"libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line."
1.6.0 appears to just deprecate this way of passing the credentials. Now what is actually passing them like that is the real question, I'd think.
I don't mind stabilizing a newer version on the pretext of security, but that doesn't mean other stuff calling osinfo-install-script now suddenly doesn't put the password into the process commandline anymore.
So lets stable anyways as we are so behind on libosinfo, and there have been no bug reports that I know of for a week for this version.
osinfo-db I usually ALLARCHES myself, but due to the huge jump and some test cases moving churn upstream lets include it in the batch without ALLARCHES this time.
Repository is clean, all done!