pulp/pulpcore 3.123.2

on GitHub

3.123.2 (2026-11-05)

REST API

Bugfixes

• Fixed uploads of files whose names start with artifact when the media root is empty.
  #8041
• Insures that Content-Disposition, Content-Security-Policy, and X-Content-Type-Options
  are set consistently in the content-app. This addresses CVE-2026-84232.

Plugin API

Bugfixes

• Pulp's gpg_verify() function now respects the system policy for the sequoia crypto library in /etc/crypto-policies/back-ends/sequoia.config (or the path set by the environment variable SEQUOIA_CRYPTO_POLICY).

Pulp File

No significant changes.

Pulp Cert Guard

No significant changes.