Fedora 43: libwebsockets update bumps SONAME causing DNF dependency issues

Ask Fedora
1

There was a libwebsockets update [1] from 4.4.1-2.fc43 to 4.5.8-2.fc43. This update bumped the SONAME of the library from .20 to .21 thereby making (at least) a rebuild of mosquitto a necessity, which hasn’t not be done:

Repositories loaded.
Problem: installed package mosquitto-2.0.22-6.fc43.x86_64 requires libwebsockets.so.20()(64bit), but none of the providers can be installed
  - cannot install both libwebsockets-4.5.8-2.fc43.x86_64 from updates and libwebsockets-4.4.4-1.fc43.x86_64 from @System
  - cannot install both libwebsockets-4.4.1-2.fc43.x86_64 from fedora and libwebsockets-4.5.8-2.fc43.x86_64 from updates
  - cannot install the best update candidate for package mosquitto-2.0.22-6.fc43.x86_64
  - cannot install the best update candidate for package libwebsockets-4.4.4-1.fc43.x86_64

Package                                     Arch        Version                                     Repository                  Size
Skipping packages with conflicts:
 libwebsockets                              x86_64      4.5.8-2.fc43                                updates                961.7 KiB
 libwebsockets                              x86_64      4.4.1-2.fc43                                fedora                 919.7 KiB

Nothing to do.
  1. Making sure you're not a bot!
3

…add kismet also:

Repositories loaded.
Problem 1: installed package kismet-0.0.2025.09.R1-1.fc43.x86_64 requires libwebsockets.so.20()(64bit), but none of the providers can be installed
  - cannot install both libwebsockets-4.5.8-2.fc43.x86_64 from updates and libwebsockets-4.4.4-1.fc43.x86_64 from @System
  - cannot install both libwebsockets-4.4.1-2.fc43.x86_64 from fedora and libwebsockets-4.5.8-2.fc43.x86_64 from updates
  - cannot install the best update candidate for package libwebsockets-4.4.4-1.fc43.x86_64
  - cannot install the best update candidate for package kismet-0.0.2025.09.R1-1.fc43.x86_64
 Problem 2: problem with installed package
  - installed package kismet-0.0.2025.09.R1-1.fc43.x86_64 requires libwebsockets.so.20()(64bit), but none of the providers can be installed
  - package kismet-0.0.2025.09.R1-1.fc43.x86_64 from fedora requires libwebsockets.so.20()(64bit), but none of the providers can be installed
  - cannot install both libwebsockets-4.5.8-2.fc43.x86_64 from updates and libwebsockets-4.4.4-1.fc43.x86_64 from @System
  - cannot install both libwebsockets-4.4.1-2.fc43.x86_64 from fedora and libwebsockets-4.5.8-2.fc43.x86_64 from updates
  - package mosquitto-2.0.22-6.fc43.1.x86_64 from copr:copr.fedorainfracloud.org:allenhewes:f43-override requires libwebsockets.so.21()(64bit), but none of the providers can be installed
  - cannot install the best update candidate for package mosquitto-2.0.22-6.fc43.x86_64

Package                                Arch   Version                                Repository                                 Size
Skipping packages with conflicts:
 libwebsockets                         x86_64 4.5.8-2.fc43                           updates                               961.7 KiB
 libwebsockets                         x86_64 4.4.1-2.fc43                           fedora                                919.7 KiB
Skipping packages with broken dependencies:
 mosquitto                             x86_64 2.0.22-6.fc43.1                        copr:copr.fedorainfracloud.org:allenh   1.0 MiB
 kismet                                x86_64 0.0.2025.09.R1-1.fc43                  fedora                                 23.2 MiB

Nothing to do.
4

A better place to report this issue is at https://bugzilla.redhat.com/ for the component kismet and mosquitto.

6

It probably should have been updated to version 4.4.5 instead of being switched to the 4.5 branch

7

mosquitto: 2507510 – F43FailsToInstall: mosquitto

https://bodhi.fedoraproject.org/updates/FEDORA-2026-923c12c14d

kismet: 2507497 – F43FailsToInstall: kismet

8

IMHO this is still wrong. The update to libwebsockets should be replaced by security update libwebsockets v4.4.5 .

there are more packages affected by the ABI change ,

# dnf rq --whatdepends  "libwebsockets.so.20()(64bit)" --releasever 43
Updating and loading repositories:
Repositories loaded.
ardour7-0:7.5.0-17.fc43.x86_64
ardour8-0:8.12.0-5.fc43.x86_64
ardour9-0:9.7.0-1.fc43.x86_64
janus-eventhandlers-ws-0:1.3.1-4.fc43.x86_64
janus-eventhandlers-ws-0:1.3.3-1.fc43.x86_64
janus-transports-websockets-0:1.3.1-4.fc43.x86_64
janus-transports-websockets-0:1.3.3-1.fc43.x86_64
kismet-0:0.0.2025.09.R1-1.fc43.x86_64
libguac-client-kubernetes-0:1.6.0-3.fc43.x86_64
libwebsockets-devel-0:4.4.1-2.fc43.x86_64
mosquitto-0:2.0.22-4.fc43.x86_64
mosquitto-0:2.0.22-6.fc43.x86_64
seadrive-daemon-0:3.0.16-2.fc43.x86_64
seadrive-daemon-0:3.0.21-1.fc43.x86_64
seafile-0:9.0.15-2.fc43.x86_64
seafile-0:9.0.16-1.fc43.x86_64
ttyd-0:1.7.7-7.fc43.x86_64
vdr-osd2web-0:0.3.2-19.fc43.x86_64
9

Yeah, I 100% agree… but how do we get there now? The cat is out of the bag so-to-speak… A proven packager did the update :person_shrugging:

I suspect there are F43FailsToInstall rhbz’s for those packages as well. I didn’t check as I only had mosquitto and kismet installed and that’s how I stumbled across this.

I just did COPR rebuilds for my needs to get past this… I guess I could have gone the other way as I don’t know why I’d have mosquitto / kismet installed.

10

There is a way to roll out 4.4.5, I think there is a keyword in the rpmspec to override a higher version number. Has been used a few months ago to roll back an update for gdk-pixbuf2(?) in F44.

11

My RPM and Fedora macro knowledge is dated, but I would have suggested an epoch, but that’s not what you linked to there…

So I am not sure I have anything useful to contribute now…

12

I am surprised this update got through bodhi to be honest. I would have assumed (maybe that’s my issue) that this would have been caught by/in bodhi…

13

Ahhhh, Milan is using the caret operator to make RPM’s version sorting rank his change as newer… That’s a neat trick tbh…

14

Increase the epoch so the epoch:version would become 2:4.4.5. That would be then considered newer than 4.5.x.

In general, bumping a SONAME would require a total rebuild of all packages as would be done on every Fedora version before a beta is released.

15

Probably far to drastic, since this change would affect all active and future branches.

the F43 update could / should(?) be rolled back using a package similar to this one
spec file

$ rpm -qi libwebsockets
Name        : libwebsockets
Version     : 4.5.8^really4.4.5
Release     : 1.fc43
Architecture: x86_64
Install Date: Thu 30 Jul 2026 10:10:20 AM CEST

$ ll /usr/lib64/libwebsockets.so.*
-rwxr-xr-x. 1 root root 845080 Mar 19 01:00 /usr/lib64/libwebsockets.so.20

# dnf up libwebsockets
Updating and loading repositories:
 Copr repo for F43-libwebsockets owned by anotheruser                                                 100% |   2.0 KiB/s |   1.5 KiB |  00m01s
Repositories loaded.
Package                                   Arch   Version                                   Repository                                     Size
Upgrading:
 libwebsockets                            x86_64 4.5.8^really4.4.5-1.fc43                  copr:copr.fedorainfracloud.org:anotheruse 946.8 KiB
   replacing libwebsockets                x86_64 4.5.8-2.fc43                              updates                                   961.7 KiB

and will be replaced during a system-upgrade

# dnf system-upgrade download --releasever=44
Downgrading:
[deleted]
 libwebsockets                                             x86_64 4.5.8-1.fc44                 updates  993.8 KiB
   replacing libwebsockets                                 x86_64 4.5.8^really4.4.5-1.fc43     copr:cop 946.8 KiB

no changes required in F44+