- CVE-2022-40897: regex denial of service via crafted HTML in package_index - CVE-2024-6345: remote code execution via command injection in VCS download functions - CVE-2025-47273: path traversal in PackageIndex download filename resolution - Fix el7 build so the CVE fixes above can ship there: rpm 4.11 strips backslashes in shell-expansion macro bodies, so the sed capture group in the os_install_post override never matched and python3.9 modules were bytecompiled with the system python2, failing the install step on python3-only syntax; rewrite the sed without a group and stop relying on the interpreter-path macro from alt-python39-devel, whose macros file lives in /usr/lib/rpm/macros.d that rpm 4.11 does not read