I want to update python-dotenv to 1.2.2 in f44 and f43. This version contains a breaking change to fix CVE-2026-28684, CVSS v3 score 7.1.

While the change is breaking, it does not break any Fedora 43, 44 or 45 packages from building and passing %check unless they already did FTBFS.

From the policy:

Things that would make it more likely to grant a request:

The package is a "leaf" node. Nothing depends on it or requires it.

Not true, but nothing seems broken, at least not in %check.

The update fixes a security issue that would affect a large number of users.

It fixes a security issue. No data about the number of users. If it's not a large number, at least we are not potentially breaking it for a large number :)

The update doesn’t change ABI/API and nothing needs to be rebuilt against the new version.

Indeed, it does not. It extends the API in a backward-compatible way.

The update fixes serious bugs that many Fedora users are encountering.

No data about users.

Things that would make it less likely to grant a request:

The update converts databases or resources one way to a new format.

Nope.

The update requires admin intervention for the service to keep working (config file format changes, etc.)

Nope.

The update causes behavior changes (something that was denied is allowed, etc.)

Yes, it does. Otherwise, I would not request this exception. See the commit message for details. I consider this change OK to be shipped (otherwise I wouldn't request this exception either).

The update changes the UI the end user sees (moves menus or buttons around, changes option names on command line)

Nope.

The update fixes bugs that no Fedora user has reported nor would affect many Fedora users (i.e., fixes for other platforms or configurations).

It's a CVE that affects our platform. No Fedora user has reported it, prodsec did.