index 9fb775f89..1800fc2e0 100644
    hmac->digest_type = digest_type;
  
 diff --git a/glib/ghmac.c b/glib/ghmac.c
-index 616e167e7..ddb163557 100644
+index 616e167e7ff2..ddb1635578db 100644
 --- a/glib/ghmac.c
 +++ b/glib/ghmac.c
 @@ -35,7 +35,7 @@
@@ -921,10 +921,10 @@ index 616e167e7..ddb163557 100644
  #endif
  
 diff --git a/glib/meson.build b/glib/meson.build
-index 56b4615b0..9d0779af3 100644
+index 39b37310e810..57a7d3efb7f2 100644
 --- a/glib/meson.build
 +++ b/glib/meson.build
-@@ -424,7 +424,6 @@ libglib = library('glib-2.0',
+@@ -425,7 +425,6 @@ libglib = library('glib-2.0',
    dependencies : [
      atomic_dep,
      gnulib_libm_dependency,
@@ -933,10 +933,10 @@ index 56b4615b0..9d0779af3 100644
      libintl_deps,
      libm,
 diff --git a/meson.build b/meson.build
-index 7229ea8ef..d14cc6c1e 100644
+index 74c27c42487f..3470ccc87f06 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2336,12 +2336,10 @@ if host_system == 'linux'
+@@ -2367,12 +2367,10 @@ if host_system == 'linux'
    endif
  endif
  
@@ -954,10 +954,10 @@ index 7229ea8ef..d14cc6c1e 100644
  if host_system == 'windows'
    winsock2 = cc.find_library('ws2_32')
 -- 
-2.48.1
+2.51.1
 
 
-From cad32fc8043ce7f49c00cc44d040ca5e37f6d967 Mon Sep 17 00:00:00 2001
+From 0ab98c1d239b93038354f25c6f2625a3a654f804 Mon Sep 17 00:00:00 2001
 From: Michael Catanzaro <mcatanzaro@redhat.com>
 Date: Wed, 16 Jun 2021 20:46:24 -0500
 Subject: [PATCH 4/4] Disable MD5 and SHA-1 HMac tests
@@ -969,7 +969,7 @@ which may disable the algorithms.
  1 file changed, 11 insertions(+)
 
 diff --git a/glib/tests/hmac.c b/glib/tests/hmac.c
-index 3ac3206df..e7f3fdf08 100644
+index 3ac3206df3eb..e7f3fdf089b8 100644
 --- a/glib/tests/hmac.c
 +++ b/glib/tests/hmac.c
 @@ -1,7 +1,10 @@
@@ -1043,5 +1043,5 @@ index 3ac3206df..e7f3fdf08 100644
    g_test_add_func ("/hmac/ref-unref", test_hmac_ref_unref);
    g_test_add_func ("/hmac/copy", test_hmac_copy);
 -- 
-2.48.1
+2.51.1
 

diff --git a/sources b/sources
index c223a61..7e9f5fb 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (glib-2.86.1.tar.xz) = b2e9a3a35cd4cbe0bb6ca493a4250df480eeb0570a0877880ff4ec6d7f1f98d828249b3b60f839b81f17a33494d95be9d42b5f20fa6bb1acb15bcf5734adba51
+SHA512 (glib-2.87.0.tar.xz) = 07b58dc0bc395c6a53c9bc5d21674307ce9f0a836c82c04db5d5c3163685333f86ff237fc1cfde60daa10796d0de4c5ba90aa4bca056f4d670c73d97d0868b73

diff --git a/strip-trailing-slashes.patch b/strip-trailing-slashes.patch
deleted file mode 100644
index 9f968c9..0000000
--- a/strip-trailing-slashes.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From bb23a0e8cb2426c1b52a0d3d89bd97cc17919961 Mon Sep 17 00:00:00 2001
-From: Tobias Stoeckmann <tobias@stoeckmann.org>
-Date: Fri, 24 Oct 2025 13:34:03 +0200
-Subject: [PATCH] gutils: Strip all trailing slashes
-
-The code stripped all but the first trailing slash in order to handle
-the absolute root path "/". This breaks the removal of trailing slashes
-for paths starting with $HOME, though.
-
-Fix the logic to remove all trailing slashes if $HOME is encountered.
-
-Closes #3811
----
- glib/gutilsprivate.c | 6 ++++--
- glib/tests/utils.c   | 7 ++++++-
- 2 files changed, 10 insertions(+), 3 deletions(-)
-
-diff --git a/glib/gutilsprivate.c b/glib/gutilsprivate.c
-index 083f88c2ccc2..3b9206c45ce9 100644
---- a/glib/gutilsprivate.c
-+++ b/glib/gutilsprivate.c
-@@ -27,6 +27,7 @@ load_user_special_dirs_from_string (const gchar *string, const gchar *home_dir,
- {
-   gchar **lines;
-   gint n_lines, i;
-+  size_t min_len;
- 
-   lines = g_strsplit (string, "\n", -1);
-   n_lines = g_strv_length (lines);
-@@ -122,8 +123,9 @@ load_user_special_dirs_from_string (const gchar *string, const gchar *home_dir,
- 
-       d = p;
- 
--      /* remove trailing slashes */
--      for (len = strlen (d); len > 1 && d[len - 1] == '/'; len--)
-+      /* remove trailing slashes, but keep first slash in absolute path */
-+      min_len = is_relative ? 0 : 1;
-+      for (len = strlen (d); len > min_len && d[len - 1] == '/'; len--)
-         d[len - 1] = 0;
- 
-       /* Duplicates override the previous value. This is not explicit in the
-diff --git a/glib/tests/utils.c b/glib/tests/utils.c
-index 2d0b2ed70876..e886897ba095 100644
---- a/glib/tests/utils.c
-+++ b/glib/tests/utils.c
-@@ -883,7 +883,9 @@ test_user_special_dirs_load_unlocked (void)
-                                     "XDG_DOWNLOAD_DIR = \"$HOME/Downloads\"\n"
-                                     "XDG_MUSIC_DIR = \"///\"\n"
-                                     "XDG_PICTURES_DIR = \"$HOME/Pictures\"\n"
--                                    "XDG_PICTURES_DIR = \"/\"\nXDG_DOWNLOAD_DIR = \"/dev/null\n");
-+                                    "XDG_PICTURES_DIR = \"/\"\n"
-+                                    "XDG_PUBLICSHARE_DIR = \"$HOME/\"\n"
-+                                    "XDG_DOWNLOAD_DIR = \"/dev/null\n");
- 
-       g_reload_user_special_dirs_cache ();
- 
-@@ -903,6 +905,9 @@ test_user_special_dirs_load_unlocked (void)
- 
-       dir = g_get_user_special_dir (G_USER_DIRECTORY_PICTURES);
-       g_assert_cmpstr (dir, ==, "/");
-+
-+      dir = g_get_user_special_dir (G_USER_DIRECTORY_PUBLIC_SHARE);
-+      g_assert_cmpstr (dir, ==, g_get_home_dir ());
-     }
-   else
-     {
--- 
-2.51.1
-