OSTree Files

Fixes

This release reverts the static delta decompression-size safety margin introduced in 2026.3, which turned out to reject legitimate large deltas at apply time -- most visibly, Flathub Firefox updates were failing with Decompressed delta part exceeds configured limit (#3635).

Both the margin heuristic and the flat 512 MiB per-part decompression cap it fed into have been dropped for now. This deliberately reopens GHSA-7cgc-gp99-6jmm (unbounded decompression of a given delta part) until a precise, per-part exact-size-based replacement lands in a future release. The LZMA decoder memory limit (100 MiB) from that same advisory's fix is unaffected and remains in place.

Also in this release:

• core: fixed a double-increment bug in _ostree_validate_structureof_xattrs that caused every other xattr entry to be skipped during validation, letting a crafted xattr array hide unsorted or duplicate entries in odd-indexed slots (#3638).

What's Changed

• Release 2026.3 by @jmarrero in https://github.com/ostreedev/ostree/pull/3630
• tests: Fix flaky kola destructive tests by @jmarrero in https://github.com/ostreedev/ostree/pull/3631
• core: don't skip entries in _ostree_validate_structureof_xattrs by @kali834x in https://github.com/ostreedev/ostree/pull/3638
• Static delta revert margin heuristic by @cgwalters in https://github.com/ostreedev/ostree/pull/3645
• build: Remove G_GNUC_CONST from ostree-enumtypes.h.template by @correctmost in https://github.com/ostreedev/ostree/pull/3636

New Contributors

• @correctmost made their first contribution in https://github.com/ostreedev/ostree/pull/3636

Full Changelog: https://github.com/ostreedev/ostree/compare/v2026.3...v2026.4