# changelog

author: Simone Caronni <negativo17@gmail.com> - 1:1.4.36-1
changelog:
  - All references to 1.4.36.0 have disappeared completely from the git
    repository and 1.4.36 has been released in place. Bump Epoch to point to
    a real release.


author: Terje Rosten <terjeros@gmail.com> - 3.1.8-1
changelog:
  - 3.1.8
  - apt-key is gone
  - Add openssl-devel to buildreq
  - Fix include issue
  - apt-extracttemplates has moved


author: Fabrice Creuzot <code@luigifab.fr> - 3.0.0-1
changelog:
  - New upstream release
  - Add support for CSD window
  - Add --enable-only-gtkx and --disable-gtkx options


author: Ranjan Maitra <aarem AT fedoraproject DOT org> - 2.3-34
changelog:
  - updated obsolete URL http://arp242.net/code/battray/ to https://github.com/arp242/battray
  - address BZ #2387778


author: Simone Caronni <negativo17@gmail.com> - 0.1-1
changelog:
  - Update to 0.1 for https://fedoraproject.org/wiki/Releases/42/ChangeSet#Unify_/usr/bin_and_/usr/sbin


author: Jose Fernandez <me@jrfernandez.com> - 0.7.1-1
changelog:
  - Update to version 0.7.1
  - Update to upstream version 0.7.1
  - Drop patches for dependency version relaxation (no longer needed with new
    upstream)
  - Fixes CVE-2025-58160: fixes RHBZ#2391984, fixes RHBZ#2392018


author: Than Ngo <than@redhat.com> - 146.0.7680.153-1
changelog:
  - Update to 146.0.7680.153
    * CVE-2026-4439: Out of bounds memory access in WebGL
    * CVE-2026-4440: Out of bounds read and write in WebGL
    * CVE-2026-4441: Use after free in Base
    * CVE-2026-4442: Heap buffer overflow in CSS
    * CVE-2026-4443: Heap buffer overflow in WebAudio
    * CVE-2026-4444: Stack buffer overflow in WebRTC
    * CVE-2026-4445: Use after free in WebRTC
    * CVE-2026-4446: Use after free in WebRTC
    * CVE-2026-4447: Inappropriate implementation in V8
    * CVE-2026-4448: Heap buffer overflow in ANGLE
    * CVE-2026-4449: Use after free in Blink
    * CVE-2026-4450: Out of bounds write in V8
    * CVE-2026-4451: Insufficient validation of untrusted input in Navigation
    * CVE-2026-4452: Integer overflow in ANGLE
    * CVE-2026-4453: Integer overflow in Dawn
    * CVE-2026-4454: Use after free in Network
    * CVE-2026-4455: Heap buffer overflow in PDFium
    * CVE-2026-4456: Use after free in Digital Credentials API
    * CVE-2026-4457: Type Confusion in V8
    * CVE-2026-4458: Use after free in Extensions
    * CVE-2026-4459: Out of bounds read and write in WebAudio
    * CVE-2026-4460: Out of bounds read in Skia
    * CVE-2026-4461: Inappropriate implementation in V8
    * CVE-2026-4462: Out of bounds read in Blink
    * CVE-2026-4463: Heap buffer overflow in WebRTC
    * CVE-2026-4464: Integer overflow in ANGLE


author: Than Ngo <than@redhat.com> - 146.0.7680.164-1
changelog:
  - Update to 146.0.7680.164
    * High CVE-2026-4673: Heap buffer overflow in WebAudio
    * High CVE-2026-4674: Out of bounds read in CSS
    * High CVE-2026-4675: Heap buffer overflow in WebGL
    * High CVE-2026-4676: Use after free in Dawn
    * High CVE-2026-4677: Out of bounds read in WebAudio
    * High CVE-2026-4678: Use after free in WebGPU
    * High CVE-2026-4679: Integer overflow in Fonts
    * High CVE-2026-4680: Use after free in FedCM


author: Than Ngo <than@redhat.com> - 146.0.7680.177-1
changelog:
  - Update to 146.0.7680.177
    * High CVE-2026-5273: Use after free in CSS
    * High CVE-2026-5272: Heap buffer overflow in GPU
    * High CVE-2026-5274: Integer overflow in Codecs
    * High CVE-2026-5275: Heap buffer overflow in ANGLE
    * High CVE-2026-5276: Insufficient policy enforcement in WebUSB
    * High CVE-2026-5277: Integer overflow in ANGLE
    * High CVE-2026-5278: Use after free in Web MIDI
    * High CVE-2026-5279: Object corruption in V8
    * High CVE-2026-5280: Use after free in WebCodecs
    * High CVE-2026-5281: Use after free in Dawn
    * High CVE-2026-5282: Out of bounds read in WebCodecs
    * High CVE-2026-5283: Inappropriate implementation in ANGLE
    * High CVE-2026-5284: Use after free in Dawn
    * High CVE-2026-5285: Use after free in WebGL
    * High CVE-2026-5286: Use after free in Dawn
    * High CVE-2026-5287: Use after free in PDF
    * High CVE-2026-5288: Use after free in WebView
    * High CVE-2026-5289: Use after free in Navigation
    * High CVE-2026-5290: Use after free in Compositing
    * Medium CVE-2026-5291: Inappropriate implementation in WebGL
    * Medium CVE-2026-5292: Out of bounds read in WebCodecs


author: Than Ngo <than@redhat.com> - 147.0.7727.55-1
changelog:
  - Update to 147.0.7727.55
    * Critical CVE-2026-5858: Heap buffer overflow in WebML
    * Critical CVE-2026-5859: Integer overflow in WebML
    * High CVE-2026-5860: Use after free in WebRTC
    * High CVE-2026-5861: Use after free in V8
    * High CVE-2026-5862: Inappropriate implementation in V8
    * High CVE-2026-5863: Inappropriate implementation in V8
    * High CVE-2026-5864: Heap buffer overflow in WebAudio
    * High CVE-2026-5865: Type Confusion in V8
    * High CVE-2026-5866: Use after free in Media
    * High CVE-2026-5867: Heap buffer overflow in WebML
    * High CVE-2026-5868: Heap buffer overflow in ANGLE
    * High CVE-2026-5869: Heap buffer overflow in WebML
    * High CVE-2026-5870: Integer overflow in Skia
    * High CVE-2026-5871: Type Confusion in V8
    * High CVE-2026-5872: Use after free in Blink
    * High CVE-2026-5873: Out of bounds read and write in V8
    * Medium CVE-2026-5874: Use after free in PrivateAI
    * Medium CVE-2026-5875: Policy bypass in Blink
    * Medium CVE-2026-5876: Side-channel information leakage in Navigation
    * Medium CVE-2026-5877: Use after free in Navigation
    * Medium CVE-2026-5878: Incorrect security UI in Blink
    * Medium CVE-2026-5879: Insufficient validation of untrusted input in ANGLE
    * Medium CVE-2026-5880: Incorrect security UI in browser UI
    * Medium CVE-2026-5881: Policy bypass in LocalNetworkAccess
    * Medium CVE-2026-5882: Incorrect security UI in Fullscreen
    * Medium CVE-2026-5883: Use after free in Media
    * Medium CVE-2026-5884: Insufficient validation of untrusted input in Media
    * Medium CVE-2026-5885: Insufficient validation of untrusted input in WebML
    * Medium CVE-2026-5886: Out of bounds read in WebAudio
    * Medium CVE-2026-5887: Insufficient validation of untrusted input in Downloads
    * Medium CVE-2026-5888: Uninitialized Use in WebCodecs
    * Medium CVE-2026-5889: Cryptographic Flaw in PDFium
    * Medium CVE-2026-5890: Race in WebCodecs
    * Medium CVE-2026-5891: Insufficient policy enforcement in browser UI
    * Medium CVE-2026-5892: Insufficient policy enforcement in PWAs
    * Medium CVE-2026-5893: Race in V8
    * Low CVE-2026-5894: Inappropriate implementation in PDF
    * Low CVE-2026-5895: Incorrect security UI in Omnibox
    * Low CVE-2026-5896: Policy bypass in Audio
    * Low CVE-2026-5897: Incorrect security UI in Downloads
    * Low CVE-2026-5898: Incorrect security UI in Omnibox
    * Low CVE-2026-5899: Incorrect security UI in History Navigation
    * Low CVE-2026-5900: Policy bypass in Downloads
    * Low CVE-2026-5901: Policy bypass in DevTools
    * Low CVE-2026-5902: Race in Media
    * Low CVE-2026-5903: Policy bypass in IFrameSandbox
    * Low CVE-2026-5904: Use after free in V8
    * Low CVE-2026-5905: Incorrect security UI in Permissions
    * Low CVE-2026-5906: Incorrect security UI in Omnibox
    * Low CVE-2026-5907: Insufficient data validation in Media
    * Low CVE-2026-5908: Integer overflow in Media
    * Low CVE-2026-5909: Integer overflow in Media
    * Low CVE-2026-5910: Integer overflow in Media
    * Low CVE-2026-5911: Policy bypass in ServiceWorkers
    * Low CVE-2026-5912: Integer overflow in WebRTC
    * Low CVE-2026-5913: Out of bounds read in Blink
    * Low CVE-2026-5914: Type Confusion in CSS
    * Low CVE-2026-5915: Insufficient validation of untrusted input in WebML
    * Low CVE-2026-5918: Inappropriate implementation in Navigation
    * Low CVE-2026-5919: Insufficient validation of untrusted input in WebSockets


author: Than Ngo <than@redhat.com> - 147.0.7727.101-1
changelog:
  - Update to 147.0.7727.101
    * Critical CVE-2026-6296: Heap buffer overflow in ANGLE
    * Critical CVE-2026-6297: Use after free in Proxy
    * Critical CVE-2026-6298: Heap buffer overflow in Skia
    * Critical CVE-2026-6299: Use after free in Prerender
    * Critical CVE-2026-6358: Use after free in XR
    * High CVE-2026-6359: Use after free in Video
    * High CVE-2026-6300: Use after free in CSS
    * High CVE-2026-6301: Type Confusion in Turbofan
    * High CVE-2026-6302: Use after free in Video
    * High CVE-2026-6303: Use after free in Codecs
    * High CVE-2026-6304: Use after free in Graphite
    * High CVE-2026-6305: Heap buffer overflow in PDFium
    * High CVE-2026-6306: Heap buffer overflow in PDFium
    * High CVE-2026-6307: Type Confusion in Turbofan
    * High CVE-2026-6308: Out of bounds read in Media
    * High CVE-2026-6309: Use after free in Viz
    * High CVE-2026-6360: Use after free in FileSystem
    * High CVE-2026-6310: Use after free in Dawn
    * High CVE-2026-6311: Uninitialized Use in Accessibility
    * High CVE-2026-6312: Insufficient policy enforcement in Passwords
    * High CVE-2026-6313: Insufficient policy enforcement in CORS
    * High CVE-2026-6314: Out of bounds write in GPU
    * High CVE-2026-6315: Use after free in Permissions
    * High CVE-2026-6316: Use after free in Forms
    * High CVE-2026-6361: Heap buffer overflow in PDFium
    * High CVE-2026-6362: Use after free in Codecs
    * High CVE-2026-6317: Use after free in Cast
    * Medium CVE-2026-6363: Type Confusion in V8
    * Medium CVE-2026-6318: Use after free in Codecs
    * Medium CVE-2026-6319: Use after free in Payments
    * Medium CVE-2026-6364: Out of bounds read in Skia


author: Than Ngo <than@redhat.com> - 147.0.7727.116-1
changelog:
  - Update to 147.0.7727.116
    * High CVE-2026-6919: Use after free in DevTools
    * High CVE-2026-6920: Out of bounds read in GPU
    * Medium CVE-2026-6921: Race in GPU
  - Fix rhbz#2458171, unexpanded macros in manpage


author: Than Ngo <than@redhat.com> - 147.0.7727.116-2
changelog:
  - Fix FTBFS with rust 1.95
  - Backport the upstream fix GL native pixmap import support reset in GpuInit


author: Than Ngo <than@redhat.com> - 147.0.7727.137-1
changelog:
  - Update to 147.0.7727.137
     * Critical CVE-2026-7363: Use after free in Canvas
     * Critical CVE-2026-7361: Use after free in iOS
     * Critical CVE-2026-7344: Use after free in Accessibility
     * Critical CVE-2026-7343: Use after free in Views
     * High CVE-2026-7333: Use after free in GPU
     * High CVE-2026-7360: Insufficient validation of untrusted input in Compositing
     * High CVE-2026-7359: Use after free in ANGLE
     * High CVE-2026-7358: Use after free in Animation
     * High CVE-2026-7334: Use after free in Views
     * High CVE-2026-7357: Use after free in GPU
     * High CVE-2026-7356: Use after free in Navigation
     * High CVE-2026-7354: Out of bounds read and write in Angle
     * High CVE-2026-7353: Heap buffer overflow in Skia
     * High CVE-2026-7352: Use after free in Media
     * High CVE-2026-7351: Race in MHTML
     * High CVE-2026-7350: Use after free in WebMIDI
     * High CVE-2026-7349: Use after free in Cast
     * High CVE-2026-7348: Use after free in Codecs
     * High CVE-2026-7335: Use after free in media
     * High CVE-2026-7336: Use after free in WebRTC
     * High CVE-2026-7337: Type Confusion in V8
     * High CVE-2026-7347: Use after free in Chromoting
     * High CVE-2026-7346: Inappropriate implementation in Tint
     * High CVE-2026-7345: Insufficient validation of untrusted input in Feedback
     * High CVE-2026-7338: Use after free in Cast
     * High CVE-2026-7342: Use after free in WebView
     * High CVE-2026-7341: Use after free in WebRTC
     * Medium CVE-2026-7339: Heap buffer overflow in WebRTC
     * Medium CVE-2026-7340: Integer overflow in ANGLE
     * Medium CVE-2026-7355: Use after free in Media


author: Than Ngo <than@redhat.com> - 148.0.7778.96-1
changelog:
  - Update to 148.0.7778.96
     * CVE-2026-7896: Integer overflow in Blink
     * CVE-2026-7897: Use after free in Mobile
     * CVE-2026-7898: Use after free in Chromoting
     * CVE-2026-7899: Out of bounds read and write in V8
     * CVE-2026-7900: Heap buffer overflow in ANGLE
     * CVE-2026-7901: Use after free in ANGLE
     * CVE-2026-7902: Out of bounds memory access in V8
     * CVE-2026-7903: Integer overflow in ANGLE
     * CVE-2026-7904: Out of bounds read in Fonts
     * CVE-2026-7905: Insufficient validation of untrusted input in Media
     * CVE-2026-7906: Use after free in SVG
     * CVE-2026-7907: Use after free in DOM
     * CVE-2026-7908: Use after free in Fullscreen
     * CVE-2026-7909: Inappropriate implementation in ServiceWorker
     * CVE-2026-7910: Use after free in Views
     * CVE-2026-7911: Use after free in Aura
     * CVE-2026-7912: Integer overflow in GPU
     * CVE-2026-7913: Insufficient policy enforcement in DevTools
     * CVE-2026-7914: Type Confusion in Accessibility
     * CVE-2026-7915: Insufficient data validation in DevTools
     * CVE-2026-7916: Insufficient data validation in InterestGroups
     * CVE-2026-7917: Use after free in Fullscreen
     * CVE-2026-7918: Use after free in GPU
     * CVE-2026-7919: Use after free in Aura
     * CVE-2026-7920: Use after free in Skia
     * CVE-2026-7921: Use after free in Passwords
     * CVE-2026-7922: Use after free in ServiceWorker
     * CVE-2026-7923: Out of bounds write in Skia
     * CVE-2026-7924: Uninitialized Use in Dawn
     * CVE-2026-7925: Use after free in Chromoting
     * CVE-2026-7926: Use after free in PresentationAPI
     * CVE-2026-7927: Type Confusion in Runtime
     * CVE-2026-7928: Use after free in WebRTC
     * CVE-2026-7929: Use after free in MediaRecording
     * CVE-2026-7930: Insufficient validation of untrusted input in Cookies
     * CVE-2026-7931: Insufficient validation of untrusted input in iOS
     * CVE-2026-7932: Insufficient policy enforcement in Downloads
     * CVE-2026-7933: Out of bounds read in WebCodecs
     * CVE-2026-7934: Insufficient validation of untrusted input in Popup Blocker
     * CVE-2026-7935: Inappropriate implementation in Speech
     * CVE-2026-7936: Object lifecycle issue in V8
     * CVE-2026-7937: Insufficient policy enforcement in DevTools
     * CVE-2026-7938: Use after free in CSS
     * CVE-2026-7939: Inappropriate implementation in SanitizerAPI
     * CVE-2026-7940: Use after free in V8
     * CVE-2026-7941: Insufficient validation of untrusted input in Mobile
     * CVE-2026-7942: Integer overflow in ANGLE
     * CVE-2026-7943: Insufficient validation of untrusted input in ANGLE
     * CVE-2026-7944: Insufficient validation of untrusted input in Persistent Cache
     * CVE-2026-7945: Insufficient validation of untrusted input in COOP
     * CVE-2026-7946: Insufficient policy enforcement in WebUI
     * CVE-2026-7947: Insufficient validation of untrusted input in Network
     * CVE-2026-7948: Race in Chromoting
     * CVE-2026-7949: Out of bounds read in Skia
     * CVE-2026-7950: Out of bounds read and write in GFX
     * CVE-2026-7951: Out of bounds write in WebRTC
     * CVE-2026-7952: Insufficient policy enforcement in Extensions
     * CVE-2026-7953: Insufficient validation of untrusted input in Omnibox
     * CVE-2026-7954: Race in Shared Storage
     * CVE-2026-7955: Uninitialized Use in GPU
     * CVE-2026-7956: Use after free in Navigation
     * CVE-2026-7957: Out of bounds write in Media
     * CVE-2026-7958: Inappropriate implementation in ServiceWorker
     * CVE-2026-7959: Inappropriate implementation in Navigation
     * CVE-2026-7960: Race in Speech
     * CVE-2026-7961: Insufficient validation of untrusted input in Permissions
     * CVE-2026-7962: Insufficient policy enforcement in DirectSockets
     * CVE-2026-7963: Inappropriate implementation in ServiceWorker
     * CVE-2026-7964: Insufficient validation of untrusted input in FileSystem
     * CVE-2026-7965: Insufficient validation of untrusted input in DevTools
     * CVE-2026-7966: Insufficient validation of untrusted input in SiteIsolation
     * CVE-2026-7967: Insufficient validation of untrusted input in Navigation
     * CVE-2026-7968: Insufficient validation of untrusted input in CORS
     * CVE-2026-7969: Integer overflow in Network
     * CVE-2026-7970: Use after free in TopChrome
     * CVE-2026-7971: Inappropriate implementation in ORB
     * CVE-2026-7972: Uninitialized Use in GPU
     * CVE-2026-7973: Integer overflow in Dawn
     * CVE-2026-7974: Use after free in Blink
     * CVE-2026-7975: Use after free in DevTools
     * CVE-2026-7976: Use after free in Views
     * CVE-2026-7977: Inappropriate implementation in Canvas
     * CVE-2026-7978: Inappropriate implementation in Companion
     * CVE-2026-7979: Inappropriate implementation in Media
     * CVE-2026-7980: Use after free in WebAudio
     * CVE-2026-7981: Out of bounds read in Codecs
     * CVE-2026-7982: Uninitialized Use in WebCodecs
     * CVE-2026-7983: Out of bounds read in Dawn
     * CVE-2026-7984: Use after free in ReadingMode
     * CVE-2026-7985: Use after free in GPU
     * CVE-2026-7986: Insufficient policy enforcement in Autofill
     * CVE-2026-7987: Use after free in WebRTC
     * CVE-2026-7988: Type Confusion in WebRTC
     * CVE-2026-7989: Insufficient data validation in DataTransfer
     * CVE-2026-7990: Insufficient validation of untrusted input in Updater
     * CVE-2026-7991: Use after free in UI
     * CVE-2026-7992: Insufficient validation of untrusted input in UI
     * CVE-2026-7993: Insufficient validation of untrusted input in Payments
     * CVE-2026-7994: Inappropriate implementation in Chromoting
     * CVE-2026-7995: Out of bounds read in AdFilter
     * CVE-2026-7996: Insufficient validation of untrusted input in SSL
     * CVE-2026-7997: Insufficient validation of untrusted input in Updater
     * CVE-2026-7998: Insufficient validation of untrusted input in Dialog
     * CVE-2026-7999: Inappropriate implementation in V8
     * CVE-2026-8000: Insufficient validation of untrusted input in ChromeDriver
     * CVE-2026-8001: Use after free in Printing
     * CVE-2026-8002: Use after free in Audio
     * CVE-2026-8003: Insufficient validation of untrusted input in TabGroups
     * CVE-2026-8004: Insufficient policy enforcement in DevTools
     * CVE-2026-8005: Insufficient validation of untrusted input in Cast
     * CVE-2026-8006: Insufficient policy enforcement in DevTools
     * CVE-2026-8007: Insufficient validation of untrusted input in Cast
     * CVE-2026-8008: Inappropriate implementation in DevTools
     * CVE-2026-8009: Inappropriate implementation in Cast
     * CVE-2026-8010: Insufficient validation of untrusted input in SiteIsolation
     * CVE-2026-8011: Insufficient policy enforcement in Search
     * CVE-2026-8012: Inappropriate implementation in MHTML
     * CVE-2026-8013: Insufficient validation of untrusted input in FedCM
     * CVE-2026-8014: Inappropriate implementation in Preload
     * CVE-2026-8015: Inappropriate implementation in Media
     * CVE-2026-8016: Use after free in WebRTC
     * CVE-2026-8017: Side-channel information leakage in Media
     * CVE-2026-8018: Insufficient policy enforcement in DevTools
     * CVE-2026-8019: Insufficient policy enforcement in WebApp
     * CVE-2026-8020: Uninitialized Use in GPU
     * CVE-2026-8021: Script injection in UI
     * CVE-2026-8022: Inappropriate implementation in MHTML
  - Remove old remoting-no-tests patch
  - Remove fix_GL_native_pixmap_import_support_reset_in_GpuInit patch
  - Fix build error causing by sanitizer defines in GN
  - Refresh rust-enable-unstable_feature patch
  - Fix build error with system rust compiler
  - Fix build error causing by new clang++ options which are not supported yet
  - Fix build error causing by harfbuzz library rename


author: Robert Scheck <robert@fedoraproject.org> - 4.7.0-1
changelog:
  - Upgrade to 4.7.0 (#2369521)
  - Use 'systemctl try-reload-or-restart' in logrotate postrotate
    script (#2371578, thanks to Marcos Mello)


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.33.8-5
changelog:
  - Update template with binutils fix
  - See https://bugzilla.redhat.com/show_bug.cgi?id=2428281 for binutils
    update for F44 and F45 (rawhide). This breaks the build for CRI-O.
  - This is fixed with inclusion of -Wl,-z,notext.
  - Cleaned up confusing syntax (service_name).


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.33.9-1
changelog:
  - Update to release v1.33.9
  - No changes from upstream
  - Rawhide (f44, f45) contains an update to binutils which breaks cri-o
    build. Fixed by change to template


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.33.9-5
changelog:
  - Add --skip-dynamic-tags for annocheck
  - annocheck test fails on aarch64 for pinns due to changes in binutils not
    handled by annocheck.
  - See https://sourceware.org/bugzilla/show_bug.cgi?id=33963 for more
    informaton
  - Tempory skip. Remove when annocheck 13.07 or newer is deployed in Fedora
    packit CI


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.35.1-2
changelog:
  - Refresh spec file using go2rpm
  - Update spec file template using go2rpm
  - Use kubernetes-cni instead of containernetworking-plugins
  - Adds addition cni conflist
  - Use gocheck2 for tests


author: Bradley G Smith <bradley.g.smith@gmail.com> - 1.35.3-1
changelog:
  - Update to release v1.35.3
  - Resolves: rhbz#2466629
  - Fix CVE-2026-35469
  - Upstream fixes and new feature


author: Ralf Senderek <innovation@senderek.ie> 3.4.8-12
changelog:
  - add a %generate_buildrequires section (PR#8)
  - remove duplications from -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wno-complain-wrong-lang -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -mbranch-protection=standard -fasynchronous-unwind-tables -fstack-clash-protection -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer


author: Ralf Senderek <innovation@senderek.ie> 3.4.8-15
changelog:
  - Update cryptlib-3.4.8 with source code https://github.com/cryptlib/cryptlib
  - Update all files in the cryptlib tools package to version 1.1


author: Ralf Senderek <innovation@senderek.ie> 3.4.8-12
changelog:
  - add a %generate_buildrequires section (PR#8)
  - remove duplications from -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wno-complain-wrong-lang -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=x86-64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -mtls-dialect=gnu2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer


author: Dominik Mierzejewski <dominik@greysector.net> - 7.1.1-1
changelog:
  - Update to 7.1.1 (resolves rhbz#2349351)
  - Enable LC3 codec via liblc3
  - Backport fix for CVE-2025-22921 (resolves rhbz#2346558)


author: Simone Caronni <negativo17@gmail.com> - 7.1.2-1
changelog:
  - Update to 7.1.2.
  - Enable VANC processing for SDI.
  - Explicitly list all implicitly enabled/disabled options.


author: Sandipan Roy <sandipan@redhat.com> - 2.1.0-1
changelog:
  - Update to version 2.1.0
  - Update to 2.1.0 - Closes rhbz#2061180 rhbz#2352162
  - Implement vendoring approach using go2rpm with vendor archive
  - Add all Go dependencies bundled for offline builds in mock/koji
  - Use rpmautospec for automatic release and changelog management
  - Re-enable tests with selective skipping for TestToCSV failure only
  - Update license to include all vendored dependency licenses: Apache-2.0
    AND BSD-2-Clause AND BSD-3-Clause AND MIT
  - Preserve complete historical changelog from package inception


author: Julien Rische <jrische@redhat.com> - 1.21.2-6
changelog:
  - CVE-2024-37370 CVE-2024-37371: GSS message token handling
    Resolves: rhbz#2294678 rhbz#2294680
  - Fix double free in klist's show_ccache()
    Resolves: rhbz#2257301
  - Do not include files with "~" termination in krb5-tests


author: Julien Rische <jrische@redhat.com> - 1.21.3-1
changelog:
  - New upstream version (1.21.3)
  - CVE-2024-26458: Memory leak in src/lib/rpc/pmap_rmt.c
    Resolves: rhbz#2266732
  - CVE-2024-26461: Memory leak in src/lib/gssapi/krb5/k5sealv3.c
    Resolves: rhbz#2266741
  - CVE-2024-26462: Memory leak in src/kdc/ndr.c
    Resolves: rhbz#2266743
  - Add missing SPDX license identifiers
    Resolves: rhbz#2265333


author: Julien Rische <jrische@redhat.com> - 1.21.3-3
changelog:
  - libkrad: implement support for Message-Authenticator (CVE-2024-3596)
    Resolves: rhbz#2304071
  - Fix various issues detected by static analysis
    Resolves: rhbz#2322704
  - Remove RSA protocol for PKINIT
    Resolves: rhbz#2322706
  - Make TCP waiting time configurable
    Resolves: rhbz#2322711


author: Julien Rische <jrische@redhat.com> - 1.21.3-5
changelog:
  - Prevent overflow when calculating ulog block size (CVE-2025-24528)
    Resolves: rhbz#2342798
  - Support PKCS11 EC client certs in PKINIT
    Resolves: rhbz#2341962
  - kdb5_util: fix DB entry flags on modification
    Resolves: rhbz#2336555
  - Add ECDH support for PKINIT (RFC5349)
    Resolves: rhbz#2214326
  - Remove dependency of krb5-libs on gawk and sed
    Resolves: rhbz#2323859


author: Julien Rische <jrische@redhat.com> - 1.21.3-6
changelog:
  - Do not block HMAC-MD4/5 in FIPS mode
    Resolves: rhbz#2370259
  - PKINIT: implement paChecksum2 from MS-PKCA v20230920
    Resolves: rhbz#2357215
  - Disallow RC4 HMAC-MD5 session keys by default (CVE-2025-3576)
    Resolves: rhbz#2359705


author: Julien Rische <jrische@redhat.com> - 1.21.3-7
changelog:
  - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
    Resolves: rhbz#2463398 rhbz#2463395


author: Simone Caronni <negativo17@gmail.com> - 0.0.13^20250419gitc2860cc-2
changelog:
  - Clean up SPEC file.
  - Simplify conditionals
  - Drivers for ppc64le are long gone
  - RPMFusion package is long gone


author: Richard Russon <rich@flatcap.org> - 20250510-1
changelog:
  - Contrib
    - #4616 Fix gpg-json output
  - Bug Fixes
    - #4600 main: don't stop if /var/spool/mail is missing
    - #4602 color: fix quoted maths
    - #4604 Don't consider "weed" when writing an email to file
    - #4605 help: fix leaks
    - #4612 imap: check for incomplete Mailboxes on sync
    - #4622 fix label completion crash
  - Translations
    - #4622 update Esperanto translation
    - Update lt_LT translations
  - Docs
    -  docs: fix broken functions
  - Build
    - #4607 Check for DocBook XSL
    - #4618 Build and test on FreeBSD


author: Richard Russon <rich@flatcap.org> - 20250905-1
changelog:
  - Security
    - #4623 ncrypt/crypt.c: Protect Message-ID
  - Features
    - #4644 Provide an option to confirm on an empty To
  - Contrib
    - #4645 Add ayu-dark-256 colorscheme
  - Bug Fixes
    - #4635 Handle a non-existing message_cache_dir
    - #4642 Decouple `$crypt_encryption_info` and `$crypt_protected_headers_weed` from `$devel_security`
    - #4650 Return success after querying for config
  - Changed Config
    - Add: `confirm_empty_to = no`
    Confirm when sending an e-mail with an empty To:
  - Translations
    - 100% German
    - 100% Turkish
    - 99% Hungarian
    - 98% Lithuanian
    - 89% French
  - Build
    - #4636 Update FreeBSD CI and workaround `pkg` bug
    - actions: use checkout v5
  - Code
    - #4023 tweak observer event types
    - #4628 Use the standard countof instead of our mutt_array_size()
    - #4637 Update types in test dummy code
    - #4638 remove useless const qualifier from log_queue_get()
    - #4655 Make sure ctype(3) function arguments are valid
    - #4657 Fix warning about unused function and data
    - #4659 Include term.h and [n]curses.h consistently


author: Richard Russon <rich@flatcap.org> - 20260105-1
changelog:
  - Security
    - #4725	deprecate old ssl and tls options
  - Features
    - #4718	add `$message_id_format`
    - Notmuch: hide some old/deprecated features
  - Bug Fixes
    - #4666	limit: force refresh of index bar
    - #4671	Update the status bar on thread [un]collapse
    - #4673	shrink history file on every new entry
    - #4679	Flush S/MIME passkey on failure to sign
    - #4684	execute message-hook sooner
    - #4687	fix: exec auto-completion
    - #4688	Fix infinite loop in GnuTLS socket I/O when socket blocks
    - #4696	`cmd_parse_fetch()`: debug: avoid NULL dereference
    - #4697	expunge: guard against segfault
    - #4719	alias: complete when only one match
    - #4726	imap: protect against crash on shutdown
    - fix resolve for tagged save
    - help: fix sorting of unbound functions
    - help: hide deprecated functions
  - Changed Config
    - New: `message_id_format = "<%z@%f>"`
    - Deprecated `ssl_use_sslv2`
    - Deprecated `ssl_use_sslv3`
    - Deprecated `ssl_use_tlsv1`
    - Deprecated `ssl_use_tlsv1_1`
  - Translations
    - 100% Esperanto
    - 100% Lithuanian
    - 100% Serbian
    - 100% Turkish
  - Docs
    - #4665	Revamp the S/MIME docs
    - #4680	Document how to use S/MIME with GPGMe
    - #4692	update the contribution guidelines
    - fix deprecated $pager example
    - lots man pages fixes
    - update help for sort options
  - Build
    - #4668	fix build for re-entrant ncurses
    - #4727	make openssl/gnutls mutually exclusive
    - libkey: light refactoring
    - lua: create liblua
  - Code
    - #4695	Replace some `TAILQ` uses with `ARRAY`
    - convert the ctype wrappers to use `bool`
    - global invert `OptNoCurses` to `OptGui`
    - key: collapse redirector functions
    - move `km_init()` earlier in startup
    - opcodes: add flags to `MenuFuncOp`
    - pass focused window to global functions
    - Use `buf_at()` to get a char from a `Buffer`
    - use `StringArray` everywhere


author: Richard Russon <rich@flatcap.org> - 20260406-1
changelog:
  - Features
    - #4799 Add IMAP connection monitoring, timeouts, and reconnection backoff
  - Bug Fixes
    - #4755 Fix off-by-one in ARRAY_RESERVE()
    - #4819 Fix IMAP crash when changing folders
    - Fix freeze in IMAP with OpenSSL
    - Fix blocking IMAP pipeline drain with many mailboxes
    - Fix crash on threaded index update
    - Fix crash on NULL thread in display subject
    - Fix menu half-down when data fits in one page
    - Fix alias search prompt
    - Fix index tag colours
    - Protect hooks against unhook during execution
    - Fix leak in pattern alias search
    - Consistently convert headers to LF EOL convention
  - Changed Config
    - Changed: `compose_show_preview = yes`
    Display a preview of the message body in the Compose window
  - Docs
    - `$message_id_format`: mention Base64Url encoding
    - Fix descriptions of deprecated config options
  - Build
    - #4826 Use optreset on Solaris too
    - #4827 Avoid function name clash on Solaris
    - #4828 Allow Solaris to use qsort_s
    - Check docs requirements in configure
  - Code
    - Fix graphviz debug output


author: Richard Russon <rich@flatcap.org> - 20260504-1
changelog:
  - Security
    - Fix GSSAPI buffer underflow on short unwrapped tokens
    - Reject percent-encoded NUL bytes in URL decoding
    - Skip CN fallback when SAN dNSName entries exist (RFC6125)
    - Cap POP3 UIDL responses to prevent OOM from a malicious server
    - Harden POP host URL copy
  - Bug Fixes
    - #4836 imap: fix memory leak in `msg_parse_flags`
    - #4849 Fix memmove in `mutt_str_expand_tabs`
    - #4850 IMAP: enhance stability with re-entrancy protection and reconnection fixes
    - #4852 Say which mailcap field we are looking for
    - #4853 Don't overwrite content_type
    - pager: fix crash on `uncolor *`
    - pager: fix wrong line index in signature syntax realloc
    - pager: fix OOB read on short log lines in `display_line()`
    - pager: fix off-by-one in newline restoration
    - imap: fix sort for missing emails
    - imap: fix crash when syncing mailbox on exit
    - Fix crash in `cmd_parse_fetch()` when edata is NULL
    - log: fix missing errors on startup
    - Force cursor to be visible on exit


author: Jens Petersen <petersen@redhat.com> - 2.31.2-33
changelog:
  - ghost /nix/var/nix/* and sockets
  - add builds/ ghost back to daemon (since it creates it)
  - db/ and gcroots/auto/ remain after uninstalling


author: Jens Petersen <petersen@redhat.com> - 2.31.2-36
changelog:
  - trivial spec changes
  - list nix-daemon files without glob
  - commented TEST_ROOT: doesn't actually work


author: Jens Petersen <petersen@redhat.com> - 2.31.3-2
changelog:
  - sync readme/gating/tests improvements from rawhide/f44
  - document nixGL
  - enable gating on tier0 and install CI tests


author: Jens Petersen <petersen@redhat.com> - 2.31.5-1
changelog:
  - update to 2.31.5: fixes GHSA-vh5x-56v6-4368
  - https://discourse.nixos.org/t/security-advisory-local-privilege-
    escalation-in-lix-and-nix/77407
  - https://github.com/NixOS/nix/security/advisories/GHSA-vh5x-56v6-4368


author: Jan Staněk <jstanek@redhat.com> - 1:20.20.0-3
changelog:
  - Convert to next-gen packaging
  - Use packaging scripts and spec file structure from current nodejs24


author: Andrei Radchenko <aradchen@redhat.com> - 1:20.20.2-4
changelog:
  - test plan: diverge from f44
  - bin packages were introduced in f44 onwards
  - provision step should be set automatically by testing farm


author: Than Ngo <than@redhat.com> - 3.25.0-1
changelog:
  - Update to 3.25.0
  - Drop patches which are included in upstream
  - Adapt p11sak patch
  - Fix RPM build warnings
  - Add jq and openssl in Build Requirement, required for testcases


author: Than Ngo <than@redhat.com> - 3.25.0-4
changelog:
  - Require openssl >= 3.5.1
  - Fix incorrect effective group id of pkcsslotd daemon
  - Fix covscan findings
  - Fix detection of EC curve not supported by OpenSSL-3.5.x
  - Fix the image mode issue again as bootc expects to use /run/lock


author: Stefano Brivio <sbrivio@redhat.com> - 0^20251209.gc3f1ba7-1
changelog:
  - Fix build on Fedora 43, selinux_requires_min not available on Copr builders
  - use %selinux_requires_min macro, drop overlapping dependencies
  - use regex instead of SELinux template
  - Upstream changes: https://passt.top/passt/log/?qt=range&q=2025_09_19.623dbf6..2025_12_09.c3f1ba7


author: Stefano Brivio <sbrivio@redhat.com> - 0^20260507.g1afd4ed-1
changelog:
  - Install pesto, its SELinux policy, and the man page from the spec file
  - Upstream changes: https://passt.top/passt/log/?qt=range&q=2026_01_20.386b5f5..2026_05_07.1afd4ed


author: Simone Caronni <negativo17@gmail.com> - 1.24.1-10
changelog:
  - Update logroate and reload commands:
  - https://bugzilla.redhat.com/show_bug.cgi?id=2372537
  - https://bugzilla.redhat.com/show_bug.cgi?id=2403541


author: Remi Collet <remi@remirepo.net> - 8.4.15-2
changelog:
  - Fix GH-20528 regression breaks mysql connexion using an IPv6 address enclosed
    in square brackets (upstream patch)


author: Miro Hrončok <mhroncok@redhat.com> - 1.18.5-1
changelog:
  - %pyproject_extras_subpkg: Only %ghost the dist-info directory, not the content
  - That way, accidentally unpackaged files within are reported as errors
  - %pyproject_save_files: Also save top level typing stub files (.pyi)


author: Miro Hrončok <mhroncok@redhat.com> - 1.19.0-1
changelog:
  - Add -d option for %pyproject_buildrequires and %pyproject_wheel to specify a working directory
  - Fixes: rhbz#2371389


author: Charalampos Stratakis <cstratak@redhat.com> - 1.20.0-1
changelog:
  - Add %pyproject_patch_dependency macro for overriding dependency constraints
  - Overrides apply to both BuildRequires and runtime Requires (via METADATA patching)
  - Resolves: rhbz#2386906


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.20.1-1
changelog:
  - Move %pyproject_patch_dependency implementation to pyproject-srpm-macros
  - Make pyproject-rpm-macros depend on pyproject-srpm-macros
  - Resolves: rhbz#2463187


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 1.21.0-1
changelog:
  - Implement extras validation
  - %pyproject_buildrequires: validates if extras exist in upstream metadata, otherwise ValueError is raised on Fedora >=45 and RHEL >=11. It will emit a warning instead on older releases.
  - Both user-specified extras and metadata extras are normalized following PEP 685 conventions.


author: Miro Hrončok <mhroncok@redhat.com> - 1.22.0-1
changelog:
  - Add long option support for all public parametric macros
  - E.g. %pyproject_buildrequires --no-runtime is equivalent to %pyproject_buildrequires -R
  - %pyproject_save_files: Allow to use --auto instead of +auto
  - %pyproject_patch_dependency: Validate arguments early, in %prep


author: Jerry James <loganjerry@gmail.com> - 1.17.2-3
changelog:
  - Change ExcludeArch to ExclusiveArch
  - Limits the build to arches with working binary builders
  - Allows installation on any arch


author: Jerry James <loganjerry@gmail.com> - 1.19.1-4
changelog:
  - Update various npm components used in the build
  - Fix CVE-2025-69873: update ajv to 6.15.0/8.20.0
  - Fix CVE-2026-0540 and CVE-2026-41240: update DOMPurify to 3.4.2
  - Fix CVE-2026-3449: update @tootallnate/once to 3.0.1
  - Fix CVE-2026-4800: update lodash to 4.18.1
  - Fix CVE-2026-6321: update fast-uri to 3.1.2


author: Benjamin A. Beasley <code@musicinmybrain.net> - 3.1.48-1
changelog:
  - Update to 3.1.48; closes RHBZ#2460480, fixes GHSA-rpm5-65cw-6hj4,
    fixes GHSA-x2qx-6953-8485, and fixes GHSA-7545-fcxq-7j24


author: Sandipan Roy <sandipan@fedoraproject.org> - 1.12-2
changelog:
  - Migrate to pyproject macros (replacing deprecated \
    CFLAGS="${CFLAGS:-${RPM_OPT_FLAGS}}" LDFLAGS="${LDFLAGS:-${RPM_LD_FLAGS}}"\
    /usr/bin/python3 setup.py  build --executable="/usr/bin/python3 -sP" 
  /\
    CFLAGS="${CFLAGS:-${RPM_OPT_FLAGS}}" LDFLAGS="${LDFLAGS:-${RPM_LD_FLAGS}}"\
    /usr/bin/python3 setup.py  install -O1 --skip-build --root /builddir/build/BUILD/python-advisory-parser-1.12-build/BUILDROOT --prefix /usr 
    rm -rfv /builddir/build/BUILD/python-advisory-parser-1.12-build/BUILDROOT/usr/bin/__pycache__
  )


author: John Kacur <jkacur@redhat.com> - 6.17.7-1
changelog:
  - Changed the kernel version to 6.17.7
  - changed the rteval-loads number scheme to reflect the kernel version


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.5.5-1
changelog:
  - Update to version 0.5.5; fixes RHBZ#2397644
  - Security fix for CVE-2025-59825 / GHSA-3wgq-wrwc-vqmv


author: Peter Jones <pjones@redhat.com> - 15.8-2
changelog:
  - Update to shim-15.8
    Resolves: CVE-2023-40546
    Resolves: CVE-2023-40547
    Resolves: CVE-2023-40548
    Resolves: CVE-2023-40549
    Resolves: CVE-2023-40550
    Resolves: CVE-2023-40551
    Resolves: rhbz#2113005
    Resolves: rhbz#2189197
    Resolves: rhbz#2238884
    Resolves: rhbz#2259264


author: Nicolas Frayer <nfrayer@redhat.com>
changelog:
  - Migrate to SPDX license
  - Please refer to https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2


author: Remi Collet <remi@fedoraproject.org> - 8.0.6-1
changelog:
  - update to 8.0.6
    fixes CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 and CVE-2025-46819
  - update documentation to 8.0.5


author: Remi Collet <remi@fedoraproject.org> - 8.0.7-1
changelog:
  - Valkey 8.0.7 - Released Mon 23 February 2026
  - Upgrade urgency SECURITY: This release includes security fixes


author: Sudip Shil <sshil@redhat.com> - 2.1.0-0
changelog:
  - Added --language (-l) CLI option to detect the default font for a given language code, which detects and prints the default font family that supports the specified language.
  - Introduced valid_langs[] array containing known language codes supported by fontconfig, Rejects invalid language codes early with a clear error message.
  - Checks not only if a font is returned, but whether it actually supports the given language.
  - Updated --help output to include usage for --language option.
  - updated readme with installation, build section.


author: Sudip Shil <sshil@redhat.com> - 2.2.0-1
changelog:
  - Modified input_char to handle multiple words as a single input string, allowing space-separated characters.
  - :: as the delimiter for Fontconfig parameters.
  - help section in better format
  - Modified tests.sh to include new test cases for space-separated inputs and :: parameter handling.


author: Sudip Shil <sshil@redhat.com> - 2.3.0-1
changelog:
  - Improve input handling for -f option and Update test cases in to cover new scenarios and edge cases.
  - now tests.sh can capture segmentation fault and save in test_error txt file
  - Created github workflow action tests.yml in github - if test fails then it is usefull for CI and automation.


author: Sudip Shil <sshil@redhat.com> - 3.0.0-1
changelog:
  - resolve snowflake emoji incorrectly defaulting to Symbola
  - emoji detection for BMP ranges and remove redundant logic
  - Integrate Pango API to segment and find fonts and refine hex detection logics
  - Fix Pango sans-serif fallback and --language feature not giving output fixed
  - Fix CI build by adding missing GLib and Pango dependencies


author: Michael Young <m.a.young@durham.ac.uk> - 4.19.3-2
changelog:
  - update to xen-4.19.3
    remove patches now included or superceded upstream
    includes patches for
    x86: Incorrect stubs exception handling for flags recovery [XSA-470,
  	CVE-2025-27465]
    x86: Transitive Scheduler Attacks [XSA-471, CVE-2024-36350,
   	CVE-2024-36357]


author: Michael Young <m.a.young@durham.ac.uk> - 4.19.3-4
changelog:
  - Mutiple vulnerabilities in the Viridian interface [XSA-472,
          CVE-2025-27466, CVE-2025-58142, CVE-2025-58143]
  - Arm issues with page refcounting [XSA-473, CVE-2025-58144,
          CVE-2025-58145]


author: Michael Young <m.a.young@durham.ac.uk> - 4.19.3-6
changelog:
  - x86: Incorrect input sanitisation in Viridian hypercalls [XSA-475,
          CVE-2025-58147, CVE-2025-58148]


author: Michael Young <m.a.young@durham.ac.uk> - 4.19.4-2
changelog:
  x86: buffer overrun with shadow paging + tracing [XSA-477, CVE-2025-58150]
  	(#2434045)
    x86: incomplete IBPB for vCPU isolation [XSA-479, CVE-2026-23553]
  	(#2434047)


author: Michael Young <m.a.young@durham.ac.uk> - 4.19.4-3
changelog:
  - Use after free of paging structures in EPT [XSA-480, CVE-2026-23554]
  - Xenstored DoS by unprivileged domain [XSA-481, CVE-2026-23555]


author: Michael Young <m.a.young@durham.ac.uk> - 4.19.5-2
changelog:
  - oxenstored keeps quota related use counts across domain destruction
          [XSA-483, CVE-2026-23556]
  - Xenstored DoS via XS_RESET_WATCHES command [XSA-484, CVE-2026-23557]
  - grant table v2 race in status page mapping [XSA-486, CVE-2026-23558]
  - x86: Floating Point Divider State Sampling [XSA-488, CVE-2025-54505]


author: Filipe Rosset <rosset.filipe@gmail.com> - 1.10-1
changelog:
  - update to 1.10 fixes rhbz#2464731 - fix license GPL-3.0-only - updated /
    reorganize BuildRequires list


