openstack/glance — Week of 2026-09-12

Image-import hardening. The week is almost entirely about locking down where Glance will actually connect when pulling images from the network. New logic pins import downloads to a validated destination address so the URL that passed policy checks is the one the socket opens, and adding an HTTP image location or a web-download import URI now rejects restricted hosts up front. A companion change properly enforces the fetch-size limit on web-download so oversized responses are cut off. Together this is roughly 1,400 lines of security-relevant plumbing landing on master and being carried back across stable branches — the "pin destination" and "block restricted hosts" patches each shipped in multiple backport copies, and the DNS-resolution fix that now iterates over every allowed address before giving up landed three times in parallel. See the master patch for the destination-pinning approach.

Stability. Beyond the import-path work, a small doc fix clarifies a config dependency exercised by the stage test, and the cursive dependency path was updated after that project moved.

Release plumbing. Master was opened for the next cycle with the standard stable/2026.2 branch creation: .gitreview, TOX_CONSTRAINTS_FILE, and the master-version bump all landed together.