Hi, all.

GnuPG 2.4.9-freepg-1 has been released.

It contains backported bugfixes from upstream GnuPG 2.5, plus all the
previous FreePG patches.

Since 31st of December last year, upstream GnuPG is no longer providing
bugfix releases for the 2.4 branch, in an attempt to encourage people to
upgrade to 2.5. The FreePG project considers the 2.5.x branch to be
experimental, primarily due to its use of non-OpenPGP algorithms by
default, and is continuing to support 2.4 by porting bugfixes from the
2.5 and 2.2 branches, which are both still maintained upstream.

Release Notes
=============

Noteworthy changes in version 2.4.9-freepg-1 (2026-07-02)
---------------------------------------------------------

- Backported several bugfixes from 2.5:

   * dirmngr: Fix a call of calloc.
   * agent: Fix the regression in pkdecrypt with TPM RSA.
   * tpm: Fix possible buffer overflow in PKDECRYPT
   * gpg: Fix armor parsing when no CRC is found.
   * gpg: Fix armored input parsing.
   * gpg: Fix handling with no CRC armor.
   * gpgsm: Require a minimum tag length for GCM decryption.
   * gpg: Fix edge case in --refresh-keys

- Fixed several tests introduced by the "tests: add test cases for
import without uid" patch.

https://gitlab.com/freepg/gnupg/-/releases/gnupg-2.4.9-freepg-1