[DevomB]

Main's pin gate fails on ten upstream releases with no current review row. This adds or updates one row in tools/pin-reviews.tsv for each, dated 2026-10-23, and restores the held section between the toolchain and fine sections.

package	pinned	reviewed up to	verdict	why
iproute2	7.2.0	7.3.0	fine	35 commits: new features (OVPN, DPLL, nexthop fdb ports, bond lacp_strict), small leak fixes, header and warning updates. No security fix.
elfutils	0.191	0.197	fine	Five libelf commits in 0.197. The one that matters bounds the allocation a crafted zstd-compressed section asks for. Only root loading BPF through ip or tc would parse a foreign object. The readelf, libdw and unstrip fixes are in code the image does not install.
s6-rc	0.7.0.0	0.8.0.2	fine	The one fix enlarges s6-rc-set-new's buffer, which 0.8.0.1 had left one byte short. 0.7.0.0 sizes it right, and Kryptik runs no s6-rc-set command.
linux-firmware	20260916	20261019	fine	Changed files the image ships: AMD family 1Ah microcode (models 02h and 11h only), iwlwifi core24.80-41, amdgpu updates, ath11k/ath12k board files. No commit, AMD or Intel advisory, Debian tracker entry or NVD record names a security fix in them.
nano	9.2	9.3	fine	Mini bar file-name clipping, keypad operator keys, Alt with multibyte input, tidying. No security fix.
harfbuzz	14.6.0	15.0.0	fine	GHSA-r62p-jr5f-3mjm is in libharfbuzz-subset, which the toolkit image does not build. The hb_font_set_face/hb_font_set_variation memory fixes need calls that the pinned Pango 1.58.2 and GTK 3.24.52 never make (checked in the tarballs).
llvm	23.1.3	23.1.4	fine	34 code generation and tooling fixes. No security fix. Only bindgen's libclang and configure's llvm-objdump use this build. GCC compiles the browser.
ca-bundle	2026-08-13	2026-10-20	held	Same certdata.txt as 2026-09-25, but curl.se leaves out three emSign roots after the eMudhra intermediate key compromise reported on 2026-10-20. NSS 3.131.1 drops the same three. With the pin, OpenSSL and Python (the net zone's release-server check, lynx in a zone) still trust them.
firefox	153.5.0	153.5.1	held	MFSA 2026-112, CVE-2026-113470 (high): the built-in OneCRL entries for the compromised eMudhra intermediates. A profile made fresh at each start lacks them until Remote Settings syncs.
node	24.22.0	24.22.1	held	A security release (seven CVEs, plus OpenSSL 3.5.9 and NSS 3.131.1 roots). Node only runs offline in the browser's build, so none of it reaches a running system. It is held because it is a security release.

The bumps for the three held rows are queued. None is made today: the owner tests on a laptop this weekend, and each one rebuilds the 2.5-hour browser image. ca-bundle is built before wlroots, the base every image is built on.

Held rows pass main's gate. A release tag's --no-held check refuses them until the three bumps land.

Checked with tools/check-pin-reviews.sh --survey against a hand-made survey of these ten packages, plus libaio as UNKNOWN. All ten rows parse and none is stale. The three held rows print as HELD, and --no-held refuses them.