v2026.4

Fixes

This release reverts the static delta decompression-size safety margin introduced in 2026.3, which turned out to reject legitimate large deltas at apply time -- most visibly, Flathub Firefox updates were failing with Decompressed delta part exceeds configured limit (#3635).

Both the margin heuristic and the flat 512 MiB per-part decompression cap it fed into have been dropped for now. This deliberately reopens GHSA-7cgc-gp99-6jmm (unbounded decompression of a given delta part) until a precise, per-part exact-size-based replacement lands in a future release. The LZMA decoder memory limit (100 MiB) from that same advisory's fix is unaffected and remains in place.

Also in this release:

• core: fixed a double-increment bug in _ostree_validate_structureof_xattrs that caused every other xattr entry to be skipped during validation, letting a crafted xattr array hide unsorted or duplicate entries in odd-indexed slots (#3638).

What's Changed

• Release 2026.3 by @jmarrero in #3630
• tests: Fix flaky kola destructive tests by @jmarrero in #3631
• core: don't skip entries in _ostree_validate_structureof_xattrs by @kali834x in #3638
• Static delta revert margin heuristic by @cgwalters in #3645
• build: Remove G_GNUC_CONST from ostree-enumtypes.h.template by @correctmost in #3636

New Contributors

• @correctmost made their first contribution in #3636

Full Changelog: v2026.3...v2026.4