easybuilders/easybuild easybuild-v5.4.2 on GitHub

EasyBuild v5.4.2 is primarily a security bug fix release, though it also includes other minor bug fixes, minor enhancements, software updates, support for new software projects, and more.

Highlights for this release are listed below.

More details are available in the detailed release notes which includes links to the respective pull requests for more information.

A note on security fixes

Several security issues have been reported in the last ~10 days, some of which for software projects supported by EasyBuild.

To be clear: these security issues don't apply to EasyBuild itself, though they are relevant if you use EasyBuild to install affected software...

The most prominent issue was the removal of trust in some root certificates (primarily an emSign one), a result of the private keys of eMudhra intermediate CA certificates that got compromised (see also https://emudhra.we-have-a-problem.com, https://access.redhat.com/security/vulnerabilities/RHSB-2026-012).

Apparently, these root certificates are copied all over the place in software, including in pip, the certifi Python packages, the Mozilla::CA Perl package, several R packages, Java (SDK), Go (and software built with it!), etc.

It's quite telling that a security issue doesn't get just one but several CVEs assigned to it...

In addition, a buffer overflow vulnerability in Brotli also got a lot of attention (see https://app.opencve.io/cve/CVE-2026-111497).

In reaction to this, we have added patches and applied in-place updates in various easyconfig files.

It is strongly recommended that you re-install these easyconfig files.
(Yes, we know this is painful to do, since many of the affected easyconfig files are commonly used dependencies).

We do want to point out that the only guarantee we can provide is that more weeding out of untrusted root certificates and adding patches for more software will be necessary in the near future.

There's just no way we have covered every possible things we could cover, but we didn't want to hold back this release any further.

Although the updated easyconfig files in this EasyBuild release fix several of the reported security issues, there is definitely more work to do to mitigate this hot mess...

Next to rebuilding the easyconfigs to which patches were added to mitigate security issues, we also recommend taking a look at the script that we implemented with several EasyBuild maintainers and contributors to remove untrusted root certificates from software installations without reinstalling them, see https://github.com/easybuilders/eMudhra-untrusted-certificates.

Prominent security/bug fixes & changes

(bug fixes or changes that (may) warrant re-installing easyconfigs are marked with (***))

restore initial environment after each installation in build_and_install_software function;
fix --sanity-check-only for Bundle easyblock;
(***) add patch for pip extension in Python easyconfigs to remove emSign root CA certificate;
(***) in place update of certifi extension in easyconfigs for: Python 3.10.x, Python-bundle-PyPI, poetry, flit, wfdb;
(***) add backported patch to make Python's ssl module distrust those root certificates;
(***) in place update of Mozilla::CA extension in Perl-bundle-CPAN easyconfigs and (old) Perl easyconfigs;
(***) add patch for openssl extension in R easyconfigs to remove emSign root CA certificate;
(***) add patch for RCurl and rsconnect extensions in R-bundle-CRAN easyconfigs to remove emSign root CA certificate;
(***) add patch for Julia multiarch to remove emSign root CA certificate;
(***) in-place update to Go 1.26.10 as build dependency for: caddy, elprep 5.1.2, gh-dash 4.26.0, gh, git-lfs, git-lfs-s3, Miller, OBITools4, ollama, rclone 1.66.0+, SeqKit 2.10.1+, s9s, tcping, yq;
(***) update Java wrappers to latest corresponding version;
(***) add post-install command to expand list of blocked certificates for Java;
(***) add patches for Brotli to fix CVE-2026-111497;
(***) use Brotli libraries from dependency in Brotli-python;
(***) add support for UNIX sockets to tensorboard for secure usage in Open OnDemand;
remove easyconfigs for older versions of rclone;
remove easyconfigs for older versions of SeqKit;
archive CVE ridden code-servers;
(***) build Mesa in OpenGL 2025.09 with static LLVM to drop LLVM to build dependency;
(***) remove unavailable interactiveDisplayBase from R-bundle-Bioconductor/3.23;

Highlighted enhancements & updates

(enhancements or updates that (may) warrant updating existing installations are marked with (***))

disable post-install pip check if it failed before install for EasyBuild;

Supported software

Support for installing 46 new software packages has been added, including (but not limited to):

AGFusion
complexPyTorch
DIPPER
FusionInspector
metaMIC
nimblephysics
Polypolish
PowerFLOW
pyhanami
scikit-bio-binaries
tigramite
xCDAT

This brings the total number of supported software packages to 3,273 (excluding extensions)!

Various software updates have been added, including (but not limited to):

ArviZ 1.0.0
BBMap 40.02
code-server 4.143.1
CuPy 14.2.0
DFT-D4 4.2.0
Go 1.26.10
LDC 1.43.0
NanoPlot 1.44.1
PyWavelets 1.10.0
Spark 4.2.0,
SymEngine 0.15.0,
tblite 0.6.0
VSEARCH 2.32.0

An up-to-date list of supported software is available here.

Contributions

These changes result from various contributions, made by 20 different contributors:

8 merged pull requests for EasyBuild framework
7 merged pull requests for easyblocks
177 merged pull requests for easyconfigs

Thanks to everyone who contributed to this release in one way or another!

Upgrading

To upgrade to EasyBuild v5.4.2, there are several options.
Two particularly easy options include:

eb --install-latest-eb-release
eb --from-pr 27312 # use easyconfig from PR #27312

easybuilders/easybuild easybuild-v5.4.2 EasyBuild v5.4.2 on GitHub