This patch release fixes transactions that an agent sent while dnf was still running them. Their package changes never reached the server, so some assets showed the wrong builds as installed, including in the CVE Exposure card.
Fixes
- Leave transactions stored without an end time out of
GET /v1/transactions/ids, so the agent sends them again until dnf records their end. This needs an agent release with the matching parser fix. A transaction that dnf aborted never gets an end time, so the agent sends it again on every run. - Count only install and removal actions in a transaction's vulnerability list, so
Reason Changeitems no longer show as introduced vulnerabilities.
Full Changelog: v1.39.1...v1.39.2