# changelog

author: Douglas Kosovic <doug@uq.edu.au> - 1.20.20-5
changelog:
  - Add README.Fedora for Fedora or README.EPEL for EPEL
  - Use (go-l2tp or xl2tpd) dependency for Fedora 43 to handle upgrades
    from earlier Fedora versions that had xl2tpd installed.


author: Douglas Kosovic <doug@uq.edu.au> - 1.52.0-1
changelog:
  - Updated to 1.52.0 release
    Verify file permissions for private connections to prevent unprivileged
    user from using other user's certs (CVE-2025-9615)
  - Ensure NetworkManager dependency has CVE-2025-9615 update.
  - Correct sed example in generated README.Fedora and README.EPEL files.


author: Douglas Kosovic <doug@uq.edu.au> - 1.52.2-1
changelog:
  - Updated to 1.52.2 release which has experimental IPv6 support.
  - Update CVE-2025-9615 related Requires and BuildRequires.
  - Fix typos found by codespell.


author: Than Ngo <than@redhat.com> - 146.0.7680.153-1
changelog:
  - Update to 146.0.7680.153
    * CVE-2026-4439: Out of bounds memory access in WebGL
    * CVE-2026-4440: Out of bounds read and write in WebGL
    * CVE-2026-4441: Use after free in Base
    * CVE-2026-4442: Heap buffer overflow in CSS
    * CVE-2026-4443: Heap buffer overflow in WebAudio
    * CVE-2026-4444: Stack buffer overflow in WebRTC
    * CVE-2026-4445: Use after free in WebRTC
    * CVE-2026-4446: Use after free in WebRTC
    * CVE-2026-4447: Inappropriate implementation in V8
    * CVE-2026-4448: Heap buffer overflow in ANGLE
    * CVE-2026-4449: Use after free in Blink
    * CVE-2026-4450: Out of bounds write in V8
    * CVE-2026-4451: Insufficient validation of untrusted input in Navigation
    * CVE-2026-4452: Integer overflow in ANGLE
    * CVE-2026-4453: Integer overflow in Dawn
    * CVE-2026-4454: Use after free in Network
    * CVE-2026-4455: Heap buffer overflow in PDFium
    * CVE-2026-4456: Use after free in Digital Credentials API
    * CVE-2026-4457: Type Confusion in V8
    * CVE-2026-4458: Use after free in Extensions
    * CVE-2026-4459: Out of bounds read and write in WebAudio
    * CVE-2026-4460: Out of bounds read in Skia
    * CVE-2026-4461: Inappropriate implementation in V8
    * CVE-2026-4462: Out of bounds read in Blink
    * CVE-2026-4463: Heap buffer overflow in WebRTC
    * CVE-2026-4464: Integer overflow in ANGLE


author: Than Ngo <than@redhat.com> - 146.0.7680.164-1
changelog:
  - Update to 146.0.7680.164
    * High CVE-2026-4673: Heap buffer overflow in WebAudio
    * High CVE-2026-4674: Out of bounds read in CSS
    * High CVE-2026-4675: Heap buffer overflow in WebGL
    * High CVE-2026-4676: Use after free in Dawn
    * High CVE-2026-4677: Out of bounds read in WebAudio
    * High CVE-2026-4678: Use after free in WebGPU
    * High CVE-2026-4679: Integer overflow in Fonts
    * High CVE-2026-4680: Use after free in FedCM


author: Than Ngo <than@redhat.com> - 146.0.7680.177-1
changelog:
  - Update to 146.0.7680.177
    * High CVE-2026-5273: Use after free in CSS
    * High CVE-2026-5272: Heap buffer overflow in GPU
    * High CVE-2026-5274: Integer overflow in Codecs
    * High CVE-2026-5275: Heap buffer overflow in ANGLE
    * High CVE-2026-5276: Insufficient policy enforcement in WebUSB
    * High CVE-2026-5277: Integer overflow in ANGLE
    * High CVE-2026-5278: Use after free in Web MIDI
    * High CVE-2026-5279: Object corruption in V8
    * High CVE-2026-5280: Use after free in WebCodecs
    * High CVE-2026-5281: Use after free in Dawn
    * High CVE-2026-5282: Out of bounds read in WebCodecs
    * High CVE-2026-5283: Inappropriate implementation in ANGLE
    * High CVE-2026-5284: Use after free in Dawn
    * High CVE-2026-5285: Use after free in WebGL
    * High CVE-2026-5286: Use after free in Dawn
    * High CVE-2026-5287: Use after free in PDF
    * High CVE-2026-5288: Use after free in WebView
    * High CVE-2026-5289: Use after free in Navigation
    * High CVE-2026-5290: Use after free in Compositing
    * Medium CVE-2026-5291: Inappropriate implementation in WebGL
    * Medium CVE-2026-5292: Out of bounds read in WebCodecs


author: Than Ngo <than@redhat.com> - 147.0.7727.55-1
changelog:
  - Update to 147.0.7727.55
    * Critical CVE-2026-5858: Heap buffer overflow in WebML
    * Critical CVE-2026-5859: Integer overflow in WebML
    * High CVE-2026-5860: Use after free in WebRTC
    * High CVE-2026-5861: Use after free in V8
    * High CVE-2026-5862: Inappropriate implementation in V8
    * High CVE-2026-5863: Inappropriate implementation in V8
    * High CVE-2026-5864: Heap buffer overflow in WebAudio
    * High CVE-2026-5865: Type Confusion in V8
    * High CVE-2026-5866: Use after free in Media
    * High CVE-2026-5867: Heap buffer overflow in WebML
    * High CVE-2026-5868: Heap buffer overflow in ANGLE
    * High CVE-2026-5869: Heap buffer overflow in WebML
    * High CVE-2026-5870: Integer overflow in Skia
    * High CVE-2026-5871: Type Confusion in V8
    * High CVE-2026-5872: Use after free in Blink
    * High CVE-2026-5873: Out of bounds read and write in V8
    * Medium CVE-2026-5874: Use after free in PrivateAI
    * Medium CVE-2026-5875: Policy bypass in Blink
    * Medium CVE-2026-5876: Side-channel information leakage in Navigation
    * Medium CVE-2026-5877: Use after free in Navigation
    * Medium CVE-2026-5878: Incorrect security UI in Blink
    * Medium CVE-2026-5879: Insufficient validation of untrusted input in ANGLE
    * Medium CVE-2026-5880: Incorrect security UI in browser UI
    * Medium CVE-2026-5881: Policy bypass in LocalNetworkAccess
    * Medium CVE-2026-5882: Incorrect security UI in Fullscreen
    * Medium CVE-2026-5883: Use after free in Media
    * Medium CVE-2026-5884: Insufficient validation of untrusted input in Media
    * Medium CVE-2026-5885: Insufficient validation of untrusted input in WebML
    * Medium CVE-2026-5886: Out of bounds read in WebAudio
    * Medium CVE-2026-5887: Insufficient validation of untrusted input in Downloads
    * Medium CVE-2026-5888: Uninitialized Use in WebCodecs
    * Medium CVE-2026-5889: Cryptographic Flaw in PDFium
    * Medium CVE-2026-5890: Race in WebCodecs
    * Medium CVE-2026-5891: Insufficient policy enforcement in browser UI
    * Medium CVE-2026-5892: Insufficient policy enforcement in PWAs
    * Medium CVE-2026-5893: Race in V8
    * Low CVE-2026-5894: Inappropriate implementation in PDF
    * Low CVE-2026-5895: Incorrect security UI in Omnibox
    * Low CVE-2026-5896: Policy bypass in Audio
    * Low CVE-2026-5897: Incorrect security UI in Downloads
    * Low CVE-2026-5898: Incorrect security UI in Omnibox
    * Low CVE-2026-5899: Incorrect security UI in History Navigation
    * Low CVE-2026-5900: Policy bypass in Downloads
    * Low CVE-2026-5901: Policy bypass in DevTools
    * Low CVE-2026-5902: Race in Media
    * Low CVE-2026-5903: Policy bypass in IFrameSandbox
    * Low CVE-2026-5904: Use after free in V8
    * Low CVE-2026-5905: Incorrect security UI in Permissions
    * Low CVE-2026-5906: Incorrect security UI in Omnibox
    * Low CVE-2026-5907: Insufficient data validation in Media
    * Low CVE-2026-5908: Integer overflow in Media
    * Low CVE-2026-5909: Integer overflow in Media
    * Low CVE-2026-5910: Integer overflow in Media
    * Low CVE-2026-5911: Policy bypass in ServiceWorkers
    * Low CVE-2026-5912: Integer overflow in WebRTC
    * Low CVE-2026-5913: Out of bounds read in Blink
    * Low CVE-2026-5914: Type Confusion in CSS
    * Low CVE-2026-5915: Insufficient validation of untrusted input in WebML
    * Low CVE-2026-5918: Inappropriate implementation in Navigation
    * Low CVE-2026-5919: Insufficient validation of untrusted input in WebSockets


author: Than Ngo <than@redhat.com> - 147.0.7727.101-1
changelog:
  - Update to 147.0.7727.101
    * Critical CVE-2026-6296: Heap buffer overflow in ANGLE
    * Critical CVE-2026-6297: Use after free in Proxy
    * Critical CVE-2026-6298: Heap buffer overflow in Skia
    * Critical CVE-2026-6299: Use after free in Prerender
    * Critical CVE-2026-6358: Use after free in XR
    * High CVE-2026-6359: Use after free in Video
    * High CVE-2026-6300: Use after free in CSS
    * High CVE-2026-6301: Type Confusion in Turbofan
    * High CVE-2026-6302: Use after free in Video
    * High CVE-2026-6303: Use after free in Codecs
    * High CVE-2026-6304: Use after free in Graphite
    * High CVE-2026-6305: Heap buffer overflow in PDFium
    * High CVE-2026-6306: Heap buffer overflow in PDFium
    * High CVE-2026-6307: Type Confusion in Turbofan
    * High CVE-2026-6308: Out of bounds read in Media
    * High CVE-2026-6309: Use after free in Viz
    * High CVE-2026-6360: Use after free in FileSystem
    * High CVE-2026-6310: Use after free in Dawn
    * High CVE-2026-6311: Uninitialized Use in Accessibility
    * High CVE-2026-6312: Insufficient policy enforcement in Passwords
    * High CVE-2026-6313: Insufficient policy enforcement in CORS
    * High CVE-2026-6314: Out of bounds write in GPU
    * High CVE-2026-6315: Use after free in Permissions
    * High CVE-2026-6316: Use after free in Forms
    * High CVE-2026-6361: Heap buffer overflow in PDFium
    * High CVE-2026-6362: Use after free in Codecs
    * High CVE-2026-6317: Use after free in Cast
    * Medium CVE-2026-6363: Type Confusion in V8
    * Medium CVE-2026-6318: Use after free in Codecs
    * Medium CVE-2026-6319: Use after free in Payments
    * Medium CVE-2026-6364: Out of bounds read in Skia


author: Than Ngo <than@redhat.com> - 147.0.7727.116-1
changelog:
  - Update to 147.0.7727.116
    * High CVE-2026-6919: Use after free in DevTools
    * High CVE-2026-6920: Out of bounds read in GPU
    * Medium CVE-2026-6921: Race in GPU
  - Fix rhbz#2458171, unexpanded macros in manpage


author: Than Ngo <than@redhat.com> - 147.0.7727.116-2
changelog:
  - Fix FTBFS with rust 1.95
  - Backport the upstream fix GL native pixmap import support reset in GpuInit


author: Than Ngo <than@redhat.com> - 147.0.7727.137-1
changelog:
  - Update to 147.0.7727.137
     * Critical CVE-2026-7363: Use after free in Canvas
     * Critical CVE-2026-7361: Use after free in iOS
     * Critical CVE-2026-7344: Use after free in Accessibility
     * Critical CVE-2026-7343: Use after free in Views
     * High CVE-2026-7333: Use after free in GPU
     * High CVE-2026-7360: Insufficient validation of untrusted input in Compositing
     * High CVE-2026-7359: Use after free in ANGLE
     * High CVE-2026-7358: Use after free in Animation
     * High CVE-2026-7334: Use after free in Views
     * High CVE-2026-7357: Use after free in GPU
     * High CVE-2026-7356: Use after free in Navigation
     * High CVE-2026-7354: Out of bounds read and write in Angle
     * High CVE-2026-7353: Heap buffer overflow in Skia
     * High CVE-2026-7352: Use after free in Media
     * High CVE-2026-7351: Race in MHTML
     * High CVE-2026-7350: Use after free in WebMIDI
     * High CVE-2026-7349: Use after free in Cast
     * High CVE-2026-7348: Use after free in Codecs
     * High CVE-2026-7335: Use after free in media
     * High CVE-2026-7336: Use after free in WebRTC
     * High CVE-2026-7337: Type Confusion in V8
     * High CVE-2026-7347: Use after free in Chromoting
     * High CVE-2026-7346: Inappropriate implementation in Tint
     * High CVE-2026-7345: Insufficient validation of untrusted input in Feedback
     * High CVE-2026-7338: Use after free in Cast
     * High CVE-2026-7342: Use after free in WebView
     * High CVE-2026-7341: Use after free in WebRTC
     * Medium CVE-2026-7339: Heap buffer overflow in WebRTC
     * Medium CVE-2026-7340: Integer overflow in ANGLE
     * Medium CVE-2026-7355: Use after free in Media


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.16-1
changelog:
  - 2.4.16 (fedora#2417970)
  - rebuild due binutils bug (fedora#2418285)
  - fix division by zero crash in pstops (fedora#2415396)


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.17-1
changelog:
  - 2.4.17 (fedora#2456363, fedora#2456362, fedora#2454994, fedora#2454993,
    fedora#2454992, fedora#2454990)


author: Marek Blaha <mblaha@redhat.com> - 5.2.14.0-2
changelog:
  - Remove incorrect dnfdaemon output parameter names (https://github.com/rpm-software-management/dnf5/issues/2317)


author: Petr Pisar <ppisar@redhat.com> - 5.2.18.0-2
changelog:
  - Fix a crash in dnf5daemon-server when receiving an unknown locale from
    a D-Bus client (CVE-2026-3836) (bug #2445771)


author: Petr Pisar <ppisar@redhat.com> - 5.2.18.0-3
changelog:
  - Make a dependency on libcurl-full for dnf5-plugin-automatic optional
    (bug #2322918)
  - Work around a race in rotating system state files (bug #2457408)
  - Respect nocrypto tsflag when setting a transaction per-element verification
    policy (bug #2443503)
  - Require rpm-libs >= 5.99.90 because of rpmteSetVfyLevel()
  - Handle caching unsigned packages in local plugin


author: Aaron Merey <amerey@redhat.com> - 0.193-1
changelog:
  - Upgrade to upstream elfutils 0.193
  - Drop upstreamed patches
    elfutils-0.192-ATOMIC_VAR_INIT.patch
    elfutils-0.192-libelf-static.patch
    elfutils-0.192-fix-configure-conditional.patch
    elfutils-0.192-more-dwarf5-lang.patch
    elfutils-0.192-fix-zsh-profile.patch
    elfutils-0.192-stacktrace-lto.patch
    elfutils-0.192-imasig-fail-free.patch
    elfutils-0.192-strip-ignore-non-ET_REL.patch


author: Aaron Merey <amerey@redhat.com> - 0.195-1
changelog:
  - Upgrade to upstream elfutils 0.195
  - Drop upstreamed patches
    elfutils-0.194-aarch64-Recognize-SHT_AARCH64_ATTRIBUTES.patch
    elfutils-0.194-alloc-jobs.patch
    elfutils-0.194-fix-const.patch
    elfutils-0.194-sh_addr-non-zero.patch


author: Sandipan Roy <sandipan@redhat.com> - 2.1.0-1
changelog:
  - Update to version 2.1.0
  - Update to 2.1.0 - Closes rhbz#2061180 rhbz#2352162
  - Implement vendoring approach using go2rpm with vendor archive
  - Add all Go dependencies bundled for offline builds in mock/koji
  - Use rpmautospec for automatic release and changelog management
  - Re-enable tests with selective skipping for TestToCSV failure only
  - Update license to include all vendored dependency licenses: Apache-2.0
    AND BSD-2-Clause AND BSD-3-Clause AND MIT
  - Preserve complete historical changelog from package inception


author: Florian Weimer <fweimer@redhat.com> - 2.41-9
changelog:
  - Auto-sync with upstream branch release/2.41/master,
    commit e7c419a2957590fb657900fc92a89708f41abd9d:
  - iconv: iconv -o should not create executable files (bug 33164)
  - CVE-2025-8058: Fix double-free after allocation failure in regcomp (#2383154)


author: Florian Weimer <fweimer@redhat.com> - 2.41-10
changelog:
  - Auto-sync with upstream branch release/2.41/master,
    commit 513629b14d43bffd83985ffb9cf10e5599e649d2:
  - elf: Handle ld.so with LOAD segment gaps in _dl_find_object (bug 31943)
  - elf: Extract rtld_setup_phdr function from dl_main
  - elf: Do not add a copy of _dl_find_object to libc.so
  - stdlib: resolve a double lock init issue after fork [BZ #32994]


author: Florian Weimer <fweimer@redhat.com> - 2.41-11
changelog:
  - Auto-sync with upstream branch release/2.41/master,
    commit a52c9b75c70124fe4f69e6b0ed288e2c14bd7ce9:
  - Optimize __libc_tsd_* thread variable access
  - i386: Add GLIBC_ABI_GNU_TLS version [BZ #33221]
  - i386: Also add GLIBC_ABI_GNU2_TLS version [BZ #33129]
  - i386: Update ___tls_get_addr to preserve vector registers
  - elf: Preserve _rtld_global layout for the release branch
  - elf: Test dlopen (NULL, RTLD_LAZY) from an ELF constructor
  - elf: Fix handling of symbol versions which hash to zero (bug 29190)
  - x86-64: Add GLIBC_ABI_DT_X86_64_PLT [BZ #33212]
  - x86-64: Add GLIBC_ABI_GNU2_TLS version [BZ #33129]
  - elf: Compile _dl_debug_state separately (bug 33224)
  - elf: Restore support for _r_debug interpositions and copy relocations
  - elf: Introduce _dl_debug_change_state
  - elf: Introduce separate _r_debug_array variable
  - Use TLS initial-exec model for __libc_tsd_CTYPE_* thread variables [BZ #33234]
  - ctype: Fallback initialization of TLS using relocations (bug 19341, bug 32483)
  - Use proper extern declaration for _nl_C_LC_CTYPE_{class,toupper,tolower}
  - Remove <libc-tsd.h>
  - AArch64: Improve codegen SVE log1p helper
  - AArch64: Optimise SVE FP64 Hyperbolics
  - AArch64: Optimize SVE exp functions
  - AArch64: Improve codegen in SVE log1p
  - AArch64: Optimize inverse trig functions
  - AArch64: Optimize algorithm in users of SVE expf helper
  - AArch64: Avoid memset ifunc in cpu-features.c [BZ #33112]
  - nptl: Fix SYSCALL_CANCEL for return values larger than INT_MAX (BZ 33245)


author: Frédéric Bérat <fberat@redhat.com> - 2.41-12
changelog:
  - Auto-sync with upstream branch master,
    commit 6a0b8e366520a09722aef6c17ec1b103e82f3c28:
  - ppc64le: Power 10 rawmemchr clobbers v20 (bug #33091) (Sachin Monga)
  - ppc64le: Restore optimized strncmp for power10 (Sachin Monga)
  - ppc64le: Restore optimized strcmp for power10 (Sachin Monga)
  - AArch64: Fix and improve SVE pow(f) special cases (Pierre Blanchard)
  - AArch64: fix SVE tanpi(f) [BZ #33642] (Pierre Blanchard)
  - AArch64: Fix instability in AdvSIMD sinh (Joe Ramsay)
  - AArch64: Fix instability in AdvSIMD tan (Joe Ramsay)
  - AArch64: Optimise SVE scalar callbacks (Joe Ramsay)
  - aarch64: fix includes in SME tests (Yury Khrustalev)
  - aarch64: Do not link conform tests with -Wl,-z,force-bti (bug 33601) (Florian Weimer)
  - aarch64: fix cfi directives around __libc_arm_za_disable (Yury Khrustalev)
  - aarch64: tests for SME (Yury Khrustalev)
  - aarch64: clear ZA state of SME before clone and clone3 syscalls (Yury Khrustalev)
  - aarch64: define macro for calling __libc_arm_za_disable (Yury Khrustalev)
  - aarch64: update tests for SME (Yury Khrustalev)
  - aarch64: Disable ZA state of SME in setjmp and sigsetjmp (Yury Khrustalev)
  - x86: fix wmemset ifunc stray '!' (bug 33542) (Jiamei Xie)
  - x86: Detect Intel Nova Lake Processor (Sunil K Pandey)
  - x86: Detect Intel Wildcat Lake Processor (Sunil K Pandey)
  - nss: Group merge does not react to ERANGE during merge (bug 33361) (Florian Weimer)
  - AArch64: Fix SVE powf routine [BZ #33299] (Pierre Blanchard)


author: Frédéric Bérat <fberat@redhat.com> - 2.41-13
changelog:
  - Auto-sync with upstream branch master,
    commit c96b4ed1e26f06ebc56c17ba2c29d1647be68c1e:
  - nptl: Optimize trylock for high cache contention workloads (BZ #33704) (Sunil K Pandey)
  - support: Exit on consistency check failure in resolv_response_add_name (Florian Weimer)
  - support: Fix FILE * leak in check_for_unshare_hints in test-container (Florian Weimer)
  - sprof: fix -Wformat warnings on 32-bit hosts (Collin Funk)
  - sprof: check pread size and offset for overflow (DJ Delorie)


author: Florian Weimer <fweimer@redhat.com> - 2.41-15
changelog:
  - Auto-sync with upstream branch release/2.41/master,
    commit fb4db64a04ad6c96cd1fbb7e02eb59323b1f2ac2:
  - posix: Reset wordexp_t fields with WRDE_REUSE (CVE-2025-15281)
  - resolv: Fix NSS DNS backend for getnetbyaddr (CVE-2026-0915)
  - memalign: reinstate alignment overflow check (CVE-2026-0861)


author: Frédéric Bérat <fberat@redhat.com> - 2.41-17
changelog:
  - Auto-sync with upstream branch release/2.41/master,
    commit 47c0cc364dcfc7376bf7156d0cf1f27fb38d230a:
  - tests: fix tst-rseq with Linux 7.0 (Michael Jeanson)
  - elf: parse /proc/self/maps as the last resort to find the gap for tst-link-map-contiguous-ldso (Xi Ruoyao)
  - resolv: Check hostname for validity (CVE-2026-4438) (Carlos O'Donell)
  - resolv: Count records correctly (CVE-2026-4437) (Carlos O'Donell)
  - posix: Run tst-wordexp-reuse-mem test (Florian Weimer)
  - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module (Florian Weimer)
  - posix: Fix invalid flags test for p{write,read}v2 (Yury Khrustalev)
  - nss: Missing checks in __nss_configure_lookup, __nss_database_get (bug 28940) (Florian Weimer)
  - Linux: In getlogin_r, use utmp fallback only for specific errors (Florian Weimer)
  - nss: Introduce dedicated struct nss_database_for_fork type (Florian Weimer)
  - Switch currency symbol for the bg_BG locale to euro (Florian Weimer)
  - Remove patches already applied upstream:
    - glibc-rh2429016.patch


author: Packit <hello@packit.dev> - 47-1
changelog:
  Changes with 47
  ----------------
    - Revert "spec: Use gosource macro for Source0" (#433)
      - Author: Simon de Vlieger, Reviewers: Brian C. Lane, Tomáš Hozza

  — Somewhere on the Internet, 2026-01-16


author: Packit <hello@packit.dev> - 48-1
changelog:
  Changes with 48
  ----------------
    - Add pxe-tar-xz to bib types and add boot tests for f43, stream9, and stream10 (#436)
      - Author: Brian C. Lane, Reviewers: Lukáš Zapletal, Simon de Vlieger
    - Support rootless bootc-image-builder (#445)
      - Author: Alexander Larsson, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - chore: fix constant format string (#438)
      - Author: Simon de Vlieger, Reviewers: Brian C. Lane, Lukáš Zapletal
    - tests: Fix bootc pxe testing (#439)
      - Author: Brian C. Lane, Reviewers: Simon de Vlieger

  — Somewhere on the Internet, 2026-02-04


author: Packit <hello@packit.dev> - 50-1
changelog:
  Changes with 50
  ----------------
    - SPEC: define default permissions for /var/cache/image-builder (#454)
      - Author: Tomáš Hozza, Reviewers: Lukáš Zapletal, Simon de Vlieger
    - build(deps): bump actions/cache from 4 to 5 (#434)
      - Author: {}, Reviewers: Achilleas Koutsou, Lukáš Zapletal
    - deps: bump Go to 1.24.12 and use new Go functions (#452)
      - Author: Lukáš Zapletal, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - go.mod: update osbuild/images to v0.240.0 (#456)
      - Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Simon de Vlieger

  — Somewhere on the Internet, 2026-02-17


author: Packit <hello@packit.dev> - 51-1
changelog:
  Changes with 51
  ----------------
    - go.mod: update osbuild/images to v0.243.0 (#457)
      - Author: Achilleas Koutsou, Reviewers: Lukáš Zapletal, Simon de Vlieger

  — Somewhere on the Internet, 2026-02-19


author: Packit <hello@packit.dev> - 53-1
changelog:
  Changes with 53
  ----------------
    - chore: bump dependencies via gobump (#475)
      - Author: SchutzBot, Reviewers: Lukáš Zapletal, Tomáš Hozza
    - cmd: allow specifying AWS credentials profile (#443)
      - Author: Jakub Kadlčík, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - deps: bump images to 0.248.0 (#479)
      - Author: Simon de Vlieger, Reviewers: Nobody
    - docs: update COPR command for RHEL (#477)
      - Author: Lukáš Zapletal, Reviewers: Brian C. Lane, Simon de Vlieger
    - test: bump ISO timeout (#469)
      - Author: Lukáš Zapletal, Reviewers: Simon de Vlieger, Tomáš Hozza

  — Somewhere on the Internet, 2026-03-13


author: Packit <hello@packit.dev> - 55-1
changelog:
  Changes with 55
  ----------------
    - chore: bump dependencies via gobump (#460)
      - Author: SchutzBot, Reviewers: Lukáš Zapletal
    - deps: bump images (#483)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová

  — Somewhere on the Internet, 2026-03-24


author: Packit <hello@packit.dev> - 57-1
changelog:
  Changes with 57
  ----------------
    - deps: update `images` to 0.254.0 (#489)
      - Author: Simon de Vlieger, Reviewers: Anna Vítová, Lukáš Zapletal

  — Somewhere on the Internet, 2026-04-06


author: Packit <hello@packit.dev> - 58-1
changelog:
  Changes with 58
  ----------------
    - deps: bump images to 0.256.0 (#491)
      - Author: Simon de Vlieger, Reviewers: Anna Vítová, Lukáš Zapletal

  — Somewhere on the Internet, 2026-04-07


author: Packit <hello@packit.dev> - 60-1
changelog:
  Changes with 60
  ----------------
    - Support --in-vm in image-builder (#485)
      - Author: Anna Vítová, Reviewers: Lukáš Zapletal, Simon de Vlieger
    - deps: bump images to 0.258.0 (#495)
      - Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Anna Vítová

  — Somewhere on the Internet, 2026-04-14


author: Packit <hello@packit.dev> - 63-1
changelog:
  Changes with 63
  ----------------
    - deps: bump images to 0.259.0 (#501)
      - Author: Anna Vítová, Reviewers: Lukáš Zapletal, Tomáš Hozza
    - docs: update satellite info (#503)
      - Author: Lukáš Zapletal, Reviewers: Brian C. Lane, Tomáš Hozza
    - main: `--version` -> `version` subcommand (#505)
      - Author: Simon de Vlieger, Reviewers: Brian C. Lane, Lukáš Zapletal
    - many: Generate rpmlist as an output of manifestgen (#502)
      - Author: Anna Vítová, Reviewers: Lukáš Zapletal, Simon de Vlieger

  — Somewhere on the Internet, 2026-04-29


author: Patrick Monnerat <patrick@monnerat.net> 13.0.50.20220502-27
changelog:
  - Patch "cve-2025-11082" fixes CVS 2025-11082.
    https://bugzilla.redhat.com/show_bug.cgi?id=2400356
  - Patch "cve-2025-11083" fixes CVS 2025-11083.
    https://bugzilla.redhat.com/show_bug.cgi?id=2400349
  - Conditional explicit BR tcl/tk 8.
  - Dummy rpm check section.


author: Patrick Monnerat <patrick@monnerat.net> 18.0.50.20260306-1
changelog:
  - New upstream snapshot.
  - Fixes CVEs 2025-11494, 2025-11495, 2026-2341, 2026-3441, 2026-3442.
    https://bugzilla.redhat.com/show_bug.cgi?id=2402843
    https://bugzilla.redhat.com/show_bug.cgi?id=2402846
    https://bugzilla.redhat.com/show_bug.cgi?id=2438918
    https://bugzilla.redhat.com/show_bug.cgi?id=2443834
  - Fixes CVEs 2025-69644, 2025-69645, 2025-69646.
    https://bugzilla.redhat.com/show_bug.cgi?id=2445281
    https://bugzilla.redhat.com/show_bug.cgi?id=2445284
    https://bugzilla.redhat.com/show_bug.cgi?id=2446276
  - Fixes FTBFS.
    https://bugzilla.redhat.com/show_bug.cgi?id=2434680
  - Relax BR of itcl/itk/iwidgets.
  - Patch "libtool_tag" to force C++ language tagging in libtool.


author: Patrick Monnerat <patrick@monnerat.net> 18.0.50.20260306-2
changelog:
  - Patch "cve-2026-4647" to fix CVE-2026-4647.
    https://bugzilla.redhat.com/show_bug.cgi?id=2450318
  - Always use Tcl/Tk version 9.


author: Patrick Monnerat <patrick@monnerat.net> 18.0.50.20260306-3
changelog:
  - Fix CVE-2026-6846.
    https://sourceware.org/bugzilla/show_bug.cgi?id=34049
    https://bugzilla.redhat.com/show_bug.cgi?id=2460525


author: Julien Rische <jrische@redhat.com> - 1.21.2-6
changelog:
  - CVE-2024-37370 CVE-2024-37371: GSS message token handling
    Resolves: rhbz#2294678 rhbz#2294680
  - Fix double free in klist's show_ccache()
    Resolves: rhbz#2257301
  - Do not include files with "~" termination in krb5-tests


author: Julien Rische <jrische@redhat.com> - 1.21.3-1
changelog:
  - New upstream version (1.21.3)
  - CVE-2024-26458: Memory leak in src/lib/rpc/pmap_rmt.c
    Resolves: rhbz#2266732
  - CVE-2024-26461: Memory leak in src/lib/gssapi/krb5/k5sealv3.c
    Resolves: rhbz#2266741
  - CVE-2024-26462: Memory leak in src/kdc/ndr.c
    Resolves: rhbz#2266743
  - Add missing SPDX license identifiers
    Resolves: rhbz#2265333


author: Julien Rische <jrische@redhat.com> - 1.21.3-3
changelog:
  - libkrad: implement support for Message-Authenticator (CVE-2024-3596)
    Resolves: rhbz#2304071
  - Fix various issues detected by static analysis
    Resolves: rhbz#2322704
  - Remove RSA protocol for PKINIT
    Resolves: rhbz#2322706
  - Make TCP waiting time configurable
    Resolves: rhbz#2322711


author: Julien Rische <jrische@redhat.com> - 1.21.3-5
changelog:
  - Prevent overflow when calculating ulog block size (CVE-2025-24528)
    Resolves: rhbz#2342798
  - Support PKCS11 EC client certs in PKINIT
    Resolves: rhbz#2341962
  - kdb5_util: fix DB entry flags on modification
    Resolves: rhbz#2336555
  - Add ECDH support for PKINIT (RFC5349)
    Resolves: rhbz#2214326
  - Remove dependency of krb5-libs on gawk and sed
    Resolves: rhbz#2323859


author: Julien Rische <jrische@redhat.com> - 1.21.3-6
changelog:
  - Do not block HMAC-MD4/5 in FIPS mode
    Resolves: rhbz#2370259
  - PKINIT: implement paChecksum2 from MS-PKCA v20230920
    Resolves: rhbz#2357215
  - Disallow RC4 HMAC-MD5 session keys by default (CVE-2025-3576)
    Resolves: rhbz#2359705


author: Julien Rische <jrische@redhat.com> - 1.21.3-7
changelog:
  - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
    Resolves: rhbz#2463398 rhbz#2463395


author: Dodji Seketeli <dodji@redhat.com> - 2.6-1
changelog:
  - Update to upstream 2.6 tarball
  - Add xxhash-devel as BuildRequires
  - Update library to libabigail.so.5.0.0


author: Dodji Seketeli <dodji@redhat.com> - 2.7-1
changelog:
  - Update to upstream 2.7 tarball
  - Do not build with by default XXH_INLINE_ALL anymore
  - Drop xxhash-static dependency
  - Add xz-devel >= 5.2.0 dependency to support reading xz-compressed binaries
  - Support new libabigail.so.6.0.0 SONAME


author: Dodji Seketeli <dodji@redhat.com> - 2.9-1
changelog:
  - Update to upstream 2.9 tarball
  - Support new libabigail.so.8.0.0 SONAME
  - Run 'make check check-self-compare' instead of two separate make invocations.


author: Petr Písař <ppisar@redhat.com> - 0.7.36-3
changelog:
  - Fix a buffer overflow when copying SHA-384/512 checksum from a Debian
    repository (upstream GH#616)


author: FeRD (Frank Dana) <ferdnyc@gmail.com> - 9.9p1-8
changelog:
  - Replace deprecated (since 8.7) ChallengeResponseAuthentication
    with KbdInteractiveAuthentication, in redhat sshd config


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-9
changelog:
  - Fix regression of Match directive processing
  - Fix missing error codes set and invalid error code checks in OpenSSH. It
    prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS
    is on (CVE-2025-26465, CVE-2025-26466).


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-12
changelog:
  - CVE-2025-61984: Reject usernames with control characters
    Resolves: rhbz#2402667
  - CVE-2025-61985: Reject URL-strings with NULL characters
    Resolves: rhbz#2402670


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-13
changelog:
  - CVE-2026-3497: Fix information disclosure or denial of service due
    to uninitialized variables in gssapi-keyex
    Resolves: rhbz#2447289


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-14
changelog:
  - CVE-2026-35385: Fix privilege escalation via scp legacy protocol
    when not in preserving file mode
    Resolves: rhbz#2454941


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-13
changelog:
  - Locally configured providers should not interfere with openssl build-time tests
  - Load system default cipher string from crypto-policies configuration file
    include /etc/crypto-policies/back-ends/opensslcnf.config and remove
    /etc/crypto-policies/back-ends/openssl.config.


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.4-3
changelog:
  - Proper providing of default cipher string file on compilation
    Build with no-atexit similar to CentOS/RHEL


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.6-3
changelog:
  - Don't crash on parsing PKCS#12 without MAC
  - Resloves: CVE-2025-11187
  - Resloves: CVE-2025-15467
  - Resloves: CVE-2025-69419


author: Packit <hello@packit.dev> - 154-1
changelog:
  Changes with 154
  ----------------
    - CI: run testing on RHEL 9.8 and 10.2 nightly (HMS-9226) (#4893)
      - Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - Update snapshots to 20251023 (#4905)
      - Author: SchutzBot, Reviewers: Sanne Raymaekers, Simon de Vlieger
    - chore: bump dependencies via gobump (#4895)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Lukáš Zapletal, Simon de Vlieger
    - cloudapi: add new dnf customizations [HMS-9335] (#4899)
      - Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Tomáš Hozza
    - cloudapi: split out resolver job enqueueing into a separate function (#4894)
      - Author: Achilleas Koutsou, Reviewers: Sanne Raymaekers, Tomáš Hozza
    - fix worker AMI builds by not running mock as root (#4902)
      - Author: Ondřej Budai, Reviewers: Florian Schüller, Sanne Raymaekers
    - gitlab: only update github status at the end of the pipeline(s) (#4900)
      - Author: Achilleas Koutsou, Reviewers: Anna Vítová, Brian C. Lane, Sanne Raymaekers
    - go.mod: update images to v0.209.0 (#4901)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Lukáš Zapletal
    - go.mod: update osbuild/images to v0.208.0 (#4898)
      - Author: Sanne Raymaekers, Reviewers: Lukáš Zapletal, Ondřej Budai
    - test/cases/usbi-wsl: delete azure resources in order (#4896)
      - Author: Sanne Raymaekers, Reviewers: Simon de Vlieger, Tomáš Hozza
    - worker: support partial results (HMS-9343) (#4897)
      - Author: Sanne Raymaekers, Reviewers: Lukáš Zapletal, Tomáš Hozza

  — Somewhere on the Internet, 2025-10-29


author: Packit <hello@packit.dev> - 155-1
changelog:
  Changes with 155
  ----------------
    - build(deps): bump actions/upload-artifact from 4 to 5 (#4906)
      - Author: dependabot[bot], Reviewers: Achilleas Koutsou, Sanne Raymaekers
    - chore: bump dependencies via gobump (#4907)
      - Author: SchutzBot, Reviewers: Florian Schüller, Lukáš Zapletal, Simon de Vlieger
    - chore: bump dependencies via gobump (#4912)
      - Author: SchutzBot, Reviewers: Sanne Raymaekers, Tomáš Hozza
    - cloudapi/v2: add netinst image type (HMS-9566) (#4913)
      - Author: Tomáš Koscielniak, Reviewers: Lukáš Zapletal, Simon de Vlieger
    - schutzbot/terraform: bump terraform sha (#4909)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Florian Schüller, Lukáš Zapletal, Simon de Vlieger
    - weldr,cloudapi: tweaks around the reporegistry handling (#4910)
      - Author: Michael Vogt, Reviewers: Achilleas Koutsou, Brian C. Lane, Lukáš Zapletal

  — Somewhere on the Internet, 2025-11-12


author: Packit <hello@packit.dev> - 158-1
changelog:
  Changes with 158
  ----------------
    - Add new job type for generating manifests using image-builder-cli [HMS-9049] (#4904)
      - Author: Achilleas Koutsou, Reviewers: Nobody
    - chore(deps): update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 docker digest to 90c2b32 (#4937)
      - Author: {}, Reviewers: Florian Schüller, Sanne Raymaekers
    - go.mod: update osbuild/images to v0.230.0 (#4964)
      - Author: Achilleas Koutsou, Reviewers: Gianluca Zuccarelli, Lukáš Zapletal
    - konflux: osbuild-composer use tasks with valid cosign (HMS-9721) (#4956)
      - Author: Florian Schüller, Reviewers: Sanne Raymaekers, Tomáš Hozza
    - osbuild-worker-executor: ignore item order in tarball in test (#4965)
      - Author: Achilleas Koutsou, Reviewers: Lukáš Zapletal, Michael Vogt
    - schutzfile: pin osbuild to version ignoring PQC keys (#4968)
      - Author: Ondřej Budai, Reviewers: Simon Steinbeiß
    - templates/openshift: switch to konflux images (HMS-9722) (#4957)
      - Author: Sanne Raymaekers, Reviewers: Nobody
    - test/{api,ubi}: pin cloud-tools to an older version (#4966)
      - Author: Ondřej Budai, Reviewers: Tomáš Hozza
    - worker: support separate set of s3 credentials (#4958)
      - Author: Sanne Raymaekers, Reviewers: Gianluca Zuccarelli, Lukáš Zapletal, Tomáš Hozza

  — Somewhere on the Internet, 2025-12-24


author: Packit <hello@packit.dev> - 160-1
changelog:
  Changes with 160
  ----------------
    - Update snapshots to 20260106 (#4976)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - chore(deps): update konflux references (#4978)
      - Author: {}, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - chore: bump dependencies via gobump (#4979)
      - Author: SchutzBot, Reviewers: Lukáš Zapletal, Tomáš Hozza
    - ci: gobump blueprint separately (#4973)
      - Author: Lukáš Zapletal, Reviewers: Sanne Raymaekers, Simon de Vlieger

  — Somewhere on the Internet, 2026-01-21


author: Packit <hello@packit.dev> - 161-1
changelog:
  Changes with 161
  ----------------
    - Update snapshots to 20260118 (#4985)
      - Author: SchutzBot, Reviewers: Lukáš Zapletal, Tomáš Hozza
    - chore: bump dependencies via gobump (#4988)
      - Author: SchutzBot, Reviewers: Lukáš Zapletal, Tomáš Hozza
    - packit: Build RHEL10 RPMs for x86 and ARM in COPR (#4982)
      - Author: Simon Steinbeiß, Reviewers: Lukáš Zapletal, Tomáš Hozza
    - worker: add job to generate bootc manifests [HMS-10006] (#4977)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Tomáš Hozza

  — Somewhere on the Internet, 2026-02-04


author: Packit <hello@packit.dev> - 162-1
changelog:
  Changes with 162
  ----------------
    - Add Transactions and Modules fields to depsolve job result (HMS-9090) (#5006)
      - Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    - Move workers to rhel 10 (HMS-9987) (#4975)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Gianluca Zuccarelli, Simon de Vlieger
    - Update snapshots to 20260201 (#4997)
      - Author: SchutzBot, Reviewers: Achilleas Koutsou, Simon de Vlieger
    - cloudapi/v2: allow upload types for pxe & network installer (HMS-10178) (#5004)
      - Author: Gianluca Zuccarelli, Reviewers: Lukáš Zapletal, Sanne Raymaekers
    - go.mod: bump osbuild/images to v0.236.0 (HMS-10105) (#4990)
      - Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Ondřej Budai
    - templates/packer: fix registration script (#5007)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Gianluca Zuccarelli, Lukáš Zapletal
    - tests: Update Upgrade test to RHEL 9.8 from 9.7 (#4999)
      - Author: Tomáš Koscielniak, Reviewers: Brian C. Lane, Tomáš Hozza
    - tools/build-rpms: build rpms on rhel 10 (#5005)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Lukáš Zapletal, Simon de Vlieger

  — Somewhere on the Internet, 2026-02-11


author: Packit <hello@packit.dev> - 164-1
changelog:
  Changes with 164
  ----------------
    - build(deps): bump actions/upload-artifact from 5 to 6 (#4961)
      - Author: {}, Reviewers: Achilleas Koutsou, Tomáš Hozza
    - chore(deps): update konflux references (#5023)
      - Author: {}, Reviewers: Sanne Raymaekers, Tomáš Hozza

  — Somewhere on the Internet, 2026-02-18


author: Packit <hello@packit.dev> - 165-1
changelog:
  Changes with 165
  ----------------
    -  templates/packer: set crypto policy to LEGACY on rhel workers (#5038)
      - Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Anna Vítová, Gianluca Zuccarelli
    - Schutzfile: bump osbuild (#5044)
      - Author: Sanne Raymaekers, Reviewers: Anna Vítová, Lukáš Zapletal
    - Update osbuild/images to v0.242.0 and enable aws-cvm in cloud API (#5026)
      - Author: Achilleas Koutsou, Reviewers: Lukáš Zapletal, Tomáš Hozza
    - chore: bump dependencies via gobump (#5043)
      - Author: SchutzBot, Reviewers: Lukáš Zapletal, Tomáš Koscielniak
    - cloudapi/v2: add content sets to subscription image options (HMS-8857) (#4981)
      - Author: Bryttanie, Reviewers: Gianluca Zuccarelli, Lukáš Zapletal
    - cloudapi: Add optional blueprint-id UUID field (HMS-3881) (#4996)
      - Author: Simon Steinbeiß, Reviewers: Lukáš Zapletal, Simon de Vlieger
    - go.mod: bump osbuild/images to v0.244.0 (#5033)
      - Author: Achilleas Koutsou, Reviewers: Sanne Raymaekers, Simon de Vlieger

  — Somewhere on the Internet, 2026-03-04


author: Packit <hello@packit.dev> - 168-1
changelog:
  Changes with 168
  ----------------
    - Add DequeueAnyChannel to enable multi-tenant BootcPreManifest processing (HMS-10445) (#5084)
      - Author: Tomáš Hozza, Reviewers: Brian C. Lane, Ondřej Budai
    - Fail bootc composes on composer build version mismatch (HMS-10378) (#5082)
      - Author: Tomáš Hozza, Reviewers: Lukáš Zapletal, Ondřej Budai
    - Make bootc container source type configurable (HMS-10262) (#5087)
      - Author: Tomáš Hozza, Reviewers: Lukáš Zapletal, Sanne Raymaekers
    - Replace monolithic bootc-manifest worker job with multi-stage server-orchestrated job graph (HMS-10378) (#5069)
      - Author: Tomáš Hozza, Reviewers: Nobody
    - Update snapshots to 20260405 (#5080)
      - Author: SchutzBot, Reviewers: Lukáš Zapletal, Simon de Vlieger, Tomáš Hozza
    - chore(deps): update konflux references (#5070)
      - Author: {}, Reviewers: Anna Vítová, Lukáš Zapletal
    - chore(deps): update konflux references (#5089)
      - Author: {}, Reviewers: Lukáš Zapletal, Sanne Raymaekers
    - chore: add .gitattributes file (#5078)
      - Author: Lukáš Zapletal, Reviewers: Anna Vítová, Simon de Vlieger, Tomáš Hozza
    - cloudapi: Add fedora names for network-installer (#5079)
      - Author: Brian C. Lane, Reviewers: Lukáš Zapletal, Simon de Vlieger
    - cmd/osbuild-worker: cleanup jobimpl-osbuild.go (#5083)
      - Author: Anna Vítová, Reviewers: Brian C. Lane, Tomáš Hozza
    - templates/packer: add container registries init script (#5086)
      - Author: Sanne Raymaekers, Reviewers: Gianluca Zuccarelli, Lukáš Zapletal
    - worker: use slices.EqualFunc to compare dependency modules (#5085)
      - Author: Tomáš Hozza, Reviewers: Brian C. Lane, Simon de Vlieger

  — Somewhere on the Internet, 2026-04-15


author: Packit <hello@packit.dev> - 171-1
changelog:
  Changes with 171
  ----------------
    - Add optional container image cleanup to bootc info resolve job and enable it for the service (HMS-10446) (#5108)
      - Author: Tomáš Hozza, Reviewers: Gianluca Zuccarelli, Lukáš Zapletal
    - Enable bootc installer ISO builds via Cloud API (HMS-10568) (#5112)
      - Author: Tomáš Hozza, Reviewers: Lukáš Zapletal, Sanne Raymaekers
    - Update snapshots to 20260426 (#5114)
      - Author: SchutzBot, Reviewers: Lukáš Zapletal, Tomáš Hozza
    - chore(deps): update konflux references (#5113)
      - Author: {}, Reviewers: Lukáš Zapletal, Tomáš Hozza
    - cicd: split gobump into two jobs (#5109)
      - Author: Lukáš Zapletal, Reviewers: Anna Vítová, Tomáš Hozza
    - test/old-worker-new-composer: skip v168 release due to buggy SPEC (#5111)
      - Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Sanne Raymaekers
    - weldr: Use the job id instead of creating a new one (#5110)
      - Author: Brian C. Lane, Reviewers: Lukáš Zapletal, Tomáš Hozza
    - worker: use require.Eventually for the flaky test (#5074)
      - Author: Lukáš Zapletal, Reviewers: Simon de Vlieger, Tomáš Hozza

  — Somewhere on the Internet, 2026-04-29


author: Paul Howarth <paul@city-fan.org> - 1.57-1
changelog:
  - Update to 1.57 (rhbz#2325504)
    - Add on_error callback to csv()
    - Retain runtime error from csv()


author: Paul Howarth <paul@city-fan.org> - 1.58-1
changelog:
  - Update to 1.58 (rhbz#2334923)
    - Add strict_eol (warnings default in csv())
    - Add XS line number in errors
    - Add streaming support (not set in stone)


author: Paul Howarth <paul@city-fan.org> - 1.60-1
changelog:
  - Update to 1.60 (rhbz#2343165)
    - Add SECURITY.md
    - CR/NL/CRNL inside quoted fields not affected by strict_eol
    - Fix incorrect error 2014 (GH#62)


author: Paul Howarth <paul@city-fan.org> - 1.61-1
changelog:
  - Update to 1.61 (rhbz#2383739)
    - Add love letter to CSV from xan project with reference
    - Bugtracker to Github (long overdue) (GH#63)
    - Update to Devel::PPPort-3.73


author: Paul Howarth <paul@city-fan.org> - 1.62-1
changelog:
  - Update to 1.62 (rhbz#2463743)
    - It is 2026
    - Fix possible stack corruption (GH#65, CVE-2026-7111)


author: Paul Howarth <paul@city-fan.org> - 1.37-1
changelog:
  - Update to 1.37
    Features:
    - Add LoadBytes, LoadUTF8, DumpBytes, DumpUTF8 functions (GH#51)
    Fixes:
    - Fix heap buffer overflow in the YAML emitter - CVE-2026-4177 (GH#67)
    - Fix DumpFile with tied filehandles (IO::String, IO::Scalar) (GH#22)
    - Fix _is_glob to recognize IO::Handle subclasses (GH#23)
    - Fix memory leak when dumping filehandles (CPAN RT#41199, GH#42)
    - Fix dumping of tied hashes (GH#31)
    - Fix dumping strings starting with '...' as unquoted plain scalars (GH#34)
    - Fix dumping strings with tabs and carriage returns as plain scalars (GH#59)
    - Fix double-dash YAML parsing (RT#34073, GH#35)
    - Fix extra newline after empty arrays/hashes in YAML output (GH#36)
    - Remove trailing whitespace from YAML output lines (GH#37, GH#38, GH#39)
    - Fix quoting of \r and \t in YAML output instead of emitting raw bytes
      (GH#40)
    - Fix growing !!perl/regexp objects in round-trips (GH#43)
    - Fix quoted '=' being transformed into 'str' (GH#45)
    - Fix backslash-space escape in double-quoted YAML strings (GH#61)
    - Fix flow sequence comma separator not recognized without trailing space
      (GH#60)
    - Fix wide character warning in DumpFile (GH#28)
    - Fix inline arrays without space after comma (GH#25)
    - Fix: quote strings matching YAML implicit types to prevent round-trip
      failures (GH#26)
    - Fix JSON::Syck::Dump to use JSON-valid \uXXXX escapes in output (GH#21)
    - Fix JSON::Syck::Load decoding of \/ and \uXXXX escape sequences (GH#30)
    - Fix: apply JSON postprocessing to JSON::Syck::DumpFile output (GH#104)
    - Fix: add tied-filehandle fallback to JSON::Syck::DumpFile (GH#98)
    - Fix: handle JSON escape sequences in SingleQuote mode Load (GH#99)
    - Fix: restore Perl 5.8 compatibility in test suite (GH#121)
    - Fix: correct copy-paste error in Makefile.PL clean target (GH#101)
    - Fix: correct $SortKeys POD default from false to true (GH#100)
    - Fix: correct POD documentation errors (GH#103)
    Maintenance:
    - Add C23-compatible function prototypes for GCC 15 compatibility (GH#112)
    - Silence macOS compiler warnings (GH#92)
    - Guard stdint.h include for portability (HP-UX 11.11) (GH#33)
    - Guard stdint.h include in syck_st.h for portability (GH#24)
    - Update ppport.h to 3.68
    - Add regression tests for magical variable dumping (GH#32)
    - CI: modernize GitHub Actions workflow (GH#123, GH#124)
    - CI: add disttest job to validate MANIFEST completeness
  - Use %{make_build} and %{make_install}
  - Drop workaround for C23 incompatibility


author: Paul Howarth <paul@city-fan.org> - 1.39-1
changelog:
  - Update to 1.39
    Bug Fixes:
    - Fix: escape solidus (/) as \/ in JSON::Syck::Dump for XSS safety
      (GH#125, GH#130)
    - Fix: anchor tracking for blessed scalar refs in Dump (GH#126, GH#131)
    - Fix: prevent buffer underflow in base60 (sexagesimal) parsing (GH#133)
    - Fix: guard against NULL type from strtok in tag parsing (GH#135)
    - Fix: correct copy-paste bug in syck_seq_assign() ASSERT macros (GH#137)
    - Fix t/yaml-implicit-typing.t failure with -Duselongdouble perls
      (GH#138, GH#139)
    Improvements:
    - Resolve TODO tests for empty/invalid YAML to match actual behaviour
      (GH#127, GH#129)
    Maintenance:
    - Remove dead Perl 5.6 TODOs and convert 5.8 TODO to SKIP (GH#129)
    - Add comprehensive implicit type resolution test suite (GH#137)
    - Update MANIFEST to include all unit tests
    - Clean up test names to remove unnecessary numbering


author: Paul Howarth <paul@city-fan.org> - 1.41-1
changelog:
  - Update to 1.41
    Bug Fixes:
    - Fix float parsing on -Dusequadmath perls: use Perl's Atof() instead of
      strtod() so that floats like -3.14 are not corrupted by double-precision
      rounding artifacts (GH#140, GH#141)


author: Paul Howarth <paul@city-fan.org> - 1.42-1
changelog:
  - Update to 1.42
    Bug Fixes:
    - Fix: Replace strtok() with strpbrk() and fix sign-compare warnings in
      perl_syck.h (GH#145)
    - Fix: Terminate plain scalars at document boundaries --- and ... (GH#150)
    - Fix: Skip %TAG and %YAML directives in document header (GH#151)
    - Fix: Plug SV leak when eval_pv croaks on bad perl/code blocks (GH#153)
    - Fix: Allow non-specific tag '!' before block scalars (GH#27, GH#102)
    - Fix: Remove spurious %type <nodeId> for indent_open in gram.y
      (GH#157, GH#158)
    - Fix: Use modern bison %define api.prefix directive (GH#159, GH#160)
    Improvements:
    - Implement YAML merge key (<<) support (GH#149)
    Maintenance:
    - Remove dead Perl 5.6/5.8 version guards from test files (GH#146)
    - Add YAML 1.0 spec compliance audit and coverage tests (GH#148)
    - Add comprehensive round-trip tests for YAML 1.0 spec features (GH#152)
    - Remove unneeded TODO in t/json-basic.t (GH#154)
    - Add regex Dump/Load/round-trip tests to perl tag scheme (GH#155)
    - Do not require a .y file to build YAML::Syck; add brew support for bison
    - Don't ship docs/ directory in tarball


author: Paul Howarth <paul@city-fan.org> - 1.43-1
changelog:
  - Update to 1.43
    Bug Fixes:
    - Fix: Prevent resource leaks on croak/early-return paths in Dump (GH#161)
    - Fix: Prevent output SV leaks on croak in Dump/DumpFile callers (GH#163)
    - Fix: Load() in list context returns empty list for empty/undef input; also
      applies to LoadBytes and LoadUTF8 (GH#164, GH#165)
    - Fix: DumpCode serializes prototype string instead of code body (GH#168)
    - Fix: Memory leak in !perl/scalar Load - newRV_inc should be newRV_noinc
      (GH#170)
    - Fix: Add pTHX_ to SAVEDESTRUCTOR_X callback for threaded Perl
      (GH#175, GH#176)
    - Fix: Add TODO guard for eval_pv leak on Perl < 5.14 (GH#179, GH#180)
    - Fix: Negative hex and octal values parsed as 0 with ImplicitTyping (GH#183)
    - Fix: Negative int#base60 values produce unsigned wraparound (GH#185)
    Improvements:
    - Modernize META_MERGE for CPANTS compliance (GH#162)
    - Fix hash table size handling and remove compile warnings in syck_st (GH#174)
    Maintenance:
    - Restore TODO guard for Dump code leak test on Perl < 5.26 (GH#167)
    - Resolve 2010 TODO in perl_json_postprocess with test coverage (GH#166)
    - CI: Upgrade actions to resolve Node.js 20 deprecation warnings (GH#177)


author: Paul Howarth <paul@city-fan.org> - 1.44-1
changelog:
  - Update to 1.44
    Bug Fixes:
    - Fix: Positive hex and octal values parsed as 0 with ImplicitTyping (GH#187)
    - Fix: Resolve uintptr_t redefinition error on Win64 MinGW (GH#186)


author: Paul Howarth <paul@city-fan.org> - 1.45-1
changelog:
  - Update to 1.45
    Bug Fixes:
    - Fix: Use syck_base64_free() to fix Windows "Free to wrong pool" crash in
      base64 encode/decode buffers; also plugs a memory leak (GH#189)
    - Fix: Clear type tag on blessed scalar alias early-return so the stale tag
      no longer leaks onto the next emitted item (GH#193, GH#194, rhbz#2459200)
    - Fix: Negative float#base60 values produce wrong results; strip sign before
      accumulating and avoid negative zero for portable stringification (GH#191)
    - Fix: Prevent memory leaks when Load/LoadJSON croak on parse errors (GH#192)
    Maintenance:
    - Test: Add coverage for SortKeys and JSON MaxDepth (GH#188)
    - Test: Add error handling coverage for LoadFile/DumpFile (GH#190)
    - Update README


author: Paul Howarth <paul@city-fan.org> - 1.3.8b-8
changelog:
  - Drop EL-7 support
    - Drop mod_geoip support
    - Drop mod_wrap support
    - Always build mod_proxy
    - Always use libpcre2
    - Always use maridb client library in preference to mysql
    - Always use libpq client library in preference to postgresql
    - Always use OpenSSL Cipher Profiles
  - Explicitly switch from libmemcached to libmemcached-awesome from Fedora 35
    onwards


author: Paul Howarth <paul@city-fan.org> - 1.3.8b-9
changelog:
  - Fix RADIUS Message-Authenticator verification in mod_radius
    - https://github.com/proftpd/proftpd/issues/1840
    - https://bugzilla.redhat.com/show_bug.cgi?id=2325448


author: Paul Howarth <paul@city-fan.org> - 1.3.8c-1
changelog:
  - Update to 1.3.8c
    - Using FTPS after upgrading from 1.3.8a to 1.3.8b lead to crash (GH#1770)
    - Bad handling of lack of extended attributes lead to SFTP out of memory
      error (GH#1785)
    - mod_sftp_sql logged "header value too long" due to unexpected key header
      text (GH#1529)
    - SSH ECDSA host key algorithms were not used as expected despite configuring
      appropriate key (GH#1839)
    - RADIUS Message-Authenticator verification failed with ProFTPD mod_radius
      (GH#1840)
    - Supplemental group inheritance granted unintended access to GID 0 due to
      lack of supplemental groups from mod_sql (GH#1830)


author: Paul Howarth <paul@city-fan.org> - 1.3.8c-2
changelog:
  - Fixes for C23 compatibility
  - Update mod_vroot to 0.9.12
    - Implement a realpath(3) callback for the FSIO API, for better
      interoperability of other modules when mod_vroot is in effect


author: Paul Howarth <paul@city-fan.org> - 1.3.8c-3
changelog:
  - Avoid NULL pointer dereferences in mod_ls (CVE-2024-57392)
    - https://github.com/proftpd/proftpd/issues/1866
  - Add explicit BR: libxcrypt-devel


author: Paul Howarth <paul@city-fan.org> - 1.3.8d-1
changelog:
  - Update to 1.3.8d
    - Use of HideNoAccess for SFTP sessions can lead to segfault and/or
      unexpected behaviour (GH#1855)
    - SFTP channel allocations can lead to high memory utilization over time
      (GH#1876)
    - Avoid NULL pointer dereferences in mod_ls (GH#1866, CVE-2024-57392)


author: Paul Howarth <paul@city-fan.org> - 1.3.9-1
changelog:
  - Update to 1.3.9 (see RELEASE_NOTES for details)
  - Update mod_proxy to 0.9.5
    - Implemented new IgnoreForeignAddress ProxyOption
    - Fixed passive data transfers to backend IPv4 address when IPv6 support is
      enabled


author: Paul Howarth <paul@city-fan.org> - 1.3.9a-1
changelog:
  - Update to 1.3.9a
    - SCP transfers failed for files with spaces in their names (GH#1886)
    - LDAPDefaultGID ignored since 1.3.9 (GH#1898)
    - Compilation of mod_wrap2 failed when the --enable-wrapper-options configure
      option was used (Bug #4512)
    - mod_sftp failed to parse authorized user/host public keys with CRLF line
      endings (GH#1904)
    - Uploads using MODE Z sometimes resulted in corrupted files or broken
      transfers (GH#1896)
    - Remove usage of the deprecated MySQL_OPT_RECONNECT option for newer MySQL
      versions (GH#1911)
    - Update usage of MySQL API for SSL/TLS connections to server (GH#340)
    - mod_sftp leaked file descriptor when reading SFTPHostKey file (GH#1959)
    - Large/slow SCP downloads could be unnecessarily truncated by TimeoutStalled
      (GH#1964)
    - Handling of CRLs in mod_tls was incorrect, leading to confusing errors
      (GH#1960)
    - Resumed SSL_SESSION management in mod_tls lead to memory growth, infinite
      loop using newer OpenSSL versions (GH#1963)
    - mod_quotatab_ldap interactions could lead to segfault due to stale pointer
      (GH#1984)
    - RNTO before authentication lead to out-of-order response codes (GH#2003)
    - MaxLoginAttemptsFromUser event never triggered in mod_ban for SFTP sessions
      (GH#2009)
    - Using toupper(3) on non-ASCII FTP command bytes might cause remote DoS
      (GH#2019)
    - Out-of-bounds single byte read when FTP command input buffer starts with LF
      (GH#2020)
    - FTP command LIST/NLST -B could cause buffer overflow when listing certain
      crafted filenames (GH#2030)
    - Memory exhaustion with mod_log_forensic when downloading very large files
      via SFTP (GH#2043)
    - Setting process groups during authentication crashed when using mod_radius
      and <IfGroup> (GH#2046)
    - SQL injection possible via mod_sql because of is_escaped_text() logic error
      (GH#2052, CVE-2026-42167)


author: Peter Jones <pjones@redhat.com> - 15.8-2
changelog:
  - Update to shim-15.8
    Resolves: CVE-2023-40546
    Resolves: CVE-2023-40547
    Resolves: CVE-2023-40548
    Resolves: CVE-2023-40549
    Resolves: CVE-2023-40550
    Resolves: CVE-2023-40551
    Resolves: rhbz#2113005
    Resolves: rhbz#2189197
    Resolves: rhbz#2238884
    Resolves: rhbz#2259264


author: Nicolas Frayer <nfrayer@redhat.com>
changelog:
  - Migrate to SPDX license
  - Please refer to https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2


author: Attila Kovacs <attipaci@gmail.com> - 1.5.0-1
changelog:
  - Upstream v1.5.0, and streamlined package structure - Switched to CMake
    for the build - devel sub-package now includes CMake / pkgconfig
    configurations - No longer includes cio-data subpackage (no longer needed
    or used) - No longer includes legacy solsys1 / solsys2 ubpackages


author: Michael Young <m.a.young@durham.ac.uk> - 4.19.3-2
changelog:
  - update to xen-4.19.3
    remove patches now included or superceded upstream
    includes patches for
    x86: Incorrect stubs exception handling for flags recovery [XSA-470,
  	CVE-2025-27465]
    x86: Transitive Scheduler Attacks [XSA-471, CVE-2024-36350,
   	CVE-2024-36357]


author: Michael Young <m.a.young@durham.ac.uk> - 4.19.3-4
changelog:
  - Mutiple vulnerabilities in the Viridian interface [XSA-472,
          CVE-2025-27466, CVE-2025-58142, CVE-2025-58143]
  - Arm issues with page refcounting [XSA-473, CVE-2025-58144,
          CVE-2025-58145]


author: Michael Young <m.a.young@durham.ac.uk> - 4.19.3-6
changelog:
  - x86: Incorrect input sanitisation in Viridian hypercalls [XSA-475,
          CVE-2025-58147, CVE-2025-58148]


author: Michael Young <m.a.young@durham.ac.uk> - 4.19.4-2
changelog:
  x86: buffer overrun with shadow paging + tracing [XSA-477, CVE-2025-58150]
  	(#2434045)
    x86: incomplete IBPB for vCPU isolation [XSA-479, CVE-2026-23553]
  	(#2434047)


author: Michael Young <m.a.young@durham.ac.uk> - 4.19.4-3
changelog:
  - Use after free of paging structures in EPT [XSA-480, CVE-2026-23554]
  - Xenstored DoS by unprivileged domain [XSA-481, CVE-2026-23555]


author: Michael Young <m.a.young@durham.ac.uk> - 4.19.5-2
changelog:
  - oxenstored keeps quota related use counts across domain destruction
          [XSA-483, CVE-2026-23556]
  - Xenstored DoS via XS_RESET_WATCHES command [XSA-484, CVE-2026-23557]
  - grant table v2 race in status page mapping [XSA-486, CVE-2026-23558]
  - x86: Floating Point Divider State Sampling [XSA-488, CVE-2025-54505]


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.6-1
changelog:
  - xwayland 24.1.6 (#2343992)
  - CVE fix for: CVE-2025-26594, CVE-2025-26595, CVE-2025-26596, CVE-2025-26597,
                 CVE-2025-26598, CVE-2025-26599, CVE-2025-26600, CVE-2025-26601


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.7-1
changelog:
  - Update to xserver 24.1.7
  - CVE fix for: CVE-2025-49175, CVE-2025-49176, CVE-2025-49177
                 CVE-2025-49178, CVE-2025-49179, CVE-2025-49180


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-1
changelog:
  - Update to xwayland 24.1.9 (#2406802)
  - CVE fix for: CVE-2025-62229, CVE-2025-62230, CVE-2025-62231


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.10-1
changelog:
  - Update to xwayland 24.1.10
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001,
                 CVE-2026-34002, CVE-2026-34003


