# changelog

author: Mark Reynolds <mreynolds@redhat.com> - 2.3.4-3
changelog:
  - Bump version to 2.3.4-3
  - Resolves: rhbz#2189954 - RFE Improve reponse time to filters containing 'nsrole'
  - Resolves: rhbz#2189946 - RFE support of slapi_memberof for plugins/core server
  - Resolves: rhbz#1974242 - Paged search impacts performance


author: Mark Reynolds <mreynolds@redhat.com> - 2.3.6-2
changelog:
  - Bump version to 2.3.6-2
  - Resolves: rhbz#2225532 - 389-ds-base FTBFS with rust-1.71.0
  - Resolves: rhbz#2218209 - useradd: invalid user ID '389:389': installing 389-ds-base in container fails to create the dirsrv user
  - Resolves: rhbz#2207691 - python3-lib389: Python tarfile extraction needs change to avoid a warning
  - Resolves: rhbz#2179278 - dirsrv failed to start after reboot because "dirsrv" did not have access on /run/dirsrv


author: Simon Pichugin <spichugi@redhat.com> - 2.3.6-3
changelog:
  - Bump version to 2.3.6-3
  - Resolves: rhbz#2236163 - Regression: replication can't be enabled for consumer or hub role


author: James Chapman <jachapma@redhat.com> - 2.4.4-1
changelog:
  - Bump version to 2.4.4-1
  - Resolves: RHEL-15907 - Rebase 389-ds-base-2.4 in RHEL 9.4
  - Resolves: RHEL-16830 - ns-slapd crash in slapi_attr_basetype


author: James Chapman <jachapma@redhat.com> - 2.4.5-1
changelog:
  - Bump version to 2.4.5-1
  - Resolves: RHEL-15907 - Rebase 389-ds-base in RHEL 9.4
  - Resolves: RHEL-5142  - RFE Disable Transparent Huge Pages when using large caches
  - Resolves: RHEL-5130  - RFE Add PROXY protocol support to 389-ds-base via confiuration item - similar to Postfix
  - Resolves: RHEL-5133  - RFE Provide a history for 'LastLoginTime'
  - Resolves: RHEL-16984 - RFE inChain Matching Rule


author: James Chapman <jachapma@redhat.com> - 2.4.5-2
changelog:
  - Bump version to 2.4.5-2
  - Resolves: RHEL-15907 - Rebase 389-ds-base in RHEL 9.4
  - Resolves: RHEL-5142  - RFE Disable Transparent Huge Pages when using large caches
  - Resolves: RHEL-5130  - RFE Add PROXY protocol support to 389-ds-base via confiuration item - similar to Postfix
  - Resolves: RHEL-5133  - RFE Provide a history for 'LastLoginTime'
  - Resolves: RHEL-16984 - RFE inChain Matching Rule


author: Simon Pichugin <spichugi@redhat.com> - 2.4.5-4
changelog:
  - Bump version to 2.4.5-4
  - Resolves: RHEL-5130  - RFE Add PROXY protocol support to 389-ds-base via confiuration item - similar to Postfix


author: Viktor Ashirov <vashirov@redhat.com> - 2.4.5-6
changelog:
  - Bump version to 2.4.5-6
  - Resolves: RHEL-30588 - [RFE] allows plugins to log multi-factor authentication notification


author: James Chapman <jachapma@redhat.com> - 2.4.5-7
changelog:
  - Bump version to 2.4.5-7
  - Resolves: RHEL-34819 - redhat-ds:11/389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c
  - Resolves: RHEL-34825 - redhat-ds:11/389-ds-base: potential denial of service via specially crafted kerberos AS-REQ requ


author: James Chapman <jachapma@redhat.com> - 2.4.5-9
changelog:
  - Bump version to 2.4.5-9
  - Resolves: RHEL-44323 - unauthenticated user can trigger a DoS by sending a specific extended search request
  - Resolves: RHEL-40945 - Malformed userPassword hash may cause Denial of Service
  - Resolves: RHEL-49457 - perf search result investigation for many large static groups and members 
  - Resolves: RHEL-49459 - subsuffix are not returned in one level scoped search


author: James Chapman <jachapma@redhat.com> - 2.5.1-1
changelog:
  - Bump version to 2.5.1-1
  - Resolves: RHEL-31777 - Rebase 389-ds-base.2.5.1 in RHEL 9.5
  - Resolves: RHEL-33348 - redhat-ds:11/389-ds-base: potential denial of service via specially crafted kerberos AS-REQ requ


author: James Chapman <jachapma@redhat.com> - 2.5.1-2
changelog:
  - Bump version to 2.5.1-2
  - Resolves: RHEL-44324 - unauthenticated user can trigger a DoS by sending a specific extended search request
  - Resolves: RHEL-40946 - Malformed userPassword hash may cause Denial of Service
  - Resolves: RHEL-33087 - dsconf schema does not show inChain matching rule
  - Resolves: RHEL-28177 - Malformed userPassword may cause crash at do_modify in slapd/modify.c
  - Resolves: RHEL-25070 - nsslapd-haproxy-trusted-ip is not in schema


author: Viktor Ashirov <vashirov@redhat.com> - 2.5.2-1
changelog:
  - Bump version to 2.5.2-1
  - Resolves: RHEL-5108 - ns-slapd crash in referint_get_config
  - Resolves: RHEL-5113 - nsslapd-numlisteners limit is not enforced
  - Resolves: RHEL-5115 - `dscreate ds-root` accepts relative path
  - Resolves: RHEL-5131 - ldif2db can be very slow
  - Resolves: RHEL-5138 - Logconv.pl CSV file contains mismatched header and data columns
  - Resolves: RHEL-14760 - ns-slapd crash in vlvIndex_delete
  - Resolves: RHEL-17511 - nsslapd-idletimeout is ignored
  - Resolves: RHEL-49454 - perf search result investigation for many large static groups and members
  - Resolves: RHEL-49458 - subsuffix are not returned in one level scoped search


author: Viktor Ashirov <vashirov@redhat.com> - 2.5.2-2
changelog:
  - Bump version to 2.5.2-2
  - Resolves: RHEL-55744 - ipahealthcheck.ds.backends.BackendsCheck.DSBLE0006: BDB is deprecated and should not be used as a backend


author: James Chapman <jachapma@redhat.com> - 2.5.2-3
changelog:
  - Bump version to 2.5.2-3
  - Resolves: RHEL-65775 - Wrong set of entries returned for some search filters [rhel-9.5.z]
  - Resolves: RHEL-66138 - deadlock during cleanAllRuv [rhel-9.5.z]
  - Resolves: RHEL-67163 - cleanallruv consums CPU and is slow [rhel-9.5.z]
  - Resolves: RHEL-70257 - Freelist ordering causes high wtime [rhel-9.5.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.5.2-5
changelog:
  - Resolves: RHEL-74350 - Some nsslapd-haproxy-trusted-ip values are discarded upon a restart. [rhel-9.5.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.5.2-6
changelog:
  - Resolves: RHEL-69825 - "Duplicated DN detected" errors when creating indexes or importing entries. [rhel-9.5.z]
  - Resolves: RHEL-70126 - Crash in attrlist_find() when the Account Policy plugin is enabled. [rhel-9.5.z]
  - Resolves: RHEL-74152 - backup/restore broken [rhel-9.5.z]
  - Resolves: RHEL-74157 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex [rhel-9.5.z]
  - Resolves: RHEL-74167 - On replica consumer, account policy plugin fails to manage the last login history [rhel-9.5.z]
  - Resolves: RHEL-78343 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) [rhel-9.5.z]
  - Resolves: RHEL-79497 - Failed to set sslversionmax to TLS1.3  in FIPS mode with dsconf $INSTANCE security set --tls-protocol-max TLS1.3 [rhel-9.5.z]
  - Resolves: RHEL-81102 - After an initial failure, subsequent online backups will not work. [rhel-9.5.z]
  - Resolves: RHEL-81107 - Online backup hangs sporadically. [rhel-9.5.z]
  - Resolves: RHEL-81113 - IPA LDAP error code T3 when no exceeded time limit from a paged search result [rhel-9.5.z]
  - Resolves: RHEL-81139 - Healthcheck tool should warn admin about creating a substring index on membership attribute [rhel-9.5.z]
  - Resolves: RHEL-81146 - 389DirectoryServer Process Stops When Setting up Sorted VLV Index [rhel-9.5.z]
  - Resolves: RHEL-81157 - AddressSanitizer: double-free  [rhel-9.5.z]
  - Resolves: RHEL-81171 - leaked_storage: Variable "childelems" going out of scope leaks the storage it points to. [rhel-9.5.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.5.2-9
changelog:
  - Resolves: RHEL-83874 - CVE-2025-2487 389-ds-base: null pointer dereference leads to denial of service [rhel-9.5.z]
  - Resolves: RHEL-80712 - Increased memory consumption caused by NDN cache [rhel-9.5.z]
  - Resolves: RHEL-87194 - Some replication status data are reset upon a restart. [rhel-9.5.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.6.1-1
changelog:
  - Update to 2.6.1
  - Resolves: RHEL-5151 - [RFE] defer memberof nested updates
  - Resolves: RHEL-54148 - leaked_storage: Variable "childelems" going out of scope leaks the storage it points to.
  - Resolves: RHEL-60135 - deadlock during cleanAllRuv
  - Resolves: RHEL-61341 - After an initial failure, subsequent online backups will not work.
  - Resolves: RHEL-61349 - Remove deprecated setting for HR time stamps in logs
  - Resolves: RHEL-62875 - Passwords are not being updated to use the configured storage scheme ( nsslapd-enable-upgrade-hash is enabled ).
  - Resolves: RHEL-64438 - VLV errors with RSNv3 and pruning enabled [rhel-9]
  - Resolves: RHEL-64854 - cleanallruv consums CPU and is slow
  - Resolves: RHEL-65506 - AddressSanitizer: double-free
  - Resolves: RHEL-65512 - AddressSanitizer: heap-use-after-free in import_abort_all
  - Resolves: RHEL-65561 - LeakSanitizer: detected memory leaks in dbmdb_public_db_op
  - Resolves: RHEL-65662 - Replication issue between masters using cert based authentication
  - Resolves: RHEL-65664 - LDAP unprotected search query during certificate based authentication
  - Resolves: RHEL-65665 - Ambiguous warning about SELinux in dscreate for non-root user
  - Resolves: RHEL-65741 - LeakSanitizer: memory leak in ldbm_entryrdn.c
  - Resolves: RHEL-65776 - Wrong set of entries returned for some search filters [rhel-9]
  - Resolves: RHEL-67004 - "dsconf config replace" should handle multivalued attributes.
  - Resolves: RHEL-67005 - Online backup hangs sporadically.
  - Resolves: RHEL-67008 - Some replication status data are reset upon a restart.
  - Resolves: RHEL-67020 - 389DirectoryServer Process Stops When Setting up Sorted VLV Index
  - Resolves: RHEL-67024 - Some nsslapd-haproxy-trusted-ip values are discarded upon a restart.
  - Resolves: RHEL-69806 - ipahealthcheck.ds.replication displays WARNING '1 conflict entries found under the replication suffix'
  - Resolves: RHEL-69826 - "Duplicated DN detected" errors when creating indexes or importing entries. [rhel-9]
  - Resolves: RHEL-70127 - Crash in attrlist_find() when the Account Policy plugin is enabled. [rhel-9]
  - Resolves: RHEL-70252 - Freelist ordering causes high wtime
  - Resolves: RHEL-71218 - Sub suffix causes "id2entry - Could not open id2entry err 0" error when the Directory Server starts [rhel-9]
  - Resolves: RHEL-74153 - backup/restore broken [rhel-9]
  - Resolves: RHEL-74158 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex [rhel-9]
  - Resolves: RHEL-74163 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set [rhel-9]
  - Resolves: RHEL-74168 - On replica consumer, account policy plugin fails to manage the last login history [rhel-9]
  - Resolves: RHEL-74174 - Replication broken after backup restore with freeipa configuration [rhel-9]
  - Resolves: RHEL-74353 - nsslapd-haproxy-trusted-ip is not in schema [rhel-9]
  - Resolves: RHEL-76019 - IPA LDAP error code T3 when no exceeded time limit from a paged search result [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.6.1-3
changelog:
  - Resolves: RHEL-18333 Can't rename users member of automember rule
  - Resolves: RHEL-61341 After an initial failure, subsequent online backups will not work.
  - Resolves: RHEL-63887 nsslapd-mdb-max-dbs autotuning doesn't work properly
  - Resolves: RHEL-63891 dbscan crashes when showing statistics for MDB
  - Resolves: RHEL-63998 dsconf should check for number of available named databases
  - Resolves: RHEL-78344 During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.6.1-4
changelog:
  - Resolves: RHEL-78722 - Failed to set sslversionmax to TLS1.3 in FIPS mode with dsconf $INSTANCE security set --tls-protocol-max TLS1.3


author: Viktor Ashirov <vashirov@redhat.com> - 2.6.1-6
changelog:
  - Resolves: RHEL-86065 - Backport lib389 fixes required for WebUI [rhel-9.6.z]
  - Resolves: RHEL-80713 - Increased memory consumption caused by NDN cache [rhel-9.6.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.6.1-8
changelog:
  - Resolves: RHEL-83876 - CVE-2025-2487 389-ds-base: null pointer dereference leads to denial of service [rhel-9.6]


author: Viktor Ashirov <vashirov@redhat.com> - 2.6.1-9
changelog:
  - Reverts: RHEL-80713 - Increased memory consumption caused by NDN cache [rhel-9.6.z]
  - Resolves: RHEL-95443 - ns-slapd[xxxx]: segfault at 10d7d0d0 ip 00007ff734050cdb sp 00007ff6de9f1430 error 6 in libslapd.so.0.1.0[7ff733ec0000+1b3000] [rhel-9.6.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.6.1-10
changelog:
  - Resolves: RHEL-89735 - dsconf backend replication monitor fails if replica id starts with 0 [rhel-9.6.z]
  - Resolves: RHEL-89746 - ns-slapd crash in dbmdb_import_prepare_worker_entry() [rhel-9.6.z]
  - Resolves: RHEL-89752 - Nested group does not receive memberOf attribute [rhel-9.6.z]
  - Resolves: RHEL-89761 - dsidm Error: float() argument must be a string or a number, not 'NoneType' [rhel-9.6.z]
  - Resolves: RHEL-89768 - Crash in __strlen_sse2 when using the nsRole filter rewriter. [rhel-9.6.z]
  - Resolves: RHEL-89773 - Improve the "result" field of ipa-healthcheck if replicas are busy [rhel-9.6.z]
  - Resolves: RHEL-89781 - RHDS12.2 NSMMReplicationPlugin - release_replica Unable to parse the response [rhel-9.6.z]
  - Resolves: RHEL-95767 - Improve  error message when bulk import connection is closed [rhel-9.6.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.6.1-11
changelog:
  - Resolves: RHEL-18333 - Can't rename users member of automember rule [rhel-9.6.z]
  - Resolves: RHEL-81140 - Healthcheck tool should warn admin about creating a substring index on membership attribute [rhel-9.6.z]
  - Resolves: RHEL-92052 - Memory leak in roles_cache_create_object_from_entry [rhel-9.6.z]
  - Resolves: RHEL-95384 - Getting error messages while migration to LMDB.
  - Resolves: RHEL-106582 - Failure to gather database statistics with LMDB.
  - Resolves: RHEL-106793 - LDAP healthcheck complains about needed parameters when using LMDB.
  - Resolves: RHEL-107004 - Failure to get Server monitoring data when NDN cache is disabled. [rhel-9.6.z]
  - Resolves: RHEL-109033 - Allow Uniqueness plugin to search uniqueness attributes using custom matching rules [rhel-9.6.z]
  - Resolves: RHEL-109884 - Wrong backend database name syntax causes "Red Hat Directory Server" => "Databases" menu blank in Cockpit [rhel-9.6.z]
  - Resolves: RHEL-109888 - RootDN Access Control Plugin with wildcards for IP addresses fails with an error "Invalid IP address" [rhel-9.6.z]
  - Resolves: RHEL-109891 - On RHDS 12.6 The user password policy for a user was created, but the pwdpolicysubentry attribute for this user incorrectly points to the People OU password policy instead of the specific user policy.  [rhel-9.6.z]
  - Resolves: RHEL-109896 - AddressSanitizer: leak in do_search [rhel-9.6.z]
  - Resolves: RHEL-109904 - ns-slapd crashed when we add nsslapd-referral [rhel-9.6.z]
  - Resolves: RHEL-109945 - CWE-284 dirsrv log rotation creates files with world readable permission [rhel-9.6.z]
  - Resolves: RHEL-109954 - CWE-532 Created user password hash available to see in audit log [rhel-9.6.z]
  - Resolves: RHEL-109957 - CWE-778 Log doesn't show what user gets password changed by administrator [rhel-9.6.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.6.1-12
changelog:
  - Resolves: RHEL-104590 - RHDS12: Web console doesn't show Server Version [rhel-9.6.z]
  - Resolves: RHEL-104592 - The numSubordinates value is not matching the number of direct children. [rhel-9.6.z]
  - Resolves: RHEL-111227 - Error showing local password policy on web UI [rhel-9.6.z]
  - Resolves: RHEL-112678 - Statistics about index lookup report a wrong duration [rhel-9.6.z]
  - Resolves: RHEL-112692 - Crash if repl keep alive entry can not be created [rhel-9.6.z]
  - Resolves: RHEL-112725 - Exception thrown by dsconf instance repl get_ruv [rhel-9.6.z]
  - Resolves: RHEL-113979 - AddressSanitizer: memory leak in memberof_add_memberof_attr [rhel-9.6.z]
  - Resolves: RHEL-114952 - lib389/replica.py is using unexisting datetime.UTC in python3.9 [rhel-9.6.z]
  - Resolves: RHEL-117048 - Replication online reinitialization of a large database gets stalled. [rhel-9.6.z]
  - Resolves: RHEL-117769 - When the server restarts after a crash, the RFE assumes memberof should be recomputed. It triggers a memberof fixup task, dirsrv became unresponsive. [rhel-9.6.z]
  - Resolves: RHEL-117778 - Ignore the memberOfDeferredUpdate setting when LMDB is used.  [rhel-9.6.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.7.0-3
changelog:
  - Resolves: RHEL-77983 - Defects found by OpenScanHub
  - Resolves: RHEL-79673 - Improve the "result" field of ipa-healthcheck if replicas are busy
  - Resolves: RHEL-80496 - Can't rename users member of automember rule [rhel-9]
  - Resolves: RHEL-81141 - Healthcheck tool should warn admin about creating a substring index on membership attribute [rhel-9]
  - Resolves: RHEL-89736 - dsconf backend replication monitor fails if replica id starts with 0 [rhel-9]
  - Resolves: RHEL-89745 - ns-slapd crash in dbmdb_import_prepare_worker_entry() [rhel-9]
  - Resolves: RHEL-89753 - Nested group does not receive memberOf attribute [rhel-9]
  - Resolves: RHEL-89769 - Crash in __strlen_sse2 when using the nsRole filter rewriter. [rhel-9]
  - Resolves: RHEL-89782 - RHDS12.2 NSMMReplicationPlugin - release_replica Unable to parse the response [rhel-9]
  - Resolves: RHEL-95768 - Improve error message when bulk import connection is closed [rhel-9]
  - Resolves: RHEL-101189 - lib389/replica.py is using unexisting datetime.UTC in python3.9


author: Viktor Ashirov <vashirov@redhat.com> - 2.7.0-4
changelog:
  - Resolves: RHEL-61347 - Directory Server is unavailable after a restart with nsslapd-readonly=on and consumes 100% CPU


author: Viktor Ashirov <vashirov@redhat.com> - 2.7.0-5
changelog:
  - Resolves: RHEL-89762 - dsidm Error: float() argument must be a string or a number, not 'NoneType' [rhel-9]
  - Resolves: RHEL-92041 - Memory leak in roles_cache_create_object_from_entry
  - Resolves: RHEL-95444 - ns-slapd[xxxx]: segfault at 10d7d0d0 ip 00007ff734050cdb sp 00007ff6de9f1430 error 6 in libslapd.so.0.1.0[7ff733ec0000+1b3000] [rhel-9]
  - Resolves: RHEL-104821 - ipa-restore fails to restore SELinux contexts, causes ns-slapd AVC denials on /dev/shm after restore.
  - Resolves: RHEL-107005 - Failure to get Server monitoring data when NDN cache is disabled. [rhel-9]
  - Resolves: RHEL-107581 - segfault - error 4 in libpthread-2.28.so [rhel-9]
  - Resolves: RHEL-107585 - ns-slapd crashed when we add nsslapd-referral [rhel-9]
  - Resolves: RHEL-107586 - CWE-284 dirsrv log rotation creates files with world readable permission [rhel-9]
  - Resolves: RHEL-107587 - CWE-532 Created user password hash available to see in audit log [rhel-9]
  - Resolves: RHEL-107588 - CWE-778 Log doesn't show what user gets password changed by administrator [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.7.0-7
changelog:
  - Resolves: RHEL-104591 - RHDS12: Web console doesn't show Server Version [rhel-9]
  - Resolves: RHEL-104593 - The numSubordinates value is not matching the number of direct children. [rhel-9]
  - Resolves: RHEL-109034 - Allow Uniqueness plugin to search uniqueness attributes using custom matching rules [rhel-9]
  - Resolves: RHEL-109885 - Wrong backend database name syntax causes "Red Hat Directory Server" => "Databases" menu blank in Cockpit [rhel-9]
  - Resolves: RHEL-109889 - RootDN Access Control Plugin with wildcards for IP addresses fails with an error "Invalid IP address" [rhel-9]
  - Resolves: RHEL-109892 - On RHDS 12.6 The user password policy for a user was created, but the pwdpolicysubentry attribute for this user incorrectly points to the People OU password policy instead of the specific user policy.  [rhel-9]
  - Resolves: RHEL-109897 - AddressSanitizer: leak in do_search [rhel-9]
  - Resolves: RHEL-113981 - AddressSanitizer: memory leak in memberof_add_memberof_attr [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.7.0-8
changelog:
  - Resolves: RHEL-111228 - Error showing local password policy on web UI [rhel-9.7.z]
  - Resolves: RHEL-117049 - Replication online reinitialization of a large database gets stalled. [rhel-9.7.z]
  - Resolves: RHEL-117770 - When the server restarts after a crash, the RFE assumes memberof should be recomputed. It triggers a memberof fixup task, dirsrv became unresponsive. [rhel-9.7.z]
  - Resolves: RHEL-123230 - Improve the way to detect asynchronous operations in the access logs [rhel-9.7.z]
  - Resolves: RHEL-123243 - Attribute uniqueness is not enforced upon modrdn operation [rhel-9.7.z]
  - Resolves: RHEL-123257 - Typo in errors log after a Memberof fixup task. [rhel-9.7.z]
  - Resolves: RHEL-123278 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue [rhel-9.7.z]
  - Resolves: RHEL-123367 - IPA health check up script shows time skew is over 24 hours [rhel-9.7.z]
  - Resolves: RHEL-123765 - 389-ds-base OpenScanHub Leaks Detected [rhel-9.7.z]
  - Resolves: RHEL-123852 - Units for changing MDB max size are not consistent across different tools [rhel-9.7.z]
  - Resolves: RHEL-123892 - Improve output dsctl dbverify when backend does not exist [rhel-9.7.z]
  - Resolves: RHEL-123896 - [WebUI] Replication tab crashes after enabling replication as a consumer [rhel-9.7.z]
  - Resolves: RHEL-123922 - Changelog trimming - add number of scanned entries to the log [rhel-9.7.z]
  - Resolves: RHEL-126551 - RHDS 12.6 doesn't handle 'ldapsearch' filter with space char in DN name correctly [rhel-9.7.z]
  - Resolves: RHEL-129558 - Online initialization of consumers fails with error -23 [rhel-9.7.z]
  - Resolves: RHEL-129579 - Fix paged result search locking [rhel-9.7.z]
  - Resolves: RHEL-138480 - Memory leak observed in ns-slapd with 389-ds-base-2.6.1-12 [rhel-9.7.z]
  - Resolves: RHEL-140088 - Upgrading IDM  to latest version: 389-ds-base and ipa-server breaks replication  [rhel-9.7.z]
  - Resolves: RHEL-140274 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. [rhel-9.7.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.7.0-9
changelog:
  - Resolves: RHEL-116425 - RetroCL plugin generates invalid LDIF [rhel-9.7.z]
  - Resolves: RHEL-123243 - Attribute uniqueness is not enforced upon modrdn operation [rhel-9.7.z]
  - Resolves: RHEL-123765 - 389-ds-base OpenScanHub Leaks Detected [rhel-9.7.z]
  - Resolves: RHEL-123896 - [WebUI] Replication tab crashes after enabling replication as a consumer [rhel-9.7.z]
  - Resolves: RHEL-129558 - Online initialization of consumers fails with error -23 [rhel-9.7.z]
  - Resolves: RHEL-140088 - Upgrading IDM  to latest version: 389-ds-base and ipa-server breaks replication  [rhel-9.7.z]
  - Resolves: RHEL-142979 - Scalability issue of replication online initialization with large database [rhel-9.7.z]
  - Resolves: RHEL-146898 - memory corruption in alias entry plugin [rhel-9.7.z]
  - Resolves: RHEL-147211 - Access logs are not getting deleted as configured. [rhel-9.7.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.7.0-10
changelog:
  - Resolves: RHEL-123243 - Attribute uniqueness is not enforced upon modrdn operation [rhel-9.7.z]
  - Resolves: RHEL-123765 - 389-ds-base OpenScanHub Leaks Detected [rhel-9.7.z]
  - Resolves: RHEL-137083 - CVE-2025-14905 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow [rhel-9.7.z]
  - Resolves: RHEL-140088 - Upgrading IDM  to latest version: 389-ds-base and ipa-server breaks replication  [rhel-9.7.z]
  - Resolves: RHEL-150906 - Remove memberof_del_dn_from_groups from MemberOf plugin [rhel-9.7.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.7.0-12
changelog:
  - Resolves: RHEL-153553 - 389-ds-base-2.7.0-10.el9_7 updates dse.ldif with lowercase DNs causing ipa-healthcheck errors


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-1
changelog:
  - Resolves: RHEL-111229 - Error showing local password policy on web UI [rhel-9]
  - Resolves: RHEL-112680 - Statistics about index lookup report a wrong duration [rhel-9]
  - Resolves: RHEL-116426 - RetroCL plugin generates invalid LDIF [rhel-9]
  - Resolves: RHEL-117050 - Replication online reinitialization of a large database gets stalled. [rhel-9]
  - Resolves: RHEL-117748 - The numSubordinates value is not matching the number of direct children. [rhel-9]
  - Resolves: RHEL-117771 - When deferred memberof update is enabled after the server crashed it should not launch memberof fixup task by default
  - Resolves: RHEL-117782 - Ignore the memberOfDeferredUpdate setting when LMDB is used.  [rhel-9]
  - Resolves: RHEL-121170 - Units for changing MDB max size are not consistent across different tools [rhel-9]
  - Resolves: RHEL-123231 - Improve the way to detect asynchronous operations in the access logs [rhel-9]
  - Resolves: RHEL-123244 - Attribute uniqueness is not enforced upon modrdn operation [rhel-9]
  - Resolves: RHEL-123258 - Typo in errors log after a Memberof fixup task. [rhel-9]
  - Resolves: RHEL-123272 - LDAP high CPU usage while handling indexes with IDL scan limit at INT_MAX [rhel-9]
  - Resolves: RHEL-123279 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue [rhel-9]
  - Resolves: RHEL-123368 - IPA health check up script shows time skew is over 24 hours [rhel-9]
  - Resolves: RHEL-123766 - 389-ds-base OpenScanHub Leaks Detected [rhel-9]
  - Resolves: RHEL-123893 - Improve output dsctl dbverify when backend does not exist [rhel-9]
  - Resolves: RHEL-123897 - [WebUI] Replication tab crashes after enabling replication as a consumer [rhel-9]
  - Resolves: RHEL-123923 - Changelog trimming - add number of scanned entries to the log [rhel-9]
  - Resolves: RHEL-126552 - RHDS 12.6 doesn't handle 'ldapsearch' filter with space char in DN name correctly [rhel-9]
  - Resolves: RHEL-129559 - Online initialization of consumers fails with error -23 [rhel-9]
  - Resolves: RHEL-129580 - Fix paged result search locking [rhel-9]
  - Resolves: RHEL-138481 - Memory leak observed in ns-slapd with 389-ds-base-2.6.1-12 [rhel-9]
  - Resolves: RHEL-139825 - Rebase 389-ds-base to 2.8.x
  - Resolves: RHEL-140089 - Upgrading IDM  to latest version: 389-ds-base and ipa-server breaks replication  [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-2
changelog:
  - Resolves: RHEL-140089 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-3
changelog:
  - Resolves: RHEL-117050 - Replication online reinitialization of a large database gets stalled. [rhel-9]
  - Resolves: RHEL-123244 - Attribute uniqueness is not enforced upon modrdn operation [rhel-9]
  - Resolves: RHEL-123279 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue [rhel-9]
  - Resolves: RHEL-140275 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. [rhel-9]
  - Resolves: RHEL-142980 - Scalability issue of replication online initialization with large database [rhel-9]
  - Resolves: RHEL-146899 - memory corruption in alias entry plugin [rhel-9]
  - Resolves: RHEL-147212 - Access logs are not getting deleted as configured. [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-4
changelog:
  - Resolves: RHEL-117050 - Replication online reinitialization of a large database gets stalled. [rhel-9]
  - Resolves: RHEL-123279 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue [rhel-9]
  - Resolves: RHEL-140275 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. [rhel-9]
  - Resolves: RHEL-142980 - Scalability issue of replication online initialization with large database [rhel-9]
  - Resolves: RHEL-146899 - memory corruption in alias entry plugin [rhel-9]
  - Resolves: RHEL-147212 - Access logs are not getting deleted as configured. [rhel-9]
  - Resolves: RHEL-150907 - Remove memberof_del_dn_from_groups from MemberOf plugin [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-5
changelog:
  - Resolves: RHEL-137084 - CVE-2025-14905 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow [rhel-9.8]
  - Resolves: RHEL-152335 - Crash in trim_changelog() during the Retro Changelog trimming. [rhel-9.8]
  - Resolves: RHEL-152338 - Crash ( Segmentation fault ) in atomic_compare_exchange() [rhel-9.8]


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-7
changelog:
  - Resolves: RHEL-152356 - Getting "build_candidate_list - Database error 11" messages after migrating to LMDB. [rhel-9.8.z]
  - Resolves: RHEL-168967 - Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. [rhel-9.8.z]
  - Resolves: RHEL-170269 - DS 12 does not handle escape char in bind user [rhel-9.8.z]
  - Resolves: RHEL-174524 - [RFE] Add OS-level thread names to all server threads [rhel-9.8.z]
  - Resolves: RHEL-178086 - CVE-2026-9064 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) [rhel-9.8]
  - Resolves: RHEL-180716 - Online export is failing when using the option "-s" [rhel-9.8.z]
  - Resolves: RHEL-183895 - Server shutdown during online reindex may lead to data loss [rhel-9.8.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-8
changelog:
  - Resolves: RHEL-182159 - CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [rhel-9.8.z]
  - Resolves: RHEL-183103 - CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [rhel-9.8.z]


author: Caolán McNamara <caolanm@redhat.com> - 2.4.1-5
changelog:
  - disable building BOX2D_BUILD_UNIT_TESTS due to "SIGSTKSZ ... no
    longer constant on Linux ... redefined to sysconf(_SC_SIGSTKSZ)"
    https://github.com/bminor/glibc/blob/master/NEWS causing build failure


author: Paul Howarth <paul@city-fan.org> - 1.0.5-23
changelog:
  - Don't pass gcc-only compiler flags to other compilers, e.g. clang
    (based on https://src.fedoraproject.org/rpms/Judy/pull-request/3 from
    Timm Baeder)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.46.0-16
changelog:
  - Revert OVS checkpoint rollback patches.
  - Fix OVS stage3 activation without DHCP client initialized (RHEL-49799)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.46.0-18
changelog:
  - Fix crash dereferencing NULL pointer during debug logging (RHEL-46200)
  - Use /etc/hosts for hostname reesolution (RHEL-53202)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.46.0-19
changelog:
  - Retry hostname resolutions when it fails (RHEL-55397)
  - cloud-setup: allow bigger restart bursts (RHEL-56739)
  - cloud-setup: Fix Azure primary and secondary address swap (RHEL-56386)


author: Beniamino Galvani <bgalvani@redhat.com> - 1.45.8-1
changelog:
  - Update to 1.45.8 (development)
  - Introduce "stable-ssid" option for wifi.cloned-mac-address property (RHEL-16470)


author: Ján Václav <jvaclav@redhat.com> - 1.45.9-1
changelog:
  - Update to 1.45.9 (development)
  - Add support for PRP/HSR interface (RHEL-5852)
  - Drop support for the 'slaves-order' option in NetworkManager.conf (RHEL-19437)
  - Return error when setting invalid IP addresses or properties via D-Bus (RHEL-19315)
  - Fix extra route being created besides ECMP route (RHEL-1682)


author: Stanislas FAYE <sfaye@redhat.com> - 1.45.10-1
changelog:
  - Update to 1.45.10 (development)
  - Deprecate and Replace connection.master in libnm-core and libnm (RHEL-17619)


author: Stanislas FAYE <sfaye@redhat.com> - 1.45.90-1
changelog:
  - Update to 1.45.90 release (release candidate)
  - Deprecate and Replace connection.slave-type in libnm-core and libnm (RHEL-17620)
  - [RFE] Support assigning IPv4 static route to interface without IPv4 address (RHEL-5098)


author: Íñigo Huguet <ihuguet@redhat.com> - 1.45.91-1
changelog:
  - Update to 1.45.91 release (release candidate)
  - Support changing the DSCP header field for DHCP packets, and set the default to CS0 (RHEL-16040)
  - Deprecate connection.autoconnect-slaves in favour of autoconnect-ports (RHEL-17621)
  - Don't reset bridge's PVID in reapply if it didn't change (RHEL-21576)


author: Stanislas FAYE <sfaye@redhat.com> - 1.46.0-1
changelog:
  - Update to 1.46.0 release
  - Fix DHCPv4 lease can't be renewed after it expires (RHEL-24127)
  - Support the MACsec offload mode (RHEL-24337)
  - Support creating generic devices via external "device-handler" dispatcher (RHEL-1567)
  - Support changing the eswitch mode (RHEL-1441)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1.46.0-2
changelog:
  - Drop PrivateUser directive from nm-cloud-setup service (RHEL-27503)
  - Support rollback on global DNS (RHEL-29725)
  - Do not allow OVS bridge or port to be parent (RHEL-28545)


author: Beniamino Galvani <bgalvani@redhat.com> 1:1.48.2-1
changelog:
  - Update to 1.48.2 release
  - Save connection timestamps when shutting down (RHEL-35539)
  - Fix regression with OpenVPN dynamic challenge (RHEL-43720)


author: Stanislas Faye <sfaye@redhat.com> 1:1.48.4-1
changelog:
  - Update to 1.48.4 release
  - Support matching a OVS system interface by MAC address (RHEL-34617)
  - When looking up the system hostname from the reverse DNS lookup of
    addresses configured on interfaces, NetworkManager now takes into
    account the content of /etc/hosts (RHEL-33435)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.48.6-1
changelog:
  - Wait until link is ready before activating for ovs-interface (RHEL-49796)
  - Fix rollback on OVS checkpoint (RHEL-31972)
  - Assert that the auto-activate list is empty on dispose (RHEL-44345)


author: Fernando Fernandez Mancera <ferferna@redha.com> - 1:1.46.8-1
changelog:
  - Stop writing offensive terms into keyfiles (RHEL-52597)
  - Remove offensive words (RHEL-33368)
  - Fix cloned-mac-address race condition with DHCP on ovs-interfaces (RHEL-49796)


author: Íñigo Huguet <ihuguet@redhat.com> - 1:1.48.10-1
changelog:
  - Unblock the autoconnect for children when parent is available (RHEL-46904)
  - Fix crash produced by malformed LLDP package when debug logging (RHEL-46199)
  - Support reapplying bridge-port VLANs (RHEL-26750)
  - Add small backoff time before resync (RHEL-29902)


author: Eduard Abdullin <eabdullin@almalinux.org> - 1:1.48.10-2.alma.1
changelog:
  - cloud-setup: allow bigger restart bursts
  - cloud-setup: azure: ensure that primary address is placed
   first


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.48.10-2
changelog:
  - cloud-setup: Allow bigger restart bursts (RHEL-56740)
  - cloud-setup: Fix Azure swap of primary and secondary IP addresses (RHEL-56387)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.48.10-3
changelog:
  - Only validate the SR-IOV device capability when SR-IOV is enabled (RHEL-58397)
  - Fix bug when deactivating port connections (RHEL-50747)
  - Fix validation of ovs-dpdk interface name (RHEL-60022)


author: Íñigo Huguet <ihuguet@redhat.com> - 1:1.48.10-4
changelog:
  - Remove routes added by NetworkManager when doing reapply, also those not in main table (RHEL-73013)


author: Wen Liang <wenliang@redhat.com> - 1:1.48.10-5
changelog:
  - vpn: Support routing rules in vpn conenctions (RHEL-73167)
  - vpn: Place gateway route to table defined in ipvx.route-table (RHEL-73166)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.48.10-8
changelog:
  - policy: always reset retries when unblocking children or ports (RHEL-78748)
  - core: prevent the activation of unavailable OVS interfaces only (RHEL-79995)


author: Íñigo Huguet <ihuguet@redhat.com> - 1:1.52.0-1
changelog:
  - Update to 1.52.0
  - Add support for creating VLANs for secondary VNICs in nm-cloud-setup (RHEL-36423)
  - Always reset retries when unblocking children or ports (RHEL-78122)
  - Prevent the activation of unavailable OVS interfaces (RHEL-79997)


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.52.0-3
changelog:
  - Invalid memory access on Dnsconfd DBUS error (RHEL-84692)
  - Support IP configuration for secondary interfaces on Oracle VM from metadata (RHEL-84695)


author: Wen Liang <wenliang@redhat.com> - 1:1.52.0-4
changelog:
  - ovs: allow reapplying ovs-bridge and ovs-port properties (RHEL-87595)
  - core: ovs: fix NULL pointer dereference in ovsdb read timeout callback (RHEL-87347)


author: Íñigo Huguet <ihuguet@redhat.com> - 1:1.51.7-2
changelog:
  - Remove the build argument -flto-partition to avoid compilation crashes due
    to high memory usage.


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.52.0-6
changelog:
  - ovs: only keep bridges and ports with NM interfaces attached (RHEL-87167)
  - device: update the external-down unmanaged flag on port attach/release (RHEL-93183)
  - ovs: set the tun interface up before stage3 (RHEL-98550)
  - bridge: fix reapplying port VLANs (RHEL-102742)
  - device: don't disable IPv6 in stage3 on reapply (RHEL-102771)


author: Íñigo Huguet <ihuguet@redhat.com> - 1:1.53.1-1
changelog:
  - Update to 1.53.1 (dev)
  - Update MPTCP endpoints creation order (RHEL-78752)
  - Print all warnings from nmcli to stderr (RHEL-74255)


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.53.2-1
changelog:
  - Update to 1.53.2 (dev)
  - Fix invalid memory access on Dnsconfd DBUS error (RHEL-83175)
  - Avoid getting transient hostname when "localhost" set in /etc/hostname (RHEL-55730)


author: Filip Pokrývka <fpokryvk@redhat.com> - 1:1.53.3-1
changelog:
  - Update to 1.53.3 (dev)
  - Add more IPv6 prefix delegation options (RHEL-85765)
  - Fix order of parsing port/controller properties in nmcli (RHEL-85767)
  - Improve interface activation logic (RHEL-85766)
  - Fix WireGuard IPv6 firewall rules (RHEL-85763)
  - Support OVS-DPDK dpdk-lsc-interrupt and mtu_request configurations (RHEL-77148)


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.53.4-1
changelog:
  - Update to 1.53.4 (dev)
  - initrd: add new NBFT parser (RHEL-83061)
  - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083)
  - Support reapply on OVS settings (RHEL-86877)
  - Add support for configuring the loopback interface in nmtui (RHEL-85770)
  - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764)
  - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778)
  - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168)


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.53.90-1
changelog:
  - Update to 1.54.0 (rc1)
  - Devices not becoming managed sometimes (RHEL-93108)
  - Crash on _l3cfg_notify_cb (RHEL-92314)
  - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610)


author: Filip Pokryvka <fpokryvk@redhat.com> - 1:1.53.91-1
changelog:
  - Update to 1.54.0 (rc2)
  - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728)
  - Fix a race condition in ovs tun interface (RHEL-98551)


author: Filip Pokryvka <fpokryvk@redhat.com> - 1:1.53.92-1
changelog:
  - Update to 1.54.0 (rc3)
  - Fix ipv6 static route deleted with dualstack (RHEL-102772)
  - Allow setting IP method to disabled in port connection (RHEL-102768)


author: Filip Pokryvka <fpokryvk@redhat.com> - 1:1.54.0-1
changelog:
  - Update to 1.54.0
  - Fix reaply on bridge port VLAN (RHEL-102743)
  - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787)


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.53.4-1
changelog:
  - Update to 1.53.4 (dev)
  - initrd: add new NBFT parser (RHEL-83061)
  - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083)
  - Support reapply on OVS settings (RHEL-86877)
  - Add support for configuring the loopback interface in nmtui (RHEL-85770)
  - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764)
  - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778)
  - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168)

  Resolves: RHEL-83061
  Resolves: RHEL-59083
  Resolves: RHEL-87596
  Resolves: RHEL-85770
  Resolves: RHEL-85764
  Resolves: RHEL-85778
  Resolves: RHEL-87168


author: Vladimír Beneš <vbenes@redhat.com>- 1:1.54.1-1
changelog:
  - Update to 1.54.1
  - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954)
  - Fix connection.autoconnect-ports of OVS ports (RHEL-114200)
  - Global DNS config without domains silently ignored from D-Bus (RHEL-115973)


author: Íñigo Huguet <ihuguet@redhat.com> - 1:1.54.2-1
changelog:
  - Update to 1.54.2
  - Support setting protocol version of HSR/PRP (RHEL-122172)
  - Support interlink for HSR/PRP (RHEL-122175)
  - Improve logging of networking off (RHEL-122173 )
  - Don't delete unrelated OVS ports (RHEL-121104)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1.2.18-2
changelog:
  - Support point-to-point IPSec tunnel (RHEL-20690)
  - Fix crash in libreswan_nmstate_iface_dpd_rsa (RHEL-21221)
  - Support configuring IPSec mode with 'type' (RHEL-21554)


author: Vladimír Beneš <vbenes@redhat.com 1.2.27-1
changelog:
  - Update to 1.2.27 version
  - Support leftsendcert in X.509-Based VPN (RHEL-110771)
  - Add support for nm-auto-defaults + symetric import/export
  - Support rightca in ipsec section
  - Esp param properly exported


author: Vladimír Beneš <vbenes@redhat.com 1.2.27-1
changelog:
  - Update to 1.2.27 version
  - Add support for nm-auto-defaults + symetric import/export (RHEL-118843)
  - Support leftsendcert in X.509-Based VPN (RHEL-110772)
  - Support rightca in ipsec section
  - Esp param properly exported


author: Gris Ge <fge@redhat.com> - 1.2.29-1
changelog:
  - Upgrade to 1.2.29
  - Fix error on duplicate key 'phase2alg'. (RHEL-131232)
  - Fix import connection with RSA key. (RHEL-127865)


author: Vladimír Beneš <vbenes@redhat.com> - 1.2.27-1
changelog:
  - Update to later upstream release to address regressions (RHEL-56551)
  - Support rightca in ipsec section (RHEL-118819)


author: Vladimír Beneš <vbenes@redhat.com> - 1.2.27-2
changelog:
  - Symetric import/export with nm-auto-default (RHEL-122306)
  - Esp param properly exported (RHEL-122626)
  - Correct leftid export when it contains @


author: Gris Ge <fge@redhat.com> - 1.2.29-1
changelog:
  - Upgrade to 1.2.29
  - Support creating both ends of IPsec (Libreswan) tunnels. (RHEL-85789)
  - Support leftprotoport and rightprotoport options. (RHEL-130907)
  - Fix error on duplicate key 'phase2alg'. (RHEL-131233)
  - Fix import connection with RSA key. (RHEL-127863)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.0.32-2
changelog:
  - Resolve issues found by rpmdiff
    - add explicit Requires: on subpackages to avoid the need to test
      interoperability between the various combinations of old and new
      subpackages


author: Pavel Cahyna <pcahyna@redhat.com> - 2.0.32-3
changelog:
  - Add a patch to resolve one more issue found by rpmdiff/rpminspect:
    fix getaddrinfo detection to avoid using gethostbyname.


author: Neal Gompa <ngompa@centosproject.org> - 2.0.18-1
changelog:
  - Update to 2.0.18
    Resolves: rhbz#2028076
  - Fix multilib conflict with SDL_revision.h (rhbz#2008838)
  - Backport fix for building against wayland-1.20+
  - Add patch to split SDL2 CMake targets for static libraries (rhbz#1965359)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.9.1.1-4
changelog:
  - wla-Disable-automatic-log-collector.patch [RHEL-35963]
  - Resolves: RHEL-35963
    ([Azure][WALA] Consider to disable Log collector [rhel-10])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.9.1.1-6
changelog:
  - wla-redhat-Use-NetworkManager-to-set-DHCP-hostnames-on-r.patch [RHEL-40966]
  - wla-redhat-Remove-all-waagent-unit-files-when-uninstalli.patch [RHEL-40966]
  - wla-redhat-Mark-directories-properly-in-the-files-list.patch [RHEL-40966]
  - wla-redhat-Remove-files-inside-WALA-services-directory.patch [RHEL-40966]
  - Resolves: RHEL-40966
    ([Azure][WALA][RHEL-10] Provisioning failed if no ifcfg-eth0)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.9.1.1-7
changelog:
  - wla-skip-cgorup-monitor-2939.patch [RHEL-46713]
  - Resolves: RHEL-46713
    ([Azure][RHEL-10][WALA] waagent -collect-logs doesn't work and the log is confusing)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.9.1.1-9
changelog:
  - wla-redhat-Add-a-udev-rule-to-avoid-managing-slave-NICs-.patch [RHEL-68796]
  - Resolves: RHEL-68796
    (Please add `mana` to 99-azure-unmanaged-devices.conf of Azure image)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.9.1.1-10
changelog:
  - wla-redhat-Explicitly-list-udev-rule-requirements-in-the.patch [RHEL-84073]
  - wla-redhat-Include-10-azure-unmanaged-sriov.rules-into-i.patch [RHEL-84073]
  - Resolves: RHEL-84073
    ([Azure][ARM][RHEL-9] Kdump cannot save vmcore via ssh or nfs [rhel-10])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.13.1.1-2
changelog:
  - wla-Use-systemctl-instead-of-service-to-manager-services.patch [RHEL-109465]
  - wla-docs-add-waagent-manpage-3401.patch [RHEL-96792]
  - Resolves: RHEL-109465
    ([Azure][RHEL-10][WALA][Image mode] Cannot find 'service' command)
  - Resolves: RHEL-96792
    ([Azure][WALA][RHEL-10] Missing man page)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.13.1.1-2.el10_1.1
changelog:
  - wla-Jira-https-issues.redhat.com-browse-RHEL-129954.patch [RHEL-129954]
  - Resolves: RHEL-129954
    (Update walagent to 2.14 to support FIPS 140-3 on Azure [rhel-10.1.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.7.0.6-10
changelog:
  - wla-Disable-automatic-log-collector.patch [RHEL-7273]
  - Resolves: RHEL-7273
    ([Azure][WALA] Consider to disable Log collector)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.7.0.6-11
changelog:
  - wla-redhat-Add-a-udev-rule-to-avoid-managing-slave-NICs-.patch [RHEL-5880]
  - Resolves: RHEL-5880
    ([Azure][RHEL-9]68-azure-sriov-nm-unmanaged.rules cannot stop NetworkManager-wait-online.service checking SRIOV interface)


author: Jon Maloy <jmaloy@redhat.com> - 2.7.0.6-12
changelog:
  - wla-redhat-Include-10-azure-unmanaged-sriov.rules-into-i.patch [RHEL-40957]
  - Resolves: RHEL-40957
    ([Azure][ARM][RHEL-9] Kdump cannot save vmcore via ssh or nfs)


author: Jon Maloy <jmaloy@redhat.com> - 2.13.1.1-2
changelog:
  - wla-docs-add-waagent-manpage-3401.patch [RHEL-109496]
  - Resolves: RHEL-109496
    ([Azure][WALA][RHEL-9] Missing man page)


author: Jon Maloy <jmaloy@redhat.com> - 2.13.1.1-3
changelog:
  - wla-Use-systemctl-instead-of-service-to-manager-services.patch [RHEL-97572]
  - Resolves: RHEL-97572
    ([Azure][RHEL-9][WALA][Image mode] Cannot find 'service' command)


author: Jon Maloy <jmaloy@redhat.com> - 2.13.1.1-3.el9_7.1
changelog:
  - wla-Support-for-FIPS-140-3-3324.patch [RHEL-124949]
  - Resolves: RHEL-124949
    (Update walagent to 2.14 to support FIPS 140-3 on Azure [rhel-9.7.z])


author: Jon Maloy <jmaloy@redhat.com> - 2.13.1.1-3.el9_7.2
changelog:
  - wla-Jira-https-issues.redhat.com-browse-RHEL-134939.patch [RHEL-134939]
  - Resolves: RHEL-134939
    (Backport ConditionVirtualization=|microsoft for waagent in RHEL 9.x [rhel-9.7.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.14.0.1-2
changelog:
  - wla-Remove-10-azure-unmanaged-sriov.rules.patch [RHEL-124218]
  - Resolves: RHEL-124218
    ([Azure][WALA][RHEL-9] Remove 10-azure-unmanaged-sriov.rules)


author: Jon Maloy <jmaloy@redhat.com> - 2.14.0.1-3
changelog:
  - wla-Jira-https-issues.redhat.com-browse-RHEL-133507.patch [RHEL-133507]
  - Resolves: RHEL-133507
    (Backport ConditionVirtualization=|microsoft for waagent in RHEL 9.x)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.14.0.1-4
changelog:
  - wla-Change-redhat-waagent-network-setup.service-path-to-.patch [RHEL-82232]
  - Resolves: RHEL-82232
    ([Azure][image mode][WALA][RHEL-9] Unable to setup the persistent firewall rules)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.7.0.6-1
changelog:
  - Rebase to 2.7.0.6-1 [bz#2083464]
  - Adding restart_if implementation for RHEL [bz#2081944]
  - Resolves: bz#2083464
    ([Azure][RHEL-9]Rebase WALinuxAgent to v2.7.0.6)
  - Resolves: bz#2081944
    ([Azure][WALA][9.0] WALA provisions VM failed because of no "ifdown")


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.7.0.6-2
changelog:
  - wla-redhat-Fix-command-sequence-for-restarting-net-inter.patch [bz#2098233]
  - Resolves: bz#2098233
    ([Azure][WALA][RHEL-9] [9.1] walinuxagent kills network during boot)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.7.0.6-3
changelog:
  - wla-redhat-Use-NetworkManager-to-set-DHCP-hostnames-on-r.patch [bz#2114830]
  - wla-Update-Log-Collector-default-in-Comments-and-Readme-.patch [bz#2093965]
  - Resolves: bz#2114830
    ([Azure][WALA][RHEL-9.1] Provisioning failed if no ifcfg-eth0)
  - Resolves: bz#2093965
    ([Azure][WALA][RHEL-9] The description of "Logs.Collect" is incorrect)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.7.0.6-4
changelog:
  - wla-redhat-Remove-all-waagent-unit-files-when-uninstalli.patch [bz#2114768]
  - Resolves: bz#2114768
    ([Azure][WALA][RHEL-9] When remove package some files left)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.7.0.6-5
changelog:
  - wla-redhat-Mark-directories-properly-in-the-files-list.patch [bz#2114768]
  - Resolves: bz#2114768
    ([Azure][WALA][RHEL-9] When remove package some files left)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.7.0.6-6
changelog:
  - wla-redhat-Remove-files-inside-WALA-services-directory.patch [bz#2114768]
  - Resolves: bz#2114768
    ([Azure][WALA][RHEL-9] When remove package some files left)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.7.0.6-7
changelog:
  - wla-redhat-Azure-CVM-specific-udev-rules.patch [bz#2162668]
  - Resolves: bz#2162668
    (Add support for importing remotely sealed TPM2 objects)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.7.0.6-8
changelog:
  - wla-redhat-Explicitly-list-udev-rule-requirements-in-the.patch [bz#2165042]
  - Resolves: bz#2165042
    ([9.0.z] /dev/disk/azure/ is created as symlink to sr0 or sda and not as a directory[Azure])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.7.0.6-9
changelog:
  - wla-redhat-Adjust-tpm2_createprimary-key-attributes-to-m.patch [bz#2167322]
  - Resolves: bz#2167322
    (Adjust TPM primary key creation parameters to match Azure)


author: Jon Maloy <jmaloy@redhat.com> - 2.7.0.6-11.el9_6.1
changelog:
  - wla-redhat-Include-10-azure-unmanaged-sriov.rules-into-i.patch [RHEL-88808]
  - Resolves: RHEL-88808
    ([Azure][ARM][RHEL-9] Kdump cannot save vmcore via ssh or nfs [rhel-9.6.z])


author: Jindrich Novy <jnovy@redhat.com> - 2:1.8.0-1
changelog:
  - update to https://github.com/containers/aardvark-dns/releases/tag/v1.8.0
  - Related: Jira:RHEL-2112


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1.9.0-1
changelog:
  - update to https://github.com/containers/aardvark-dns/releases/tag/v1.9.0
  - Related: Jira:RHEL-2112


author: Ray Strode <rstrode@redhat.com> - 0.6.55-10
changelog:
  - Synchronize permissions and group ownership for icon and users dirs
    between rpm file manifest and daemon expectations.
    Resolves: #2057576


author: Kalev Lember <klember@redhat.com> - 3.28-12
changelog:
  - Split highcontrast-icon-theme out to a new subpackage
  - Explicitly require cursor and icon themes required for the gtk2 themes


author: Zoltan Fridrich <zfridric@redhat.com> - 0.16-19
changelog:
  - use gating and config file from rhel-8.5
  - remove check of periodically changing files
    Resolves: rhbz#1957656
  - config cleanup
    Resolves: rhbz#1957654


author: Zoltan Fridrich <zfridric@redhat.com> - 0.16-20
changelog:
  - fix configuration option with-dbhmactype
  - do not use sha1 and md5 by default
    Resolves: rhbz#1935457
  - fix important static analysis issues
    Resolves: rhbz#1938676


author: Radovan Sroka <rsroka@redhat.com> - 0.16-102
changelog:
  RHEL 9.5.0 ERRATUM
  - aide fails with "Not enough parameters in db:15384. Trying to continue." unexpectedly
  Resolves: RHEL-27606
  - AIDE fails when using root_prefix option
  Resolves: RHEL-28882


author: Radovan Sroka <rsroka@redhat.com> - 0.16-103
changelog:
  RHEL 9.6.0 ERRATUM
  - /boot/grub2/grubenv's timestamp is getting modified continuously due to "boot_success" implementation
  Resolves: RHEL-4331


author: Attila Lakatos <alakatos@redhat.com> - 0.16-103.2
changelog:
  RHEL 9.6.Z ERRATUM
  - CVE-2025-54389 aide: improper output neutralization enables bypassing
  Resolves: RHEL-109910


author: Attila Lakatos <alakatos@redhat.com> - 0.16-105
changelog:
  RHEL 9.7 ERRATUM
  - CVE-2025-54389 aide: improper output neutralization enables bypassing
  Resolves: RHEL-109912


author: Attila Lakatos <alakatos@redhat.com> - 0.19.2-1
changelog:
  RHEL 9.8.0 ERRATUM
  - rebase to 0.19.2
  Resolves: RHEL-110573
  - Switch to libnettle for hashing
  - prevent aide from crashing if database is a HTTPS URL
  Resolves: RHEL-76014
  - prevent aide from exiting if a file is truncated during check
  Resolves: RHEL-1569


author: Attila Lakatos <alakatos@redhat.com> - 0.19.2-4
changelog:
  - /boot/grub2/grubenv is excluded from check due to boot_success implementation
  Resolves: RHEL-83776


author: Attila Lakatos <alakatos@redhat.com> - 0.19.2-5.1
changelog:
  - Re-add syslog_format config option dropped during rebase to 0.19.2
  Resolves: RHEL-178539
  - Add aide-migrate-config to automate config migration from pre-0.19 syntax


author: Jaroslav Kysela <perex@perex.cz> - 2.2.5-2
changelog:
  - add sof-rpl-rt711-l0-rt1316-l12-rt714-l3.tplg for Dell SKU 0BDA
  - add xz compression support (with CRC32)


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.3.9-1
changelog:
  - timezone: for kickstart allow also timezones not offered by GUI (rvykydal)
    Resolves: jira#RHEL-13150
  - Rename Organization to Organization ID on subscription screen (mkolman)
    Resolves: jira#RHEL-11167


author: Martin Kolman <mkolman@redhat.com> - 34.25.4.2-1
changelog:
  - tests: Add a test case for the NVMe module (vtrefny)
    Resolves: RHEL-11543
    Resolves: RHEL-11544
  - Add a simple NVMe module for NVMe Fabrics support (vtrefny)
    Resolves: RHEL-11543
    Resolves: RHEL-11544
  - network: ignore BOOTIF connections when creating device configurations
    (rvykydal)
    Resolves: RHEL-4766
  - network: ignore BOOTIF connections when looking for initramfs bond ports
    (rvykydal)
    Resolves: RHEL-4766


author: Martin Kolman <mkolman@redhat.com> - 34.25.4.3-1
changelog:
  - Fix missing emit of zfcp kickstart statements (maier)
    Related: RHEL-11384
  - DeviceTreeViewer: Add path-id attribute to zfcp-attached SCSI disks (maier)
    Related: RHEL-11384
  - Fix missing WWID values for multipath devices in advanced storage UI
    (#2046654) (maier)
    Resolves: RHEL-11384
  - rescue: Don't allow to mount systems without a root device (vponcova)
    Resolves: RHEL-14696
  - Do not crash on default None values of ostreecontainer command (rvykydal)
    Related: RHEL-2250
  - Fix wrong dracut timeout message (jkonecny)
    Resolves: RHEL-5638
  - Move rpm-ostree deps from Lorax to Anaconda (#2125655) (jkonecny)
    Related: RHEL-2250
  - Implement needs_network for rpm_ostree_container (#2125655) (jkonecny)
    Related: RHEL-2250
  - Add tests for RPM Ostree payload with source from container (#2125655)
    (rvykydal)
    Related: RHEL-2250
  - Enable RPM OSTree from container source in payload (#2125655) (rvykydal)
    Resolves: RHEL-2250
  - Add RPM OSTree source from container (#2125655) (rvykydal)
    Related: RHEL-2250


author: Martin Kolman <mkolman@redhat.com> - 34.25.4.5-1
changelog:
  - bootupd: Use --write-uuid (walters)
    Related: RHEL-17205
  - bootloader: Detect bootupd and skip regular install (vslavik)
    Related: RHEL-17205
  - ostree: Use bootupd if installed by payload (vslavik)
    Resolves: RHEL-17205
  - bootloader: Create an installation task for collecting kernel arguments
    (vponcova)
    Related: RHEL-17205
  - bootloader: Add the collect_arguments method (vponcova)
    Related: RHEL-17205
  - bootloader: Remove the install_boot_loader function (vponcova)
    Related: RHEL-17205
  - Apply the bootloader options before the installation (vponcova)
    Related: RHEL-17205


author: Martin Kolman <mkolman@redhat.com> - 34.25.4.6-1
changelog:
  - Disable bug reporting to Bugzilla from anaconda (kkoukiou)
    Resolves: RHEL-24419
  - Fixed file-write operation to a public directory (ataf)
    Resolves: RHEL-23345


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.4.7-1
changelog:
  - Lower log file permission in /tmp (jkonecny)
    Resolves: RHEL-23345
  - Add utility function to set file mode (jkonecny)
    Related: RHEL-23345


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.5.10-1
changelog:
  - Fix check for biosboot partition in GRUB2.check (vtrefny)
    Resolves: RHEL-55922
  - Ignore all storage errors when trying to activate swaps (vtrefny)
    Resolves: RHEL-55922


author: Martin Kolman <mkolman@redhat.com> - 34.25.5.11-1
changelog:
  - security: call /usr/libexec/fips-setup-helper (asosedkin)
    Resolves: RHEL-58667
  - release-notes: Document support for compressed kernel modules in Driver Discs
    (peter.georg)
    Related: RHEL-9913
  - Add documentation about support for compressed kernel modules (peter.georg)
    Resolves: RHEL-9913
  - dd_extract: Update test info to reflect added support for compressed kernel
    modules (peter.georg)
    Resolves: RHEL-9913
  - dd_extract: Add test for zstd compressed kernel module (peter.georg)
    Resolves: RHEL-9913
  - dd_extract: Add test for xz compressed kernel module (peter.georg)
    Resolves: RHEL-9913
  - dd_extract: Add support for compressed kernel modules (peter.georg)
    Resolves: RHEL-9913
  - New version - 34.25.5.10 (k.koukiou)


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.5.13-1
changelog:
  - security: require pykickstart version with %certificates support (rvykydal)
    Resolves: RHEL-61430
  - security: do not crash initramfs ks parsing on failing certificate dump
    (rvykydal)
    Resolves: RHEL-61430
  - security: add service to transfer certificates from initramfs (rvykydal)
    Resolves: RHEL-61430
  - security: import certificates in initramfs (rvykydal)
    Resolves: RHEL-61430
  - security: install certificates in pre-install phase only for dnf payload
    (rvykydal)
    Resolves: RHEL-61430
  - security: raise exception if certificate destination is unknown (rvykydal)
    Resolves: RHEL-61430
  - security: log a warning when dumping certificate over an existing file
    (rvykydal)
    Resolves: RHEL-61430
  - security: pre-install certificates before payload installation (rvykydal)
    Resolves: RHEL-61430
  - security: add API to install certificates early before payload (rvykydal)
    Resolves: RHEL-61430
  - security: install certificates on target system (rvykydal)
    Resolves: RHEL-61430
  - security: Add API for installation on target system (rvykydal)
    Resolves: RHEL-61430
  - security: import certificates early after Anaconda start (rvykydal)
    Resolves: RHEL-61430
  - security: add API to import certificates to Anaconda environment (rvykydal)
    Resolves: RHEL-61430
  - security: add API: Certificate getter (rvykydal)
    Resolves: RHEL-61430
  - kickstart: extend section specification for list of section data (rvykydal)
  - security: implement the support to install certificates to Anaconda
    (rvykydal)
    Resolves: RHEL-61430
  - translations: bump dependency to l10n repo because of branch switch
    (k.koukiou)
  - util: correct errors and suppress stderr for common cases (riehecky)
  - util: Add additional information for EFI systems (riehecky)
    Resolves: RHEL-55128


author: Radek Vykydal <rvykydal@redhat.com> - 34.25.5.15-1
changelog:
  - security: add a development note for certificates import in initramfs
    (rvykydal)
    Related: RHEL-77155
  - security: do not issue warning on existing certificate file during dump
    (rvykydal)
    Resolves: RHEL-77155
  - network: pass NM global dns configuration to the installed system (rvykydal)
    Resolves: RHEL-71824
  - network: pass global dns initrd option to the installed system (rvykydal)
    Resolves: RHEL-71824


author: Radek Vykydal <rvykydal@redhat.com> - 34.25.5.16-1
changelog:
  - network: add dnsconfd to selected packages if used in installer (rvykydal)
    Resolves: RHEL-79803
  - network: add dnsconfd to installer environment (rvykydal)
    Resolves: RHEL-79804


author: Radek Vykydal <rvykydal@redhat.com> - 34.25.5.17-1
changelog:
  - network: start dnsconfd in initramfs (rvykydal)
    Resolves: RHEL-80303
  - network: enable dnsconfd service on installed system if required (rvykydal)
    Resolves: RHEL-80023
  - network: pass 16-dns-backend.conf to target system (rvykydal)
    Resolves: RHEL-80233
  - netowrk: enable dnsconfd service in installer environment (rvykydal)
    Resolves: RHEL-80023


author: Katerina Koukiou <kkoukiou@redhat.com> - 34.25.5.1-1
changelog:
  - anaconda-diskroot: wait before dying on media check fail (awilliam)
    Resolves: RHEL-4790
  - Add ping tool to Dracut (jkonecny)
    Resolves: RHEL-5719
  - gui:Fix index error for _remove_treeinfo_repositories() (liuwenyu.0311)
    Resolves: RHEL-29561


author: Katerina Koukiou <kkoukiou@redhat.com> - 34.25.5.3-1
changelog:
  - Fix Source0 in spec to point to upstream source URL (kkoukiou)
  - Do not try to load sha256 module in intramfs (rvykydal)
    Resolves: RHEL-4747
  - Do not try to load the floppy kernel module (jstodola)
    Resolves: RHEL-4747
  - anaconda-modprobe: don't try and load cramfs (awilliam)
    Resolves: RHEL-4747


author: Katerina Koukiou <kkoukiou@redhat.com> - 34.25.5.5-1
changelog:
  - Update translations from Weblate for rhel-9
  - Do not rewrite logs in rescue mode (jstodola)
    Resolves: RHEL-4794
  - Write a warning rescue selinux (akankovs)
    Resolves: RHEL-14005
  - Fix kickstart --dhcpclass option application (rvykydal)
    Resolves: RHEL-30406


author: Katerina Koukiou <kkoukiou@redhat.com> - 34.25.5.6-1
changelog:
  - Update translations from Weblate for rhel-9
  - Change location of rescue mode flag file (jstodola)
    Resolves: RHEL-4794


author: Radek Vykydal <rvykydal@redhat.com> - 34.25.5.7-1
changelog:
  - Fix source spoke being inaccessible if payload thread errors out (mkolman)
    Resolves: RHEL-4721
  - Do not create default wired connections for bond ports (rvykydal)
    Resolves: RHEL-38451
  - Consolidate code for dumping network connections (rvykydal)
    Related: RHEL-38451


author: Martin Kolman <mkolman@redhat.com> - 34.25.5.8-1
changelog:
  - Use proxy server also for FTP .treeinfo download (jkonecny)
    Resolves: RHEL-27938
  - Update translations from Weblate for rhel-9 (github-actions)


author: Martin Kolman <mkolman@redhat.com> - 34.25.5.9-1
changelog:
  - network: ignore kickstart configuration of nBFT devices (rvykydal)
    Resolves: RHEL-30149
    Resolves: RHEL-34235
    Resolves: RHEL-32146
  - network: do not dump configurations of nBFT devices (rvykydal)
    Resolves: RHEL-30149
    Resolves: RHEL-34235
    Resolves: RHEL-32146
  - network: ignore nBFT devices connections in network configuration (rvykydal)
    Resolves: RHEL-30149
    Resolves: RHEL-34235
    Resolves: RHEL-32146
  - network: add a test for ignoring ifname=nbft* for device renaming (rvykydal)
    Resolves: RHEL-30149
    Resolves: RHEL-34235
    Resolves: RHEL-32146
  - network: do not create empty dir for only ifname=nbft* options (rvykydal)
    Resolves: RHEL-30149
    Resolves: RHEL-34235
    Resolves: RHEL-32146
  - network: Avoid creating link files for 'nbft' interfaces (tbzatek)
    Resolves: RHEL-30149
    Resolves: RHEL-34235
    Resolves: RHEL-32146
  - Update translations from Weblate for rhel-9 (github-actions)


author: Martin Kolman <mkolman@redhat.com> - 34.25.7.6-1
changelog:
  - Fix vconsole layout doesn't work for ostree (jkonecny)
    Resolves: RHEL-101057
  - test: make dnf substitutions test check only relevant values (rvykydal)
  - test: add new substitution members in dnf tests (rvykydal)


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.7-1
changelog:
  - pyanaconda: payload: return exception details for payload failures
    (k.koukiou)
  - ui: tui: installation_source: show error message in the TUI screen
    (k.koukiou)
    Resolves: RHEL-4705
  - storage: fix mount point assignment of non-formatted swap partitions
    (rvykydal)
    Related: RHEL-16355
  - storage: include only fstab devices in fsset swap devices property (rvykydal)
    Resolves: RHEL-16355


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.8-1
changelog:
  - Fix: UnboundLocalError: local variable 'e' referenced before assignment
    (k.koukiou)
    Related to: RHEL-4705
  - Emit authselect in KS when fingerprint is enabled (adamkankovsky)
    Resolves: RHEL-85175


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.9-1
changelog:
  - Set Authselect agruments after run in Security module (adamkankovsky)
    Resolves: RHEL-85175
  - Authselect code simplification (adamkankovsky)
    Resolves: RHEL-85175
  - custom: Reallocate partitions when removing a partition (vtrefny)
    Resolves: RHEL-114169


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.10-1
changelog:
  - Fixing authselect logical differences not resolved during backporting
    (adamkankovsky)
    Resolves: RHEL-85175


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.11-1
changelog:
  - bootloader: efi: utilize grub2-common script for handling config file
    generation (k.koukiou)
    Resolves: RHEL-36187


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.12-1
changelog:
  - Fix permissions of the ssh config created by Anaconda (ppolawsk)
    Resolves: RHEL-129787
  - pyanaconda: rpm_ostree: fix _handle_boot_if_not_mount_point method issues
    (k.koukiou)
    Related: RHEL-74145
  - ostree needs to have /boot be bindmounted into sysroot. (a.badger)
    Resolves: RHEL-74145


author: Martin Kolman <mkolman@redhat.com> - 34.25.7.1-1
changelog:
  - network: disable NM autoconnections also when BOOTIF is used (rvykydal)
    Resolves: RHEL-78272
  - network: support inst.net.noautodefault option (rvykydal)
    Related: RHEL-78272
  - security: fix dnsconfd backend option check in initramfs (rvykydal)
    Resolves: RHEL-83214
  - Support leavebootorder for bootupd (jkonecny)
    Resolves: RHEL-40897
  - bootupd: call bootupctl with --update-firmware (awilliam)
    Resolves: RHEL-40897


author: Martin Kolman <mkolman@redhat.com> - 34.25.7.2-1
changelog:
  - Fix typo in systemd service (jstodola)
    Resolves: RHEL-78272
  - s390x - enable raid1 as a stage2 device (dan)
    Resolves: INSTALLER-4148
    Resolves: RHEL-21691
  - edns: restart dnsconfd only after the first kickstart parsing (rvykydal)
    Resolves: RHEL-82694
  - edns: allow dnsconfd name resolution for kickstart fetching (rvykydal)
    Resolves: RHEL-82694


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.7.3-1
changelog:
  - Sort RPM versions via rpm.labelCompare() and not via
    packaging.version.LegacyVersion() (miro)
    Resolves: RHEL-87358
  - rpm_ostree/installation.py: fix image deployment on s390x (rvykydal)
    Resolves: RHEL-63237
  - Add additional config_get Dracut function tests (jkonecny)
    Related: RHEL-48837
  - Update the tests/README.rst file (jkonecny)
    Related: RHEL-48837
  - Move shell testing to a separated directory (jkonecny)
    Related: RHEL-48837
  - Enable dynamic bash commands disable for tests (jkonecny)
    Related: RHEL-48837
  - Add test for config_get dracut function (jkonecny)
    Related: RHEL-48837
  - Fix trailing `/` when downloading stage2 image (jkonecny)
    Resolves: RHEL-48837
  - Fix whitespace chars broke Dracut config parsing (jkonecny)
    Related: RHEL-48837


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.7.4-1
changelog:
  - Revert "s390x - enable raid1 as a stage2 device" (jkonecny)
    Reverts: RHEL-21691
  - test_module_part_blivet: fix pylint disable (jkonecny)
    Related: RHEL-85416
  - pyanaconda: module.common.task fix cyclic import (jkonecny)
    Related: RHEL-85416
  - pyanaconda: module_manager: fix ciclic import (k.koukiou)
    Related: RHEL-85416
  - pyanaconda: bootloader: fix ImportError (k.koukiou)
    Related: RHEL-85416
  - ruff: enable isort rules and autofix all isort warnings Autofixed with: ruff
    check --exclude pyanaconda/core/kickstart/commands.py --fix --select I .
    (jkonecny)
    Resolves: RHEL-85416
  - Add ruff, a very fast linter (vslavik)
    Related: RHEL-85416
  - Relabel /var/log/ and /root/original-ks.cfg (champetier.etienne)
    Resolves: RHEL-85298


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.7.5-1
changelog:
  - bootloader: drop write_config_console, just preserve console= (awilliam)
    Resolves: RHEL-98670
  - payload/rpm-ostree: Include program output in exception (walters)
    Resolves: RHEL-45184


author: Nick Clifton <nickc@redhat.com> - 11.04-1
changelog:
  - Annocheck: Add crti.o and crtn.o to the list of known glibc special files.  (#2158740)
  - Annocheck: Fix memory leaks.


author: Nick Clifton <nickc@redhat.com> - 11.12-1
changelog:
  - Annocheck: Add code to handle another glibc function built without LTO.
  - GCC Plugin: Do not run if other plugins are active.  (#2175768)
  - Annocheck: Add code to handle glibc functions built without LTO.
  - Libannocheck: Fix thinko in debugging code.
  - Annocheck: Fix LTO test.
  - Notes: Display notes held in separate dbeuginfo files.
  - Annocheck: Fix atexit test.  Fix recording of version numbers.  (#2165528)
  - LLVM & Clang Plugins: Build with branch protection on AArch64.  (#2164364)
  - Libannocheck: Fix bug causing infinite looping when running tests.
  - Annocheck: Fix handling of file built by multiple versions of gcc.  (#2160700)


author: Nick Clifton <nickc@redhat.com> - 12.07-1
changelog:
  - Annocheck: Fix lto testing.  (#2177140)
  - gcc-plugin: generate warnings about misspelt -D_FORTIFY_SOURCE and/or -D_GLIBCXX_ASSERTIONS options.
  - gcc-plugin: use a bigger buffer for constructing notes.
  - llvm-plugin: Fix detection of optimization level.  Improve test.
  - clang-plugin: Improve test.
  - configure: More improvements.
  - annocheck: Fix seg-fault when checking for glibc components in string format notes.
  - configure: Simplify.
  - gcc plugin: Add filenames to string notes.  Allow use of ANNOBIN environment variable.
  - llvm plugin: Add workaround for building with LLVM-16.
  - clang plugin: Fix for building with Clang-16.
  - gcc plugin: Keep ELF notes at protocol version 3.
  - Protocol Version 4: String format notes.
  - Annocheck: Update message for LTO tests.  (#2177140)


author: Nick Clifton <nickc@redhat.com> - 12.09-1
changelog:
  - Annocheck: Fix detection of missing plugin options.  (#2189492)
  - Fix generation of auto-generated files.
  - Fix covscan reported errors.


author: Nick Clifton <nickc@redhat.com> - 12.12-1
changelog:
  - Rebuild against LLVM-16.  (#2212739)
  - Annocheck: Check for string notes in separate debug info files.  (#2211694)
  - Annocheck: Add support for el10 and rhel-10 profiles.  (RHEL-526)
  - Annocheck: Suppress more tests for Rust binaries.


author: Nick Clifton <nickc@redhat.com> - 12.28-1
changelog:
  - Tests: Fix obsoleted syntax in plans/ci.fmf  (RHEL-12194)
  - Spec File: Use SPDX licensing.
  - GCC Plugin: Record settings of -Wstrict-flex-arrays and -fstrict-flex-arrays
  - Annobin: Add future test of these options.
  - GCC Plugin: Record settings of -Wimplicit-int and -Wimplicit-function-declaration.
  - Annobin: Add test for these warnings.
  - LLVM Plugin: Fix building with LLVM version 17.
  - GCC Plugin: Enable string note format by default.
  - Annocheck: Change GO FIPS test to look for CGO_ENABLED markers.
  - Annocheck: Add test for FIPS compliant GO binaries.
  - Annocheck: Fix double free.  (#2226749)
  - Annocheck: Ignore AArch64 $x and $d symbols.  (#2221192)
  - GCC Plugin: Suppress active checks for fortran sources.  Improve scanning of COLLECT_GCC_OPTIONS.
  - Annocheck: Remove dependency upon binutils-devel.
  - Annocheck: Add detection of known parts of libstdc++-nonshared.a that contain gaps.  (#2217864)
  - Annocheck: Ignore weak/undef function symbols when checking to see if a binary contains code.  (#2217840)
  - Annocheck: Add --suppress-version-warnings option.
  - Annocheck: Do not ignore separate debuginfo files that do not contain any DWARF.  (#2144553)
  - Annocheck: Ignore /dev/null filename in string notes.
  - Annocheck: More tweaks to glibc detection heuristics.  (#2215968)


author: Nick Clifron <nickc@redhat.com> - 12.31-1
changelog:
  - Update glibc detection heuristics for PPC64.  (RHEL-16453)
  - Fix another atexit test failure.  (#2247481)
  - Fix atexit test failure.
  - Notes: Add support for string format notes.


author: Nick Clifron <nickc@redhat.com> - 12.64-1
changelog:
  - Rebase to 12.64, allowing build with LLVM 18.  (RHEL-49953)
  - Retire: annobin-strings-no-attach.patch
  - Annocheck: Add improvements to the builtby utility.
  - Annocheck: Add support for ADA binaries.
  - Annocheck: Add support for binaries built from more than two high level source languages.
  - Annocheck: Add support for object files containing no executable code.
  - Annocheck: Do not FAIL LLVM compiled binaries that have not been built with sanitize-cfi and/or sanitize-safe-stack.
  - Annocheck: Add support for Fortran binaries.
  - Annocheck: Add heuristic for detecting parts of the CGO runtime library.
  - Annocheck: Add improvements for handling Clang runtime binaries.
  - Annocheck: Add tweaks for mixed Rust/C binaries.  (#2284605)
  - Annocheck: Add more glibc source file names.
  - Annocheck: Skip GAPS test for GO binaries.  (RHEL-36308)
  - Annocheck: Remove some false positives for Rust binaries.  (#2280239)
  - Annocheck: Defer passing the branch protection test until all notes have been checked.
  - GCC Plugin: Add extra code for detecting the branch protection setting.  (RHEL-35958)
  - Annocheck: Add OpenSSL Engine test.  (PTG-319)
  - Annocheck: Test for gaps even when only one note is present.
  - Annocheck: Skip AArch64 branch protection test for GO binaries.
  - GCC Plugin: Disable active check for -Wimplicit-int for non-C sources.  (#2275884)
  - Annocheck: Ignore stack checks for AMD GPU binaries.
  - Annocheck: Do not produce FAIL result for i686 binaries in the RHEL-10 profile.
  - Annocheck: Test for __stack_chk_guard being writeable.
  - Annocheck: Update heuristics for detecting glibc code in executables.  (RHEL-30579)
  - Clang & LLVM Plugins: Allow environment to override fortification level.  (RHEL-30579)
  - Annocheck: Improve detection of -mbranch-protection option.
  - Clang Plugin: Add global-file-syms option.
  - LLVM Plugin: Add global-file-syms option.
  - Plugins: Add support for ANNOBIN environment variable.
  - GCC Plugin: Fix bug extracing the value of target specific command line options.
  - Configure: Remove check for FrontendPluginRegistry.h header as it is stored in a non-standard location on Debian systems.
  - Debuginfod test: Allow for the libdwfl library silently contacting the debuginfod server.
  - LLVM Plugin: Use llvm-config to get the correct paths and options for building executables.
  - Clang Plugin: Likewise.
  - Enable silent rules for most building.
  - Annocheck: Correctly extract DWARF attributes from DT_REL files.
  - Annocheck: Improve heuristics for locating debug info files.  (#2267097)
  - Configure: Harmonize configure options.    
  - Clang Plugin: Fix building with Clang 18.  (#31414)
  - GCC Plugin: Add support for MIPS specific target functions.
  - GCC Plugin: Use .dc.a for address expressions in 64-bit ELF format notes.
  - Annocheck: Improve heuristic for skipping LTO and FORTIFY tests.  (#2264000)
  - Annocheck: Also skip property note test for i686 binaries. (#2258571)
  - Annocheck: Also skip the entry point test for i686 binaries. (#2258571)
  - GCC Plugin: Do not use section groups with string format notes.
  - Annocheck: Disable cf-protection test for i686 architecture. (#2258571)
  - Annocheck: Improve detection of FIPS compliant GO binaries.
  - GCC Plugin: Fix recording of the -Wimplicit-int and -Wimplicit-function-declaration warnings.  Add active checks for when they are deliberately disabled.
  - Tests: Fix implicit-values test so that it will compile with gcc 14+.
  - GCC Plugin: Add support for -fhardended.


author: Nick Clifton <nickc@redhat.com> - 12.65-1
changelog:
  - Annocheck: Fix recording arguments for later re-use.  (RHEL-50802)
  - Spec File: Add LTO option to clang and llvm plugin builds.  (RHEL-50796)


author: Nick Clifton <nickc@redhat.com> - 12.83-1
changelog:
  - Annocheck: Remove spurious debugging messages.
  - Annocheck: Always look for annobin notes in separate debug info files.  (RHEL-75778)
  - Annocheck: Support multiple --debug-rpm and --debug-file options.  (RHEL-73349)
  - Annocheck: Add support for sys-root'ed glibc packages.  (RHEL-71296)
  - GCC Plugin: Tidy up use of gcc's diagnoatic headers.  (#32429)
  - Testsuite: Use configured compiler when running tests.
  - GCC Plugin: Fix building with gcc 15.  (#32429)
  - Annocheck: Fix overly long debug messages.
  - Annocheck: Rename rwx-seg test to load-segments.  Add more checks.  Add check for gaps as a future fail.
  - Annocheck: Add --no-allow-excpetions to disable exceptions for known special binaries.
  - Annocheck: Add --enable-future to enable future fail components in normal tests.
  - Annocheck: Fix bug preventing the inclusion of the rpm name in reports.
  - Annocheck: Add more exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Add --skip-passes option.
  - Annocheck: Add exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Skip property note test for i386 binaries created by LLVM.  (#2323797)
  - Annocheck: Skip FORTIFY and GLIBC_ASSERTIONS tests for LLVM produced binaries with unparseable DW_AT_producer attributes in their DWARF debug info.  (RHEL-65411)
  - GCC Plugin: Change type of the .annobin.notes section from SHT_STRTAB to SHT_PROGBITS.
  - Clang & LLVM Plugins: Include install directory in binary.  (RHEL-54069)
  - BuiltBy: Fix seg-fault when comparing language version strings.  (RHEL-53497)
  - Annocheck: Stop spurious assembler warnings.  (RHEL-53213)
  - Annocheck: Stop warnings about known gaps.    (RHEL-53218)
  - Annocheck: Fix stack realign test.  (#2302427)


author: Nick Clifton <nickc@redhat.com> - 12.87-1
changelog:
  - Annocheck: Fix locating string notes (again).  Add exception for glibc benchmark tests.  (RHEL-76809)
  - Annocheck: Add crtoffloadtableS.o to list of known gcc binaries.  (RHEL-76040)


author: Nick Clifton <nickc@redhat.com> - 12.91-1
changelog:
  - Annocheck: Fix resource leak.  (RHEL-79253)
  - Annocheck: Fix double free. Add special handling for COMBOOT modules.
  - Annocheck: Improve diagnostics when a separate debug info file cannot be found.


author: Nick Clifton <nickc@redhat.com> - 12.92-1
changelog:
  - Annocheck: Do not rely upon libelf's ability to detect links to separate debuginfo files.  (RHEL-79264)


author: Nick Clifton <nickc@redhat.com> - 12.93-1
changelog:
  - Rebuild against LLVM v20.  (RHEL-82001)
  - Rebase to 12.93.
  - Annocheck: Fix test for GO revision.  (RHEL-56031)


author: Nick Clifton <nickc@redhat.com> - 12.96-1
changelog:
  - Annocheck: Fix bugs in debug rpm location code.  Add more glibc exceptions.  (RHEL-95216)
  - Annocheck: Improve performance with multiple debug info files and multiple files to scan.  (#2366180)
  - Annocheck: Update heuristic for detecting gcc files to cope with gcc 15.  (#2365824)


author: Nick Clifton <nickc@redhat.com> - 12.98-1
changelog:
  - Rebase to 12.98.  (RHEL-105574)
  - Improve configure and meson files for consistent builds.
  - Annocheck: Delete the temporary debug info directory after the tests have finished.


author: Sergei Petrosian <spetrosi@redhat.com> - 1.3.0-3
changelog:
  - Spec: add functionality to build from a commit hash
  - Use latest 1.3.0 to add flexibility to AD integration functionality
    Resolves: rhbz#2163709


author: Sergei Petrosian <spetrosi@redhat.com> - 1.4.1-1
changelog:
  - Update BuiildRequires to use ansible-core on RHEL > 8.8
  - Move RHEL related code into an include for spec readability
  - Update role to version 1.4.1 to add customizable storage paths
    Resolves: RHEL-529


author: Sergei Petrosian <spetrosi@redhat.com> - 2.0.1-1
changelog:
  - Update role to version 2.0.1 to enhance AD integration
    Resolves: RHEL-877
    Resolves: RHEL-878
    Resolves: RHEL-879
    Resolves: RHEL-880


author: Sergei Petrosian <spetrosi@redhat.com> - 2.2.0-1
changelog:
  - Support installing SQL Server 2022 on RHEL 9 and running as a selinux-confined application
    Resolves: RHEL-16342
  - Remove unnecessary variable and RPM requirements for read-scale clusters
    Resolves: RHEL-3540
  - Add the mssql_ha_prep_for_pacemaker variable to configure SQL Server for Pacemaker
    Resolves: RHEL-19091
  - Deprecate `mssql_ha_cluster_run_role` for `mssql_manage_ha_cluster`
    Resolves: RHEL-19092


author: Sergei Petrosian <spetrosi@redhat.com> - 2.2.1-2
changelog:
  - Use latest auto-maintenance for updates in lsr_role2collection.py
  - Remove with_html, instead use built-in .README.html
    Resolves: RHEL-23455


author: Sergei Petrosian <spetrosi@redhat.com> - 2.2.1-3
changelog:
  - CHANGELOG.md was missing in some places
  - In legacy role, sed repalced unexpected strings at some places
    Resolves: RHEL-23455


author: Sergei Petrosian <spetrosi@redhat.com> - 2.2.3-1
changelog:
  - Add support for running SQL Server as a SELinux unconfined application with SELinux in enforcing mode on RHEL 9
    Resolves: RHEL-16342
  - ExcludeArch: i686


author: Sergei Petrosian <spetrosi@redhat.com> - 2.5.2-1
changelog:
  - Fail on RHEL or CentOS 10 because it's not supported
    Resolves: RHEL-67804
  - Use new adutil functionality to enable AES encryption
    Resolves: RHEL-67807
  - Add mssql_tools_versions, mssql_tls_self_sign to allow installing different versions of mssql-tools
    Resolves: RHEL-68374
  - Deprecate mssql_accept_microsoft_odbc_driver_17_for_sql_server_eula
    Resolves: RHEL-69311


author: Sergei Petrosian <spetrosi@redhat.com> - 2.6.1-1
changelog:
  - Add mssql_ha_ag_is_contained and mssql_ha_ag_reuse_system_db to allow creating AG as contained and reuse system database
    Resolves: RHEL-92712
  - Add secondary_role_allow_connections and mssql_ha_read_only_routing_list
    Resolves: RHEL-92718


author: Sergei Petrosian <spetrosi@redhat.com> - 2.6.2-1
changelog:
  - Add mssql_ha_ag_is_contained and mssql_ha_ag_reuse_system_db to allow creating AG as contained and reuse system database
    Resolves: RHEL-92712


author: Sergei Petrosian <spetrosi@redhat.com> - 2.6.4-1
changelog:
  - test: use post quantum crypto for certs where available (#368)
  - fix: Fix templates/configure_ag.j2 for Ansible 2.19
    Resolves: RHEL-106149


author: Sergei Petrosian <spetrosi@redhat.com> - 0.0.1-1
changelog:
  - Initialize the package
  - Resolves: RHEL-117252 : [RFE] Add ansible-collection-redhat-leapp to RHEL9


author: Sergei Petrosian <spetrosi@redhat.com> - 1.7.0-1
changelog:
  - Replace upstream value of leapp_system_roles_collection with downstream redhat.rhel_system_roles.
  - Resolves: RHEL-117252 : [RFE] Add ansible-collection-redhat-leapp to RHEL9


author: Sergei Petrosian <spetrosi@redhat.com> - 1.7.1-1
changelog:
  - Update to latest upstream version via commit hash
  - Resolves: RHEL-117252 : [RFE] Add ansible-collection-redhat-leapp to RHEL9


author: Sergei Petrosian <spetrosi@redhat.com> - 1.7.1-2
changelog:
  - Fix spec file to require rhel-system-roles package
  - Resolves: RHEL-117252 : [RFE] Add ansible-collection-redhat-leapp to RHEL9


author: Sergei Petrosian <spetrosi@redhat.com> - 1.7.4-1
changelog:
  - Update to latest upstream version 1.7.4
  - Resolves: RHEL-153381 : Fix the role failing on steps that copy logs to the controller EL9


author: Dimitri Savineau <dsavinea@redhat.com> - 2.14.2-4
changelog:
  - rebuild with python 3.11 (rhbz#2169466)
  - remove bundled dependencies from requirements file (rhbz#2152615)
  - add bundled version of resolvelib
  - use PyPi sources
  - remove straightplugin
  - add missing obsoletes constraint


author: Dimitri Savineau <dsavinea@redhat.com> - 2.15.0-1
changelog:
  - ansible-core 2.15.0 release (rhbz#2204510)
  - update bundled markupsafe to 2.1.2.
  - update bundled packaging to 21.3.
  - update bundled pyparsing to 3.0.7.
  - update bundled resolvelib to 1.0.1.
  - remove six runtime dependency.


author: Dimitri Savineau <dsavinea@redhat.com> - 1:2.14.7-1
changelog:
  - ansible-core 2.14.7 release (rhbz#2221820)
  - rebuild with python 3.9 (rhbz#2221820)
  - remove bundled packaging, pyparsing and resolvelib.


author: Dimitri Savineau <dsavinea@redhat.com> - 1:2.14.9-1
changelog:
  - ansible-core 2.14.9 release (rhbz#2232432)
  - Use docs and examples from ansible-documentation project.
  - Build the manpages.


author: Dimitri Savineau <dsavinea@redhat.com> - 1:2.14.14-1
changelog:
  - ansible-core 2.14.14 release (RHEL-23783)
  - Fix CVE-2024-0690 (possible information leak in tasks that ignore
    ANSIBLE_NO_LOG configuration) (RHEL-22124)


author: Thomas Woerner <twoerner@redhat.com> - 1.8.4-1
changelog:
  - Update to version 1.8.4
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.8.4
    Resolves: RHBZ#2125592
  - 'ansible-doc' -l lists most idm modules as 'UNDOCUMENTED'
    Resolves: RHBZ#2125603
  - ansible-freeipa Replica Install Setup DNS fails
    Resolves: RHBZ#2125616
  - ipaconfig does not support SID and netbios attributes
    Resolves: RHBZ#2069184


author: Thomas Woerner <twoerner@redhat.com> - 1.9.0-1
changelog:
  - Update to version 1.9.0
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.9.0
    Related: RHBZ#2125592
  - pwpolicy: Add support for password check and grace limit
    Resolves: RHBZ#2127911
  - ipaconfig: Do not allow enable_sid set to False
    Resolves: RHBZ#2127446
  - ipaclient: No kinit on controller for deployment using OTP
    Resolves: RHBZ#2127887
  - ipaclient: Configure DNS resolver
    Resolves: RHBZ#2127895
  - New netgroup management module
    Resolves: RHBZ#2127910
  - sudorule: Add support for 'hostmask' parameter
    Resolves: RHBZ#2127913
  - ipaconfig: Fix fail_json calls
    Resolves: RHBZ#2134375
  - ipaconfig: Do not require enable_sid for add_sids or netbios_name
    Resolves: RHBZ#2134505
  - ipaserver: Add missing idstart check
    Resolves: RHBZ#2132731


author: Thomas Woerner <twoerner@redhat.com> - 1.9.1-1
changelog:
  - Update to version 1.9.1
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.9.1
    Resolves: RHBZ#2125592
  - pwpolicy: Allow clearing policy values
    Resolves: RHBZ#2150334
  - Use netgroup_find instead of netgroup_show to workaround IPA bug
    Resolves: RHBZ#2144725


author: Thomas Woerner <twoerner@redhat.com> - 1.9.2-1
changelog:
  - Update to version 1.9.2
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.9.2
    Resolves: RHBZ#2125592
  - ipabackup: Use ipabackup_item again in copy_backup_to_server
    Resolves: RHBZ#2165953


author: Thomas Woerner <twoerner@redhat.com> - 1.10.0-1
changelog:
  - Update to version 1.10.0
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.10.0
    Resolves: RHBZ#2170373
  - ipareplica/server: Enable removal from domain with undeployment
    Resolves: RHBZ#2127903
  - ipagroup: Allow multiple group management
    Resolves: RHBZ#2175763
  - ipaserver: Allow deployments with random serial numbers
    Resolves: RHBZ#2127905
  - ipagroup: Fix ensuring external group members (without trust-ad)
    Resolves: RHBZ#2183822
  - ipaclient: Add subid option to select the sssd profile with-subid
    Resolves: RHBZ#2175767
  - ipaclient: Fix allow_repair with removed krb5.conf and DNS lookup
    Resolves: RHBZ#2127883
  - ipaclient: Keep server affinity while deploying as long as possible
    Resolves: RHBZ#2175757


author: Thomas Woerner <twoerner@redhat.com> - 1.11.0-1
changelog:
  - Update to version 1.11.0
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.11.0
    Resolves: RHBZ#2170373
  - Multiple service management
    Resolves: RHBZ#2175771
  - New ipacert module
    Resolves: RHBZ#2127907
  - Fix maxsequence handling in ipapwpolicy module
    Resolves: RHBZ#2214294


author: Thomas Woerner <twoerner@redhat.com> - 1.11.1-1
changelog:
  - Update to version 1.11.1
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.11.1
    Resolves: RHBZ#2170373
  - ipaautomountmap: add support for indirect maps
    Resolves: RHBZ#2050176
  - ipauser: Add support to modify GECOS field
    Resolves: RHBZ#2169372
  - ipauser: Add support for parameter "street"
    Resolves: RHBZ#2215531
  - ipauser: Add support for SMB attributes
    Resolves: RHBZ#2215533
  - ipauser: Support for External IdP attributes
    Resolves: RHBZ#2215536
  - Fix handling of ipapwpolicy attributes usercheck and dictcheck
    Resolves: RHBZ#2215542
  - Update authtypes authind
    Resolves: RHBZ#2215538


author: Thomas Woerner <twoerner@redhat.com> - 1.12.0-1
changelog:
  - Update to version 1.12.0
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.12.0
    Resolves: RHEL-13744
  - New idoverridegroup management module.
    Resolves: RHEL-16937
  - New idoverrideuser management module.
    Resolves: RHEL-16942
  - New idview management module.
    Resolves: RHEL-16934
  - New idp management module.
    Resolves: RHEL-16939
  - idoverride{user,group}: Fix delete_continue with state absent
    Resolves: RHEL-16680


author: Thomas Woerner <twoerner@redhat.com> - 1.12.1-1
changelog:
  - Update to version 1.12.1
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.12.1
    Resolves: RHEL-13744
  - ipauser module lacks the "rename" field.
    Resolves: RHEL-4962
  - Add missing support for rename in ipagroup module
    Resolves: RHEL-13758
  - The IDP module does not support the modification of IDP options
    Resolves: RHEL-17954
  - The IDP module does not support resetting IDP options
    Resolves: RHEL-17957
  - ipauser is not idempotent when random is defined
    Resolves: RHEL-19123
  - ipasudorule: Allow setting groups for runasuser
    Resolves: RHEL-19130
  - Idempotency fixes
    Resolves: RHEL-19132
  - ipadnszone: Add support for per-zone privilege delegation
    Resolves: RHEL-19134
  - Handle data type or empty string in module_utils
    Resolves: RHEL-19136


author: Thomas Woerner <twoerner@redhat.com> - 1.13.1-1
changelog:
  - Update to version 1.13.1
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.13.0
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.13.1
    Resolves: RHEL-35565
  - New inventory plugin
    Resolves: RHEL-35541
  - Enable batch command as backend
    Resolves: RHEL-38943
  - New collection sub package
    Resolves: RHEL-38931


author: Thomas Woerner <twoerner@redhat.com> - 1.13.2-1
changelog:
  - Update to version 1.13.2
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.13.2
    Resolves: RHEL-35565
  - Convert input certificates
    Resolves: RHEL-44614
  - Fix rolesdeployment with IPA 4.12
    Resolves: RHEL-40869


author: Thomas Woerner <twoerner@redhat.com> - 1.14.0-1
changelog:
  - Update to version 1.14.0
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.14.0
    Resolves: RHEL-67566
  - Multi sudorule management with the ipasudorule module
    Resolves: RHEL-61431


author: Thomas Woerner <twoerner@redhat.com> - 1.14.1-1
changelog:
  - Update to version 1.14.1
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.14.1
    Resolves: RHEL-67566
  - Fix requirements for ansible-core
    Resolves: RHEL-69146


author: Thomas Woerner <twoerner@redhat.com> - 1.14.2-1
changelog:
  - Update to version 1.14.2
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.14.2
    Resolves: RHEL-67566
  - ipareplica: Pass ipareplica_ip_addresses to ipaclient
    Resolves: RHEL-40227
  - ipagroup: Correctly handle externalmember in member actions
    Resolves: RHEL-25009
  - ipasudorule: Evaluate all members related to hosts and users
    Resolves: RHEL-68439
  - ipacert: Correctly handle removFromCRL revocation
    Resolves: RHEL-70016
  - Collection: No more role module duplication
    Resolves: RHEL-71123


author: Thomas Woerner <twoerner@redhat.com> - 1.14.3-1
changelog:
  - Update to version 1.14.3
    Resolves: RHEL-67566
  - Fix management of AD objects for ipagroup
    Resolves: RHEL-25009


author: Thomas Woerner <twoerner@redhat.com> - 1.14.4-1
changelog:
  - Update to version 1.14.4
    Resolves: RHEL-67566
  - Fix management of AD objects for ipagroup
    Resolves: RHEL-25009


author: Thomas Woerner <twoerner@redhat.com> - 1.14.5-1
changelog:
  - Update to version 1.14.5
    Resolves: RHEL-67566
  - ipa* deployment roles: Hotfix for dns_over_tls (Freeipa#7343)
    Resolves: RHEL-78230


author: Thomas Woerner <twoerner@redhat.com> - 1.15.0-1
changelog:
  - Update to version 1.15.0
    Resolves: RHEL-104652
  - ipaclient: Fix AttributeError by defaulting dns_over_tls to False
    Resolves: RHEL-92844
  - Provide compatibility for AAH naming
    Resolves: RHEL-94769
  - Ensure ipaidrange required parameters are correct on recent versions of IPA
    Resolves: RHEL-79820
  - Add support for DNS-over-TLS for ipaclient, ipareplica and ipaserver roles
    Resolves: RHEL-78636


author: Thomas Woerner <twoerner@redhat.com> - 1.15.1-1
changelog:
  - Update to version 1.15.1
    Resolves: RHEL-104652
  - ipaclient: client_dns has new statestore arg with IPA change e6445b8
    Resolves: RHEL-106558


author: Thomas Woerner <twoerner@redhat.com> - 1.16.0-1
changelog:
  - Update to version 1.16.0
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.16.0
    Resolves: RHEL-139144
  - Add suppport for passkey management
    Resolves: RHEL-139257
  - Add suppport for sysaccount management
    Resolves: RHEL-140601
  - ipadnsrecord: Allow to set any IP address if create_reverse is false
    Resolves: RHEL-140607


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1.10.9-15
changelog:
  - Implement new Java bindings and fix ant-manual license
  - Resolves: RHEL-68742, RHEL-68743, RHEL-68744, RHEL-68745, RHEL-69519


author: Neal Gompa <ngompa@centosproject.org> - 0.15.5-2
changelog:
  - Create symlinks manually to make it build
    (the symlinks were not created because of reverting the patch to
    upgrade to Meson 0.62)


author: Neal Gompa <ngompa@centosproject.org> - 0.16.1-1
changelog:
  - Rebase to 0.16.1
    Resolves: rhbz#2169103
  - Drop unneeded downstream hacks to build with older Meson


author: Richard Hughes <richard@hughsie.com> 1:9-20240827
changelog:
  - New metadata version
  - Do not ship fedora-specific files
  - Resolves: #RHEL-4522
  - Resolves: #RHEL-19012


author: Omair Majid <omajid@redhat.com> - 10.0.100~rc.2.25502.107-0.10
changelog:
  - Update to .NET SDK 10.0.100-rc.2.25502.107 and Runtime 10.0.0-rc.2.25502.107
  - Resolves: RHEL-121559


author: Tom Deseyn <tom.deseyn@gmail.com> - 8.0.103-3
changelog:
  - We disable checking the signature of the last certificate in a chain if the certificate is supposedly self-signed.
    A side effect of not checking the self-signature of such a certificate is that disabled or unsupported message
    digests used for the signature are not treated as fatal errors.
  - Resolves: RHEL-28344


author: Kalev Lember <klember@redhat.com> - 2.28.1-1
changelog:
  - Update to 2.28.1
  - Switch to meson build system
  - Update source URLs
  - Tighten -devel subpackage deps
  - Tighten soname globs


author: Jakub Martisko <jamartis@redhat.com> - 3.10.3.13
changelog:
  - Sync with rhel 8.3 + cleanup
  - Add new subpackages - z{14,15}
  - Unlike in rhel8, the base subpackage still needs to be build for z12.
  - Covscan related bugfixes
  - Spec and git cleanup (remove unused patches/sources)


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-100
changelog:
  - New upstream release, 3.0.7
    Resolves: rhbz#2019929 - capability=unknown-capability(39) in audit messages


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-101
changelog:
  - Adjust sample-rules dir permissions
    Resolves: rhbz#2054432 - /usr/share/audit/sample-rules is no longer readable by non-root users


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-102
changelog:
  - Fix path normalization in auparse
    Resolves: rhbz#2062824 - auparse missing information when used with --format-text


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-103
changelog:
  - Drop ProtectHome from auditd.service as it interferes with rules
    Resolves: rhbz#2071725 - Default systemd service config blocks audit watch rules in some directories [rhel-9.1.0]


author: Sergio Correia <scorreia@redhat.com> - 3.1.2-2
changelog:
  - Remove 
   
  if [ $1 -eq 0 ] && [ -x "/usr/lib/systemd/systemd-update-helper" ]; then 
          /usr/lib/systemd/systemd-update-helper remove-system-units from %preun scriptlet, as it was causing troubles when removing audit || : 
  fi 

    Related: RHEL-14896


author: Attila Lakatos <alakatos@redhat.com> - 3.1.5-1
changelog:
  - New upstream maintenance release, 3.1.4
  - Prevent scriplets from failing
  - When upgrading, restart the daemon if it's running
  - If uninstalling, stop the daemon
  - auditctl: use pidfd_send_signal for signaling auditd
    Resolves: RHEL-45865
  - Minor doc update
    Resolves: RHEL-5186
  - augenrules: do not exit with failure if in immutable mode
    Resolves: RHEL-40110
  - auditd.service: Disable ProtectControlGroups
    Resolves: RHEL-5197
  - auditctl: correct output when displaying rules with exe/path/dir
    Resolves: RHEL-40243


author: Attila Lakatos <alakatos@redhat.com> - 3.1.5-2
changelog:
  - Disable ProtectKernelModules=true in service file
    Resolves: RHEL-59570
  - af_unix plugin: restore original behavior in binary mode
    Resolves: RHEL-59585
  - Support image mode
    Resolves: RHEL-69033
  - Resolve ordering cycle when using remote logging
    Resolves: RHEL-11252
  - Filter syscalls to ensure architecture-specific availability
    Resolves: RHEL-70455


author: Attila Lakatos <alakatos@redhat.com> - 3.1.5-5
changelog:
  - ausearch: correct search for DAEMON related events
  - allow hex digits when interpreting tty data
    Resolves: RHEL-82279
  - Fix TTY hostname in log messages
    Resolves: RHEL-78323


author: Richard W.M. Jones <rjones@redhat.com> - 1.13.0-2
changelog:
  - Parse auto_reset_crashkernel in kdump
    resolves: rhbz#2042772
  - Add new directives and options for chrony


author: Richard W.M. Jones <rjones@redhat.com> - 1.13.0-4
changelog:
  - Fix parsing of /usr/lib/tmpfiles.d/provision.conf
  - Fix parsing of /etc/kernel/cmdline
    resolves: rhbz#2155136, rhbz#2159282


author: Pavel Březina <pbrezina@redhat.com> - 1.2.5-1
changelog:
  - Rebase to 1.2.5 (RHBZ #2080239)
  - backup-restore now works correctly (RHBZ #2070541)
  - add with-subid to sssd profile (RHBZ #2075192)
  - add with-gssapi to sssd profile (RHBZ #2077893)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.6-1
changelog:
  - Rebase to 1.2.6 (RHBZ #2142805)
  - update translations (RHBZ #2139642)
  - Change password hashing algorithm from yescrypt back to sha512 (RHBZ #2151145)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.6-2
changelog:
  - Fix Japanese translations (RHBZ #2153364)
  - Update translations (RHBZ #2189498)
  - Do not prompt for password twice when changing password of local user (RHBZ #2228098)


author: Frederic Berat <fberat@redhat.com> - 2.71-4
changelog:
  - Cherry-pick: Fix typo in variable name (#2132715)
  - Backport: Fix testsuite failures with bash 5.2


author: Caolán McNamara <caolanm@redhat.com> - 1:7.1.8.1-8
changelog:
  - Resolves: rhbz#2134759 Untrusted Macros
  - Resolves: rhbz#2134757 Weak Master Keys
  - Resolves: rhbz#2134755 Static Initialization Vector
  - Resolves: rhbz#2134761 Macro URL arbitrary script execution


author: Stephan Bergmann <sbergman@redhat.com> - 1:7.1.8.1-11
changelog:
  - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula
    Parsing
  - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded
    without prompt via IFrame
  - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write


author: Eduard Abdullin <eabdullin@almalinux.org> - 1:7.1.8.1-12.alma
changelog:
  - escape url passed to gstreamer
  - add some protocols that don't make sense as floating frame
   targets
  - warn about exotic protocols as well
  - default to ignoring libreoffice special-purpose protocols
   in calc hyperlink
  - reuse AllowedLinkProtocolFromDocument in writer
  - reuse AllowedLinkProtocolFromDocument in impress/draw
  - CVE-2023-6186 backporting


author: Tomas Popela <tpopela@redhat.com> - 1:7.1.8.1-15.el9_8.1
changelog:
  - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of
    the spec has
  - Resolves: RHEL-176576


author: Tomas Popela <tpopela@redhat.com> - 1:7.1.8.1-15.el9_8.2
changelog:
  - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in
    formula compilation
  - Resolves: RHEL-186062


author: Michal Sekletar <msekleta@redhat.com> - 0.8-21
changelog:
  - fix file attributes on /run/avahi-daemon (RHEL-5633)
  - avahi-client: fix resource leak (RHEL-27722)
  - fix resource leak in avahi_time_event_queue_new (RHEL-27717)


author: Pavel Cahyna <pcahyna@redhat.com> - 11.0.1-5
changelog:
  - Make nagios-plugin build conditional and disabled on RHEL to avoid
    generating this subpackage that has missing dependencies
  - Fix flags for annobin in Qt tools (bat & tray-monitor) build
  - Add a forgotten RHEL 8 patch to use openssl crypto (random numbers, hmac,
    hashing functions)
    Resolves: rhbz#1935458


author: Jerome Marchand <jmarchan@redhat.com> - 0.26.0-3
changelog:
  - Rebuild with LLVM 16 (rhbz#2050112)
  - Fix compactsnoop (rhbz#2042236)
  - Fix killsnoop documentation (rhbz#2075500)
  - Fix funcslower (rhbz#2075415)
  - Fix deadlock memory usage issue (rhbz#2050112)
  - Fix nfsslower (rhbz#2180934)
  - Use upstream fix for nfsslower unititialized struct issue


author: Jerome Marchand <jmarchan@redhat.com> - 0.28.0-1
changelog:
  - Rebase to v0.28.0 (RHEL-9976)
  - Rebuild with LLVM 17 (RHEL-10591)
  - Fix bpf-biosnoop out of bound access (RHEL-8664)
  - Fix kvmexit missing VM exit reasons and statistics (RHEL-8702)
  - Fix multi-word array type handling (RHEL-8674)
  - Fix tcpstates -Y (RHEL-8490)
  - Fix bio tools (RHEL-8553)


author: Jerome Marchand <jmarchan@redhat.com> - 0.28.0-5
changelog:
  - Fix libbpf bio tools (RHEL-19368)
  - Add S390x support to libbpf-tools (RHEL-16325)
  - Power enhancements(RHEL-11477)


author: Jerome Marchand <jmarchan@redhat.com> - 0.30.0-3
changelog:
  - Really prevent the loading of compromised headers (RHEL-28769, CVE-2024-2314)
  - Add python3-pyelftools dependency (RHEL-36583)


author: Jerome Marchand <jmarchan@redhat.com> - 0.34.0-1
changelog:
  - Rebase to version 0.34.0 (RHEL-78920)
  - Rebuild with LLVM 20 (RHEL-81773)
  - Fix biosnoop pattern option (RHEL-90848)
  - Fix bpf-klockstat on aarch64 and ppc64le (RHEL-78619)
  - Remove unsupported bpf-bcachefs* and bpf-zfs* tools (RHEL-78166)
  - Remove unsupported slaratetop tool (RHEL-78162)


author: Petr Menšík <pemensik@redhat.com> - 32:9.16.23-16
changelog:
  - Prevent increased CPU load on large DNS messages (CVE-2023-4408)
  - Prevent assertion failure when nxdomain-redirect is used with
   RFC 1918 reverse zones (CVE-2023-5517)
  - Prevent assertion failure if DNS64 and serve-stale is used (CVE-2023-5679)
  - Specific recursive query patterns may lead to an out-of-memory
    condition (CVE-2023-6516)
  - Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387
    CVE-2023-50868)


author: Petr Menšík <pemensik@redhat.com> - 32:9.16.23-18.2
changelog:
  - Resolve CVE-2024-1975
  - Resolve CVE-2024-1737
  - Resolve CVE-2024-4076
  - Add ability to change runtime limits for max types and records per name


author: Petr Menšík <pemensik@redhat.com> - 32:9.16.23-31.1
changelog:
  - Prevent cache poisoning due to weak PRNG (CVE-2025-40780)
  - Address various spoofing attacks (CVE-2025-40778)


author: Petr Menšík <pemensik@redhat.com> - 32:9.16.23-34.1
changelog:
  - Prevent cache poisoning due to weak PRNG (CVE-2025-40780)
  - Replace downstream fixes with upstream changes
  - Address various spoofing attacks (CVE-2025-40778)


author: Eduard Abdullin <eabdullin@almalinu.org> - 11.9-9.alma.1
changelog:
  * Thu Feb 22 2024 Petr Menšík <pemensik@redhat.com> - 11.9-9
  - Rebuild required for BIND changes for KeyTrap change (CVE-2023-50387)


author: Petr Menšík <pemensik@redhat.com> - 32:9.18.27-2
changelog:
  - Disable building of DLZ packages
  - Conflict explicitly with more bind subpackages
  - Merge license subpackage into libs


author: Alex Burmashev <alexander.burmashev@oracle.com> - 32:9.18.29-1.el9_5.1
changelog:
  - Fix CVE-2024-11187 bind: bind9: Many records in the additional section cause CPU exhaustion
  - Fix CVE-2024-12705 bind: bind9: DNS-over-HTTPS implementation suffers from multiple issues under heavy query load


author: Petr Menšík <pemensik@redhat.com> - 32:9.18.29-6
changelog:
  - Refuse malformed DNSKEY records (CVE-2025-8677)
  - Address various spoofing attacks (CVE-2025-40778)
  - Prevent cache poisoning due to weak PRNG (CVE-2025-40780)


author: Petr Menšík <pemensik@redhat.com> - 32:9.18.29-7
changelog:
  - Fix upstream reported regression in recent CVE fix (CVE-2025-8677)
  - Add upstream created test to this regression


author: Petr Menšík <pemensik@redhat.com> - 32:9.18.29-2
changelog:
  - Backport nsupdate TLS support into 9.18 (RHEL-76331)
  - Update nsupdate manual about new TLS options
  - Test nsupdate TLS support


author: Petr Menšík <pemensik@redhat.com> - 32:9.18.29-3
changelog:
  - Limit additional section records CPU processing (CVE-2024-11187)
  - Read HTTPS requests in limited chunks and prevent overload (CVE-2024-12705)


author: Yara Ahmad <yahmad@redhat.com> - 2.35.2-40
changelog:
  - Fix an illegal memory access when parsing an ELF file containing corrupt symbol version information.  (#2164701)


author: Nick Clifton <nickc@redhat.com> - 2.35.2-51
changelog:
  - Backport commit 88141209e25ce19473ec07d7aac09cc68f06a630 to fix stripping lld linked binaries.  (RHEL-50536)


author: Nick Clifton <nickc@redhat.com> - 2.35.2-52
changelog:
  - Backport commit 6fde04116b4b to stop objcopy from crashing when copying non-PE binaries into a PE output.  (RHEL-48882)


author: Nick Clifton <nickc@redhat.com> - 2.35.2-53
changelog:
  - Backport commit bc5baa9f13ff to ensure that objcopy does not loose the minimum section alignment for PE binaries.  (RHEL-30268)


author: Nick Clifton <nickc@redhat.com> - 2.35.2-55
changelog:
  - Add linker error/warning messages for executable stacks and RWX segments.  (RHEL-59801, RHEL-59802)


author: Nick Clifton <nickc@redhat.com> - 2.35.2-61
changelog:
  - Add an option to objcopy that creates padding sections that eliminate gaps between segments.  (RHEL-60807)


author: Nick Clifton <nickc@redhat.com> - 2.35.2-67
changelog:
  - Adds tests for the linker's --error-execstack and --error-rwx-segments command line options.  (RHEL-109970)


author: Peng Wu <pwu@redhat.com> - 0.3-33
changelog:
  - Provide OpenType Bitmap fonts
  - Use bitmapfonts2otb.py to combine bitmap fonts
  - Add bitmap-*-opentype-fonts sub packages


author: Jakub Martisko <jamartis@redhat.com> - 3.9.0-13
changelog:
  - Add explicit requires to the devel subpackages
  - Note: the the cblas64 seems to be linked against the libblas (not the 64 version)
  - this is not a regression, however in the Fedora it uses libblas64 instead.
  - Resolves: RHEL-5768


author: Vojtech Trefny <vtrefny@redhat.com> - 3.6.0-7
changelog:
  - Fix setting kickstart data
    Resolves: rhbz#2174296
  - Do not set memory limit for LUKS2 when running in FIPS mode
    Resolves: rhbz#2193096


author: Jan Pokorny <japokorn@redhat.com> - 3.6.0-9
changelog:
  Backport iSCSI initiator name related fixes:
  - Allow changing iSCSI initiator name after setting it
    Resolves: rhbz#2221935
  - Add a basic test case for the iscsi module
    Resolves: rhbz#2221935
  - tests: Use blivet-specific prefix for targetcli backing files
    Resolves: rhbz#2221935
  - iscsi: Save firmware initiator name to /etc/iscsi/initiatorname.iscsi
    Resolves: rhbz#2221932
  - tests: Improve iscsi_test.ISCSITestCase
    Resolves: rhbz#2221935


author: Tomas Bzatek <tbzatek@redhat.com> - 3.6.0-10
changelog:
  - nvme: Require additional rpms for dracut
    Resolves: RHEL-2855
  - nvme: Align HostNQN and HostID format to TP-4126
    Resolves: RHEL-1254


author: Tomas Bzatek <tbzatek@redhat.com> - 3.6.0-11
changelog:
  - nvme: Retrieve HostNQN from a first active fabrics connection
  - tests: Add a simple unit test for the NVMe module
    Resolves: RHEL-11541


author: Vojtech Trefny <vtrefny@redhat.com> - 3.6.0-14
changelog:
  - Do not add new PVs to the LVM devices file if it doesn't exist and VGs are present
    Resolves: RHEL-473


author: Vojtech Trefny <vtrefny@redhat.com> - 3.6.0-15
changelog:
  - Backport fixes for Stratis support needed for storage role
    Resolves: RHEL-35382
  - Add support for resizing PVs to the size of the underlying block device
    Resolves: RHEL-35386


author: Vojtech Trefny <vtrefny@redhat.com> - 3.6.0-18
changelog:
  - Add a basic read-only support for UDF filesystem
    Resolves: RHEL-13329
  - nvme: Skip startup/write when NVMe plugin isn't available
    Resolves: RHEL-28124


author: Vojtech Trefny <vtrefny@redhat.com> - 3.6.0-25
changelog:
  - Get the actual PV format size for LVMPV format
    Resolves: RHEL-74078
  - Include additional information in PartitioningError
    Resolves: RHEL-8005


author: Vojtech Trefny <vtrefny@redhat.com> - 3.6.0-26
changelog:
  - Make ActionDestroyFormat optional when the device is also scheduled to be removed
    Resolves: RHEL-8008
    Resolves: RHEL-8012


author: Hans de Goede <hdegoede@redhat.com> - 5.56-3
changelog:
  - Drop obsolete udev rule + systemd service to call btattach on BT-HCIs
    connected via UART from userspace, this is all handled in the kernel now
  - Add the btmgmt util to the packaged files


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.18-27
changelog:
  - Backport upstream PR 120 to fix segfault on invalid unit types
    Resolves: rhbz#2224578
  - Add vendor ID for NVIDIA BMCs
    Resolves: rhbz#2218358
  - Update /var/run to /run in ipmievd.service that systemd warns about
    Resolves: rhbz#2100475
  - Add upstream ipmievd patch to check received msg id against expectation
    Fixes problem where SEL response is not recognized correctly
    when SEL request times out
    Resolves: rhbz#2224569


author: Adrian Reber <adrian@lisas.de> - 1.2.5-1
changelog:
  - Updated to 1.2.5
  - No longer necessary to re-package sources: All problematic files have
    been re-licensed
  - All 19 patches are part of the 1.2.5 release and have been removed


author: Bryan Gurney <bgurney@redhat.com> - 1.6.1-2
changelog:
  - Add issues resolved by release 1.6.1
  - Resolves: RHEL-36001
  - Resolves: RHEL-36664
  - Resolves: RHEL-36667
  - Resolves: RHEL-36691


author: Patrick Palka <ppalka@redhat.com> - 1.75.0-9
changelog:
  - Apply upstream Boost.Asio patch to resolve RHEL-67973
  - Fix %patch directive compatibility with RPM 4.20


author: Jonathan Wakely <jwakely@redhat.com> - 1.75.0-7
changelog:
  - Build with zstd support (#2091041)
  - Fix rpminspect CI warnings about missing versioned dependencies


author: Colin Walters <walters@verbum.org> - 1.12.1-1
changelog:
  - Update to 1.12.1
  - Fix mount point check regression breaking bootc-image-builder
  - Resolves: RHEL-142112


author: Colin Walters <walters@verbum.org> - 1.13.0-1
changelog:
  - Update to 1.13.0
  - https://github.com/bootc-dev/bootc/releases/tag/v1.13.0
  - Resolves: RHEL-151443


author: Colin Walters <walters@verbum.org> - 0.2.11-2
changelog:
  - https://github.com/coreos/bootupd/releases/tag/v0.2.11
    Resolves: https://issues.redhat.com/browse/RHEL-5273


author: Colin Walters <walters@verbum.org> - 0.2.15-2
changelog:
  - https://github.com/coreos/bootupd/releases/tag/v0.2.15
    Related: https://issues.redhat.com/browse/RHEL-14388


author: Joseph Marrero <jmarrero@fedoraproject.org> - 0.2.18-1
changelog:
  - https://github.com/coreos/bootupd/releases/tag/v0.2.18
    backport patch to support GRUB console.cfg
    Resolves: RHEL-26439


author: Viktor Malik <vmalik@redhat.com> - 0.16.0-1
changelog:
  - Rebase on bpftrace 0.16.0 (rhbz#2121920)
  - Rebuild for LLVM 15 (rhbz#2118995)
  - Download the cereal library (not packaged into RHEL9)
  - Fixed several tools (rhbz#1975148, rhbz#2088577, rhbz#2128208, rhbz#2073675,
    rhbz#2073770)
  - Resolve conflicts between bpftrace and bcc manpages (rhbz#2075076)


author: Viktor Malik <vmalik@redhat.com> - 0.16.0-2
changelog:
  - Fix missing kprobe attachpoints for bio* tools (s390x, ppc64le)
  - Rebuild for libbpf 1.0.0
  - Resolves: rhbz#2157829
  - Related: rhbz#2157592


author: Viktor Malik <vmalik@redhat.com> - 0.17.0-1
changelog:
  - Rebase on bpftrace 0.17.0 (RHEL-286)
  - Fix runqlat.bt, tcpdrop.bt, and undump.bt on aarch64 (rhbz#2170838)


author: Viktor Malik <vmalik@redhat.com> - 0.19.1-1
changelog:
  - Rebase on bpftrace 0.19.1 (RHEL-10693)
  - Rebuild for LLVM 17 (RHEL-10592)
  - Enhancements and fixes for PowerPC (RHEL-3690, RHEL-11476)


author: Viktor Malik <vmalik@redhat.com> - 0.20.3-1
changelog:
  - Rebase on bpftrace 0.20.3 (RHEL-30779)
  - Fix CVE allowing unprivileged users loading of compromised linux headers
    (RHEL-28765, CVE-2024-2313)
  - Fix bpftrace creating BPF programs with truncated names (RHEL-8502)


author: Viktor Malik <vmalik@redhat.com> - 0.20.4-1
changelog:
  - Rebase on bpftrace 0.20.4
  - Fix CVE allowing unprivileged users loading of compromised linux headers
    (RHEL-28765, CVE-2024-2313)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 6.1-8
changelog:
  - Dropped explicit brlapi dependency (brltty) and relaxed brltty
    dependency (brlapi)
    Related: rhbz#1765611


author: Jindrich Novy <jnovy@redhat.com> - 2:1.33.5-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.33
    (https://github.com/containers/buildah/commit/70b792d)
  - Related: RHEL-2112


author: Jindrich Novy <jnovy@redhat.com> - 2:1.33.6-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.33
    (https://github.com/containers/buildah/commit/f843563)
  - Related: RHEL-2112


author: Jindrich Novy <jnovy@redhat.com> - 2:1.33.7-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.33
    (https://github.com/containers/buildah/commit/b95e962)
  - Resolves: RHEL-28230


author: Jindrich Novy <jnovy@redhat.com> - 2:1.33.7-2
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.33
    (https://github.com/containers/buildah/commit/997beea)
  - Resolves: RHEL-28731


author: Jindrich Novy <jnovy@redhat.com> - 2:1.33.7-5
changelog:
  - rebuild to address CVE-2024-34155 CVE-2024-34156 CVE-2024-34158
  - Resolves: RHEL-58191 RHEL-57972 RHEL-57910


author: Jindrich Novy <jnovy@redhat.com> - 2:1.33.9-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.33
    (https://github.com/containers/buildah/commit/4dc26b9)
  - Resolves: RHEL-61116


author: Jindrich Novy <jnovy@redhat.com> - 2:1.33.10-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.33
    (https://github.com/containers/buildah/commit/bd85c17)
  - Resolves: RHEL-61842


author: Lokesh Mandvekar <lsm5@redhat.com> - 1:1.33.1-3
changelog:
  - Rebuild for CVEs:
    CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322
  - Related: Jira:RHEL-2779


author: Jindrich Novy <jnovy@redhat.com> - 2:1.37.0-1
changelog:
  - update to https://github.com/containers/buildah/releases/tag/v1.37.0
  - Resolves: RHEL-47164 RHEL-40808


author: Jindrich Novy <jnovy@redhat.com> - 2:1.37.6-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.37
    (https://github.com/containers/buildah/commit/fd39521)
  - Resolves: RHEL-67617


author: Jindrich Novy <jnovy@redhat.com> - 2:1.37.5-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.37
    (https://github.com/containers/buildah/commit/f31d99d)
  - Resolves: RHEL-61148


author: Jindrich Novy <jnovy@redhat.com>
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.37
    (https://github.com/containers/buildah/commit/c060201)
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 2:1.39.4-2
changelog:
  - rebuild to fix CVE-2025-22871 buildah: Request smuggling due to acceptance of invalid chunked data in net/http
  - Resolves: RHEL-89294


author: Jindrich Novy <jnovy@redhat.com> - 2:1.41.4-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.41
    (https://github.com/containers/buildah/commit/ee5b574)
  - fixes "buildah: create parent directories of mount targets with mode 0755 - [RHEL-9.7]  0day"
  - Resolves: RHEL-115166


author: Jindrich Novy <jnovy@redhat.com> - 2:1.41.6-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.41
    (https://github.com/containers/buildah/commit/2ece502)
  - fixes "[Minor Incident] CVE-2025-52881 buildah: container escape and denial of service due to arbitrary write gadgets and procfs write redirects [rhel-9.7.z]"
  - Resolves: RHEL-126925


author: Jindrich Novy <jnovy@redhat.com> - 2:1.41.7-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.41
    (https://github.com/containers/buildah/commit/e363f79)
  - fixes "Bump to runc v1.2.9 or v1.3.4 to get CVE and regression fixes - Buildah [rhel-9.7.z]"
  - Resolves: RHEL-132846


author: Jindrich Novy <jnovy@redhat.com> - 2:1.41.8-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.41
    (https://github.com/containers/buildah/commit/f85ff89)
  - fixes "CVE-2025-47913 buildah: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS [rhel-9.7.z]"
  - Resolves: RHEL-134792


author: Jindrich Novy <jnovy@redhat.com> - 2:1.43.0-3
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.43
    (https://github.com/containers/buildah/commit/bbc4bd1)
  - Resolves: RHEL-95964


author: Jindrich Novy <jnovy@redhat.com> - 2:1.43.1-1
changelog:
  - update to https://github.com/containers/buildah/releases/tag/v1.43.1
  - fixes CVE-2026-34986
  - Resolves: RHEL-165035


author: Jindrich Novy <jnovy@redhat.com> - 2:1.43.1-3
changelog:
  - bump golang.org/x/crypto to v0.53.0 to fix CVE-2026-39832 and CVE-2026-39835
  - Resolves: RHEL-188733 RHEL-190066


author: Jerry James <loganjerry@gmail.com> - 1.10.14-1
changelog:
  - Version 1.10.14
  - Remove no longer needed no-unixsocket.patch
  - Add workaround for compiling tests with JDK 11


author: Jayashree Huttanagoudar <jhuttana@redhat.com> - 4.0.11-1
changelog:
  - Upgrated to latest upstream version 4.0.11
  - Added a patch to fix rpm build issue caused due to misconfiguration in upstream
  - Added required additional plugins required for build


author: Alexey Tikhonov <atikhono@redhat.com> - 1.17.1-5
changelog:
  - Resolves: rhbz#2014523 - c-ares: missing input validation of host names may lead to Domain Hijacking [rhel-9]


author: Alexey Tikhonov <atikhono@redhat.com> - 1.17.1-6
changelog:
  - Resolves: rhbz#2170868 - c-ares: buffer overflow in config_sortlist() due to missing string length check [rhel-9]


author: Alexey Tikhonov <atikhono@redhat.com> - 1.19.1-1
changelog:
  - Resolves: rhbz#2209564 - CVE-2023-31124 c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation [rhel-9]
  - Resolves: rhbz#2209556 - CVE-2023-31130 c-ares: Buffer Underwrite in ares_inet_net_pton() [rhel-9]
  - Resolves: rhbz#2209550 - CVE-2023-31147 c-ares: Insufficient randomness in generation of DNS query IDs [rhel-9]
  - Resolves: rhbz#2209520 - CVE-2023-32067 c-ares: 0-byte UDP payload Denial of Service [rhel-9.3.0]
  - Resolves: rhbz#2210370 - Rebase c-ares for RHEL 9.3


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.14.2-3
changelog:
  - Switch from autotools to meson; enable the tests, since the meson build system
    permits us to use a shared boost library
  - Install examples in the -doc subpackage


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.14.2-4
changelog:
  - Prepare for future upgrade to API/ABI version 1.16 by introducing virtual
    Provides for a name for API/ABI version 1.0: cairomm1.0. This will be the name
    of a future package that continues to provide API/ABI version 1.0 after the
    upgrade.


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.14.2-7
changelog:
  - Working (but weak, dependent on SHA1) source signature verification
  - Added API/ABI version to descriptions


author: Jon Maloy <jmaloy@redhat.com> - 4.0.2-11
changelog:
  - Fix CVE-2025-68114 (memory corruption) and CVE-2025-67873 (heap buffer overflow)
    Resolves: RHEL-137758


author: Jon Maloy <jmaloy@redhat.com> - 4.0.2-11
changelog:
  - Fix CVE-2025-68114 (memory corruption) and CVE-2025-67873 (heap buffer overflow)
    Resolves: RHEL-137760


author: Josh Stone <jistone@redhat.com> - 1.71.0-2
changelog:
  - Relax the suspicious_double_ref_op lint (rhbz2225471)
  - Enable the profiler runtime for native hosts (rhbz2213875)


author: Andreas Schneider <asn@redhat.com> - 0.3.12-1
changelog:
  - Update to version 0.3.12
  - resolves: RHEL-121734
  - Added channel binding support
  - resolves: RHEL-103417


author: Ding-Yi Chen <dchen@redhat.com> - 0.3.5-6
changelog:
  - Review comment #16 addressed
  - It make more sense that -selinux and -certmonger depends on main package,
    Not the other round
  - Recommends: logrotate
  - Supplements: -selinux, -certmonger


author: Rob Crittenden <rcritten@redhat.com> - 0.79.14-6
changelog:
  - Certificate format validation when adding the SCEP server's CA
    (#1492112)
  - Replace some SHA1 usages with SHA256 in the unit tests


author: <thalman@redhat.com> - 0.6.1-16
changelog:
  - CVE-2023-37464 cjose: AES GCM decryption uses the Tag length from the actual
    Authentication Tag provided in the JWE
    Resolves: rhbz#2223308


author: Konrad Kleine <kkleine@redhat.com> - 19.1.5-1
changelog:
  - Update to 19.1.5
  - Enable LLVM_ENABLE_ZSTD (rhbz#2321848)
  - Remove HTML documentation
  - Add lldb man pages
  - Fix profiling after a binutils NOTE change (rhbz#2322754)
  - Install i386 config files on x86_64


author: Kashyap Chamarthy <kchamart@redhat.com> - 20.1.7-2
changelog:
  - Add riscv64 enablement bits; thanks: Songsong Zhang
     (U2FsdGVkX1@gmail.com) and David Abdurachmanov (davidlt@rivosinc.com)


author: Tom Stellard <tstellar@redhat.com> - 20.1.8-2
changelog:
  - Backport fix for pgo optimized rust toolchain on ppc64le (rhbz#2382683)
  - Backport fix for crbit spill miscompile on ppc64le power9 and power10 (rhbz#2383037)
  - Backport fix for build of highway package on ppc64le (rhbz#2383182)


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-11
changelog:
  - ci-fix-Always-use-single-datasource-if-specified-5098.patch [RHEL-36255]
  - Resolves: RHEL-36255
    ([rhel-9.5] DataSourceNoCloudNet not configurable via config files)


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-12
changelog:
  - ci-fix-cloudstack-Use-parsed-lease-file-for-virtual-rou.patch [RHEL-40217]
  - Resolves: RHEL-40217
    ([Cloud-init] CloudstackDataSource cannot work with NetworkManager)


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-13
changelog:
  - ci-feat-sysconfig-Add-DNS-from-interface-config-to-reso.patch [RHEL-17961]
  - ci-fix-jsonschema-Add-missing-sudo-definition-5418.patch [RHEL-44337]
  - ci-doc-update-examples-to-reflect-alternative-ways-to-p.patch [RHEL-44337]
  - ci-fix-dhcp-Guard-against-FileNotFoundError-and-NameErr.patch [RHEL-44598]
  - ci-fix-Address-TIOBE-abstract-interpretation-issues-486.patch [RHEL-44598]
  - ci-Update-pylint-version-to-support-python-3.12-5338.patch [RHEL-44598]
  - Resolves: RHEL-17961
    ([RHEL-9] cloud-init fails to configure DNS search domains)
  - Resolves: RHEL-44337
    ([rhel-9] fix `SUDO` configuration schema for users and groups)
  - Resolves: RHEL-44598
    (fix pylint error and support python 3.12)


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-14
changelog:
  - ci-Deprecate-the-users-ssh-authorized-keys-property-516.patch [RHEL-45262]
  - ci-docs-Add-deprecated-system_info-to-schema-5168.patch [RHEL-45262]
  - ci-fix-schema-permit-deprecated-hyphenated-keys-under-u.patch [RHEL-45262]
  - Resolves: RHEL-45262
    (Deprecate the users ssh-authorized-keys property and permit deprecated hyphenated keys under users key)


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-15
changelog:
  - ci-Support-metalink-in-yum-repository-config-5444.patch [RHEL-44916]
  - ci-fix-vmware-Set-IPv6-to-dhcp-when-there-is-no-IPv6-ad.patch [RHEL-46194]
  - Resolves: RHEL-44916
    ([RFE] Support metalink in yum repository config)
  - Resolves: RHEL-46194
    ([RHEL-9] It leaves the ipv6 networking config as blank in NM keyfile when config dhcp ipv6 with customization spec)


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-16
changelog:
  - ci-fix-add-schema-rules-for-baseurl-and-metalink-in-yum.patch [RHEL-46873]
  - Resolves: RHEL-46873
    (Suggest to update schema to support metalink)


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-17
changelog:
  - ci-fix-Clean-cache-if-no-datasource-fallback-5499.patch [RHEL-49736]
  - ci-Support-setting-mirrorlist-in-yum-repository-config-.patch [RHEL-49674]
  - Resolves: RHEL-49736
    ([Cloud-init] [RHEL-9] Password reset feature broken with CloudstackDataSource)
  - Resolves: RHEL-49674
    (Support setting mirrorlist in yum repository config)


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-18
changelog:
  - ci-Revert-fix-vmware-Set-IPv6-to-dhcp-when-there-is-no-.patch [RHEL-54373]
  - Resolves: RHEL-54373
    ([RHEL9]Revert "fix(vmware): Set IPv6 to dhcp when there is no IPv6 addr (#5471)")


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-19
changelog:
  - ci-fix-Add-subnet-ipv4-ipv6-to-network-schema-5191.patch [RHEL-54686]
  - Resolves: RHEL-54686
    ([RHEL-9.5] cloud-init schema validation fails.)


author: Eduard Abdullin <eabdullin@almalinux.org> - 23.4-19.el9_5.4.alma.1
changelog:
  - Fix import error for passlib on Python 3.13
   (#4669)
  - Fix metric setting for ifcfg network connections for rhel
   (#5777)
  - fix: Render bridges correctly for v2 on sysconfig with
   set-name (#5674)
  - fix: Render v2 bridges correctly on network-manager with
   set-name (#5740)
  - Prevent NM from handling DNS when network interfaces have DNS
   config (#5846)
  - refactor: Ensure internal DNS state same for v1 and v2
   (#4756)


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-19.el9_5.1
changelog:
  - ci-Fix-metric-setting-for-ifcfg-network-connections-for.patch [RHEL-65018]
  - ci-fix-python3.13-Fix-import-error-for-passlib-on-Pytho.patch [RHEL-65018]
  - Resolves: RHEL-65018
    (Configuring metric for default gateway is not working [rhel-9.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-19.el9_5.2
changelog:
  - ci-fix-Render-bridges-correctly-for-v2-on-sysconfig-wit.patch [RHEL-65021]
  - ci-fix-Render-v2-bridges-correctly-on-network-manager-w.patch [RHEL-65021]
  - Resolves: RHEL-65021
    (NoCloud - network_config bridges incorrectly configured [rhel-9.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-19.el9_5.3
changelog:
  - ci-Prevent-NM-from-handling-DNS-when-network-interfaces.patch [RHEL-65778]
  - Resolves: RHEL-65778
    ([RHEL-9] Prevent NM from handling DNS when network interfaces have DNS config [rhel-9.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-19.el9_5.4
changelog:
  - ci-refactor-Ensure-internal-DNS-state-same-for-v1-and-v.patch [RHEL-68409]
  - Resolves: RHEL-68409
    (cloud-init fails to configure DNS and search domain [rhel-9.5.z])


author: Jon Maloy <jmaloy@redhat.com> - 23.4-19.el9_5.5
changelog:
  - ci-fix-nocloud-smbios-datasource-definition.patch [RHEL-79774]
  - Resolves: RHEL-79774
    ([RHEL 9] Backport support for smbios datasource definition [rhel-9.5.z])


author: Jon Maloy <jmaloy@redhat.com> - 23.4-19.el9_5.6
changelog:
  - ci-fix-rh_subscription-add-string-type-to-org-5453.patch [RHEL-81163]
  - Resolves: RHEL-81163
    (Cloud-init fails to subscribe system if activation key 'org' is not an integer [rhel-9.5.z])


author: Camilla Conte <cconte@redhat.com> - 23.4-2
changelog:
  - 0003-Setting-autoconnect-priority-setting-for-network-scr.patch [RHEL-18313]
  - Resolves: RHEL-18313


author: Camilla Conte <cconte@redhat.com> - 23.4-3
changelog:
  - 0004-net-network_manager-do-not-set-may-fail-to-False-for.patch [RHEL-21629]
  - 0005-net-allow-dhcp6-configuration-from-generate_fallback.patch [RHEL-21629]
  - Resolves: RHEL-21629
  - 0006-net-nm-check-for-presence-of-ifcfg-files-when-nm-con.patch [RHEL-17609]
  - Resolves: RHEL-17609
  - 0007-test-jsonschema-Pin-jsonschema-version-4781.patch


author: Camilla Conte <cconte@redhat.com> - 23.4-4
changelog:
  - 0008-fix-clean-stop-warning-when-running-clean-command-47.patch [RHEL-21531]
  - Resolves: RHEL-21531


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-5
changelog:
  - ci-Revert-Use-grep-for-faster-parsing-of-cloud-config-i.patch [RHEL-22255]
  - Resolves: RHEL-22255
    ([Azure][RHEL-9] cloud-init-23.4 cannot read "- Azure" datasource_list format)


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-6
changelog:
  - ci-fix-Add-types-to-network-v1-schema-4841.patch [RHEL-21324]
  - Resolves: RHEL-21324
    ([rhel-9] The schema WARNING info for network-config.json is not suitable in cloud-init-23.4)


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-7
changelog:
  - ci-Retain-exit-code-in-cloud-init-status-for-recoverabl.patch [RHEL-28549]
  - Resolves: RHEL-28549
    ([RHEL 9.4] cloud-init 23.4 returns 2 on recoverable errors instead of 0)


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-7.1
changelog:
  - ci-fix-Correct-v2-NetworkManager-route-rendering-4637.patch [RHEL-20964]
  - ci-feat-apply-global-DNS-to-interfaces-in-network-manag.patch [RHEL-20964]
  - ci-fix-Undeprecate-network-in-schema-route-definition-5.patch [RHEL-29709]
  - Resolves: RHEL-20964
    ([rhel-9]cloud-init fails to configure DNS/search domains for network-config v1)
  - Resolves: RHEL-29709
    (Suggest to backport patch ff40d1a to undeprecate 'network' in schema route definition)


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-7.2
changelog:
  - ci-fix-Fall-back-to-cached-local-ds-if-no-valid-ds-foun.patch [RHEL-32846]
  - Resolves: RHEL-32846
    ([cloud-init][ESXi]VMware datasource resets on every boot causing it to lose network configuration [rhel-9])


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-7.5
changelog:
  - ci-fix-cloudstack-Use-parsed-lease-file-for-virtual-rou.patch [RHEL-40217]
  - Resolves: RHEL-40217
    ([Cloud-init] CloudstackDataSource cannot work with NetworkManager)
  - ci-feat-sysconfig-Add-DNS-from-interface-config-to-reso.patch [RHEL-17961]


author: Camilla Conte <cconte@redhat.com> - 23.1.1-12
changelog:
  - Resolves: RHEL-2323
  - 0031-net-fix-ipv6_dhcpv6_stateful-stateless-slaac-configu.patch [bz#2227767]
  - Resolves: bz#2227767


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-20
changelog:
  - ci-Fix-metric-setting-for-ifcfg-network-connections-for.patch [RHEL-61224]
  - ci-fix-python3.13-Fix-import-error-for-passlib-on-Pytho.patch [RHEL-61224]
  - Resolves: RHEL-61224
    (Configuring metric for default gateway is not working)


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-21
changelog:
  - ci-fix-Render-bridges-correctly-for-v2-on-sysconfig-wit.patch [RHEL-38927]
  - ci-fix-Render-v2-bridges-correctly-on-network-manager-w.patch [RHEL-38927]
  - Resolves: RHEL-38927
    (NoCloud - network_config bridges incorrectly configured)


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-22
changelog:
  - ci-Prevent-NM-from-handling-DNS-when-network-interfaces.patch [RHEL-65768]
  - Resolves: RHEL-65768
    ([RHEL-9] Prevent NM from handling DNS when network interfaces have DNS config)


author: Miroslav Rezanina <mrezanin@redhat.com> - 24.4-2
changelog:
  - ci-downstream-Revert-feat-Use-NetworkManager-renderer-b.patch [RHEL-74334]
  - Resolves: RHEL-74334
    ([rhel-9.6] Suggest to continue using sysconfig as the default network renderer in rhel-9.6)


author: Jon Maloy <jmaloy@redhat.com> - 24.4-3
changelog:
  - ci-Use-log_with_downgradable_level-for-user-password-wa.patch [RHEL-71122]
  - ci-downstream-set-deprecation-boundary-version.patch [RHEL-71122]
  - Resolves: RHEL-71122
    (Suggest to change some log messages from warning to info after rebase cloud-init-24.4 [RHEL-9.6] )


author: Jon Maloy <jmaloy@redhat.com> - 24.4-4
changelog:
  - ci-net-sysconfig-do-not-remove-all-existing-settings-of.patch [RHEL-76361]
  - Resolves: RHEL-76361
    ([c9s] cloud-init remove 'NOZEROCONF=yes' from /etc/sysconfig/network)


author: Jon Maloy <jmaloy@redhat.com> - 24.4-4.el9_6.1
changelog:
  - ci-fix-NM-reload-and-bring-up-individual-network-conns-.patch [RHEL-83636]
  - Resolves: RHEL-83636
    (DataSourceNoCloudNet network configuration is ineffective [rhel-9.6.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 24.4-4.el9_6.2
changelog:
  - Adding missed fix 'Retain exit code in cloud-init status for recoverable errors'
  - Resolves: RHEL-101693


author: Miroslav Rezanina <mrezanin@redhat.com> - 24.4-4.el9_6.3
changelog:
  - ci-fix-Don-t-attempt-to-identify-non-x86-OpenStack-inst.patch [RHEL-100611]
  - ci-fix-strict-disable-in-ds-identify-on-no-datasources-.patch [RHEL-100611]
  - Resolves: RHEL-100611
    (CVE-2024-6174 cloud-init: From CVEorg collector [rhel-9.6.z])


author: Jon Maloy <jmaloy@redhat.com> - 24.4-5
changelog:
  - ci-fix-NM-reload-and-bring-up-individual-network-conns-.patch [RHEL-81703]
  - Resolves: RHEL-81703
    (DataSourceNoCloudNet network configuration is ineffective - c9s)


author: Jon Maloy <jmaloy@redhat.com> - 24.4-6
changelog:
  - ci-feat-aliyun-datasource-support-crawl-metadata-at-onc.patch [RHEL-88658]
  - Resolves: RHEL-88658
    (Cloud-Init Backport Optimization Features on Alibaba Cloud)


author: Miroslav Rezanina <mrezanin@redhat.com> - 24.4-7
changelog:
  - ci-fix-Don-t-attempt-to-identify-non-x86-OpenStack-inst.patch [RHEL-100615]
  - ci-fix-strict-disable-in-ds-identify-on-no-datasources-.patch [RHEL-100615]
  - Fix missing patch [RHEL-101692]
  - Resolves: RHEL-100615
    (CVE-2024-6174 cloud-init: From CVEorg collector [rhel-9.7])
  - Resolves: RHEL-101692
    (c9s dist-git missing patch "downstream: Retain exit code in cloud-init status for recoverable errors")


author: Jon Maloy <jmaloy@redhat.com> - 24.4-7.el9_7.1
changelog:
  - ci-downstream-Do-not-override-changes-in-disable-sshd-k.patch [RHEL-128882]
  - Resolves: RHEL-128882
    ([rhel-9] cloud-init upgrade is overwriting modifications in disable-sshd-keygen-if-cloud-init-active.conf [rhel-9.7.z])


author: Jon Maloy <jmaloy@redhat.com> - 24.4-8
changelog:
  - ci-downstream-Do-not-override-changes-in-disable-sshd-k.patch [RHEL-128876]
  - Resolves: RHEL-128876
    ([rhel-9] cloud-init upgrade is overwriting modifications in disable-sshd-keygen-if-cloud-init-active.conf)


author: Miroslav Rezanina <mrezanin@redhat.com> - 24.4-8.el9_8.1
changelog:
  - ci-fix-Pass-interface-string-to-get_newest_lease-6648.patch [RHEL-159095]
  - ci-fix-cloudstack-Improve-domain-name-DHCP-lease-lookup.patch [RHEL-159095]
  - ci-downstream-fix-test_cloudstack.py-since-pytest-fixtu.patch [RHEL-159095]
  - Resolves: RHEL-159095
    (CLONE - [GSS][Secure Support] [RHEL-9] cloud-init requests lease before DHCP can provide one [rhel-9.8.z])


author: Packit <hello@packit.dev> - 11-1
changelog:
  - Show SELinux security context in permissions dialog
  - Support changing permissions of enclosed files


author: Packit <hello@packit.dev> - 14-1
changelog:
  - Allow editing multiple file permissions
  - Support uploading files with administrator privileges
  - Add drag 'n drop support


author: Packit <hello@packit.dev> - 311-1
changelog:
  - Allow pasting multiple SSH keys at once in Create VM dialog
  - Fix detaching host device for running VMs


author: Packit <hello@packit.dev> - 332-1
changelog:
  - The "shareable" attribute of disks is no longer modified by Cockpit
  - Bug fixes and translation updates


author: Packit <hello@packit.dev> - 336-1
changelog:
  - Graphical VNC and serial consoles improvements
  - Control VNC console resizing and scaling
  - Bug fixes and translation updates


author: Packit <hello@packit.dev> - 345-1
changelog:
  - New virtual machines don't get SPICE graphics anymore
  - Support for network port forwarding
  - Bug fixes and translation updates


author: Packit <hello@packit.dev> - 318-1
changelog:
  - Storage: Extra confirmation before deleting non-empty partitions in Anaconda's Web UI
  - Discontinue Intel 32-bit support in Fedora, CentOS, and RHEL
  - cockpit.js: Get user primary group ID


author: Packit <hello@packit.dev> - 320-1
changelog:
  - pam-ssh-add: Fix insecure killing of session ssh-agent [CVE-2024-6126]
  - sosreport: Read report directory from sos config (fix page on Debian/Ubuntu)


author: Packit <hello@packit.dev> - 323-1
changelog:
  - metrics: Install valkey instead of redis on RHEL/CentOS 10
  - login: Prevent multiple logins in a single browser session
  - Update documentation links


author: Packit <hello@packit.dev> - 330-1
changelog:
  - Web server: Increased sandboxing, setuid removal, bootc support
  - Development: New install mode using systemd-sysext
  - ws container: Move to Fedora 41


author: Packit <hello@packit.dev> - 331-1
changelog:
  - ws: Prevent search engine indexing with robots.txt
  - container/ws: Support using an external SSH agent


author: Packit <hello@packit.dev> - 332-1
changelog:
  - containers/ws: Include cockpit-files
  - login: Beibooting to all supported OSes
  - metrics: Show system boots in metrics


author: Packit <hello@packit.dev> - 339-1
changelog:
  - Add cockpit/ws arm64 container
  - Storage: Disk Self-Test error warnings on the overview page
  - Bug fixes and translation updates


author: Packit <hello@packit.dev> - 350-1
changelog:
  - networking: fix renaming of bridges and other groups (RHEL-117883)
  - bridge: fix OpenSSH_10.2p1 host key detection


author: Tomas Matus <tmatus@redhat.com> - 356.1-1
changelog:
  - ws: Prevent remote code execution with SSH argument injection (RHEL-158310)
  - node: update lodash dependency (RHEL-164196)


author: Jindrich Novy <jnovy@redhat.com> - 84.1-1
changelog:
  - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/84.1
  - Related: RHEL-2112


author: Packit <hello@packit.dev> - 89-1
changelog:
  - Use binary http channel for podman socket for non-UTF-8 robustness
  - Stop using obsolete cockpit.utf8_{de,en}coder() API
  - Fix tests for CentOS/RHEL 10


author: Justin Stephenson <jstephen@redhat.com> - 12-1
changelog:
  - Drop moment.js dependency
  - Tests: Assert pause state with a later command in rec1
  - CI: Update image to ubuntu 20.04


author: Justin Stephenson <jstephen@redhat.com> - 13-1
changelog:
  - Play after rewind in testFastforwardControls
  - Set TZ to avoid CI failures with testFilter* tests
  - testZoomSpeedControls incorrectly checks scale
  - Fix testSessionRecordingConf
  - Read TMT_TEST_DATA variable for LOGS in browser.sh
  - Fix node-modules in run-test.sh
  - Install sssd-proxy in test browser.sh
  - Add Files path for test recordings
  - FMF: Run tests together
  - Add executable bit to browser shell scripts
  - FMF: Fix minor typo in plans
  - Add FMF tests and test scripts
  - Read existing sssd conf domains and services
  - Makefile: Update Cockpit lib to 269bf89276c679a03befc8a04244addd
  - Remove CentOS condition in testZoomSpeedControls
  - Add accessible name label for Progress component
  - Remove 'enable_files_domain' from SSSD Config
  - SSSD config changes
  - testFastforwardControls update after player-restart
  - Switch wait_present to wait_visible
  - ESLint error and warning fixes
  - Fix stylelint errors
  - Dependency updates
  - Bring up to date with cockpit starter kit
  - Config: Switch SSSD files provider to Proxy provider
  - Update fedora license in spec file
  - Makefile: Bump test API to 267
  - Makefile: drop installing cockpit-ws/cockpit-packagekit
  - src: load translations via po.js
  - .semaphore: update TEST_OS to Fedora 36
  - webpack.config.js: update compression plugin to succeed build
  - Makefile: Adjust to changed rpmspec -q behaviour
  - Use standard "translate" marker in HTML
  - Update dependencies excluding Patternfly
  - Remove unneeded tlog UID code


author: Justin Stephenson <jstephen@redhat.com> - 16-1
changelog:
  - Rebase to upstream release 16
  - Config: Add sssd-proxy requirement
  - Commits from release 15
  - Config: Update to authselect with-tlog feature
  - stylelint: handle stylelint-scss deprecation
  - Add ruff configuration
  - package.json: drop flowtype plugin
  - package.json: drop po2json
  - package.json: document the required nodejs version
  - fmf: Plumb through $TEST_* variables for unexpected messages
  - tests: Use mc for testPlayBinary
  - package.json: drop deprecated eslint-plugin-standard
  - Revert "build: add support for /pybridge scenario"
  - Player: Stop making the Terminal object state
  - build.js: support flags
  - packaging: Update spec License: to SPDX format
  - build.js: Fix LINT env variable check
  - Tests: Allow charset journal messages
  - Update to the new root creation function
  - package.json: Bump stylelint to 15
  - test: add check for sssd config id_provider proxy
  - Tests: Allow invalid non-UTF8 journal messages
  - Add xterm-canvas-addon dependency for rendering
  - Minor Eslint fixes
  - Tests: Update data list to PF5 for testAppMenu
  - Update org.cockpit-project.session-recording.metainfo.xml
  - Makefile: bump our test/common dependency
  - patternfly-5-overrides should be auto-imported by the page.scss file
  - Drop obsolete pf-m-redhat-font class
  - Commits from release 14
  - Upgrade to PatternFly 5 Alpha
  - Makefile: Update Cockpit lib to da5abbb4245b0455cc8b610efe01e684
  - package.json: Pin down versions of @patternfly/react-{styles,icons}
  - Makefile: Update Cockpit lib to 947f1753867e3924b9617aaace936225
  - Makefile: Fix watch dependencies
  - Update release.yml
  - Automate the release process


author: Justin Stephenson <jstephen@redhat.com> - 17-1
changelog:
  - Rebase to upstream release 17
  - Config: Use authselect enable-feature when possible
  - Test: Move from CDP to BiDi
  - Replace jQuery extend() with standard JS spread
  - Convert to TypeScript
  - Convert Application to a functional component
  - package.json: Drop date-fns
  - Various test fixes and build related fixes


author: Richard Hughes <richard@hughsie.com> 1.4.5-1
changelog:
  - New upstream version
  - Add new API for gnome-settings-daemon
  - Check for errors from more sqlite calls
  - Fix owner and permissions on existing state files
  - Fix segfault due to dereferencing NULL pointer
  - Make the build reproductible


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-2
changelog:
  - Remove support for building FIPS mode binaries for the
    compat libraries
  - Ships openssl11.cnf as the configuration file.
  - Resolves: rhbz#1993795
  - Related: rhbz#1947584


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
    Resolves: rhbz#2063147
  - Disable FIPS mode; it does not work and will not be certified
    Resolves: rhbz#2091968


author: Petr Hybl <phybl@redhat.com> - 1:1.1.1k-5.2
changelog:
  - Fixes CVE-2025-69419 OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing
    Resolves: RHEL-142722


author: Petr Hybl <phybl@redhat.com> - 1:1.1.1k-5.2
changelog:
  - Fixes CVE-2025-69419 OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing
    Resolves: RHEL-142723


author: Pavol Žáčik <pzacik@redhat.com> - 1:1.1.1k-5.3
changelog:
  - Fixes CVE-2026-28390: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing
    Resolves: RHEL-165863


author: Nicolas Mailhot <nim@fedoraproject.org>
changelog:
  - 20141121-15
  💥 Actually rebuild with fonts-rpm-macros 2.0.4 to make sure fontconfig files are
    valid


author: Jindrich Novy <jnovy@redhat.com> - 2:2.1.2-2
changelog:
  - update to latest content of https://github.com/containers/conmon/releases/tag/2.1.2
    (https://github.com/containers/conmon/commit/2bc95ee697e87d5f7b77063cf83fc32739addafe)
  - Related: #2061316


author: Jindrich Novy <jnovy@redhat.com> - 3:2.2.1-1
changelog:
  - update to https://github.com/containers/conmon/releases/tag/v2.2.1
  - enable RELRO
  - Related: RHEL-111919


author: Phil Sutter <psutter@redhat.com> - 1.4.5-15
changelog:
  - conntrack: fix compiler warnings
  - src: fix strncpy -Wstringop-truncation warnings
  - connntrack: Fix for memleak when parsing -j arg
  - Drop pointless assignments
  - Don't call exit() from signal handler
  - read_config_yy: Drop extra argument from dlog() call
  - helpers: ftp: Avoid ugly casts
  - Fix potential buffer overrun in snprintf() calls
  - cache: Fix features array allocation
  - hash: Flush tables when destroying


author: Phil Sutter <psutter@redhat.com> - 1.4.7-1
changelog:
  - config: Fix -Wimplicit-function-declaration
  - network: Fix -Wstrict-prototypes
  - build: don't suppress various warnings
  - build: conntrack-tools requires libnetfilter_conntrack >= 1.0.9
  - New version 1.4.7


author: Kelvin Fan <kfan@redhat.com> - 0.21-1
changelog:
  - Update to 0.21
  - Require util-linux >= 2.36-1
  - Remove files related to the issuegen and motdgen executables


author: Jindrich Novy <jnovy@redhat.com> - 3:2.215.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.215.0
  - Related: #2176063


author: Jindrich Novy <jnovy@redhat.com> - 3:2.216.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.216.0
  - Related: #2176063


author: Jindrich Novy <jnovy@redhat.com> - 3:2.217.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.217.0
  - Related: #2176063


author: Jindrich Novy <jnovy@redhat.com> - 3:2.218.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.218.0
  - Related: #2176063


author: Jindrich Novy <jnovy@redhat.com> - 3:2.219.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.219.0
  - Related: #2176063


author: Jindrich Novy <jnovy@redhat.com> - 3:2.221.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.221.0
  - Related: #2176063


author: Jindrich Novy <jnovy@redhat.com> - 3:2.221.1-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.221.1
  - Related: #2176063


author: Jindrich Novy <jnovy@redhat.com> - 3:2.229.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.229.0
  - Resolves: RHEL-28925


author: Jindrich Novy <jnovy@redhat.com> - 3:2.222.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.222.0
  - Related: Jira:RHEL-2112


author: Jindrich Novy <jnovy@redhat.com> - 3:2.224.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.224.0
  - Related: Jira:RHEL-2112


author: Lokesh Mandvekar <lsm5@redhat.com> - 3:2.226.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.226.0
  - Remove dependency on policycoreutils-python-utils
  - Related: Jira:RHEL-2112
  - Related: Jira:RHEL-18316


author: Jindrich Novy <jnovy@redhat.com> - 3:2.227.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.227.0
  - Related: RHEL-2112


author: Jindrich Novy <jnovy@redhat.com> - 3:2.228.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.228.0
  - Related: RHEL-2112


author: Jindrich Novy <jnovy@redhat.com> - 3:2.228.1-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.228.1
  - Related: RHEL-2112


author: Jindrich Novy <jnovy@redhat.com> - 3:2.229.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.229.0
  - Related: RHEL-2112


author: Jindrich Novy <jnovy@redhat.com> - 3:2.230.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.230.0
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 3:2.231.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.231.0
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 3:2.232.1-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.232.1
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 3:2.233.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.233.0
  - Resolves: RHEL-58997


author: Jindrich Novy <jnovy@redhat.com> - 3:2.234.2-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.234.2
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 4:2.235.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.235.0
  - Resolves: RHEL-85434


author: Jindrich Novy <jnovy@redhat.com> - 3:2.235.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.235.0
  - Resolves: RHEL-80473


author: Jindrich Novy <jnovy@redhat.com> - 3:2.236.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.236.0
  - Resolves: RHEL-80473


author: Jindrich Novy <jnovy@redhat.com> - 3:2.237.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.237.0
  - Related: RHEL-80816


author: Jindrich Novy <jnovy@redhat.com> - 4:2.238.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.238.0
  - Related: RHEL-80816


author: Jindrich Novy <jnovy@redhat.com> - 4:2.239.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.239.0
  - Related: RHEL-80816


author: Jindrich Novy <jnovy@redhat.com> - 4:2.240.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.240.0
  - Related: RHEL-80816


author: Lokesh Mandvekar <lsm5@redhat.com> - 4:2.240.0-3
changelog:
  - Delete 405.patch. This was reverted upstream. If it's needed for OCP, this
  can be revisited.
  - Resolves: RHEL-123749


author: Jindrich Novy <jnovy@redhat.com> - 4:2.240.0-4
changelog:
  - Fix Selinux type container_engine_t is missing permissions to allow write to audit log
  - Resolves: RHEL-150544


author: Jindrich Novy <jnovy@redhat.com> - 4:2.241.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.241.0
  - Resolves: RHEL-112187


author: Jindrich Novy <jnovy@redhat.com> - 4:2.242.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.242.0
  - Related: RHEL-111919


author: Jindrich Novy <jnovy@redhat.com> - 4:2.244.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.244.0
  - Resolves: RHEL-112187


author: Jindrich Novy <jnovy@redhat.com> - 4:2.245.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.245.0
  - Related: RHEL-111919


author: Lokesh Mandvekar <lsm5@redhat.com> - 1-14
changelog:
  - rebuild with updated dependencies:
    [python-]podman 4.8.0, buildah 1.33.2, skopeo 1.14.0,
    aardvark-dns and netavark 1.9.0
  - Related: Jira:RHEL-2112


author: Jindrich Novy <jnovy@redhat.com> - 1:1.3.0-2
changelog:
  - rebuild for following CVEs:
  CVE-2022-41724 CVE-2022-41725 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723 CVE-2023-24539 CVE-2023-24540 CVE-2023-29400
  - Resolves: #2179960
  - Resolves: #2187333
  - Resolves: #2187376
  - Resolves: #2203705
  - Resolves: #2207519


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.4.1
  - Resolves: RHEL-28855


author: Jindrich Novy <jnovy@redhat.com> - 1:1.5.0-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.5.0
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 1:1.5.1-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.5.1
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 1:1.6.0-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.6.0
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 1:1.6.1-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.6.1
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 1:1.6.2-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.6.2
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 1:1.6.2-2
changelog:
  - rebuild to fix CVE-2025-22871 containernetworking-plugins: Request smuggling due to acceptance of invalid chunked data in net/http
  - Resolves: RHEL-90031


author: Jindrich Novy <jnovy@redhat.com> - 1:1.7.1-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.7.1
  - Resolves: RHEL-89428


author: Jindrich Novy <jnovy@redhat.com> - 1:1.8.0-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.8.0
  - Related: RHEL-111919


author: Jindrich Novy <jnovy@redhat.com> - 1:1.9.0-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.9.0
  - Related: RHEL-111919


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1-131
changelog:
  - fetch TMT podman revdep tests from podman dist-git
  - needs at least podman 5.4.0-8.el9
  - Related: RHEL-80816


author: Jindrich Novy <jnovy@redhat.com> - 4:1-135
changelog:
  - Update rhel-shortnames-overrides to include complete list of UBI/RHEL images
  - Resolves: RHEL-116618


author: Jindrich Novy <jnovy@redhat.com> - 4:1-135
changelog:
  - Update rhel-shortnames-overrides to include complete list of UBI/RHEL images
  - Related: RHEL-111919


author: Aashish Radhakrishnan <aaradhak@redhat.com> - 0.24.0-2
changelog:
  - Restore single-decimal precision to stream output
    Backport https://github.com/coreos/coreos-installer/pull/1654


author: Joel Capitao <jcapitao@redhat.com> - 0.24.0-3
changelog:
  - Use the full path for the 'root=' kernel arg when rootfs on mpath
    Backport https://github.com/coreos/coreos-installer/pull/1677


author: Yasmin Valim <ydesouza@redhat.com> - 0.24.0-4
changelog:
  - Check if firstboot args are defined and add them manually 
    Backport https://github.com/coreos/coreos-installer/pull/1699


author: Yasmin Valim <ydesouza@redhat.com> - 0.24.0-5
changelog:
  - Uses blkid -p instead of lsblk to bypass the cache
    Backport https://github.com/coreos/coreos-installer/pull/1692


author: Jan Friesse <jfriesse@redhat.com> - 3.1.10-1.1
changelog:
  - Resolves: RHEL-163816
  - Resolves: RHEL-163837

  - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091)
  - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092)


author: Jan Friesse <jfriesse@redhat.com> - 3.1.5-3
changelog:
  - Resolves: rhbz#2024652
  - Resolves: rhbz#2024657

  - totem: Add cancel_hold_on_retransmit config option (rhbz#2024652)
  - merge upstream commit cdf72925db5a81e546ca8e8d7d8291ee1fc77be4 (rhbz#2024652)
  - totemsrp: Switch totempg buffers at the right time (rhbz#2024657)
  - merge upstream commit e7a82370a7b5d3ca342d5e42e25763fa2c938739 (rhbz#2024657)


author: Jan Friesse <jfriesse@redhat.com> - 3.1.5-4
changelog:
  - Resolves: rhbz#2070623

  - logrotate: Use copytruncate method by default (rhbz#2070623)
  - merge upstream commit 04362046c4a9d7307feb5b68341d567b7d0b94d6 (rhbz#2070623)


author: Jan Friesse <jfriesse@redhat.com> - 3.1.9-2.1
changelog:
  - Resolves: RHEL-163815
  - Resolves: RHEL-163836

  - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091)
  - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092)


author: Marek Polacek <polacek@redhat.com> 11.4.1-2
changelog:
  - update from releases/gcc-11-branch (#2193180)
    - GCC 11.4 release
    - PRs bootstrap/90543, c++/53932, c++/69410, c++/92752, c++/98056,
  	c++/98821, c++/100295, c++/100474, c++/101118, c++/101869,
  	c++/102780, c++/103871, c++/104527, c++/105406, c++/105996,
  	c++/106188, c++/106675, c++/106713, c++/106740, c++/107065,
  	c++/107163, c++/107179, c++/107558, c++/107579, c++/107864,
  	c++/108138, c++/108180, c++/108365, c++/108468, c++/108474,
  	c++/108607, c++/108975, c++/108998, c++/109096, c++/109164, c/107127,
  	c/107465, c/109151, d/107592, d/108050, d/108877, d/109108,
  	debug/106719, debug/108573, debug/108716, debug/108967, driver/106624,
  	fortran/85877, fortran/95107, fortran/96024, fortran/96025,
  	fortran/99036, fortran/103259, fortran/104332, fortran/106209,
  	fortran/106945, fortran/107576, fortran/107872, fortran/108131,
  	fortran/108349, fortran/108420, fortran/108421, fortran/108451,
  	fortran/108453, fortran/108501, fortran/108502, fortran/108527,
  	fortran/108529, fortran/108609, fortran/108937, fortran/109186,
  	fortran/109511, fortran/109846, ipa/105685, ipa/106124, ipa/107944,
  	libquadmath/87204, libquadmath/94756, libstdc++/91456,
  	libstdc++/103934, libstdc++/104866, libstdc++/104875,
  	libstdc++/105844, libstdc++/106183, libstdc++/107801,
  	libstdc++/107814, libstdc++/108030, libstdc++/108118,
  	libstdc++/108265, libstdc++/108636, libstdc++/108856,
  	libstdc++/108952, libstdc++/109064, libstdc++/109261,
  	libstdc++/109949, lto/109263, middle-end/104450, middle-end/104464,
  	middle-end/106190, middle-end/107317, middle-end/108237,
  	middle-end/108264, middle-end/108435, middle-end/108459,
  	middle-end/108546, middle-end/108625, middle-end/108685,
  	middle-end/108854, other/108560, other/109306,
  	rtl-optimization/106751, rtl-optimization/107482,
  	rtl-optimization/108193, rtl-optimization/108596,
  	rtl-optimization/109585, target/70243, target/90458, target/96373,
  	target/98776, target/100758, target/104871, target/104921,
  	target/105554, target/105599, target/106736, target/106875,
  	target/107568, target/107714, target/107863, target/108272,
  	target/108348, target/108589, target/108699, target/108807,
  	target/108812, target/108881, target/109067, target/109140,
  	target/109276, testsuite/47334, testsuite/103823, testsuite/108151,
  	testsuite/108973, testsuite/108985, tree-optimization/105484,
  	tree-optimization/106809, tree-optimization/107107,
  	tree-optimization/107212, tree-optimization/107254,
  	tree-optimization/107323, tree-optimization/107451,
  	tree-optimization/107554, tree-optimization/107898,
  	tree-optimization/107997, tree-optimization/108068,
  	tree-optimization/108076, tree-optimization/108095,
  	tree-optimization/108199, tree-optimization/108498,
  	tree-optimization/108688, tree-optimization/108692,
  	tree-optimization/108821, tree-optimization/108950,
  	tree-optimization/109176, tree-optimization/109410,
  	tree-optimization/109473, tree-optimization/109491,
  	tree-optimization/109502, tree-optimization/109573,
  	tree-optimization/109724, tree-optimization/109778
    - PRs fortran/100607, libstdc++/109822, target/109954,
  	tree-optimization/109505


author: Marek Polacek <polacek@redhat.com> 11.4.1-2.1
changelog:
  - fix ICE on pr96024.f90 on big-endian hosts (PR fortran/96024, #2213211)
  - use -fno-stack-protector to fix bit-field aarch64 tests (#2213221)


author: Marek Polacek <polacek@redhat.com> 11.4.1-3
changelog:
  - update from releases/gcc-11-branch (RHEL-17638)
    - PRs c++/106310, c++/106890, c++/109666, c++/109761, c++/111357,
  	c++/111512, c++/112795, d/108842, d/110359, d/110511, d/110516,
  	debug/110295, fortran/95947, fortran/103506, fortran/107397,
  	fortran/110288, fortran/110585, fortran/110658, fortran/111837,
  	fortran/111880, libstdc++/95048, libstdc++/99327, libstdc++/104161,
  	libstdc++/104242, libstdc++/108178, libstdc++/111050,
  	libstdc++/111511, libstdc++/112314, libstdc++/112491,
  	middle-end/110200, middle-end/111699, middle-end/111818,
  	middle-end/112733, rtl-optimization/110237, sanitizer/112727,
  	target/96762, target/101177, target/101469, target/105325,
  	target/109800, target/109932, target/110011, target/110044,
  	target/110170, target/110309, target/110741, target/111001,
  	target/111340, target/111367, target/111408, target/111815,
  	target/112672, target/112816, target/112837, target/112845,
  	target/112891, testsuite/66005, tree-optimization/110298,
  	tree-optimization/110731, tree-optimization/110914,
  	tree-optimization/111015, tree-optimization/111614,
  	tree-optimization/111764, tree-optimization/111917
  - use -fno-stack-protector in some aarch64 tests


author: Florian Weimer <fweimer@redhat.com> - 11.5.0-10
changelog:
  - Exception handling performance improvements (RHEL-105072)
  - libgcc: Use _dl_find_object to find DWARF data in unwinder
  - libgcc: Use lock-free data structures for run-time unwinder registration


author: David Malcolm <dmalcolm@redhat.com> - 11.5.0-14
changelog:
  - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding
    branches and calls to gcov output, but not conditions (RHEL-105416).


author: Marek Polacek <polacek@redhat.com> 11.5.0-1
changelog:
  - update from releases/gcc-11 branch (RHEL-35635)
    - GCC 11.5 release
    - PRs ada/113893, ada/113979, analyzer/104042, c/113262, c/114007, c/114493,
  	c++/89224, c++/92145, c++/92407, c++/97990, c++/99710, c++/100667,
  	c++/100772, c++/101765, c++/103185, c++/104051, c++/111485,
  	c++/111529, c++/113598, c++/113674, c++/114537, c++/114561,
  	c++/114562, c++/114572, c++/114634, c++/114691, d/113125, d/113758,
  	d/114171, debug/111080, debug/112718, driver/115440, fortran/50410,
  	fortran/103715, fortran/104908, fortran/107426, fortran/114474,
  	fortran/114825, gcov-profile/114115, libfortran/110651,
  	libgomp/113192, libquadmath/114533, libstdc++/104259,
  	libstdc++/104606, libstdc++/105417, libstdc++/110054,
  	libstdc++/113250, libstdc++/114147, libstdc++/114401,
  	libstdc++/114750, libstdc++/114803, libstdc++/115269,
  	libstdc++/115454, libstdc++/115575, middle-end/90348,
  	middle-end/95351, middle-end/107385, middle-end/108789,
  	middle-end/110027, middle-end/110115, middle-end/110176,
  	middle-end/111422, middle-end/111632, middle-end/112732,
  	middle-end/113907, middle-end/113921, middle-end/114599,
  	middle-end/114734, middle-end/114753, middle-end/115527,
  	middle-end/115836, objc/101666, objc/101718, preprocessor/105608,
  	rtl-optimization/100303, rtl-optimization/108086,
  	rtl-optimization/110079, rtl-optimization/114768,
  	rtl-optimization/114902, rtl-optimization/115092, sanitizer/97696,
  	sanitizer/111736, sanitizer/114956, sanitizer/115172, target/88309,
  	target/101737, target/101865, target/105522, target/108120,
  	target/108743, target/110411, target/111610, target/111677,
  	target/112397, target/113122, target/113281, target/114049,
  	target/114098, target/114130, target/114184, target/114310,
  	target/114837, target/114846, target/115253, target/115297,
  	target/115360, target/115457, target/115475, target/115611,
  	target/115691, testsuite/113175, testsuite/114034, testsuite/114036,
  	tree-optimization/110386, tree-optimization/110422,
  	tree-optimization/111039, tree-optimization/111070,
  	tree-optimization/111331, tree-optimization/111407,
  	tree-optimization/111445, tree-optimization/111736,
  	tree-optimization/112495, tree-optimization/112505,
  	tree-optimization/112793, tree-optimization/113372,
  	tree-optimization/113552, tree-optimization/113603,
  	tree-optimization/114027, tree-optimization/114115,
  	tree-optimization/114566, tree-optimization/114876,
  	tree-optimization/115192, tree-optimization/115337,
  	tree-optimization/115843
  - fix FLUSH IOSTAT value (PR libfortran/101255, RHEL-32536)
  - fix conditions for using memcmp in
    std::lexicographical_compare_three_way (PR libstdc++/113960)


author: Marek Polacek <polacek@redhat.com> 11.5.0-2
changelog:
  - fix TARGET_CPU_DEFAULT (PR target/105157, RHEL-50037)
  - libstdc++: Workaround kernel-headers on s390x-linux (RHEL-50054)
  - fix wrong code with memcpy from _Complex (PR tree-optimization/116034)


author: Lianbo Jiang <lijiang@redhat.com> - 8.0.2-2
changelog:
  - Fix an assertion failure in the gdb's copy_type()
  - Fix for "bt" command printing "bogus exception frame" warning


author: Lianbo Jiang <lijiang@redhat.com> - 8.0.4-2
changelog:
  - Fix the "dis -lr" not displaying the source file names
    and line numbers
  - Fix incorrect symbol translation by the 'struct blk_mq_ops'


author: Lianbo Jiang <lijiang@redhat.com> - 9.0.0-2
changelog:
  - vmware_guestdump: Version 7 support
  - Fix incorrect task state during exit
  - Add multi-threads support in crash target
  - Call cmd_bt silently after "set pid"
  - x86_64: Add gdb multi-stack unwind support
  - arm64: Add gdb multi-stack unwind support
  - ppc64: Add gdb multi-stack unwind support
  - Fix the issue of "page excluded" messages flooding
  - Fix "kmem -p" option on Linux 6.16-rc1 and later kernels


author: Lianbo Jiang <lijiang@redhat.com> - 9.0.0-3
changelog:
  - x86_64: filter unwanted warning message for "bt -T" cmd
  - doc: Update requirements for building on Fedora
  - gdb: Fix a regression for eppic extension on gdb-16.2
  - Fix crash initialization failure on LoongArch with recent GDB versions
  - gdb: Disable DT_DEBUG lookup by GDB inside the vmcore


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.17.7-1
changelog:
  - Update to 0.17.7
  - Remove insecure hashes SHA-1 and MD5 from the default build (RhBug:1935486)
  - Fix error when updating repo with removed modules metadata
  - Exit with status code 1 when loading of repo's metadata fails
  - Fix memory leaks (RhBug:1998426)
  - Fix valgrind warnings caused by subprocess calls


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.17.7-2
changelog:
  - Switch default of --keep-all-metadata to TRUE and add --discard-additional-metadata (RhBug:2055032)


author: Lukas Hrazky <lhrazky@redhat.com> - 0.20.1-1
changelog:
  - Update to 0.20.1
  - createrepo_c shouldn't silently produce duplicate-NEVRA repos
  - Fix bad performance with task queue management
  - Update errno usage to fix incorrect GError messages
  - Install header for createrepo_shared module
  - Remove C API for cr_xml_parse_main_metadata_together
  - Remove python bindings for xml_parse_main_metadata_together
  - Fix '&' encoding in attributes when parsing repodata
  - Add a streaming parsing API that is user-controllable.
  - Fix a memory leak of primary pkg when parsing interrupted
  - Fix a memory leak when removing the first link in a list
  - Remove `allow_out_of_order` option for `xml_parse_main_metadata_together`
  - Make parse warnings visible through cr.Repomd(), cr.UpdateInfo()
  - Use --error-exit-val option by default
  - If new and old repomd matches during --update don't update
  - Add `cr_repomd_compare` for comparing two repomds
  - Store parsed repomd in `cr_MetadataLocation`
  - Set database version only for the database records, not everything
  - Use copy+delete fallback when moving of a dir fails
  - Fix memory leaks
  - [spec] Option for legacy hashes, enable on RHEL <= 8 (RhBug:2022271)


author: Jindrich Novy <jnovy@redhat.com> - 1.23.1-1
changelog:
  - update to https://github.com/containers/crun/releases/tag/1.23.1
  - fixes "Bump crun to 1.23.1 in RHEL 9.6"
  - Resolves: RHEL-110662


author: Jindrich Novy <jnovy@redhat.com> - 1.27-1
changelog:
  - update to https://github.com/containers/crun/releases/tag/1.27
  - fixes CVE-2026-30892 crun: crun: Privilege escalation due to incorrect parsing of the `--user` option [rhel-9.7.z]
  - Resolves: RHEL-161439


author: Jindrich Novy <jnovy@redhat.com> - 1.27-1
changelog:
  - update to https://github.com/containers/crun/releases/tag/1.27
  - fixes CVE-2026-30892 crun: crun: Privilege escalation due to incorrect parsing of the `--user` option [rhel-9.8]
  - Resolves: RHEL-161441


author: Vladis Dronov <vdronov@redhat.com> - 15.9-10
changelog:
  - Bring in important patches from the upstream (39fb38..eaea31 in a git repo)
  - Fix the upstream tarball URL
  - Remove outdated patch files


author: Vladis Dronov <vdronov@redhat.com> - 15.9-14
changelog:
  - Add distrubution patches which were not upstreamed (bz 2072635)
  - Add self-tests
  - Add OSCI harness


author: Vladis Dronov <vdronov@redhat.com> - 15.9-26
changelog:
  - Update cscope to 15.9-26 from Fedora (RHEL-65465)
  - Fix signal handling at exit
  - Minor edits in the rpm scripts and the changelog
  - Make xemacs a bcond


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-19
changelog:
  - 2217177 - Delays printing to lpd when reserved ports are exhausted
  - 2217284 - The command "cancel -x <job>" does not remove job files
  - 2217954 - Enlarge backlog queue for listen() in cupsd


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-19
changelog:
  - CVE-2023-34241 cups: use-after-free in cupsdAcceptClient() in scheduler/client.c
  - CVE-2023-32324 cups: heap buffer overflow may lead to DoS


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-22
changelog:
  - RHEL-14931 cupsd memory leak in cupsdDeleteJob() with "PreserveJobHistory Off"
  - RHEL-15308 cupsd fails to open cups-files.conf and the resulting error message is lost


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-23
changelog:
  - RHEL-19205 Recommend new cups-filters subpackages with weak dep for better upgrade exp
  - RHEL-19495 cupsGetJobs fails to connect if poll() gets POLLOUT|POLLHUP in revents


author: Pavol Zacik <pzacik@redhat.com> - 1:2.3.3op2-26
changelog:
  - RHEL-40388 cups: Cupsd Listen arbitrary chmod 0140777
  - Delete the domain socket file after stopping the cups.socket service
  - Fix cupsd Listener checks


author: Pavol Zacik <pzacik@redhat.com> - 1:2.3.3op2-28
changelog:
  - RHEL-39940 cups: Cupsd Listen arbitrary chmod 0140777
  - Delete the domain socket file after stopping the cups.socket service
  - Fix cupsd Listener checks


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.2.3.3op2-33.1
changelog:
  - RHEL-113077 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-34
changelog:
  - RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
  - RHEL-113078 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-34.1
changelog:
  - RHEL-129746 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack
  - RHEL-129738 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-35
changelog:
  - RHEL-102665 The KONICA MINOLTA C352 is not distributed using cups-browsed and the included ppd file


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-37
changelog:
  - RHEL-129747 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack
  - RHEL-129740 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.28.7-14
changelog:
  - RHEL-19201 redhat-lsb unnecessary pulls in cups and avahi dependencies
  - RHEL-16026 Cups Browsed does not correctly pull printer location and description information from print server


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.28.7-16
changelog:
  - CVE-2024-47175 cups-filters: remote command injection via attacker controlled data in PPD file
  - CVE-2024-47076 cups-filters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes
  - CVE-2024-47176 cups-filters: cups-browsed binds on UDP INADDR_ANY:631 trusting any packet from any source


author: Bryan Gurney <bgurney@redhat.com> - 71.1-7
changelog:
  - Pull in fixes from upstream v72 and v73 (Jeff Moyer)
  - Fix enable-namespace all reporting errors incorrectly
  - Add support for inject-smart on papr scm
  - Related: rhbz#2040075
  - Related: rhbz#1873851
  - Related: rhbz#1880578
  - Related: rhbz#1922538
  - Related: rhbz#2087707


author: Jeff Moyer <jmoyer@redhat.com> - 71.1-8
changelog:
  - Backport changes up to v74, excluding the config file changes. (Jeff Moyer)
    This includes support for the CXL commands, and adds the following
    packages: cxl-cli, cxl-devel, cxl-libs
  - Resolves: rhbz#2132167


author: Jeff Moyer <jmoyer@redhat.com> - 78-1
changelog:
  - Rebase to v78
  - Add support for legacy monitor.conf file location
  - Fix a test failure.
  - Resolves: RHEL-10382
  - Resolves: RHEL-8204
  - Resolves: RHEL-29151


author: Martin Osvald <mosvald@redhat.com> - 3.4.1-7
changelog:
  - Resolves: #2096149 - Fatal error when running "squatter -r user"
  - Resolves: #2096885 - Enhanced TMT testing for centos-stream


author: Martin Osvald <mosvald@redhat.com> - 3.4.1-11
changelog:
  - Resolves: RHEL-20925 - Seen/Unseen Flag not working correctly
    for shared mailboxes
  - cyrus-imapd.spec: rename patches to correspond with others


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 2.1.27-12
changelog:
  - Incorporate the upstream gdbm specific patch from
    https://github.com/cyrusimap/cyrus-sasl/pull/554
  - Resolves rhbz#1947971


author: Bryan Gurney <bgurney@redhat.com> - 1.10-8.el9
changelog:
  - Supersede uninitialized value patch with upstream version
  - Add upstream patch: common: fix mismatch between prototype and body
  - Makefile: bypass check-doc in check target
  - Related: rhbz#1985096


author: Bryan Gurney <bgurney@redhat.com> - 1.10.1-1
changelog:
  - Update to PMDK version 1.10.1
  - Related: rhbz#1874208
  - Remove BuildRequires line for libfabric-devel
  - Related: rhbz#2009502


author: Eugene Syromiatnikov <esyr@redhat.com> - 3.6-13
changelog:
  - Change "Requires: genisoimage" dependency to "Requires: /usr/bin/mkisofs"
    to enable xorriso-provided drop-in replacement implementation usage.


author: Mark Wielaard <mjw@redhat.com> - 5.0-8
changelog:
  - Add 0001-debug_str_offsets-header-version-and-padding-are-2-b.patch
  - Add 0001-debugedit-Handle-unused-.debug_str_offsets-entries.patch


author: Mark Wielaard <mjw@redhat.com> - 5.0-11
changelog:
  - Add 0001-Add-basic-find-debuginfo-script-tests.patch
  - Add debugedit-5.0-find-debuginfo-tests-fixups.patch


author: Alejandro Sáez <asm@redhat.com> - 1.21.2-1
changelog:
  - Rebase to 1.21.2
  - Add support for ppc64le and aarch64
  - Enable the test suite
  - Resolves: RHEL-22429


author: Alejandro Sáez <asm@redhat.com> - 1.21.2-2
changelog:
  - Modify ports: Some CI systems complain about the usage of the 8888 port.
  - Improve the way PPC64LE support is enabled.
  - Resolves: RHEL-22429


author: Petr Pisar <ppisar@redhat.com> - 4.14.0-17
changelog:
  - Revert more specific error message on a locked OSTree system or a bootc system
    without a usr-overlay (RHEL-49670)


author: Petr Pisar <ppisar@redhat.com> - 4.14.0-18
changelog:
  - More specific error message on a locked OSTree system or a bootc system
    without a usr-overlay (RHEL-49670)


author: Marek Blaha <mblaha@redhat.com> - 4.14.0-19
changelog:
  - Catch more specific OSError instead of SMTPException in dnf-automatic email
    emitter (RHEL-49743)


author: Evan Goode <egoode@redhat.com> - 4.14.0-30
changelog:
  - Mark transient transactions in DNF history (RHEL-84512)
  - Warn/disallow changes outside /usr, /etc with --transient (RHEL-84499)


author: Evan Goode <egoode@redhat.com> - 4.14.0-31
changelog:
  - Introduce $releasever_major, $releasever_minor variables, shell-style
    variable substitution (RHEL-65817)


author: Ales Matej <amatej@redhat.com> - 4.14.0-33
changelog:
  - autoremove: when a dangling protected dependency is found produce a wanrning
    and skip it (RHEL-76112)


author: Petr Menšík <pemensik@redhat.com> - 2.85-18.1
changelog:
  - Prevent overflow in extract_name function (CVE-2026-2291)
  - Prevent DoS in DNSSEC validation (CVE-2026-4890)
  - Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891)
  - Prevent out-of-bounds write in DHCPv6 server (CVE-2026-4892)
  - Prevent source check avoidance by RFC 7871 client-subnet (CVE-2026-4893)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-11.1
changelog:
  - fix CVE-2024-23184: using a large number of address headers may trigger a denial of service (RHEL-55211)
  - fix CVE-2024-23185: very large headers can cause resource exhaustion when parsing message (RHEL-55225)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-14
changelog:
  - fix CVE-2024-23184: using a large number of address headers may trigger a denial of service (RHEL-55212)
  - fix CVE-2024-23185: very large headers can cause resource exhaustion when parsing message (RHEL-55224)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-15.1
changelog:
  - fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161639)
  - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162287)
  - fix CVE-2026-27857: denial of service via specially crafted NOOP command (RHEL-161678)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-16
changelog:
  - add /var/lib/dovecot to tmpfiles for image mode (RHEL-139098)
  - fix building with latest openssl (RHEL-140619)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-17
changelog:
  - fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161640)
  - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162288)
  - fix CVE-2026-27857: denial of service via specially crafted NOOP command (RHEL-161679)


author: Timothy Redaelli <tredaelli@redhat.com> - 21.11.2-1
changelog:
  - Rebase to 21.11.2 (#2126159)
  - Includes fixes for CVE-2022-2132 (#2107173) and CVE-2022-28199 (#2123616)


author: Pavel Valena <pvalena@redhat.com> - 057-67.git20240812
changelog:
  - feat(systemd): install systemd-executor
  - test: use -device instead of -watchdog to remove qemu
  - fix(fips): remove /dev/{random,urandom} pre-creation
  - fix(systemd): always include sg module
  - fix(fips): do not blindly remove /boot
  - fix(github): update format of labeler
  - fix(network-manager): add "After" dependency on dbus.service
  - fix(url-lib.sh): nfs_already_mounted() with trailing slash in
  - feat(systemd-pcrphase): introducing the systemd-pcrphase
  - fix(systemd-pcrphase): only include
  - fix(nfs): include also entries from /usr/lib/{passwd,group}


author: Pavel Valena <pvalena@redhat.com> - 057-70.git20240819
changelog:
  - fix(systemd): set right permissions for the machine-id file
  - feat(lsinitrd.sh): look for initrd in /usr/lib/modules/
  - feat(dracut-init.sh): give --force-add precedence over --omit


author: Pavel Valena <pvalena@redhat.com> - 057-79.git20241127
changelog:
  - fix(35network-manager): install nftables kernel modules
  - fix(35network-manager): install nft binary during module
  - fix(dracut-install): copy xattr when use clone ioctl
  - feat(dracut.sh): add --add-confdir option
  - fix: typo in variable name
  - feat(fips): add support for UKIs
  - fix(kernel-modules): use modalias info in get_dev_module()
  - fix(dracut-functions.sh): convert mmcblk to the real kernel


author: Pavel Valena <pvalena@redhat.com> - 057-86.git20250217
changelog:
  - fix(35network-manager): remove duplicate installkernel
  - feat(fips): include fips module unconditionally
  - fix(dracut.sh): make omit-drivers option do exact match for
  - feat: add openssl module


author: Pavel Valena <pvalena@redhat.com> - 057-101.git20250808
changelog:
  - fix(systemd): add missing modprobe@.service
  - fix: let check_vol_slaves_all return 1 when checks on all
  - improvement(74nvmf): lookup required NIC kernel modules for
  - fix(74nvmf): set root=nvmf
  - chore(multipath): remove `rd_NO_MULTIPATH` kernel command
  - refactor(multipath): remove custom multipathd.service
  - fix(systemd): systemd.volatile needs overlayfs kernel module
  - refactor(dracut): introduce clamp_mtimes helper function
  - fix(dracut): ensure hardlink deduplication is reproducible


author: Pavel Valena <pvalena@redhat.com> - 057-110.git20260130
changelog:
  - fix(systemd-repart): allow partition format
  - feat(install.d):according to the changes of
  - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded
  - fix(pcsc): add opensc load module file
  - fix(pcsc): add --disable-polkit to pcscd.service
  - fix(pkcs11): delete trailing dot on
  - fix(multipath): disable user_friendly_names with mpathconf
    Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322


author: Pavel Valena <pvalena@redhat.com> - 057-113.git20260502
changelog:
  - fix(network-legacy): replace `echo` writes with `printf` to
  - fix(iscsi): replace `echo` writes with `printf` to prevent
  - fix(base): replace eval with safe variable indirection in
    Resolves: RHEL-170857


author: Pavel Valena <pvalena@redhat.com> - 057-115.git20260514
changelog:
  - fix(network): warn on suspicious shell metacharacters in
  - fix(base): escape arguments in initqueue hook script
    Related: RHEL-170857


author: Pavel Valena <pvalena@redhat.com> - 057-20.git20221213
changelog:
  - refactor(url-lib): write curl output directly to file
  - fix(dracut-initramfs-restore.sh): initramfs detection not
  - fix(90kernel-modules): install blk modules using symbol
  - fix(squash): build ld cache for squash loader
  - test(16-DMSQUASH): make it pass on arch
  - feat(dmsquash-live): add new dmsquash-live-autooverlay module


author: Pavel Valena <pvalena@redhat.com> - 057-38.git20230725
changelog:
  - fix(dracut.sh): use dynamically uefi's sections offset
  - fix(dracut.sh): handle imagebase for uefi
  - fix(dracut.sh): use gawk for strtonum
  - fix(rngd): install system service file
  - fix(nvmf): nvme list-subsys prints the address using commas
  - fix(nvmf): don't try to validate network connections in
  - fix(nvmf): no need to load the nvme module
  - fix(nvmf): don't create did-setup file
  - fix(nvmf): don't use "finished" queue for autoconnect
  - fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes
  - fix(nvmf): avoid calling "exit" in a cmdline hook
  - fix(nvmf): run cmdline hook before parse-ip-opts.sh
  - feat(nvmf): set rd.neednet=1 if tcp records encountered
  - fix(nvmf): install 8021q module unconditionally
  - fix(nvmf): support /etc/nvme/config.json
  - feat(nvmf): add code for parsing the NBFT


author: Pavel Valena <pvalena@redhat.com> - 057-43.git20230816
changelog:
  - feat(spec): include modules for IMA
  - fix(dracut): there can be \ at the end on line in awk script
  - fix(rngd): spacing
  - fix(integrity): do not enable EVM if there is no key
  - fix(fips): include openssl's fips.so and openssl.cnf


author: Pavel Valena <pvalena@redhat.com> - 057-51.git20231114
changelog:
  - fix(dracut.sh): correct wrong systemd variable paths
  - fix(hwdb): follow shfmt-recommended format
  - feat(dracut): add --sbat option to add sbat policy to UKI
  - feat(systemd): install systemd-sysroot-fstab-check
  - fix(dracut.spec): add jq dependency to network subpackage
  - fix(fcoe-uefi): exit early on empty vlan


author: Pavel Valena <pvalena@redhat.com> - 057-80.git20250411
changelog:
  - fix(kernel-modules): use modalias info in get_dev_module()
  - fix(dracut-functions.sh): convert mmcblk to the real kernel
  - fix(35network-manager): install nftables kernel modules
  - fix(35network-manager): install nft binary during module
  - feat(dracut.sh): add --add-confdir option


author: Pavel Valena <pvalena@redhat.com> - 057-89.git20250311
changelog:
  - chore(multipath): remove `rd_NO_MULTIPATH` kernel command
  - refactor(multipath): remove custom multipathd.service
  - fix(multipath): disable user_friendly_names with mpathconf
    Resolves: RHEL-109565
    Resolves: RHEL-96101


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.6.0-6
changelog:
  - Gating rebuild [bz#1974188]
  - Resolves: bz#1974188
    (Define tests, including gating tests, for dtc)


author: Jiri Olsa <jolsa@redhat.com> - 1.22-1
changelog:
  - New release: v1.22
  - Resolves: rhbz#2010414
  - Introduce -j/--jobs option to specify the number of threads to use.
  - Multithreaded DWARF loading, requires elfutils >= 0.178.
  - Preparatory work for multithreaded BTF encoding, the focus for 1.23.
  - Allow encoding BTF to a separate file.
  - Show all different types with the same name, not just the first one found.
  - Stop assuming that reading from stdin means pretty, add --prettify.
  - Improve type resolution for the --header command line option.
  - Do not consider the ftrace filter when encoding BTF for kernel functions.
  - Lock calls to non-thread safe elfutils' dwarf_decl_file() and dwarf_decl_line().
  - Change hash table size to one that performs better with current typical vmlinux files.
  - Allow tweaking the hash table size from the command line.
  - Add --kabi_prefix to avoid deduplication woes when using _RH_KABI_REPLACE().
  - Add --with_flexible_array to show just types with flexible arrays.
  - Support btfdiff with a detached BTF file.
  - Introduce sorted type output (--sort).
  - Disable incomplete CTF encoder.


author: Viktor Malik <vmalik@redhat.com> - 1.24-1
changelog:
  - Resolves: rhbz#2140020
  - New release: v1.23
  - Process DW_TAG_LLVM_annotation tags.
  - Initial support for DW_TAG_skeleton_unit.
  - Encode BTF_KIND_TYPE_TAG and BTF_KIND_DECL_TAG
  - Fix handling of percpu symbols on s390.
  - Use cacheline size to infer struct member alignment from BTF.
  - Add --skip_missing to not stop when not finding one of -C arguments.
  - Fix __attribute__((__aligned__(N)) printing alignment for struct members.
  - Fix nested __attribute__(__aligned__(N)) struct printing order.
  - New release: v1.24
  - Add support to BTF_KIND_ENUM64.
  - Support multithreaded BTF encoding.
  - Encode char type as signed in BTF.
  - Introduce --lang and --lang_exclude to pahole.
  - Introduce --compile to pahole.
  - Don't segfault when processing bogus files.


author: Viktor Malik <vmalik@redhat.com> - 1.25-1
changelog:
  - Resolves: rhbz#2190484
  - Build with system libbpf
  - New release: v1.25
  - Support for DW_TAG_unspecified_type more generally.
  - Make sure struct member offsets are in ascending order. Rust BTF needs this.
  - Support C atomic types (DW_TAG_atomic_type).
  - Initial support for DW_TAG_LLVM_annotation, used for BTF type tags, for __rcu, __user, etc
  - Exclude functions with the same name (static functions in different CUs), inconsistent prototypes or not following calling convention.
  - Allow generation of BTF for optimized functions, those that end with a .isra*, .constprop*.
  - Support 'pahole --lang=/--lang_exclude=asm'
  - Support --compile from DWARF in addition to from BTF.
  - Exclude RUST CUs in 'btfdiff', as those are not yet being BTF encoded.


author: Viktor Malik <vmalik@redhat.com> - 1.27-1
changelog:
  - Resolves: RHEL-30780
  - New release: v1.26
  - When expanding types using 'pahole -E' do it for union and struct typedefs and for enums too.
  - Print number of holes, bit holes and bit paddings in class member types.
  - Introduce --contains_enumerator=ENUMERATOR_NAME:
  - Fix pretty printing using DWARF, waiting for a CU with both class (-C) and a specified "type_enum".
  - Add support for DW_TAG_constant in the DWARF loader, first seen in Go DWARF.
  - Fix loading DW_TAG_subroutine_type generated by the Go compiler.
  - Fix loading of 32-bit signed enums from BTF.
  - Add 'pahole --btf_features' to allow consumers to specify an opt-in set of features they want to use in BTF encoding.
  - Parallelize loading BTF and DWARF, speeding up a bit btfdiff.
  - Do type expansion to cover "private" types and enumerations in btfdiff.
  - New release: v1.27
  - Reproducible parallel builds: multiple runs with different number of loading/encoding threads produce the same result.
  - Inject kfunc decl tags into BTF from the BTF IDs ELF section in the Linux kernel vmlinux file.
  - Sanitize unsupported DWARF int type with greater-than-16 byte, as BTF doesn't support it.
  - Initial support for BTF_KIND_DECL_TAG in the BTF loader, adding support in pfunct output.
  - Fix hole discovery with inheritance in C++.


author: Gregory Bell <grbell@redhat.com> - 1.30-1
changelog:
  - New release: 1.30
  - Better detection of abort during DWARF loader thread processing
  - pahole now detects presence of libbpf APIs and BTF features using weak function
    declarations when built using a shared library libbpf
  - Type tags are emitted for BPF arena pointers with new BTF "attributes" feature
  - New release: 1.29
  - Multithreading is now in the DWARF loader using a jobs queue and a pool of worker threads.
  - The BTF encoding now is always reproducible, and as fast/faster than before.
  - The memory consumption is reduced.
  - Support for multiple BTF_DECL_TAGs pointing to same tag.
  - Verify that pfunct prints btf_decl_tags read from BTF.
  - Don't print functions twice when using 'pfunct -f function_name'.
  - New release: 1.28
  - Various improvements to reduce the memory footprint of pahole, notably when doing BTF encoding.
  - Show flexible arrays statistics
  - Add '--padding N' and '--padding_ge N' to show structs with paddings
  - Introduce --running_kernel_vmlinux to find a vmlinux that matches the build-id of the running kernel.
  - Don't stop pfunct output at the first function that matches a filter, show all of them
  - Allow encoding data about all global variables, not just per CPU ones
  - Handle .BTF_ids section endianness, fully supporting cross builds
  - Generate decl tags for bpf_fastcall for eligible kfuncs
  - Add "distilled_base" BTF feature to split BTF generation.
  - Use the ELF_C_READ_MMAP mode with libelf, reducing peak memory utilization
  - Allow overriding /sys/kernel/btf/vmlinux via the PAHOLE_VMLINUX_BTF_FILENAME env var
  - Allow setting the list of compile units via PAHOLE_LANG_EXCLUDE env var
  - Serialize access to elfutils dwarf_getlocation().
  - Honour --lang_exclude when merging LTO built CUs.
  - Add the debuginfod client cache directory to the vmlinux search path.
  - Print the CU's language when a tag isn't supported.
  - Initial support for GNU_formal_parameter_pack, GNU_template_parameter_pack, template_value_param and template_type_param DWARF tags.
  - Improve the parameter parsing by checking DW_OP_[GNU_]entry_value
  - Introduce a tests/ directory with regression tests


author: Gregory Bell <grbell@redhat.com> - 1.31-1
changelog:
  - Rework the selection of functions to represent in BTF, for instance:
  - Skip functions that passes values thru the stack when those structs don't
  have expected alignment due to some attribute usage that then causes
  problems with BTF trampolines due to lack of expressiveness in BTF to
  signal such special cases.
  - Skip objects (compile units) without DWARF: don't stop a multi object
  encoding session just because one doesn't have any DWARF in it.
  - Fix BTF dedup by updating libbpf. 
  - Fix the inference of the explicit alignment attribute of zero length arrays,
  like struct skb_ext->data[] in the Linux kernel. Important as BTF has no no
  explicit alignment attribute encoding.
  - Fix the inference of alignments after bitfields, such as in struct
  nft_rule_dp->data[] after ->handle:42, also in the Linux kernel.    
  - Fix segfault with --show_reorg_steps option, e.g. pahole -R -S -C task_struct.
  - Add comparision of functions encoded in BTF between baseline 'master' branch
  and current branch, i.e. 'next'.


author: Jakub Jelinek <jakub@redhat.com> 0.13-6
changelog:
  - DW_FORM_implicit_const handling fixes (sw#27212, sw#27213)
  - temporarily build odr tests with -gdwarf-4 as they are incompatible with
    DWARF 5


author: Hui Wang <huwang@redhat.com> - 1:4.20-4
changelog:
  - Drop unnecessary javax16.api.jar
  - Add dependency on javapackages-tools since the ecj binary requires it to run


author: Miroslav Rezanina <mrezanin@redhat.com> - 20230524-4
changelog:
  - edk2-OvmfPkg-ResetVector-Fix-assembler-bit-test-flag-chec.patch [RHEL-9943]
  - Resolves: RHEL-9943
    ([EDK2][AMDSERVER Bug] OvmfPkg/ResetVector: Fix assembler bit test flag check [rhel-9.3.0.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-1
changelog:
  - Rebase to edk2-stable202311 [RHEL-12323]
  - Switch to OpenSSL 3.0 [RHEL-49]
  - Resolves: RHEL-12323
    (Rebase EDK2 for RHEL 9.4)
  - Resolves: RHEL-49
    (consume / bundle RHEL-9 OpenSSL (version 3.0.x) in RHEL-9 edk2)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-2
changelog:
  - edk2-OvmfPkg-RiscVVirt-use-gEfiAuthenticatedVariableGuid-.patch [RHEL-20963]
  - edk2-OvmfPkg-VirtNorFlashDxe-stop-accepting-gEfiVariableG.patch [RHEL-20963]
  - edk2-OvmfPkg-VirtNorFlashDxe-sanity-check-variables.patch [RHEL-20963]
  - Resolves: RHEL-20963
    ([rhel9] guest fails to boot due to ASSERT error)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-3
changelog:
  - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411.patch [RHEL-21155]
  - edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117.patch [RHEL-21155]
  - edk2-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch [RHEL-21155]
  - Resolves: RHEL-21155
    (CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-9])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-4
changelog:
  - edk2-OvmfPkg-VirtNorFlashDxe-add-casts-to-UINTN-and-UINT3.patch [RHEL-20963]
  - edk2-OvmfPkg-VirtNorFlashDxe-clarify-block-write-logic-fi.patch [RHEL-20963]
  - edk2-OvmfPkg-VirtNorFlashDxe-add-a-loop-for-NorFlashWrite.patch [RHEL-20963]
  - edk2-OvmfPkg-VirtNorFlashDxe-allow-larger-writes-without-.patch [RHEL-20963]
  - edk2-OvmfPkg-VirtNorFlashDxe-ValidateFvHeader-unwritten-s.patch [RHEL-20963]
  - edk2-OvmfPkg-VirtNorFlashDxe-move-DoErase-code-block-into.patch [RHEL-20963]
  - Resolves: RHEL-20963
    ([rhel9] guest fails to boot due to ASSERT error)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-5
changelog:
  - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-4118.patch [RHEL-21157]
  - edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4118.patch [RHEL-21157]
  - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411-2.patch [RHEL-21157]
  - edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-411-3.patch [RHEL-21157]
  - edk2-SecurityPkg-Updating-SecurityFixes.yaml-after-symbol.patch [RHEL-21157]
  - edk2-OvmfPkg-Sec-Setup-MTRR-early-in-the-boot-process.patch [RHEL-21704]
  - edk2-MdePkg-ArchitecturalMsr.h-add-defines-for-MTRR-cache.patch [RHEL-21704]
  - edk2-UefiCpuPkg-MtrrLib.h-use-cache-type-defines-from-Arc.patch [RHEL-21704]
  - edk2-OvmfPkg-Sec-use-cache-type-defines-from-Architectura.patch [RHEL-21704]
  - Resolves: RHEL-21157
    (CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-9])
  - Resolves: RHEL-21704
    (vGPU VM take several minutes to show tianocore logo if firmware is ovmf)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-6
changelog:
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Un.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p2.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p3.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p4.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Re.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Dhcp6Dxe-Removes-duplicate-check-and-repl.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Dhcp6Dxe-Packet-Length-is-not-updated-bef.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Updating-SecurityFixes.yaml.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - Resolves: RHEL-21841
    (CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-9])
  - Resolves: RHEL-21843
    (CVE-2023-45230 edk2: Buffer overflow in the DHCPv6 client via a long Server ID option [rhel-9])
  - Resolves: RHEL-21845
    (CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-9])
  - Resolves: RHEL-21847
    (CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-9])
  - Resolves: RHEL-21849
    (TRIAGE CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-9])
  - Resolves: RHEL-21851
    (CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-9])
  - Resolves: RHEL-21853
    (TRIAGE CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-9])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-6.el9_4.1
changelog:
  - edk2-EmbeddedPkg-Hob-Integer-Overflow-in-CreateHob.patch [RHEL-30156]
  - edk2-StandaloneMmPkg-Hob-Integer-Overflow-in-CreateHob.patch [RHEL-30156]
  - Resolves: RHEL-30156
    (CVE-2022-36765 edk2: integer overflow in CreateHob() could lead to HOB OOB R/W [rhel-9.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-6.el9_4.2
changelog:
  - edk2-NetworkPkg-SECURITY-PATCH-CVE-2023-45237.patch [RHEL-40270 RHEL-40272]
  - edk2-NetworkPkg-TcpDxe-SECURITY-PATCH-CVE-2023-45236.patch [RHEL-40270 RHEL-40272]
  - edk2-NetworkPkg-TcpDxe-Fixed-system-stuck-on-PXE-boot-flo.patch [RHEL-40270 RHEL-40272]
  - edk2-MdePkg-BaseRngLib-Add-a-smoketest-for-RDRAND-and-che.patch [RHEL-40270 RHEL-40272]
  - edk2-SecurityPkg-RngDxe-add-rng-test.patch [RHEL-40270 RHEL-40272]
  - edk2-OvmfPkg-wire-up-RngDxe.patch [RHEL-40270 RHEL-40272]
  - edk2-CryptoPkg-Test-call-ProcessLibraryConstructorList.patch [RHEL-40270 RHEL-40272]
  - edk2-MdePkg-X86UnitTestHost-set-rdrand-cpuid-bit.patch [RHEL-40270 RHEL-40272]
  - Resolves: RHEL-40270
    (CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-9.4.z])
  - Resolves: RHEL-40272
    (CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-9.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-6.el9_4.3
changelog:
  - edk2-OvmfPkg-Add-Hash2DxeCrypto-to-OvmfPkg.patch [RHEL-46976]
  - edk2-NetworkPkg-DxeNetLib-adjust-PseudoRandom-error-loggi.patch [RHEL-54188]
  - edk2-NetworkPkg-DxeNetLib-Reword-PseudoRandom-error-loggi.patch [RHEL-54188]
  - Resolves: RHEL-46976
    (No http boot support on edk2-ovmf-20231122-6.el9_4.2)
  - Resolves: RHEL-54188
    ([RHEL-9.4.z] edk2 hit Failed to generate random data)


author: Jon Maloy <jmaloy@redhat.com> - 20231122-6.el9_4.4
changelog:
  - edk2-Bumped-openssl-submodule-version-to-0205b5898872.patch [RHEL-55337]
  - Resolves: RHEL-55337
    (CVE-2024-6119 edk2/openssl: Possible denial of service in X.509 name checks [rhel-9.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240214-2
changelog:
  - edk2-OvmfPkg-PlatformPei-log-a-warning-when-memory-is-tig.patch [RHEL-22202]
  - edk2-OvmfPkg-PlatformPei-consider-AP-stacks-for-pei-memor.patch [RHEL-22202]
  - edk2-OvmfPkg-PlatformPei-rewrite-page-table-calculation.patch [RHEL-22202]
  - edk2-OvmfPkg-PlatformPei-log-pei-memory-cap-details.patch [RHEL-22202]
  - edk2-UefiCpuPkg-MpInitLib-Add-support-for-multiple-HOBs-t.patch [RHEL-22202]
  - edk2-UefiCpuPkg-MpInitLib-Add-support-for-multiple-HOBs-t.p2.patch [RHEL-22202]
  - edk2-UefiCpuPkg-MpInitLib-Add-support-for-multiple-HOBs-t.p3.patch [RHEL-22202]
  - edk2-UefiCpuPkg-MpInitLib-Add-support-for-multiple-HOBs-t.p4.patch [RHEL-22202]
  - edk2-UefiCpuPkg-MpInitLib-Add-support-for-multiple-HOBs-t.p5.patch [RHEL-22202]
  - edk2-UefiCpuPkg-MpInitLib-return-early-in-GetBspNumber.patch [RHEL-22202]
  - Resolves: RHEL-22202
    ([EDK2] Support booting with 4096 vcpus)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-1
changelog:
  - Rebase to edk2-stable202405
  - Bumo openssl to 8e5beb77088b
  - Resolves: RHEL-32486
    (rebase to edk2-stable202405 [rhel-9])
  - Resolves: RHEL-36446
    (edk2: enable MOR [rhel-9])
  - Resolves: RHEL-21653
    (CVE-2023-6237 edk2: openssl: Excessive time spent checking invalid RSA public keys [rhel-9])
  - Resolves: RHEL-21150
    (CVE-2023-6129 edk2: mysql: openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC)
  - Resolves: RHEL-22490
    (CVE-2024-0727 edk2: openssl: denial of service via null dereference [rhel-9])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-2
changelog:
  - edk2-MdeModulePkg-Warn-if-out-of-flash-space-when-writing.patch [RHEL-43442]
  - Resolves: RHEL-43442
    (edk2 disconnects abnormally before loading the kernel)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-3
changelog:
  - edk2-NetworkPkg-DxeNetLib-adjust-PseudoRandom-error-loggi.patch [RHEL-45899]
  - edk2-NetworkPkg-DxeNetLib-Reword-PseudoRandom-error-loggi.patch [RHEL-45899]
  - Resolves: RHEL-45899
    ([RHEL-9.5.0] edk2 hit Failed to generate random data)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-4
changelog:
  - edk2-AmdSevDxe-Fix-the-shim-fallback-reboot-workaround-fo.patch [RHEL-56081]
  - Resolves: RHEL-56081
    ([EDK2] Shim fallback reboot workaround might not work on SNP)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-5
changelog:
  - edk2-UefiCpuPkg-PiSmmCpuDxeSmm-skip-PatchInstructionX86-c.patch [RHEL-45847]
  - Resolves: RHEL-45847
    ([RHEL9.5] Hotplug vcpu to a guest cause guest kernel panic)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-6
changelog:
  - edk2-OvmfPkg-CpuHotplugSmm-delay-SMM-exit.patch [RHEL-56974]
  - edk2-Bumped-openssl-submodule-version-to-0205b5898872.patch [RHEL-55336]
  - Resolves: RHEL-56974
    (qemu-kvm: warning: Blocked re-entrant IO on MemoryRegion: acpi-cpu-hotplug at addr: 0x0 [rhel-9])
  - Resolves: RHEL-55336
    (CVE-2024-6119 edk2/openssl: Possible denial of service in X.509 name checks [rhel-9.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-6.el9_5.1
changelog:
  - edk2-MdePkg-Fix-overflow-issue-in-BasePeCoffLib.patch [RHEL-60831]
  - Resolves: RHEL-60831
    (CVE-2024-38796 edk2: Integer overflows in PeCoffLoaderRelocateImage [rhel-9.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-6.el9_5.2
changelog:
  - edk2-OvmfPkg-Add-a-Fallback-RNG-RH-only.patch [RHEL-65735]
  - edk2-OvmfPkg-ArmVirtPkg-Add-a-Fallback-RNG-RH-only.patch [RHEL-65735]
  - Resolves: RHEL-65735
    ([Regression] HTTP Boot not working on old vCPU without virtio-rng device present  [rhel-9.5.z])


author: Jon Maloy <jmaloy@redhat.com> - 20240524-6.el9_5.3
changelog:
  - edk2-OvmfPkg-Rerun-dispatcher-after-initializing-virtio-r.patch [RHEL-63094]
  - Resolves: RHEL-63094
    ([Regression] HTTP Boot fails to work with edk2-ovmf-20231122-6.el9_4.2 and greater [rhel-9.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-7
changelog:
  - edk2-OvmfPkg-VirtioGpuDxe-ignore-display-resolutions-smal.patch [RHEL-56248]
  - edk2-OvmfPkg-QemuVideoDxe-ignore-display-resolutions-smal.patch [RHEL-56248]
  - edk2-MdePkg-Fix-overflow-issue-in-BasePeCoffLib.patch [RHEL-60833]
  - Resolves: RHEL-56248
    (507x510 display resolution should not crash the firmware [edk2,rhel-9.6])
  - Resolves: RHEL-60833
    (CVE-2024-38796 edk2: Integer overflows in PeCoffLoaderRelocateImage [rhel-9.6])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-8
changelog:
  - edk2-OvmfPkg-Add-a-Fallback-RNG-RH-only.patch [RHEL-65725]
  - Resolves: RHEL-65725
    ([Regression] HTTP Boot not working on old vCPU without virtio-rng device present [rhel-9.6])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-9
changelog:
  - edk2-OvmfPkg-ArmVirtPkg-Add-a-Fallback-RNG-RH-only.patch [RHEL-66230]
  - Resolves: RHEL-66230
    ([Regression] [aarch64] HTTP Boot not working on old vCPU without virtio-rng device present [rhel-9.6])


author: Jon Maloy <jmaloy@redhat.com> - 20240524-10
changelog:
  - edk2-OvmfPkg-Rerun-dispatcher-after-initializing-virtio-r.patch [RHEL-58631]
  - Resolves: RHEL-58631
    ([Regression] HTTP Boot fails to work with edk2-ovmf-20231122-6.el9_4.2 and greater)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20241117-2
changelog:
  - edk2-Fix-amd-sev-firmware-file-for-amd-snp.patch [RHEL-72447]
  - Resolves: RHEL-72447
    ( QEMU should creating new json file that will correctly describe firmware for amd-sev-snp [rhel-9])


author: Jon Maloy <jmaloy@redhat.com> - 20241117-2.el9_6.1
changelog:
  - edk2-Update-dbx-revocation-list-to-2025-02-24-version.patch [RHEL-83018]
  - Resolves: RHEL-83018
    (The newer revocation file and Server 2025 required to update it [rhel-9.6.z])


author: Jon Maloy <jmaloy@redhat.com> - 20241117-3
changelog:
  - edk2-OvmfPkg-Use-the-OvmfPkg-version-of-CcProbeLib.patch [RHEL-70865]
  - edk2-Update-dbx-revocation-list-to-2025-02-24-version.patch [RHEL-83019]
  - Resolves: RHEL-70865
    (SNP guest failed to boot with SVSM using OVMF.amdsev.fd [rhel-9.7])
  - Resolves: RHEL-83019
    (The newer revocation file and Server 2025 required to update it [rhel-9])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20241117-4
changelog:
  - edk2-update-dbx-to-20250610.patch [RHEL-96869]
  - Resolves: RHEL-96869
    ([edk2,rhel-9] dbx update 20250610)


author: Jon Maloy <jmaloy@redhat.com> - 20241117-4.el9_7.1
changelog:
  - edk2-OvmfPkg-IoMmuDxe-Fix-1M-and-2M-buffer-handling.patch [RHEL-121875]
  - Resolves: RHEL-121875
    (Fail to create AMD SEV SLES 15 SP4 guest via virt-install --cdrom [rhel-9.7.z])


author: Jon Maloy <jmaloy@redhat.com> - 20241117-4.el9_7.3
changelog:
  - edk2-OvmfPkg-MemEncryptSevLib-Evict-cache-lines-during-SN.patch [RHEL-125104]
  - edk2-MdePkg-Add-the-COHERENCY_SFW_NO-CPUID-bit-field.patch [RHEL-125104]
  - edk2-OvmfPkg-ResetVector-Make-ReceivedVc-a-flag-in-SEV-ES.patch [RHEL-125104]
  - edk2-OvmfPkg-MemEncryptSevLib-Check-if-SEV-SNP-coherency-.patch [RHEL-125104]
  - edk2-openssl-flatten-contents-of-openssl-tarball.patch [RHEL-115923]
  - edk2-Bumped-openssl-submodule-to-version-3.0.7-29.1.patch [RHEL-115923]
  - Resolves: RHEL-125104
    ([edk2] VM panic on booting SNP guest with large memory on Genoa [rhel-9.7.z])
  - Resolves: RHEL-115923
    (CVE-2025-9230 edk2: Out-of-bounds read & write in RFC 3211 KEK Unwrap [rhel-9.7.z])


author: Oliver Steffen <osteffen@redhat.com> - 20230524-1
changelog:
  - Rebase to edk2-stable202305 tag [RHEL-585]
    Resolves: RHEL-585
    ([rhel-9.3] rebase EDK2 to edk2-stable202305)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20230524-2
changelog:
  - edk2-ArmVirt-add-VirtioSerialDxe-to-ArmVirtQemu-builds.patch [RHEL-643]
  - edk2-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtio.patch [RHEL-643]
  - edk2-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtioPc.patch [RHEL-643]
  - edk2-ArmVirt-PlatformBootManagerLib-set-up-virtio-serial-.patch [RHEL-643]
  - edk2-OvmfPkg-VirtioSerialDxe-use-TPL_NOTIFY.patch [RHEL-643]
  - edk2-OvmfPkg-VirtioSerialDxe-Remove-noisy-debug-print-on-.patch [RHEL-643]
  - edk2-OvmfPkg-PlatformInitLib-limit-phys-bits-to-46.patch [bz#2174749]
  - edk2-Revert-OvmfPkg-disable-dynamic-mmio-window-rhel-only.patch [bz#2174749]
  - edk2-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch [bz#2124143]
  - edk2-OvmfPkg-PlatformInitLib-check-PcdUse1GPageTable.patch [RHEL-644]
  - edk2-OvmfPkg-OvmfPkgIa32X64-enable-1G-pages.patch [RHEL-644]
  - edk2-OvmfPkg-MicrovmX64-enable-1G-pages.patch [RHEL-644]
  - Resolves: RHEL-643
    (add virtio serial support to armvirt)
  - Resolves: bz#2174749
    ([edk2] re-enable dynamic mmio window)
  - Resolves: bz#2124143
    (ovmf must consider max cpu count not boot cpu count for apic mode [rhel-9])
  - Resolves: RHEL-644
    (enable gigabyte pages)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20230524-3
changelog:
  - edk2-OvmfPkg-AmdSev-fix-BdsPlatform.c-assertion-failure-d.patch [bz#2190244]
  - edk2-OvmfPkg-IoMmuDxe-add-locking-to-IoMmuAllocateBounceB.patch [bz#2211060]
  - edk2-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch [bz#2218196]
  - Resolves: bz#2190244
    ([EDK2] [AMDSERVER 9.3 Bug] OVMF AP Creation Fixes)
  - Resolves: bz#2211060
    (SEV-es guest randomly stuck at boot to hard drive screen from powerdown and boot again)
  - Resolves: bz#2218196
    (Add vtpm devices with OVMF.amdsev.fd causes VM reset)


author: Jon Maloy <jmaloy@redhat.com> - 20241117-5
changelog:
  - edk2-MdePkg-Acpi66.h-Add-ACPI-6.6-header.patch [RHEL-109010]
  - edk2-OvmfPkg-WorkArea.h-Add-MAILBOX_GDT.patch [RHEL-109010]
  - edk2-OvmfPkg-Add-the-Test-command-in-TDX-MailBox.patch [RHEL-109010]
  - edk2-OvmfPkg-Add-the-ResetVector-in-TDX-MailBox.patch [RHEL-109010]
  - edk2-OvmfPkg-TdxDxe-Support-5-level-paging-for-ResetVecto.patch [RHEL-109010]
  - edk2-OvmfPkg-IoMmuDxe-Fix-1M-and-2M-buffer-handling.patch [RHEL-69780]
  - Resolves: RHEL-109010
    (TD guest dmesg reports ACPI BIOS Warning (bug): Incorrect checksum in table [APIC] - 0x29)
  - Resolves: RHEL-69780
    (Fail to create AMD SEV SLES 15 SP4 guest via virt-install --cdrom [rhel-9.8])


author: Jon Maloy <jmaloy@redhat.com> - 20241117-6
changelog:
  - edk2-OvmfPkg-MemEncryptSevLib-Evict-cache-lines-during-SN.patch [RHEL-121983]
  - edk2-MdePkg-Add-the-COHERENCY_SFW_NO-CPUID-bit-field.patch [RHEL-121983]
  - edk2-OvmfPkg-ResetVector-Make-ReceivedVc-a-flag-in-SEV-ES.patch [RHEL-121983]
  - edk2-OvmfPkg-MemEncryptSevLib-Check-if-SEV-SNP-coherency-.patch [RHEL-121983]
  - Resolves: RHEL-121983
    ([edk2] VM panic on booting SNP guest with large memory on Genoa)


author: Jon Maloy <jmaloy@redhat.com> - 20241117-7
changelog:
  - edk2-make-dbxupdate.sh-get-version-tag-add-to-commit-mess.patch [RHEL-126100]
  - edk2-update-dbx-to-20251016-v1.6.1.patch [RHEL-126100]
  - Resolves: RHEL-126100
    ([edk2,rhel-9] dbx update to 20251016 / v1.6.1)


author: Jon Maloy <jmaloy@redhat.com> - 20241117-8
changelog:
  - edk2-openssl-flatten-contents-of-openssl-tarball.patch [RHEL-115922]
  - edk2-Bumped-openssl-submodule-to-version-3.0.7-29.1.patch [RHEL-115922]
  - Resolves: RHEL-115922
    (CVE-2025-9230 edk2: Out-of-bounds read & write in RFC 3211 KEK Unwrap [rhel-9.8])


author: Mark Wielaard <mjw@redhat.com> - 0.187-4
changelog:
  - Upgrade to elfutils 0.187
    - debuginfod: Support -C option for connection thread pooling.
    - debuginfod-client: Negative cache file are now zero sized instead
      of no-permission files.
    - addr2line: The -A, --absolute option, which shows file names
      includingthe full compilation directory is now the
      default.  To get theold behavior use the new option --relative.
    - readelf, elflint: Recognize FDO Packaging Metadata ELF notes
    - libdw, debuginfo-client: Load libcurl lazily only when files need
      to be fetched remotely. libcurl is now never loaded when
      DEBUGINFOD_URLS is unset. And whenDEBUGINFOD_URLS is set,
      libcurl is only loaded when the debuginfod_begin function is
      called.
  - Add elfutils-0.187-csh-profile.patch
  - Add elfutils-0.187-debuginfod-client-fd-leak.patch
  - Add elfutils-0.187-mhd_no_dual_stack.patch
  - Add elfutils-0.187-mhd_epoll.patch


author: Frank Ch. Eigler <fche@redhat.com> - 0.187-5
changelog:
  - rhbz2088774: ship /etc/profile.d/debuginfod* files even without
                 default DEBUGINFOD_URLS.


author: Mark Wielaard <mjw@redhat.com> - 0.189-3
changelog:
  - Add elfutils-0.189-elf_getdata_rawchunk.patch
  - Add elfutils-0.189-debuginfod_config_cache-double-close.patch


author: Mark Wielaard <mjw@redhat.com> - 0.190-1
changelog:
  - Upgrade to upstream elfutils 0.190
  - Add eu-srcfiles
  - Drop upstreamed patches
    elfutils-0.189-debuginfod_config_cache-double-close.patch
    elfutils-0.189-elf_getdata_rawchunk.patch
    elfutils-0.189-elfcompress.patch
  - Only package debuginfod-client-config.7 manpage for debuginfod-client


author: Aaron Merey <amerey@redhat.com> - 0.191-1
changelog:
  - Upgrade to upstream elfutils 0.191
  - Drop upstreamed patches
    elfutils-0.190-fix-core-noncontig.patch
    elfutils-0.190-gcc-14.patch
    elfutils-0.190-remove-ET_REL-unstrip-test.patch
  - Drop testcore-noncontig.bz2
  - Add elfutils-0.191-profile-empty-urls.patch
  - Add elfutils-0.191-riscv-flatten.patch
  - Add feature flag for reenabling elfutils-libelf-devel-static and elfutils-devel-static


author: Aaron Merey <amerey@redhat.com> - 0.191-3
changelog:
  - eu-srcfiles directly links to libdebuginfod.so so explicitly
    Require elfutils-debuginfod-client not just Recommends.


author: Aaron Merey <amerey@redhat.com> - 0.193-1
changelog:
  - Upgrade to upstream elfutils 0.193
  - Drop upstreamed patches
    elfutils-0.192-fix-free.patch
    elfutils-0.192-libelf-static.patch
    elfutils-0.192-stacktrace-lto.patch


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-9
changelog:
  - Fix etags local command injection vulnerability (#2175190)
  - Fix htmlfontify.el command injection vulnerability (#2175179)
  - Fix ruby-mode.el local command injection vulnerability (#2175142)
  - Fix ob-latex.el command injection vulnerability (#2180590)


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-10
changelog:
  - org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331)
  - Disable xwidgets (RHEL-33447)


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-10
changelog:
  - Disable xwidgets (RHEL-14551)
  - org-file-contents: Consider all remote files unsafe (CVE-2024-30205)
  - Make Gnus treats inline MIME contents as untrusted (CVE-2024-30203)
  - Add protection for LaTeX preview (CVE-2024-30204)
  - org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331)


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-11.el9_5.1
changelog:
  - Fix man.el shell injection vulnerability (RHEL-79021)
  - Eliminate use of obsolete patch syntax (RHEL-80450)


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-18
changelog:
  - Fix nsm-should-check for "google.com" failure (RHEL-94297)
  - Fix package tests for tetris no longer existing as a package (RHEL-94297)
  - Introduce untrusted-content variable (RHEL-94297)


author: Jacek Migacz <jmigacz@redhat.com> - 12.3-1
changelog:
  - Fix build failure on CentOS Stream. Related: rhbz#1951306
  - Revert patch for FSF addresses (it became obsolete with 12.2)
  - Remove Obsoletes and Provides tetex-preview


author: Jeff Law <law@redhat.com> - 1.1.2-7
changelog:
  - Force C++14 as this code is not C++17 ready
  - Fix sprintf format issue
  - Fix ordered comparison of a pointer against zero issue
  -


author: Jack Magne <jmagne@redhat.com> - 1.1.2-14
changelog:
  Resolves: rhbs #2007544,2000928,2000929
  - Bugzilla Bug  2007544 - The esc provides outdated configuration for opensc
  - Bugzilla Bug  2000928 - ESC does not detect smart cards and crashes upon launch [rhel-9.0.0]
  - Bugzilla Bug  2000929 - [RHEL-9][AppStream] esc present in comps but missing from repository [rhel-9.0.0]


author: Jack Magne <jmagne@redhat.com> - 1.1.2-16
changelog:
  Resolves: rhbs #2050849
  - Bug 2050849 - Volkswagen Siemens CardOS M4.4 and 5.0 cards display incorrect status in ESC [RHEL 9.1]


author: Marek Kasik <mkasik@redhat.com> - 40.1-5
changelog:
  - Use tmp dir as containing folder for non-native files
  - Backport fixes for issues found by Coverity Scan
  - Fix some other issues found by Coverity Scan
  - Resolves: #1975150


author: Milan Crha <mcrha@redhat.com> - 3.40.4-10
changelog:
  - Related: RHEL-12405 (Move WebKitGTK parts in Evolution Data Server into optional subpackage)
  - Add dependency on newly introduced evolution-data-server-ui


author: Milan Crha <mcrha@redhat.com> - 3.40.4-8
changelog:
  - Resolves: RHEL-12405 (Move WebKitGTK parts in Evolution Data Server into optional subpackage)
  - Add requirement on ui subpackage into ui-devel subpackage


author: Milan Crha <mcrha@redhat.com> - 3.40.4-2
changelog:
  - Resolves: RHEL-19371 (Backport upstream patch to workaround broken text/calendar mail attachments by the server)


author: Jan Grulich <jgrulich@redhat.com> - 0.27.4-4
changelog:
  - Fix out-of-bounds read in Exiv2::Jp2Image::printStructure
    Resolves: bz#1993247

  - Fix out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header
    Resolves: bz#1993284


author: Jan Grulich <jgrulich@redhat.com> - 0.27.5-1
changelog:
  - Exiv2 0.27.5
    Resolves: bz#2018421

    Fix stack exhaustion issue in the printIFDStructure function leading to DoS
    Resolves: bz#2003670


author: Tomas Korbar <tkorbar@redhat.com> - 2.5.0-2
changelog:
  - Fix parsing of large tokens
  - Reject direct parameter entity recursion
  - Resolves: RHEL-29699
  - Resolves: RHEL-29696


author: Tomas Korbar <tkorbar@redhat.com> - 2.5.0-2.1
changelog:
  - Fix multiple CVEs
  - Fix CVE-2024-45492 integer overflow
  - Fix CVE-2024-45491 Integer Overflow or Wraparound
  - Fix CVE-2024-45490 Negative Length Parsing Vulnerability
  - Resolves: RHEL-57510
  - Resolves: RHEL-57497
  - Resolves: RHEL-56763


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.10-10
changelog:
  - Fix multiple CVEs
  - CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
  - CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
  - CVE-2022-25315 expat: integer overflow in storeRawNames()
  - Resolves: CVE-2022-25236
  - Resolves: CVE-2022-25235
  - Resolves: CVE-2022-25315


author: Tomas Korbar <tkorbar@redhat.com> - 2.4.7-1
changelog:
  - Rebase to version 2.4.7
  - Resolves: rhbz#2067201
  - Resolves: CVE-2022-25313
  - Resolves: CVE-2022-25314
  - Resolves: CVE-2022-25236


author: Tomas Korbar <tkorbar@redhat.com> - 2.5.0-3
changelog:
  - Fix CVE-2024-45490, CVE-2024-45491, CVE-2024-45492
  - Resolves: RHEL-56761
  - Resolves: RHEL-57520
  - Resolves: RHEL-57511


author: Radovan Sroka <rsroka@redhat.com> - 1.0.3-3
changelog:
  RHEL 9 BETA
  - SELinux prevents fapolicyd from watch_mount/watch_with_perm on /dev/shm
  Resolves: rhbz#1932225
  Resolves: rhbz#1977731


author: Zoltan Fridrich <zfridric@redhat.com> - 1.0.4-101
changelog:
  RHEL 9.0.0 ERRATUM
  - rebase to 1.0.4
  - added rpm_sha256_only option
  - added trust.d directory
  - allow file names with whitespaces in trust files
  - use full paths in trust files
  Resolves: rhbz#2032408
  - fix libc.so getting identified as application/x-executable
  Resolves: rhbz#2015307
  - fix selinux DSP module definition in spec file
  Resolves: rhbz#2014449


author: Radovan Sroka <rsroka@redhat.com> - 1.1-100
changelog:
  RHEL 9.0.0 ERRATUM
  - rebase to 1.1
  Resolves: rhbz#2032408
  - introduce rules.d
  Resolves: rhbz#2054740
  - remove pretrans scriptlet
  Resolve: rhbz#2051481


author: Radovan Sroka <rsroka@redhat.com> - 1.1-104
changelog:
  RHEL 9.1.0 ERRATUM
  - CVE-2022-1117 fapolicyd: fapolicyd wrongly prepares ld.so path
  Resolves: rhbz#2069123
  - Faulty handling of static applications
  Resolves: rhbz#2096457


author: Radovan Sroka <rsroka@redhat.com> - 1.1.3-102
changelog:
  RHEL 9.1.0 ERRATUM
  - rebase fapolicyd to the latest stable vesion
  Resolves: rhbz#2100041
  - fapolicyd gets way too easily killed by OOM killer
  Resolves: rhbz#2097385
  - fapolicyd does not correctly handle SIGHUP
  Resolves: rhbz#2070655
  - Introduce ppid rule attribute
  Resolves: rhbz#2102558
  - fapolicyd often breaks package updates
  Resolves: rhbz#2111244
  - drop libgcrypt in favour of openssl
  Resolves: rhbz#2111938
  - Remove dnf plugin
  Resolves: rhbz#2113959
  - fapolicyd.rules doesn't advertise that using a username/groupname instead of uid/gid also works
  Resolves: rhbz#2115849


author: Radovan Sroka <rsroka@redhat.com> - 1.1.3-104
changelog:
  RHEL 9.2.0 ERRATUM
  - statically linked app can execute untrusted app
  Resolves: rhbz#2097077
  - fapolicyd ineffective with systemd DynamicUser=yes
  Resolves: rhbz#2136802
  - Starting manually fapolicyd while the service is already running breaks the system
  Resolves: rhbz#2160517
  - Cannot execute /usr/libexec/grepconf.sh when falcon-sensor is enabled
  Resolves: rhbz#2160518
  - fapolicyd: Introduce filtering of rpmdb
  Resolves: RHEL-192


author: Radovan Sroka <rsroka@redhat.com> - 1.3.2-100
changelog:
  RHEL 9.3.0 ERRATUM
  - Rebase fapolicyd to the latest stable version
  Resolves: RHEL-430
  - fapolicyd can leak FDs and never answer request, causing target process to hang forever
  Resolves: RHEL-621
  - RFE: send rule number to fanotify so it gets audited
  Resolves: RHEL-624
  - fapolicyd needs to make sure the FD limit is never reached
  Resolves: RHEL-623
  - fapolicyd still allows execution of a program after "untrusting" it
  Resolves: RHEL-622
  - Default q_size doesn't match manpage's one
  Resolves: RHEL-627
  - fapolicyd-cli --update then mount/umount twice causes fapolicyd daemon to block (state 'D')
  Resolves: RHEL-817
  - Fix broken backwards compatibility backend numbers
  Resolves: RHEL-730
  - SELinux prevents the fapolicyd from reading symlink (cert_t)
  Resolves: RHEL-816


author: Petr Lautrbach <lautrbach@redhat.com> - 1.3.3-106.1
changelog:
  - RPMDB crashes with SIGBUS when updating the RPMDB repeatedly
  - Add /var/lib/fapolicyd to tmpfiles
  - File /run/fapolicyd differs from RPM expectations
  - fapolicyd.service badly instructs how to start after nss-user-lookup.target
  - fapolicy rule containing 'pattern=normal' produces error
  - "fapolicyd-cli --file add" crashes when processing sockets


author: Petr Lautrbach <lautrbach@redhat.com> - 1.4-1
changelog:
  - fapolicyd-1.4 and fapolicyd-selinux-1.0
    https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v1.4


author: Petr Lautrbach <lautrbach@redhat.com> - 1.4.3-1
changelog:
  - fapolicyd-1.4.3
    https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v1.4.3
    https://github.com/linux-application-whitelisting/fapolicyd-selinux/releases/tag/v1.1


author: Petr Lautrbach <lautrbach@redhat.com> - 1.4.3-2
changelog:
  - Fix binary path of rpm-loader
  - Map file with MAP_SHARED instead of MAP_PRIVATE
  - Fix segfault when interrupting fapolicyd startup


author: Antonio Murdaca <amurdaca@redhat.com> - 0.5.1-1
changelog:
  * chore: update patch for new release by @nullr0ute in https://github.com/fdo-rs/fido-device-onboard-rs/pull/625
   * chore: fix require error with commitlint by @miabbott in https://github.com/fdo-rs/fido-device-onboard-rs/pull/636
   * fix(license): replace space with - in Apache 2.0 by @7flying in https://github.com/fdo-rs/fido-device-onboard-rs/pull/632
   * fix(data-formats): use serde_tuple serializer for error messages by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/629
   * fix: cargo test for non-root users by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/635
   * fix(get_current_user_name): remove trailing whitespaces. by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/638
   * chore: bump mio from 0.8.10 to 0.8.11 by @dependabot in https://github.com/fdo-rs/fido-device-onboard-rs/pull/640
   * fix: vendored tarfile creation by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/634
   * fix: static-mut-refs warning by @7flying in https://github.com/fdo-rs/fido-device-onboard-rs/pull/651
   * Enable CentOS 9 builds and add Testing Farm e2e tests by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/650
   * Add an OV re-registration window option when using DB storage by @7flying in https://github.com/fdo-rs/fido-device-onboard-rs/pull/643
   * chore: bump pem from 2.0.1 to 3.0.3 by @dependabot in https://github.com/fdo-rs/fido-device-onboard-rs/pull/639
   * chore: bump h2 from 0.3.25 to 0.3.26 by @dependabot in https://github.com/fdo-rs/fido-device-onboard-rs/pull/659
   * feat: verify trusted manufacturers by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/656
   * database enhancements by @runcom in https://github.com/fdo-rs/fido-device-onboard-rs/pull/666
   * chore: bump openssl to 0.10.66 by @7flying in https://github.com/fdo-rs/fido-device-onboard-rs/pull/664
   * chore(store): make the store OVs agnostic by @runcom in https://github.com/fdo-rs/fido-device-onboard-rs/pull/671
   * feat(manufacturing-server): implement an export OVs endpoint  by @runcom in https://github.com/fdo-rs/fido-device-onboard-rs/pull/673
   * fix(systemd-units): run before powering off the system by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/676
   * fix(dracut): use isolate on error in the manufacturing-client service by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/678
   * fix(systemd-generator): write configuration to '/run' by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/677
   * fix(owner-tool): use the new API to export ovs by @runcom in https://github.com/fdo-rs/fido-device-onboard-rs/pull/675
   * chore: update diesel to 2.2.3 by @7flying in https://github.com/fdo-rs/fido-device-onboard-rs/pull/669
   * chore: bump reqwest from 0.11.27 to 0.12.7 by @dependabot in https://github.com/fdo-rs/fido-device-onboard-rs/pull/683
   * fix: use centos-stream-9 target instead of epel-9 by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/687
   * enhance onboarding testing by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/681
   * ci: add konflux test cases by @yih-redhat in https://github.com/fdo-rs/fido-device-onboard-rs/pull/688
   * fix(make-vendored-tarfile.sh): exclude idna tests with unicode points by @runcom in https://github.com/fdo-rs/fido-device-onboard-rs/pull/692
   * chore: bump for 0.5.1 by @runcom in https://github.com/fdo-rs/fido-device-onboard-rs/pull/693

   * @miabbott made their first contribution in https://github.com/fdo-rs/fido-device-onboard-rs/pull/636
   * @yih-redhat made their first contribution in https://github.com/fdo-rs/fido-device-onboard-rs/pull/688

   **Full Changelog**: https://github.com/fdo-rs/fido-device-onboard-rs/compare/v0.5.0...v0.5.1


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-100
changelog:
  - fence_ibm_powervs: update description of api-type parameter to show
    correct default value
    Resolves: RHEL-114753


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-105
changelog:
  - bundled urllib3: fix CVE-2025-66471
  - bundled urllib3: fix CVE-2026-21441
    Resolves: RHEL-139799, RHEL-140796


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-110
changelog:
  - bundled urllib3: fix CVE-2024-37891, CVE-2025-66418, CVE-2025-66471,
    CVE-2026-21441, and pyasn1 CVE-2026-23490 on all archs
    Resolves: RHEL-146344


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-110.1
changelog:
  - bundled cryptography: replace with dependency to fix CVE-2026-26007
  - bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597
    Resolves: RHEL-167241, RHEL-155676


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-85
changelog:
  - fence_azure_arm: use azure-identity instead of msrestazure, which has
    been deprecated
    Resolves: RHEL-76493


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-86.3
changelog:
  - fence_ibm_vpc: refresh bearer-token if token data is corrupt, and
    avoid edge-case of writing empty token file
    Resolves: RHEL-83488


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-86.4
changelog:
  - fence_sbd: improve error handling and get devices from SBD_DEVICE env
    variable if devices parameter isnt set
    Resolves: RHEL-92695


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-77
changelog:
  - fence_scsi: preempt clears all devices on the mpath device, so only
    run it for the first device
    Resolves: RHEL-59878
  - ha-cloud-support: remove bundled awscli and use awscli2 package
    instead
    Resolves: RHEL-60020


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-80
changelog:
  - fence_mpath: add support for hex-key format (used in multipath.conf)
    Resolves: RHEL-56138
  - fence_scsi/fence_mpath: add support for SPC-4 disks
    Resolves: RHEL-7629


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-81
changelog:
  - fence_ibm_powervs: add private endpoint and token file support
    Resolves: RHEL-62206
  - ha-cloud-support: bundle libs for the powervs-subnet resource agent
    Resolves: RHEL-64023


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-87
changelog:
  - fence_ibm_vpc: refresh bearer-token if token data is corrupt, and
    avoid edge-case of writing empty token file
    Resolves: RHEL-83255


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-88
changelog:
  - fence_compute/fence_evacuate: dont use deprecated inspect.getargspec()
    Resolves: RHEL-84448
  - fence_sbd: get devices from SBD_DEVICE env variable if devices
    parameter isnt set
    Resolves: RHEL-79798


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-98.4
changelog:
  - bundled urllib3: fix CVE-2025-66471
  - bundled urllib3: fix CVE-2026-21441
    Resolves: RHEL-139793, RHEL-140795


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-98.10
changelog:
  - bundled urllib3: fix CVE-2024-37891, CVE-2025-66418, CVE-2025-66471,
    CVE-2026-21441, and pyasn1 CVE-2026-23490 on all archs
    Resolves: RHEL-146351


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-98.12
changelog:
  - bundled cryptography: replace with dependency to fix CVE-2026-26007
  - bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597
    Resolves: RHEL-148436, RHEL-155675


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-45
changelog:
  - fence_aws: add --skip-race-check parameter to allow running outside
    of AWS network
    Resolves: rhbz#2183162


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-55
changelog:
  - bundled dateutil: fix tarfile CVE-2007-4559
    Resolves: rhbz#2217902
  - fence_ipmilan: fix typos in metadata
    Resolves: rhbz#2224267


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-56
changelog:
  - fence_scsi: fix registration handling if ISID conflicts
    Resolves: RHEL-5396
  - bundled certifi: fix CVE-2023-37920
    Resolves: RHEL-9446


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-60
changelog:
  - all agents: update metadata in non-I/O agents to Power or Network
    fencing
    Resolves: RHEL-14030


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-62
changelog:
  - bundled urllib3: fix CVE-2023-45803
    Resolves: RHEL-18139
  - bundled pycryptodome: fix CVE-2023-52323
    Resolves: RHEL-20917
  - bundled jinja2: fix CVE-2024-22195
    Resolves: RHEL-21345


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-62.1
changelog:
  - ha-cloud-support: upgrade bundled pyroute2 libs to fix issue in
    gcp-vpc-move-route's stop-action
    Resolves: RHEL-29668


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-66
changelog:
  - Add missing licenses to spec-file
    Resolves: RHEL-27929
  - ha-cloud-support: fix aliyun-cli
    Resolves: RHEL-28097


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-69
changelog:
  - ha-cloud-support: upgrade bundled pyroute2 libs to fix issue in
    gcp-vpc-move-route's stop-action
    Resolves: RHEL-29649


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-70
changelog:
  - fence_aliyun: add credentials file support, filter parameter, and
    optimize log output
    Resolves: RHEL-31488, RHEL-31485, RHEL-31483


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-73
changelog:
  - fence_vmware_rest: detect if the API user has sufficient rights to
    manage the fence device
    Resolves: RHEL-25256


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-76.1
changelog:
  - fence_scsi: preempt clears all devices on the mpath device, so only
    run it for the first device
    Resolves: RHEL-59882


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-76.6
changelog:
  - fence_ibm_vpc: refresh bearer-token if token data is corrupt, and
    avoid edge-case of writing empty token file
    Resolves: RHEL-83487


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 6.4.24-1
changelog:
  - Update to fetchmail-6.4.24 (fixes CVE-2021-36386 and CVE-2021-39272)
    Resolves: #2005307, #1999276


author: Pavel Reichl <preichl@redhat.com> - 3.35-1
changelog:
  - Rebase to new upstream release
  - Do NOT drop support for pmemblk https://github.com/axboe/fio/commit/04c1cdc
  - Add signature check
  - Related: rhbz#2188805


author: Jan Grulich <jgrulich@redhat.com - 128.4.0-2
changelog:
  - Enable PipeWire camera support for RHEL 10
    + backport upstream fixes for PipeWire camera support
    Fixes: RHEL-64749


author: Eric Garver <egarver@redhat.com> - 1.3.4-6
changelog:
  - feat(IPv6_rpfilter): support loose rpfilter
  - feat(IPv6_rpfilter): support loose-forward rpfilter
  - feat(IPv6_rpfilter): support strict-forward rpfilter


author: Eric Garver <egarver@redhat.com> - 1.3.4-17
changelog:
  - fix(server): load firewall rules before claiming dbus
  - fix(nftables): ipset: add entries from GLib loop when idle
  - fix(systemd): Requires dbus


author: Richard Hughes <richard@hughsie.com> 1.2-7
changelog:
  - Disable JLink support to remove one extra dep we are not going to support
  - Resolves: rhbz#1948597


author: Debarshi Ray <rishi@fedoraproject.org> - 1.12.4-2
changelog:
  - Don't try to add Fedora's OCI Flatpak repository on RHEL
  - Remove an obsolete Fedora-specific update path
  Resolves: #2051697


author: Kalev Lember <klember@redhat.com> - 1.12.9-2
changelog:
  - Backport upstream patches for CVE-2024-42472
  - Require bubblewrap version that has new --bind-fd option backported for
    addressing CVE-2024-42472


author: Jan Grulich <jgrulich@redhat.com> - 1.12.9-4.1
changelog:
  - Fix arbitrary code execution via crafted symlinks in sandbox-expose options
    Resolves: RHEL-165643
  - Fix arbitrary file deletion on host via improper cache file path validation
    Resolves: RHEL-170171


author: Arjun Shankar <arjun@redhat.com> - 2.6.4-6
changelog:
  - Re-work flex subpackages and provide shared libraries (#1327851):
  - Remove and obsolete the flex-devel subpackage containing static libraries
  - Provide shared libraries in a new subpackage named libfl2
  - Provide development files in a new subpackage named libfl-devel
  - Provide static libraries in a new subpackage named libfl-static


author: Lukáš Zaoral <lzaoral@redhat.com>- 3.0.4-9
changelog:
  - backport the following fixes from Fedora:
    - fix header conflicts in multilib installs (RHEL-134741)
    - fix rpmlint warnings


author: Adam Jackson <ajax@redhat.com> - 1.3.5-9
changelog:
  - Remove BuildRequires xprop entirely. If present, the configure script will call
    it looking for a property on the root window that Fedora's X server does not
    set, and which would not work anyway since there is no X server running in the
    buildroot, so we can just remove the dependency.


author: Fabio Alessandro Locati <fale@fedoraproject.org> - 5.13.1-2
changelog:
  - Provide the right font configuration
  - Drop ttf format since upstream affirms that otf is to be preferred


author: Akira TAGOH <tagoh@redhat.com> - 2.13.94-2
changelog:
  - Fix the score calculation on matching for multiple values.
  - Enable 11-lcdfilter-default.conf.
    Resolves: rhbz#1965684
  - Rebase to the latest release.
    Resolves: rhbz#2023161


author: Akira TAGOH <tagoh@redhat.com> - 2.13.95-1
changelog:
  - New upstream release.
  - Update deps to font(notosans)
    https://fedoraproject.org/wiki/Changes/DefaultToNotoFonts


author: Akira TAGOH <tagoh@redhat.com> - 2.14.0-1
changelog:
  - New upstream release.
  - Rebase to 2.14 and revert Noto Default change happened in f36.
    Resolves: rhbz#2075393


author: Nicolas Mailhot <nim@fedoraproject.org>
changelog:
  - 3.0.3-1
  🐞 Fix bugs in the 3.0.2 refactoring
  - 3.0.2-1
  🐞 Workaround Fedora problems created by rpm commit 93604e2
     harder


author: Benjamin Berg <bberg@redhat.com> - 1.94.0-3
changelog:
  - Use GFDL abbreviation as GFDLv1.1+ is not listed
  - Install PAM module into /usr
  - Pull in further test fixes


author: José Expósito <jexposit@redhat.com> - 3.2.1-10
changelog:
  - Fix CVE-2024-24258 and CVE-2024-24259
    Resolves: https://issues.redhat.com/browse/RHEL-25176
    Resolves: https://issues.redhat.com/browse/RHEL-25178


author: Pavel Cahyna <pcahyna@redhat.com> - 1.6.14-2
changelog:
  - Apply upstream patch 41d0d70f
    ipmi-config: fix incorrect output of IPv6_Dynamic_Address_Source_Type


author: Antonio Torres <antorres@redhat.com> - 3.0.21-31
changelog:
  - Update OpenSSL 3.0 support backport to current v3.0.x branch state
  - Add "--enable-fips-workaround" to build options
    Related: rhbz#2083699


author: Antonio Torres <antorres@redhat.com> - 3.0.21-34
changelog:
  - Use GID / UID 95 as it's reserved for FreeRADIUS (https://pagure.io/setup/blob/07f8debf03dfb0e5ed36051c13c86c8cd00cd241/f/uidgid#_107)
    Resolves: #2095403


author: Ondrej Holy <oholy@redhat.com> - - 2:2.4.1-4
changelog:
  - CVE-2022-39282: Fix length checks in parallel driver (#2136152)
  - CVE-2022-39283: Add missing length check in video channel (#2136154)
  - CVE-2022-39316, CVE-2022-39317: Add missing length checks in zgfx (#2145140)
  - CVE-2022-39318: Fix division by zero in urbdrc channel (#2145140)
  - CVE-2022-39319: Add missing length checks in urbdrc channel (#2145140)
  - CVE-2022-39320: Ensure urb_create_iocompletion uses size_t (#2145140)
  - CVE-2022-39347: Fix path validation in drive channel (#2145140)
  - CVE-2022-41877: Add missing length check in drive channel (#2145140)


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.2-1
changelog:
  - Update to 2.11.2 (RHEL-4290, RHEL-4292, RHEL-4296, RHEL-4298, RHEL-4300,
    RHEL-4302, RHEL-4304, RHEL-4306, RHEL-4308, RHEL-4310, RHEL-4312,
    RHEL-10060)


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-1
changelog:
  - Update to 2.11.7 (CVE-2024-32039, CVE-2024-32040, CVE-2024-32041,
    CVE-2024-32458, CVE-2024-32459, CVE-2024-32460, CVE-2024-32658,
    CVE-2024-32659, CVE-2024-32660, CVE-2024-32661, CVE-2024-32662)


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-1.1
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-142426, RHEL-142410, RHEL-142394, RHEL-142378, RHEL-142362,
    Resolves: RHEL-142346, RHEL-142330


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-1.4
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-148046, RHEL-148049, RHEL-148054, RHEL-148061, RHEL-148079
    Resolves: RHEL-148094, RHEL-148096, RHEL-148104, RHEL-148939, RHEL-149029
    Resolves: RHEL-149042, RHEL-149065, RHEL-155993


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-1.6
changelog:
  - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)
  - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983)
    Resolves: RHEL-162958, RHEL-162978


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-1.7
changelog:
  - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986)
  - Fix growth of preallocated buffers (CVE-2026-27951)
  - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775)
  - Add DSP format checks (CVE-2026-31884)
  - Fix DSP array bounds checks (CVE-2026-31883)
  - Fix DSP array bounds checks (CVE-2026-31885)
  - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985)
    Resolves: RHEL-159815, RHEL-155477, RHEL-161046, RHEL-161481
    Resolves: RHEL-161517, RHEL-161084, RHEL-167803


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-3
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-142427, RHEL-142411, RHEL-142395, RHEL-142379, RHEL-142363
    Resolves: RHEL-142348, RHEL-142332


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-6
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-148052, RHEL-148053, RHEL-148056, RHEL-148075, RHEL-148081
    Resolves: RHEL-148098, RHEL-148105, RHEL-148106, RHEL-148941, RHEL-149032
    Resolves: RHEL-149043, RHEL-149066, RHEL-155994


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-7.1
changelog:
  - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)
  - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983)
    Resolves: RHEL-163097, RHEL-163113


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-7.2
changelog:
  - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986)
  - Fix growth of preallocated buffers (CVE-2026-27951)
  - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775)
  - Add DSP format checks (CVE-2026-31884)
  - Fix DSP array bounds checks (CVE-2026-31883)
  - Fix DSP array bounds checks (CVE-2026-31885)
  - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985)
    Resolves: RHEL-159816, RHEL-155478, RHEL-161047, RHEL-161482
    Resolves: RHEL-161519, RHEL-161085, RHEL-168463


author: Michel Lind <salimma@centosproject.org> - 2.10.4-10
changelog:
  - Fix for CVE-2025-27363 out-of-bound write vulnerability
  - Patch initially by Marc Deslauriers of Canonical
  - https://www.openwall.com/lists/oss-security/2025/03/14/3
  - Adjusted for EL9 by Jonathan Wright of AlmaLinux
  - and a member of the Meta security team
  - Resolves: RHEL-83105


author: Jonathan Wright <jonathan@almalinux.org> - 2.10.4-9.alma.1
changelog:
  - Backport from CentOS Stream 9 PR by Michel Lind <salimma@centosproject.org>
  - TrueType clean up and unsigned fixes for CVE-2025-27363
  - Resolves: RHEL-83280


author: Jonathan Wright <jonathan@almalinux.org> - 2.10.4-9.alma.2
changelog:
  - Rebase CVE-2025-27363 to simpler patch by Marc Deslauriers of Canonical
  - Resolves: RHEL-83280
  - Fix previous changelog version


author: Marek Kasik <mkasik@redhat.com> - 2.10.4-1
changelog:
  - Update to 2.10.4
  - Test bitmap size earlier for PNGs
  - Fix memory leak in pngshim.c
  - Enable man pages for demos
  - Resolves: #1887084, #1890211


author: Akira TAGOH <tagoh@redhat.com> - 2.10.4-3
changelog:
  - Enable HarfBuzz support
  - Add bootstrap without HarfBuzz
  - Resolves: #1853937
  - Resolves: #1906714


author: Akira TAGOH <tagoh@redhat.com> - 1.0.10-6.el9.2
changelog:
  - Security fixes for CVE-2022-25308, CVE-2022-25309, CVE-2022-25310
    Resolves: rhbz#2050086, rhbz#2050069, rhbz#2050063


author: Michal Ruprich <mruprich@redhat.com> - 8.5.3-9
changelog:
  - Resolves: RHEL-87730 - frr-k8s CI started failing using latest rpm, failures around BFD sessions
  - Resolves: RHEL-87731 - FRR bgp session not recovered due to incorect error no AF activated for peer


author: Michal Ruprich <mruprich@redhat.com> - 8.3.1-12
changelog:
  - Resolves: RHEL-3541 - Incorrect handling of a error in parsing of an invalid section of a BGP update can de-peer a router


author: Michal Ruprich <mruprich@redhat.com> - 8.5.3-2
changelog:
  - Resolves: RHEL-15915 - crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message
  - Resolves: RHEL-15918 - crash from malformed EOR-containing BGP UPDATE message


author: Michal Ruprich <mruprich@redhat.com> - 8.5.3-4.1
changelog:
  - Resolves: RHEL-68432 - FRR gives false warning when Graceful Restart enabled
  - Resolves: RHEL-78354 - BGP with BFD has a dropped Connection before peering established
  - Resolves: RHEL-78318 - BFD status down in FRR does not bring down BGP session between peers


author: Michal Ruprich <mruprich@redhat.com> - 0.17-85
changelog:
  - Use make_build macro and remove hard-coded gcc
  - https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make


author: Jindrich Novy <jnovy@redhat.com> - 1.16-1
changelog:
  - update to https://github.com/containers/fuse-overlayfs/releases/tag/v1.16
  - fixes "Update fuse-overlayfs to 1.16 [rhel-9.7.z]"
  - Resolves: RHEL-128520


author: Richard Hughes <richard@hughsie.com> 1.8.10-1
changelog:
  - Rebase to latest upstream release to fix multiple ESP detection problems
  - Resolves: rhbz#2128384, needed for rhbz#2119436 and rhbz#2128384


author: Richard Hughes <richard@hughsie.com> 1.8.10-2
changelog:
  - Rebuild because distrobaker did entirely the wrong thing.
  - Resolves: rhbz#2128384, needed for rhbz#2119436 and rhbz#2128384


author: Richard Hughes <richard@hughsie.com> 1.9.26-1
changelog:
  - Rebase to get hardware support for CERTPX-13842
  - Resolves: #RHEL-16637
  - Resolves: #RHEL-35373
  - Resolves: #RHEL-61930


author: Lukas Javorsky <ljavorsk@redhat.com> - 26.4.9-2
changelog:
  - Explicitly require the 'procps-ng' package
  - Otherwise it will not require it in the lightweight systems (e.g. containers)
  - and Galera won't work properly


author: Marek Polacek <polacek@redhat.com> - 12.0-3
changelog:
  - use rpm/macros.gcc-toolset-12-enable for %enable_devtoolset12 and put it in
    the -runtime subpackage (#2009528)


author: Nick Clifton <nickc@redhat.com> - 10.97-1
changelog:
  - Annocheck: Add test for binaries built by cross compilers.
  - Annocheck: Improve heuristic used to detect binaries without code. (#2144533)


author: Nick Clifton <nickc@redhat.com> - 11.02-1
changelog:
  - Annocheck: Do not assume that object files contain no code simply because they do not have an executable segment.  (#2158386)
  - Annocheck: Add more special glibc filenames.  (#2158100)


author: Nick Clifton <nickc@redhat.com> - 11.05-1
changelog:
  - Annocheck: Fix handling of empty files.  (#2159292)
  - Annocheck: Add crti.o and crtn.o to the list of known glibc special files.  (#2158740)
  - Annocheck: Fix memory leaks.


author: Nick Clifton <nickc@redhat.com> - 11.06-1
changelog:
  - Annocheck: Fix handling of file built by multiple versions of gcc.  (#2160700)
  - Spec file: Enable annotated building.


author: Nick Clifton <nickc@redhat.comn> - 2.38-17
changelog:
  - NVR Bump: Fix the Provides fields of the binutils-gold and binutils-devel subpackages.  (#2216446)


author: Nick Clifton <nickc@redhat.comn> - 2.38-17.1
changelog:
  - Use z-stream NVR: Fix the Provides fields of the binutils-gold and binutils-devel subpackages.  (#2220917)


author: Nick Clifton <nickc@redhat.comn> - 2.38-18
changelog:
  - Use z-stream NVR: Fix the Provides fields of the binutils-gold and binutils-devel subpackages.  (#2216456)


author: Marek Polacek <polacek@redhat.com> 12.2.1-4
changelog:
  - update from releases/gcc-12 branch (#2110583)
  - fix up std::from_chars behavior in rounding modes other than FE_TONEAREST
    (PR libstdc++/107468)


author: Marek Polacek <polacek@redhat.com> 12.2.1-7.5
changelog:
  - fix conditions for using memcmp in
    std::lexicographical_compare_three_way (PR libstdc++/113960, RHEL-30832)


author: Kevin Buettner - 11.2-2
changelog:
  - On ix86, add -Wno-format-overflow to --enable-gdb-build-warnings. 
    (This is a workaround for the bogus warning/error that we now see
    on i686 regarding a "may write a terminating nul past the end of
    the destination" message for the sprintf() call in
    global_symbol_searcher::search() in gdb/symtab.c.)


author: Kevin Buettner - 11.2-3
changelog:
  - Backport upstream patch which removes sizes from debuginfod download
    messages when the size is not available (RHBZ 2068280, Aaron Merey).


author: Marek Polacek <polacek@redhat.com> - 12.0-3
changelog:
  - use rpm/macros.gcc-toolset-13-enable for %enable_devtoolset12 and put it in
    the -runtime subpackage (#2009528)


author: Nick Clifton <nickc@redhat.com> - 12.14-1
changelog:
  - Annocheck: Do not ignore separate debuginfo files that do not contain any DWARF.  (#2144553)
  - Annocheck: Ignore /dev/null filename in string notes.
  - Annocheck: More tweaks to glibc detection heuristics.  (#2215968)


author: Nick Clifton <nickc@redhat.com> - 12.16-1
changelog:
  - Spec File: Rebuild with annobin annotation.  (#2217814)
  - Annocheck: Ignore weak/undef function symbols when checking to see if a binary contains code.  (#2217840)
  - Annocheck: Add --suppress-version-warnings option.


author: Nick Clifton <nickc@redhat.com> - 12.20-1
changelog:
  - Annocheck: Ignore AArch64 $x and $d symbols.  (#2221192)
  - GCC Plugin: Suppress active checks for fortran sources.  Improve scanning of COLLECT_GCC_OPTIONS.


author: Nick Clifton <nickc@redhat.com> - 12.32-1
changelog:
  - LLVM Plugin: Fix building with LLVM version 17.  (RHEL-17311)
  - GCC Plugin: Add support for -fhardended.
  - Update glibc detection heuristics for PPC64.  (RHEL-16453)
  - Fix another atexit test failure.  (#2247481)
  - Fix atexit test failure.
  - Notes: Add support for string format notes.
  - GCC Plugin: Record settings of -Wstrict-flex-arrays and -fstrict-flex-arrays
  - Annobin: Add future test of these options.
  - GCC Plugin: Record settings of -Wimplicit-int and -Wimplicit-function-declaration.
  - Annobin: Add test for these warnings.
  - GCC Plugin: Enable string note format by default.
  - Annocheck: Change GO FIPS test to look for CGO_ENABLED markers.
  - Annocheck: Add test for FIPS compliant GO binaries.
  - Annocheck: Fix double free.  (#2226749)


author: Nick Clifton <nickc@redhat.com> - 12.32-2
changelog:
  - GCC Plugin: Add %verify tokens to show that the default plugin names are symbolic links. (RHEL-17505)


author: Nick Clifton <nickc@redhat.com> - 12.65-1
changelog:
  - Rebase to 12.65.  (RHEL-51018)
  - Annocheck: Fix recording arguments for later re-use.  (RHEL-50802)
  - GCC Plugin: Fix building AArch64 components with gcc earlier than 11.3.
  - Annocheck: Add improvements to the builtby utility.
  - Annocheck: Add support for ADA binaries.
  - Annocheck: Add support for binaries built from more than two high level source languages.
  - Annocheck: Add support for object files containing no executable code.
  - Annocheck: Do not FAIL LLVM compiled binaries that have not been built with sanitize-cfi and/or sanitize-safe-stack.
  - Annocheck: Add support for Fortran binaries.
  - Annocheck: Add heuristic for detecting parts of the CGO runtime library.
  - Annocheck: Add improvements for handling Clang runtime binaries.
  - Annocheck: Add tweaks for mixed Rust/C binaries.  (#2284605)
  - Annocheck: Add more glibc source file names.
  - Annocheck: Skip GAPS test for GO binaries.  (RHEL-36308)
  - Annocheck: Remove some false positives for Rust binaries.  (#2280239)
  - Annocheck: Defer passing the branch protection test until all notes have been checked.
  - GCC Plugin: Add extra code for detecting the branch protection setting.  (RHEL-35958)


author: Nick Clifton <nickc@redhat.com> - 12.69-1
changelog:
  - BuiltBy: Fix seg-fault when comparing language version strings.  (RHEL-53497)
  - Spec File: Use correct names for the symlinks.  (RHEL-53574)


author: Nick Clifton <nickc@redhat.com> - 12.92-1
changelog:
  - Rebase to bring in improvements for locating string notes.  (RHEL-79807)
  - Annocheck: Do not rely upon libelf's ability to detect links to separate debuginfo files.  (RHEL-79264)
  - Annocheck: Fix resource leak.  (RHEL-79253)
  - Annocheck: Fix double free. Add special handling for COMBOOT modules.
  - Annocheck: Improve diagnostics when a separate debug info file cannot be found.
  - Annocheck: Look for -fstack-clash-protection in DW_AT_producer string.  (RHEL-77328)
  - Annocheck: Fix locating string notes (again).  Add exception for glibc benchmark tests.  (RHEL-76456)
  - Annocheck: Add crtoffloadtableS.o to list of known gcc binaries.  (RHEL-760404)
  - Annocheck: Fix the --debug-dir option.
  - Annocheck: Fix corrupt warning message when unable to locate separate debug info files.
  - Annocheck: Remove spurious debugging messages.
  - Annocheck: Always look for annobin notes in separate debug info files.  (RHEL-75778)
  - Annocheck: Support multiple --debug-rpm and --debug-file options.  (RHEL-73349)
  - Annocheck: Add support for sys-root'ed glibc packages.  (RHEL-71296)
  - GCC Plugin: Tidy up use of gcc's diagnoatic headers.  (#32429)
  - Testsuite: Use configured compiler when running tests.
  - GCC Plugin: Fix building with gcc 15.  (#32429)
  - Annocheck: Fix overly long debug messages.
  - Annocheck: Rename rwx-seg test to load-segments.  Add more checks.  Add check for gaps as a future fail.
  - Annocheck: Add --no-allow-excpetions to disable exceptions for known special binaries.
  - Annocheck: Add --enable-future to enable future fail components in normal tests.
  - Annocheck: Fix bug preventing the inclusion of the rpm name in reports.
  - Annocheck: Add more exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Add --skip-passes option.
  - Annocheck: Add exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Skip property note test for i386 binaries created by LLVM.  (#2323797)
  - Annocheck: Skip FORTIFY and GLIBC_ASSERTIONS tests for LLVM produced binaries with unparseable DW_AT_producer attributes in their DWARF debug info.  (RHEL-65411)
  - GCC Plugin: Change type of the .annobin.notes section from SHT_STRTAB to SHT_PROGBITS.


author: Nick Clifton <nickc@redhat.com> - 2.40-12
changelog:
  - Spec File: Enable building with GTS-13 gcc.  (#2217819)
  - Spec File: Sync version number with c8s.


author: Nick Clifton <nickc@redhat.com> - 2.40-17
changelog:
  - Spec File: Do not use of the system zlib by default.  (RHEL-19373)
  - Spec File: Do not check the mtime of ld.bfd. (RHEL-21303)


author: Nick Clifton <nickc@redhat.com> - 2.40-19
changelog:
  - Spec File: Restore the SElinux context to %{_libdir}.  (RHEL-22818)
  - [2.40-18: was a failed attempt to fix RHEL-22818]


author: Marek Polacek <polacek@redhat.com> 13.1.1-4
changelog:
  - update from releases/gcc-13 branch (#2188499)
    - PRs bootstrap/110085, c++/109871, fortran/100607, libgcc/109670,
  	libgcc/109685, libstdc++/108178, libstdc++/109261, libstdc++/109758,
  	libstdc++/109822, libstdc++/109949, libstdc++/110139,
  	middle-end/110200, target/82931, target/92729, target/104327,
  	target/105753, target/106907, target/109547, target/109650,
  	target/109800, target/109939, target/109954, target/110036,
  	target/110044, target/110088, target/110108, target/110227,
  	tree-optimization/109505, tree-optimization/110165,
  	tree-optimization/110166


author: Marek Polacek <polacek@redhat.com> 13.2.1-4
changelog:
  - update from releases/gcc-13 branch
    - PRs ada/110488, ada/111434, c++/99631, c++/111471, c++/111485, c++/111493,
  	c++/111512, fortran/68155, fortran/92586, fortran/111674,
  	libstdc++/108046, libstdc++/111050, libstdc++/111102,
  	libstdc++/111511, middle-end/111699, modula2/111510, target/111121,
  	target/111411, tree-optimization/110315, tree-optimization/110386,
  	tree-optimization/111331, tree-optimization/111519


author: Marek Polacek <polacek@redhat.com> 13.2.1-5
changelog:
  - update from releases/gcc-13 branch
    - PRs c++/89038, c/111884, d/110712, d/112270, fortran/67740, fortran/97245,
  	fortran/111837, fortran/112316, libbacktrace/111315,
  	libbacktrace/112263, libstdc++/110944, libstdc++/111172,
  	libstdc++/111936, libstdc++/112089, libstdc++/112314,
  	middle-end/111253, middle-end/111818, modula2/111756, modula2/112110,
  	target/101177, target/110170, target/111001, target/111366,
  	target/111367, target/111380, target/111935, target/112443,
  	tree-optimization/111397, tree-optimization/111445,
  	tree-optimization/111489, tree-optimization/111583,
  	tree-optimization/111614, tree-optimization/111622,
  	tree-optimization/111694, tree-optimization/111764,
  	tree-optimization/111820, tree-optimization/111833,
  	tree-optimization/111917
    - fix aarch64 RA ICE (#2241139, PR target/111528)
  - fix ia32 doubleword rotates (#2238781, PR target/110792)


author: Marek Polacek <polacek@redhat.com> 13.2.1-6
changelog:
  - update from releases/gcc-13 branch
    - PRs c++/33799, c++/102191, c++/111703, c++/112269, c++/112301, c++/112633,
  	c/112339, fortran/111880, fortran/112764, libgomp/111413,
  	libstdc++/112348, libstdc++/112491, libstdc++/112607,
  	middle-end/111497, target/53372, target/110411, target/111408,
  	target/111815, target/111828, target/112672, tree-optimization/111137,
  	tree-optimization/111465, tree-optimization/111967,
  	tree-optimization/112496
  - add -fno-stack-protector to aarch64 tests (RHEL-17684)


author: Marek Polacek <polacek@redhat.com> 13.3.1-1
changelog:
  - update from releases/gcc-13 branch
    - GCC 13.3 release
    - PRs analyzer/104042, analyzer/108171, analyzer/109251, analyzer/109577,
  	analyzer/110014, analyzer/110112, analyzer/110700, analyzer/110882,
  	analyzer/111289, analyzer/112790, analyzer/112889, analyzer/112969,
  	analyzer/113253, analyzer/113333, analyzer/114408, analyzer/114473,
  	bootstrap/106472, bootstrap/114369, c/112571, c/114780, c++/89224,
  	c++/97990, c++/100667, c++/103825, c++/110006, c++/111284, c++/112769,
  	c++/113141, c++/113966, c++/114303, c++/114377, c++/114537,
  	c++/114561, c++/114562, c++/114572, c++/114580, c++/114634,
  	c++/114691, c++/114709, debug/112718, driver/111700, fortran/36337,
  	fortran/50410, fortran/55978, fortran/89462, fortran/93678,
  	fortran/95374, fortran/101135, fortran/102003, fortran/103707,
  	fortran/103715, fortran/103716, fortran/104352, fortran/106987,
  	fortran/106999, fortran/107426, fortran/110987, fortran/112407,
  	fortran/113799, fortran/113866, fortran/113885, fortran/113956,
  	fortran/114001, fortran/114474, fortran/114535, fortran/114739,
  	fortran/114825, fortran/115039, gcov-profile/114115,
  	gcov-profile/114715, ipa/92606, ipa/108007, ipa/111571, ipa/112616,
  	ipa/113359, ipa/113907, ipa/113964, jit/110466, libgcc/111731,
  	libquadmath/114533, libstdc++/66146, libstdc++/93672,
  	libstdc++/104606, libstdc++/107800, libstdc++/108976,
  	libstdc++/110050, libstdc++/110054, libstdc++/113841,
  	libstdc++/114147, libstdc++/114316, libstdc++/114359,
  	libstdc++/114367, libstdc++/114401, libstdc++/114750,
  	libstdc++/114803, libstdc++/114863, libstdc++/115063, lto/114655,
  	middle-end/110027, middle-end/111151, middle-end/111632,
  	middle-end/111683, middle-end/112684, middle-end/112732,
  	middle-end/113396, middle-end/113622, middle-end/114070,
  	middle-end/114348, middle-end/114552, middle-end/114599,
  	middle-end/114734, middle-end/114753, middle-end/114907,
  	rtl-optimization/54052, rtl-optimization/114415,
  	rtl-optimization/114768, rtl-optimization/114924, sanitizer/97696,
  	sanitizer/114687, sanitizer/114743, sanitizer/114956,
  	sanitizer/115172, target/88309, target/101865, target/105522,
  	target/110621, target/111234, target/111600, target/111610,
  	target/111822, target/112397, target/113095, target/113233,
  	target/113950, target/114049, target/114130, target/114160,
  	target/114172, target/114175, target/114272, target/114747,
  	target/114752, target/114794, target/114837, target/114848,
  	target/114981, testsuite/111066, testsuite/112297, testsuite/114034,
  	testsuite/114036, testsuite/114662, tree-optimization/91838,
  	tree-optimization/109925, tree-optimization/110838,
  	tree-optimization/111009, tree-optimization/111268,
  	tree-optimization/111407, tree-optimization/111736,
  	tree-optimization/111882, tree-optimization/112281,
  	tree-optimization/112303, tree-optimization/112793,
  	tree-optimization/112961, tree-optimization/112991,
  	tree-optimization/113552, tree-optimization/113630,
  	tree-optimization/113670, tree-optimization/113831,
  	tree-optimization/113910, tree-optimization/114027,
  	tree-optimization/114115, tree-optimization/114121,
  	tree-optimization/114203, tree-optimization/114231,
  	tree-optimization/114246, tree-optimization/114375,
  	tree-optimization/114396, tree-optimization/114485,
  	tree-optimization/114566, tree-optimization/114672,
  	tree-optimization/114733, tree-optimization/114736,
  	tree-optimization/114749, tree-optimization/114787,
  	tree-optimization/114799, tree-optimization/114876,
  	tree-optimization/114965, tree-optimization/115143,
  	tree-optimization/115152, tree-optimization/115154
  - add --without-clang-plugin --without-llvm-plugin to annobin configure
    options


author: Marek Polacek <polacek@redhat.com> 13.3.1-2
changelog:
  - update from releases/gcc-13 branch
    - PRs ada/114398, ada/114708, c/114493, c++/111529, c++/113598,
  	fortran/110415, fortran/114827, fortran/115150, libstdc++/114940,
  	libstdc++/115269, middle-end/108789, rtl-optimization/114902,
  	rtl-optimization/115092, target/113281, target/113719, target/115297,
  	target/115317, target/115324, tree-optimization/115192,
  	tree-optimization/115307, tree-optimization/115337
  - fix a shell condition (RHEL-40722)
  - backport a fix for modes_1.f90 (RHEL-40234)
  - fix up pointer types to may_alias structures (PR c/114493, RHEL-40244)


author: Keith Seitz <keiths@redhat.com> - 12.1-14
changelog:
  From Sergey Mende:
  - Backport upstream patch "gdb: call check_typedef at beginning of
    dwarf_expr_context::fetch_result". (Simon Marchi)


author: Kevin Buettner <kevinb@redhat.com> - 12.1-16
changelog:
  - Tweak gdb-6.3-rh-testversion-20041202.patch so that $_gdb_major
    and $_gdb_minor will be obtained correctly.


author: Keith Seitz <keiths@redhat.com> - 12.1-2.el9
changelog:
  - Backport binutls/29699 "Fix an illegal memory access when parsing..."
    (Nick Clifton, RHBZ 2153228)


author: Guinevere Larsen <blarsen@redhat.com> - 12.1-4.el9
changelog:
  - Backport "Fix typo in recent code to add stack recursion limit to the Rust demangler."
    (Nick Clifton)
  - Backport "Add a recursion limit to the demangle_const function in the Rust demangler."
    (Nick Clifton, RHEL-4234)


author: Nick Clifton <nickc@redhat.com> - 12.67-1
changelog:
  - Annocheck: Stop spurious assembler warnings.  (RHEL-53213)
  - Annocheck: Stop warnings about known gaps.    (RHEL-53218)
  - Annocheck: Fix stack realign test.  (#2302427)


author: Nick Clifton <nickc@redhat.com> - 12.67-2
changelog:
  - Spec File: Use correct directory for plugin installation.  (RHEL-53209)
  - Spec File: Disable plugin when running on wrong major version of the compiler.


author: Nick Clifton <nickc@redhat.com> - 12.69-1
changelog:
  - BuiltBy: Fix seg-fault when comparing language version strings.  (RHEL-53497)
  - Spec File: Use correct names for the symlinks.  (RHEL-53209)


author: Nick Clifton <nickc@redhat.com> - 12.87-1
changelog:
  - Rebase for GTS 14.1 release.  (RHEL-76932)
  - Annocheck: Fix locating string notes (again).  Add exception for glibc benchmark tests.  (RHEL-76456)
  - Annocheck: Add crtoffloadtableS.o to list of known gcc binaries.  (RHEL-760404)
  - Annocheck: Fix the --debug-dir option.
  - Annocheck: Fix corrupt warning message when unable to locate separate debug info files.
  - Annocheck: Remove spurious debugging messages.
  - Annocheck: Always look for annobin notes in separate debug info files.  (RHEL-75778)
  - Annocheck: Support multiple --debug-rpm and --debug-file options.  (RHEL-73349)
  - Annocheck: Add support for sys-root'ed glibc packages.  (RHEL-71296)
  - GCC Plugin: Tidy up use of gcc's diagnoatic headers.  (#32429)
  - Testsuite: Use configured compiler when running tests.
  - GCC Plugin: Fix building with gcc 15.  (#32429)
  - Annocheck: Fix overly long debug messages.
  - Annocheck: Rename rwx-seg test to load-segments.  Add more checks.  Add check for gaps as a future fail.
  - Annocheck: Add --no-allow-excpetions to disable exceptions for known special binaries.
  - Annocheck: Add --enable-future to enable future fail components in normal tests.
  - Annocheck: Fix bug preventing the inclusion of the rpm name in reports.
  - Annocheck: Add more exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Add --skip-passes option.
  - Annocheck: Add exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Skip property note test for i386 binaries created by LLVM.  (#2323797)
  - Annocheck: Skip FORTIFY and GLIBC_ASSERTIONS tests for LLVM produced binaries with unparseable DW_AT_producer attributes in their DWARF debug info.  (RHEL-65411)
  - GCC Plugin: Change type of the .annobin.notes section from SHT_STRTAB to SHT_PROGBITS.


author: Marek Polacek <polacek@redhat.com> 13.2.1-6
changelog:
  - update from releases/gcc-13 branch
    - PRs c++/33799, c++/102191, c++/111703, c++/112269, c++/112301, c++/112633,
  	c/112339, fortran/111880, fortran/112764, libgomp/111413,
  	libstdc++/112348, libstdc++/112491, libstdc++/112607,
  	middle-end/111497, target/53372, target/110411, target/111408,
  	target/111815, target/111828, target/112672, tree-optimization/111137,
  	tree-optimization/111465, tree-optimization/111967,
  	tree-optimization/112496
  - add -fno-stack-protector to aarch64 tests (RHEL-16940)


author: Marek Polacek <polacek@redhat.com> 13.3.1-2
changelog:
  - update from releases/gcc-13 branch
    - PRs ada/114398, ada/114708, c/114493, c++/111529, c++/113598,
  	fortran/110415, fortran/114827, fortran/115150, libstdc++/114940,
  	libstdc++/115269, middle-end/108789, rtl-optimization/114902,
  	rtl-optimization/115092, target/113281, target/113719, target/115297,
  	target/115317, target/115324, tree-optimization/115192,
  	tree-optimization/115307, tree-optimization/115337
  - fix a shell condition (RHEL-40722)
  - backport a fix for modes_1.f90 (RHEL-40234)
  - fix up pointer types to may_alias structures (PR c/114493, RHEL-39736)


author: Marek Polacek <polacek@redhat.com> 14.2.1-1
changelog:
  - update from releases/gcc-14 branch
    - GCC 14.2 release
    - PRs analyzer/114899, c++/99241, c++/99242, c++/104981, c++/106760,
  	c++/111890, c++/115165, c++/115476, c++/115550, c++/115561,
  	c++/115583, c++/115623, c++/115754, c++/115783, c++/115865,
  	c++/115897, c++/115900, c++/115986, fortran/59104, fortran/84006,
  	fortran/93635, fortran/98534, fortran/99798, fortran/100027,
  	fortran/103115, fortran/103312, fortran/113363, fortran/115700,
  	ipa/111613, ipa/113291, ipa/113787, ipa/114207, ipa/115033,
  	ipa/115277, ipa/116055, libstdc++/113376, libstdc++/114387,
  	libstdc++/115399, libstdc++/115482, libstdc++/115522,
  	libstdc++/115585, libstdc++/115807, libstdc++/115854,
  	libstdc++/116070, middle-end/115527, middle-end/115836,
  	middle-end/115887, pch/115312, rtl-optimization/115049,
  	rtl-optimization/115565, target/87376, target/88236, target/97367,
  	target/98762, target/105090, target/113715, target/114759,
  	target/114890, target/114936, target/114988, target/115068,
  	target/115153, target/115188, target/115351, target/115389,
  	target/115456, target/115457, target/115459, target/115475,
  	target/115526, target/115554, target/115562, target/115591,
  	target/115611, target/115691, target/115725, target/115726,
  	target/115752, target/115763, target/115840, target/115872,
  	target/115978, target/115981, target/115988, target/116035,
  	testsuite/115826, testsuite/116061, tree-optimization/113673,
  	tree-optimization/115382, tree-optimization/115646,
  	tree-optimization/115669, tree-optimization/115694,
  	tree-optimization/115701, tree-optimization/115723,
  	tree-optimization/115841, tree-optimization/115843,
  	tree-optimization/115867, tree-optimization/115868,
  	tree-optimization/116034, tree-optimization/116057


author: Marek Polacek <polacek@redhat.com> 14.2.1-7
changelog:
  - update from releases/gcc-14 branch (RHEL-74061)
    - PRs ada/113036, ada/113868, ada/115917, ada/117328, ada/117996,
  	analyzer/115724, c/117641, c/117745, c/117802, c++/100358, c++/101463,
  	c++/102594, c++/109859, c++/113108, c++/114854, c++/115008,
  	c++/115430, c++/115657, c++/116108, c++/116634, c++/117158,
  	c++/117317, c++/117614, c++/117615, c++/117792, c++/117825,
  	c++/117845, c++/117880, c++/117925, c++/117985, c++/118060,
  	c++/118069, driver/117942, fortran/84674, fortran/84869,
  	fortran/105054, fortran/109105, fortran/109345, fortran/115070,
  	fortran/115348, fortran/116388, fortran/117730, fortran/117763,
  	fortran/117774, fortran/117791, fortran/117797, fortran/117819,
  	fortran/117820, fortran/117843, fortran/117897, libgomp/117851,
  	libstdc++/89624, libstdc++/106212, libstdc++/106676, libstdc++/108236,
  	libstdc++/109517, libstdc++/109976, libstdc++/112349,
  	libstdc++/112641, libstdc++/117520, libstdc++/117560,
  	libstdc++/117822, libstdc++/117962, libstdc++/117966,
  	libstdc++/118035, libstdc++/118093, middle-end/43374,
  	middle-end/102674, middle-end/116997, middle-end/117433,
  	middle-end/117458, middle-end/117459, middle-end/117847,
  	middle-end/118024, modula2/114529, modula2/115003, modula2/115057,
  	modula2/115164, modula2/115276, modula2/115328, modula2/115536,
  	modula2/115540, modula2/115804, modula2/115823, modula2/115957,
  	modula2/116048, modula2/116181, modula2/116378, modula2/116557,
  	modula2/116918, modula2/117120, modula2/117371, modula2/117555,
  	modula2/117660, modula2/117904, modula2/117948, other/116603,
  	preprocessor/117118, rtl-optimization/113994, rtl-optimization/116799,
  	rtl-optimization/117095, sanitizer/117960, target/64242,
  	target/114801, target/114942, target/116371, target/116629,
  	target/116999, target/117045, target/117105, target/117304,
  	target/117357, target/117408, target/117418, target/117443,
  	target/117500, target/117525, target/117562, target/117564,
  	target/117642, target/117659, target/117675, target/117744,
  	target/117926, testsuite/103298, testsuite/109360,
  	tree-optimization/94589, tree-optimization/112376,
  	tree-optimization/116463, tree-optimization/117142,
  	tree-optimization/117254, tree-optimization/117307,
  	tree-optimization/117333, tree-optimization/117398,
  	tree-optimization/117417, tree-optimization/117439,
  	tree-optimization/117574, tree-optimization/117594,
  	tree-optimization/117612, tree-optimization/117912
  - fix up -freport-bug default (#2330362, RHEL-70192)
  - revert -mearly-ldp-fusion and -mlate-ldp-fusion default to enabled on
    aarch64 to match upstream (RHEL-74059)
  - consider TARGET_EXPR invariant like SAVE_EXPR (PR c++/118509)
  - have gfortran require install-info (RHEL-62417)


author: Marek Polacek <polacek@redhat.com> 15.1.1-1
changelog:
  - update from releases/gcc-15 branch
    - GCC 15.1 release
    - PRs fortran/119836, target/119327, target/119873, tree-optimization/118407


author: Marek Polacek <polacek@redhat.com> 15.1.1-2
changelog:
  - update from releases/gcc-15 branch
    - PRs ada/112958, ada/120104, c/120057, c++/119863, c++/119864, c++/119938,
     c++/119939, c++/119981, c++/119996, c++/120012, c++/120013,
     c++/120023, c++/120125, c++/120161, c++/120350, fortran/102891,
     fortran/102900, fortran/119928, fortran/119986, fortran/120049,
     fortran/120107, fortran/120139, fortran/120163, fortran/120179,
     fortran/120191, ipa/119852, ipa/119973, ipa/120006, ipa/120146,
     libfortran/120152, libfortran/120153, libfortran/120158,
     libfortran/120196, libstdc++/118260, libstdc++/119427,
     libstdc++/119714, libstdc++/120029, libstdc++/120114,
     libstdc++/120159, libstdc++/120187, libstdc++/120190,
     libstdc++/120198, libstdc++/120293, modula2/115276, modula2/119914,
     modula2/119915, modula2/120117, modula2/120188, preprocessor/116047,
     preprocessor/120061, target/119610, testsuite/119909,
     tree-optimization/111873, tree-optimization/119712,
     tree-optimization/120043, tree-optimization/120048,
     tree-optimization/120074, tree-optimization/120089,
     tree-optimization/120143, tree-optimization/120211


author: Siddhesh Poyarekar <siddhesh@redhat.com> 15.2.1-7
changelog:
  - update from releases/gcc-15 branch (RHEL-116513)
    - PRs ada/68179, ada/123060, ada/123088, ada/123096, ada/123138, ada/123185,
  	ada/123289, ada/123302, ada/123306, ada/123371, ada/123589,
  	analyzer/122975, analyzer/123085, c/123156, c++/91388, c++/114764,
  	c++/116952, c++/120446, c++/121854, c++/121966, c++/122048,
  	c++/122070, c++/122550, c++/122668, c++/122752, c++/122772,
  	c++/122834, c++/122922, c++/123331, c++/123597, debug/121964,
  	diagnostics/120063, fortran/107406, libfortran/122936,
  	libstdc++/120446, libstdc++/122812, libstdc++/122907,
  	libstdc++/123147, middle-end/111817, middle-end/123107,
  	middle-end/123392, middle-end/123703, rtl-optimization/121773,
  	rtl-optimization/122215, rtl-optimization/123121,
  	rtl-optimization/123523, target/117575, target/119130,
  	target/120250, target/121192, target/121485, target/123022,
  	target/123092, target/123155, target/123217, target/123460,
  	target/123484, target/123489, target/123521, target/123607,
  	target/123742, testsuite/123353, tree-optimization/122793,
  	tree-optimization/122868, tree-optimization/123040,
  	tree-optimization/123300, tree-optimization/123351,
  	tree-optimization/123372, tree-optimization/123431,
  	tree-optimization/123513, tree-optimization/123602,
  	tree-optimization/123736, tree-optimization/123741


author: Filip Januš <fjanus@redhat.com> - 2.2.5-12
changelog:
  - Add patch(gd-2.2.5-null-pointer.patch) - fix Null pointer reference in gdImageClone (gdImagePtr src)
  - Resolves: #1599032


author: Filip Januš <fjanus@redhat.com> - 2.3.1-1
changelog:
  - Upstream released new version 2.3.1
  - patch bug615 is no more needed - fixed by upstream in release
  - gdimagestring16/gdimagestring16 gdimagestringup16/gdimagestringup16 passed on
    x390s - XFAIL_TEST definition for x390s is no more necessary


author: Filip Januš <fjanus@redhat.com> - 2.3.2-1
changelog:
  - Add condition if fedora for packages not available in RHEL
  - enable avif support
  - use bcond
  - rebase to version 2.3.2


author: Bruno Larsen <blarsen@redhat.com>
changelog:
  - Bakport "Fix assertion failure in copy_type"
    (Tom Tromey, RHBZ 2155439)
  - Bakport "[gdb/testsuite] Fix PR20630 regression test in gdb.base/printcmds.exp"
    (Tom de Vries)


author: Bruno Larsen <blarsen@redhat.com> - 10.2-11.el9
changelog:
  - Backport "libiberty: prevent buffer overflow when decoding user input"
    (Luís Ferreira, RHBZ2132600)


author: Guinevere Larsen <blarsen@redhat.com> - 10.2-12.el9
changelog:
  - Backport "libiberty: Fix infinite recursion in rust demangler."
    (Nick Clifton)
  - Backport Add a recursion limit to the demangle_const function in the Rust demangler.
    (Nick Clifton, RHEL-4234)
  - Backport Fix typo in recent code to add stack recursion limit to the Rust demangler.
    (Nick Clifton)


author: Keith Seitz - 10.2-13.el9
changelog:
  - Backport patches for "Fix undefined behaviour dereferencing empty string"
    (Magne Hov et al, RHEL-17631)


author: Guinevere Larsen <blarsen@redhat.com>
changelog:
  - Remove gdb-6.5-BEA-testsuite.patch, as it was upstreamed and
    will make its way back with the next rebase.


author: Kevin Buettner <kevinb@redhat.com> - 14.1-8
changelog:
  - Backport upstream workaround for GCC 14 problem which is causing
    GDB internal errors (RHBZ 261580, Tom de Vries).


author: Keith Seitz <keiths@redhat.com>
changelog:
  - Backport "gdb: s390: Add arch14 record/replay support"
    (Andreas Arnez, RHEL-36225)
  - Backport "Add support for Power11 options"
    (Peter Bergner, RHEL-36518)
  - Backport "Sync x86 disassembler with (proposed) gdb-15.1 release."
    (many authors, RHEL-36527)


author: Guinevere Larsen <blarsen@redhat.com>
changelog:
  - Backport series Infcalls from B/P conditions in multi-threaded inferiors
    (Andrew Burgess, RHEL-13298)


author: Guinevere Larsen <blarsen@redhat.com> - 14.2-1.el9
changelog:
  - Rebase to gdb-14.2 and update all bug references
    (Resolves: RHEL-39554)
    (Resolves: RHEL-39553)
    (Resolves: RHEL-10550)
    (Resolves: RHEL-39555)
    (Resolves: RHEL-39585)
    (Resolves: RHEL-36211)


author: Andrew Burgess <aburgess@redhat.com>
changelog:
  - Remove gdb-rhbz1261564-aarch64-hw-watchpoint-test.patch.  This test
    should be covered by gdb.base/watchpoint-unaligned.exp which was
    added upstream in commit a3b60e4588606354b93508a0008a5.


author: Guinevere Larsen <guinevere@redhat.com>
changelog:
  - remove gdb-test-bt-cfi-without-die.patch.  This test has been
    accepted upstream and will make its way back to testing with
    the GDB 17 release.


author: Alexandra Hájková <ahajkova@redhat.com> - 16.2-1
changelog:
  - Rebase to FSF GDB 16.2.
    Dropped:  gdb-backport-buildid-related-changes.patch
              gdb-catchpoint-re-set.patch
              gdb-remove-qnx-neutrino-support.patch
    Modified: gdb-add-rpm-suggestion-script.patch


author: Tomas Popela <tpopela@redhat.com> - 2.42.6-3
changelog:
  - Backport fixes for CVE-2021-46829 and CVE-2021-44648
  - Resolves: rhbz#2115213
  - Resolves: rhbz#2044346


author: Ray Strode <rstrode@redhat.com> - 40.1-15
changelog:
  - Fix accountsservice user templates
    Resolves: #2062827
  - Properly force Xorg on matrox cards
    Related: #2074013
  - Fix typo that prevents the correct session type from being
    used when user switching.
    Resolves: #2074014


author: Ray Strode <rstrode@redhat.com> - 40.1-23
changelog:
  - Make /var/log/gdm tmpfiles.d snippet match files manifest
    to fix installability test
    Related: RHEL-19410


author: Joan Torres <joantolo@redhat.com> - 40.1-29
changelog:
  - Fix legacy-xorg session switching
    The fix that intended to fix the issue wasn't complete and also,
    introduced a bug on user switching for non legacy-xorg servers.
    This fix addresses both issues.
  - Avoid waiting 10s when starting GDM in legacy-xorg mode
    Resolves: RHEL-97492


author: Joan Torres <joantolo@redhat.com> - 40.1-31
changelog:
  - Fix legacy-xorg session switching
    The fix that intended to fix the issue wasn't complete and also,
    introduced a bug on user switching for non legacy-xorg servers.
    This fix addresses both issues.
  - Avoid waiting 10s when starting GDM in legacy-xorg mode
    Resolves: RHEL-72694


author: Joan Torres <joantolo@redhat.com> - 40.1-32
changelog:
  - Leave session-opened signature the same as before and use a new
    session-opened-with-session-id signal to keep ABI compatibility
    Related: RHEL-46383


author: Joan Torres <joantolo@redhat.com> - 40.1-35
changelog:
  - Instead of allowing adding custom parameters to Xorg,
    only allow adding -nocursor. Allowing adding custom parameters
    is a potential security issue.
    Related: RHEL-81194


author: Joan Torres Lopez <joantolo@redhat.com> - 40.1-43
changelog:
  - Update how GDM handles Registering session/display
    to properly terminate plymouth
    Resolves: https://redhat.atlassian.net/browse/RHEL-178706


author: Joan Torres Lopez <joantolo@redhat.com> - 40.1-44
changelog:
  - Create display in "legacy-xorg" mode checking displays in tty
    Resolves: https://redhat.atlassian.net/browse/RHEL-180820


author: Milan Crha <mcrha@redhat.com> - 2.6.0-8
changelog:
  - Backport Fedora change to provide a sysusers.d file to get user() and group() provides
    (see https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format)
  - Resolves: RHEL-78739


author: Sundeep Anand <suanand@redhat.com> - 0.21-6
changelog:
  - Add gettext-0.21-covscan.patch to fix issues detected by static analyzers
    Add gettext-0.21-disable-libtextstyle.patch
    Do not build libtextstyle, as it depends on libcroco
    which is now unmaintained and has known security bugs.
    Obsolete libtextstyle and libtextstyle-devel packages.


author: Zdenek Dohnal <zdohnal@redhat.com> - 9.54.0-15
changelog:
  - RHEL-39110 CVE-2024-33871 ghostscript: OPVP device arbitrary code execution via custom Driver library


author: Zdenek Dohnal <zdohnal@redhat.com> - 9.54.0-17
changelog:
  - RHEL-44759 CVE-2024-33870 ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths
  - RHEL-44745 CVE-2024-33869 ghostscript: path traversal and command execution due to path reduction
  - RHEL-44731 CVE-2024-29510 ghostscript: format string injection leads to shell command execution (SAFER bypass)


author: Zdenek Dohnal <zdohnal@redhat.com> - 9.54.0-16
changelog:
  - RHEL-38839 CVE-2024-33871 ghostscript: OPVP device arbitrary code execution via custom Driver library


author: Zdenek Dohnal <zdohnal@redhat.com> - 9.54.0-18
changelog:
  - RHEL-18397 CVE-2023-46751 ghostscript: dangling pointer in gdev_prn_open_printer_seekable()
  - RHEL-67048 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space
  - RHEL-67053 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding
  - RHEL-67053 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript
  - RHEL-67053 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution


author: Sandro Mani <manisandro@gmail.com> - 5.2.1-5
changelog:
  - Fix several defects found by Coverity scan
  - Generate HTML docs with consistent section IDs to avoid multilib difference


author: Josef Ridky <jridky@redhat.com> - 2:2.99.8-4
changelog:
  - Applying fixes for vulnerabilities that led to possible RCE conditions.
  - Fixes: CVE-2023-44441 CVE-2023-44442 CVE-2023-44443 CVE-2023-44444
  - Resolves: RHEL-86049 RHEL-86046 RHEL-86043 RHEL-86040


author: Josef Ridky <jridky@redhat.com> - 2:3.0.4-1.1
changelog:
  - fix CVE-2025-10920
  - fix CVE-2025-10921
  - fix CVE-2025-10922
  - fix CVE-2025-10923
  - fix CVE-2025-10924
  - fix CVE-2025-10925
  - fix CVE-2025-10934


author: Josef Ridky <jridky@redhat.com> - 2:3.0.4-1.5
changelog:
  - fix CVE-2026-4150
  - fix CVE-2026-4151
  - fix CVE-2026-4152
  - fix CVE-2026-4153
  - fix CVE-2026-4154
  - fix CVE-2026-4887


author: Josef Ridky <jridky@redhat.com> - 2:3.0.4-4.4
changelog:
  - fix CVE-2026-4150 - align with Y-stream
  - fix CVE-2026-4151
  - fix CVE-2026-4152
  - fix CVE-2026-4153
  - fix CVE-2026-4154
  - fix CVE-2026-4887


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 3.7.1-4.1
changelog:
  - Fix CVE-2026-39821: vendored golang.org/x/net/idna ToUnicode
    incorrectly accepting all-ASCII xn-- labels
  - Resolves: RHEL-183797


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-8
changelog:
  - Resolve use after free introduced by fixes for CVE-2023-24593/CVE-2023-25180
  - Related: #2181196
  - Related: #2181200


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-9
changelog:
  - Resolve s390x crashes introduced by fixes for CVE-2023-24593/CVE-2023-25180
  - Related: #2181196
  - Related: #2181200


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-11
changelog:
  - Really fix authentication failures when sd-bus clients connect to GDBus servers
  - Resolves: #2217771


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-16.2
changelog:
  - Add patches for CVE-2024-52533 and CVE-2025-4373
  - Update GDateTime test for new tzdata
  - Resolves: RHEL-94290
  - Resolves: RHEL-102845


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-17
changelog:
  - Add patches for CVE-2024-52533 and CVE-2025-4373
  - Update GDateTime test for new tzdata
  - Resolves: RHEL-94483
  - Resolves: RHEL-102844


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.68.4-19.2
changelog:
  - Fix CVE-2026-58016: broken node element nesting validation in
    D-Bus introspection XML parsing
  - Resolves: RHEL-190632


author: Florian Weimer <fweimer@redhat.com> - 2.34-100.2
changelog:
  - CVE-2024-33599: nscd: buffer overflow in netgroup cache (RHEL-34318)
  - CVE-2024-33600: nscd: null pointer dereferences in netgroup cache
  - CVE-2024-33601: nscd: crash on out-of-memory condition
  - CVE-2024-33602: nscd: memory corruption with NSS netgroup modules


author: Andrew Lukoshko <alukoshko@almalinux.org> - 2.34-100.2.alma.2
changelog:
  - elf: Avoid some free (NULL) calls in _dl_update_slotinfo
  - elf: Support recursive use of dynamic TLS in interposed malloc (RHEL-39992)


author: Patsy Griffin <patsy@redhat.com> - 2.34-100.3
changelog:
  - elf: Avoid some free (NULL) calls in _dl_update_slotinfo
  - elf: Support recursive use of dynamic TLS in interposed malloc (RHEL-39993)


author: Patsy Griffin <patsy@redhat.com> - 2.34-100.4
changelog:
  - elf: Clarify and invert second argument of _dl_allocate_tls_init
  - elf: Avoid re-initializing already allocated TLS in dlopen (RHEL-46763)


author: Patsy Griffin <patsy@redhat.com> - 2.34-122
changelog:
  - elf: Clarify and invert second argument of _dl_allocate_tls_init
  - elf: Avoid re-initializing already allocated TLS in dlopen (RHEL-36148)


author: Frédéric Bérat <fberat@redhat.com> - 2.34-265
changelog:
  - Fix null pointer dereference and assertion failures in __nss_database_get
    (bug 28940) (RHEL-150269)


author: Tamar Shacked <tshacked@redhat.com> - 6.0-56.3
changelog:
  - Rebase with latest RHGS-3.5.4
  - Fix changlog chronological order by removing unneeded changelogs
  - fixes bug bz#1939340


author: Jakub Martisko <jamartis@redhat.com> - 1:6.2.0-9
changelog:
  - Move the .hmac files to the fipscheck subfolder
  - Make symlinks from their original location (Fedora contains the .hmac files there) pointing to their new location
  Resolves: rhbz#1980758


author: Jakub Martisko <jamartis@redhat.com> - 1:6.2.0-13
changelog:
  - Fix: previous commit removed one function from the library and thus broke the ABI
  - function gmpn_preinv_divrem_1 should now not be removed
  Related: rhbz#2044216


author: Kalev Lember <klember@redhat.com> - 40~rc-1
changelog:
  - Update to 40.rc
  - Make -extras subpackage require the main package
  - Drop move-adwaita-backgrounds.patch
  - Remove old obsoletes


author: Bastien Nocera <bnocera@redhat.com> - 3.34.3-4
changelog:
  + gnome-bluetooth-3.34.3-4
  - Revert “Require PulseAudio _or_ Pipewire for Bluetooth audio”
  - Closes: #1928166


author: Felipe Borges <feborges@redhat.com> - 40.0-25
changelog:
  - Backport translations for Multitasking panel
  - Make Multitasking panel capable of handling Right-to-Left locales
    Resolves: #2105228


author: Felipe Borges <feborges@redhat.com> - 40.0-38
changelog:
  - Scale up monitors drawing in display arrangment settings when multiple monitors
    Related: RHEL-4196


author: Ray Strode <rstrode@redhat.com> - 40.0-6
changelog:
  - Copy and run the script from XDG_RUNTIME_DIR
    Resolves: https://issues.redhat.com/browse/RHEL-25536


author: Olivier Fourdan <ofourdan@redhat.com> - 40.0-8
changelog:
  - Add Xwayland and dbus-daemon as weak dependencies
    Resolves: https://issues.redhat.com/browse/RHEL-66572


author: Milan Crha <mcrha@redhat.com> - 3.40.0-4
changelog:
  - Resolves: RHEL-10492 (Move account types that depend on WebKitGTK into separate optional subpackage)


author: Milan Crha <mcrha@redhat.com> - 3.40.0-5
changelog:
  - Resolves: RHEL-10492 (Move account types that depend on WebKitGTK into separate optional subpackage)
  - backport upstream fix to use external browser for OAuth2


author: Joan Torres <joantolo@redhat.com> - 40.1.1-11
changelog:
  - Add race fixes needed when terminating a conflicting session
    on GDM greeter.
    Resolves: RHEL-92341


author: Felipe Borges <feborges@redhat.com> - 40.0.1-10
changelog:
  - Default power-button-action to poweroff on servers
    (except when power-button-action=nothing)
    Resolves: #1885639


author: Ray Strode <rstrode@redhat.com> - 40.0.1-13
changelog:
  - Revert hard dependency on subscription-manager since we're going to put it in gnome-session instead
    Related: #2175675


author: Ray Strode <rstrode@redhat.com> - 40.0.1-15
changelog:
  - Fix crashers in g-s-d and control-center related to
    making subscription-manager a soft dep
    Related: RHEL-20449


author: Felipe Borges <feborges@redhat.com> - 40.0.1-22
changelog:
  - Use mount path in "Low disk" notification when multiple mount points have same name
    Related: RHEL-11910


author: Joan Torres <joantolo@redhat.com> - 40.10-30
changelog:
  - Fix regression on multiple remote sessions and same user
    Also, add missing fix to keep API/ABI compatibility on GDM greeter proxy.
    Resolves: RHEL-109190


author: Milan Crha <mcrha@redhat.com> - 41.0-2
changelog:
  - Resolves: #2012699 (Backport changes from Fedora 35)
  - Add patch to mark compulsory only repos, not apps from it
  - Resolves: #2011176 (flathub repo can't be added through gnome-software)
  - Resolves: #2010660 (gs-repos-dialog: Can show also desktop applications)
  - Resolves: #2010353 (Optional repos cannot be disabled)
  - Resolves: #2010740 (Refresh on repository setup change)
  - Resolves: #2009063 (Correct update notifications)


author: Milan Crha <mcrha@redhat.com> - 41.5-2
changelog:
  - Resolves: #2128812 (Correct property name in GsRemovalDialog .ui file)
  - Resolves: #2129021 (Hide some errors in non-debug builds)


author: Debarshi Ray <rishi@fedoraproject.org> - 3.40.1-1
changelog:
  - Update to 3.40.1
  - Rebase the patches
  - Backport yet-to-be-released patches from upstream to avoid translation
    conflicts
  Resolves: #1959384


author: Peter Jones <pjones@redhat.com> - 3.0.9-3
changelog:
  - Fix some minor rpmlint complaints
  - Pull recent patches from upstream
  - Add support for ELF constructors and destructors
  - Fix a minor licensing problem


author: Peter Jones <pjones@redhat.com> - 3.0.11-1
changelog:
  - Update to 3.0.11 (via patches generated from git)
  - Plus newer upstream fixes (also via patches generated from git)
  - Fix shell exit failures in make
  - Fix .reloc section generation
  - Fix CHAR8 definition
  - Fix "make DESTDIR=..."
  - Change the installed .a/.o layout
  - Provide makefiles for consumers to use.
  - Make the -devel noarch since it's just headers.
  - Add a bunch of compatibility symlinks for the 3.0.8 filesystem layout
    These will go away once we've migrated everything using them in fedora
    to use the newer make system...


author: Peter Jones <pjones@redhat.com> - 3.0.11-2
changelog:
  - Make a compat subpackage to provide the old paths to our libraries, linker
    script, and includes.


author: Jakub Jelen <jjelen@redhat.com> - 2.3.3-3
changelog:
  - Mark SHA-1 digest as weak to follow SHA-1 disablement in RHEL9 (#2070722)
  - Fix interaction with SSH by not requiring the MD5 digest (#2073567)
  - Fix creation of AEAD packets (#2128058)


author: Alexander Sosedkin <asosedkin@redhat.com> - 3.8.10-1
changelog:
  - Rebase to 3.8.10
  - Revert defaulting to PBMAC1 in FIPS mode
  - Revert unapproving 1024-, 1280-, 1536- and 1792-bit RSA verification


author: Alexander Sosedkin <asosedkin@redhat.com> - 3.8.10-3
changelog:
  - Fix PKCS#11 token initialization label overflow (CVE-2025-9820)
  - Fix name constraint processing performance issue (CVE-2025-14831)


author: Alexander Sosedkin <asosedkin@redhat.com> - 3.8.10-4
changelog:
  - Fix CVE-2026-33846 (DTLS fragment reassembly, High, heap overwrite)
  - Fix CVE-2026-42009 (DTLS fragment reassembly, High, undefined behaviour)
  - Fix CVE-2026-33845 (DTLS fragment reassembly, High, heap overread)
  - Fix CVE-2026-42010 (PSK authentication, High, authentication bypass)
  - Fix CVE-2026-3833 (Name constraints, Medium, name constraint bypass)
  - Fix CVE-2026-42011 (Name constraints, Medium, name constraint bypass)
  - Fix CVE-2026-42012 (CN fallback, Medium, certificate misuse)
  - Fix CVE-2026-42013 (CN fallback, Medium, certificate misuse)
  - Fix CVE-2026-42014 (PKCS#11 PIN change, Medium, use-after-free)
  - Fix CVE-2026-5260 (PKCS#11 RSA, Medium, heap overread)
  - Fix CVE-2026-42015 (PKCS#12 appending, Low, heap overwrite)
  - Fix CVE-2026-3832 (OCSP, Low, revocation bypass)
  - Fix CVE-2026-5419 (PKCS#7, Low, timing side-channel)
  - Fix upstream security issue #1808 (PSK rehandshake)
  - Fix upstream security issue #1810 (EKU OID prefix match)
  - Fix upstream security issue #1813 (pkcs11-provider persistent keys)
  - Fix upstream security issue #1818 (RSA correctness, OpenSSL format import)
  - Fix upstream security issue #1819 (PKCS#11 trust removal error path)
  - Fix upstream security issue #1822 (SCT extension parser OOB read)
  - Fix upstream security issue #1841 (key zeroization in hybrid kex)
  - Fix upstream security issue #1823 (malformed certtool template)
  - Fix upstream security issue #1817 (session parameter loading robustness)
  - Fix upstream security issue #1820 (PKCS#11 KDF succeeding w/o deriving)
  - gnutls-3.8.10-CVE-2025-9820.patch: update Makefile.in


author: Daiki Ueno <dueno@redhat.com> - 3.8.3-2
changelog:
  - Fix timing side-channel in deterministic ECDSA (RHEL-28959)
  - Fix potential crash during chain building/verification (RHEL-28954)


author: Daiki Ueno <dueno@redhat.com> - 3.8.2-2
changelog:
  - Bump nettle dependency to 3.9.1
  - Skip KTLS test exercising ChaCha20-Poly1305 in TLS 1.2 (RHEL-18498)


author: David Benoit <dbenoit@redhat.com> 3.0.9-9
changelog:
  - Delete remove-fedora-dependency-automation.patch
  - Bundle golist in /usr/libexec
  - Related: rhbz#2043107


author: Archana Ravindar <aravinda@redhat.com> - 1.21.3-3
changelog:
  - Add missing strict fips runtime detection patch
  - Temporarily disable FIPS tests on aarch64 due to builder kernel bugs
  - Related: RHEL-12624


author: Alejandro Sáez <asm@redhat.com> - 1.21.7-1
changelog:
  - Rebase to Go 1.21.7
  - Set GOTOOLCHAIN to local
  - Resolves: RHEL-24334
  - Resolves: RHEL-18364
  - Resolves: RHEL-18365


author: Archana <aravinda@redhat.com> - 1.21.13-1
changelog:
  - Rebase to Go1.21.13 to pick the fix for CVE-2024-24791
  - Technically Go1.21.12 contains the fix for the CVE but there was another
    latest release so rebasing to that
  - Resolves: RHEL-53547


author: David Benoit <dbenoit@redhat.com> - 1.21.13-2
changelog:
  - Rebuild Go with CVE Fixes
  - Remove fix-memleak-setupRSA.patch (exists upstream)
  - Resolves: RHEL-58226
  - Resolves: RHEL-57962
  - Resolves: RHEL-57848
  - Resolves: RHEL-57865


author: Alejandro Sáez <asm@redhat.com> - 1.22.3-1
changelog:
  - Rebase to 1.22.3
  - Removes re-enable-cgo.patch
  - Resolves: RHEL-35634
  - Resolves: RHEL-35883
  - Resolves: RHEL-10068
  - Resolves: RHEL-34924


author: Archana Ravindar <aravinda@redhat.com> - 1.22.4-1
changelog:
  - Rebase to Go1.22.4 that includes fixes for CVE-2024-24789 and CVE-2024-24790
  - Resolves: RHEL-40156


author: David Benoit <dbenoit@redhat.com> - 1.22.5-2
changelog:
  - Rebuild race detector archives from LLVM sources
  - Add golang-race subpackage
  - Resolves: RHEL-33421
  - Remove unused crypto/internal/boring/syso package
  - Resolves: RHEL-54335


author: Archana <aravinda@redhat.com> - 1.23.2-1
changelog:
  - Rebase to Go1.23.2
  - Remove fix standard crypto panic patch as the source already has changes
  - Resolves: RHEL-62392


author: Archana <aravinda@redhat.com> - 1.23.10-1
changelog:
  - Update to Go 1.23.10
  - Fix for CVE-2025-4673, CVE-2025-0913, and CVE-2025-22874
  - Resolves: RHEL-96000


author: David Benoit <dbenoit@redhat.com> - 1.24.3-3
changelog:
  - Update to Go 1.24.3 (fips-3)
  - Fix linkage issue in bin/go
  - Fix loading issue in non-fips mode
  - Related: RHEL-83439
  - Related: RHEL-87632


author: Alejandro Sáez <asm@redhat.com> - 1.25.0-1
changelog:
  - Update to Go 1.25.0
  - Set GOAMD64 to v2 to align with new architecture baselines
  - Modify the modify_go.env.patch to reflect GOAMD64 baseline version change to v2
  - Resolves: RHEL-109557


author: Parag Nemade <pnemade AT redhat DOT com> - 1:1.002-0.15.20130214
changelog:
  - Un-retire this package in F38+ (#2162532)
  - Update as per suggestions given in rename package review (#2166813)


author: Nicolas Mailhot <nim@fedoraproject.org>
changelog:
  - 20200215-5
  💥 Actually rebuild with fonts-rpm-macros 2.0.4 to make sure fontconfig files are
    valid


author: Peng Wu <pwu@redhat.com> - 20230817-1
changelog:
  - Update Noto CJK to Sans 2.004 and Serif 2.002
  - Drop some Noto CJK Language Specific OTFs sub packages
  - Resolves: RHEL-13738


author: Akira TAGOH <tagoh@redhat.com> - 20201206-1
changelog:
  - Updates to 20201206.
    Resolves: rhbz#1899847
  - Refactoring spec file.
  - Fix invalid metainfo files.
    Resolves: rhbz#1830709


author: Fedora Release Engineering <releng@fedoraproject.org> - 1.20.7-20
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
  - Add upstream commits for git master which contains patches 9, 10 and 11
  - Add GCC10 fix
  - Cleanups


author: Miroslav Lichvar <mlichvar@redhat.com> - 1:3.26.1-1.el9_7.1
changelog:
  - fix buffer overflow in NMEA2000 driver (CVE-2025-67268)
  - fix integer underflow in handling of Navcom packets (CVE-2025-67269)


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-2
changelog:
  - Fixes patch 1002 for update to golang-fips
  - Remove unused code under apsl-1.1 and apsl-1.2 licenses
  - Resolves RHEL-33655


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-15
changelog:
  - Resolves RHEL-97518: Rework grafana-selinux spec file sections
  - Resolves RHEL-87861: Add additional SELinux rules for grafana-selinux package to allow LDAP connections


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-17
changelog:
  - Resolves RHEL-125692: CVE-2025-58183
  - Resolves RHEL-120426: Grafana-selinux prevents plugins from searching cgroups


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-17
changelog:
  - Resolves RHEL-144959: CVE-2026-21721
  - Resolves RHEL-146863: CVE-2025-61726
  - Resolves RHEL-147081: CVE-2025-61729
  - Resolves RHEL-147370: CVE-2025-61728
  - Resolves RHEL-149621: CVE-2025-68121


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-18
changelog:
  - Resolves RHEL-125696: CVE-2025-58183
  - Resolves RHEL-132757: Grafana-selinux prevents plugins from searching cgroups


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-20
changelog:
  - Resolves RHEL-144960: CVE-2026-21721
  - Resolves RHEL-145419: CVE-2025-61728
  - Resolves RHEL-146103: CVE-2025-61726
  - Resolves RHEL-149639: CVE-2025-68121


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-22
changelog:
  - Resolves RHEL-161804: CVE-2026-27877
  - Resolves RHEL-166346: CVE-2026-33810
  - Resolves RHEL-166703: CVE-2026-32282
  - Resolves RHEL-167390: CVE-2026-32280
  - Resolves RHEL-167696: CVE-2026-32283


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-22
changelog:
  - Resolves RHEL-161803: CVE-2026-27877
  - Resolves RHEL-166678: CVE-2026-32282
  - Resolves RHEL-167678: CVE-2026-32283


author: Sam Feifer <sfeifer@redhat.com> 9.2.10-10
changelog:
  - Resolves RHEL-7505
  - Adds a selinux policy for grafana
  - Resolves RHEL-12666
  - fix CVE-2023-39325 CVE-2023-44487 rapid stream resets can cause excessive work


author: Sam Feifer <sfeifer@redhat.com> 9.2.10-13
changelog:
  - Resolves RHEL-19296
  - Fixes coredump issue introduced by selinux
  - Patches out call to panic when trying to walk "/" directory


author: Stan Cox <scox@redhat.com> 9.2.10-3
changelog:
  - bumps exporter-toolkit to v0.7.3, sanitize-url@npm to 6.0.2, skip problematic s390 tests, License AGPL-3.0-only.


author: Andreas Gerstmayr <agerstmayr@redhat.com> 5.1.1-1
changelog:
  - update to 5.1.1 tagged upstream community sources, see CHANGELOG
  - resolve CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY


author: Sam Feifer <sfeifer@redhat.com> - 5.1.1-12
changelog:
  - Resolves RHEL-146864: CVE-2025-61726
  - Resolves RHEL-147082: CVE-2025-61729
  - Resolves RHEL-149622: CVE-2025-68121


author: Sam Feifer <sfeifer@redhat.com> - 5.1.1-15
changelog:
  - Resolves RHEL-166347: CVE-2026-33810
  - Resolves RHEL-166704: CVE-2026-32282
  - Resolves RHEL-167391: CVE-2026-32280
  - Resolves RHEL-167697: CVE-2026-32283


author: Andreas Gerstmayr <agerstmayr@redhat.com> 3.2.0-2
changelog:
  - resolve CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
  - resolve CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
  - resolve CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
  - resolve CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
  - resolve CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
  - resolve CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode


author: Andreas Gerstmayr <agerstmayr@redhat.com> 5.0.0-4
changelog:
  - update to 5.0.0 tagged upstream community sources, see CHANGELOG
  - install plugin in /usr/share and create symlink from /var using
    systemd-tmpfiles to work on rpm-ostree based distributions
  - revert the breaking change (change of internal plugin IDs) of upstream v5.0.0,
    i.e. there are no breaking changes when performing this upgrade
  - enable Go modules in build process
  - make vendor and webpack tarballs reproducible
  - drop makefile in favor of create_bundles.sh script


author: Packit Service <user-cont-team+packit-service@redhat.com> - 0.14.0-1
changelog:
  - Release 0.14.0 (Peter Robinson)
  - Updated testing documentation (Jose Noguera)
  - README updated with TOC and improved explanations (Jose Noguera)
  - Add watchdog-triggered boot check #2 (Jose Noguera)
  - Update specfile and README to reflect changes in subpackage layout. (Jose Noguera)
  - Ensure all required health checks are run #52 (Jose Noguera)


author: Sayan Paul <paul.sayan@gmail.com> - 0.15.5-1
changelog:
  - The 0.15.5 release
  - Auto-detect image type and use correct rollback
  - Support for read only /boot mount
  - Warn users of missing disabled healthchecks
  - Add feature to disable healthchecks


author: Paul Whalen <pwhalen@fedoraproject.org> - 0.15.5-3
changelog:
  - Moved greenboot config to /etc/grub.d.
  - %post symlink greenboot.cfg to bootupd if present
  - %postun remove symlink from bootupd if present


author: Sayan Paul <paul.sayan@gmail.com> - 0.15.7-1
changelog:
  - Update to 0.15.7
  - Reword warning message for disabled checks
  - Fixed the issue that boot_counter cannot be unset and some scripts do not have executable permissions
  - Packit: only use IoT relevant branches


author: Antonio Murdaca <antoniomurdaca@gmail.com> - 0.15.8-1
changelog:
  * ci: add ci test for pull request by @yih-redhat in https://github.com/fedora-iot/greenboot/pull/164
   * ci: add more wait time for fallback by @yih-redhat in https://github.com/fedora-iot/greenboot/pull/167
   * ci: fix ansible check failure by @yih-redhat in https://github.com/fedora-iot/greenboot/pull/169
   * ci: add test case of bootc anaconda iso by @yih-redhat in https://github.com/fedora-iot/greenboot/pull/171
   * test github token by @yih-redhat in https://github.com/fedora-iot/greenboot/pull/174
   * update github action by @yih-redhat in https://github.com/fedora-iot/greenboot/pull/177
   * Update greenboot-ci.yaml by @yih-redhat in https://github.com/fedora-iot/greenboot/pull/179
   * ci: fix iso case failure by @yih-redhat in https://github.com/fedora-iot/greenboot/pull/173
   * ci: add support for fedora rawhide by @yih-redhat in https://github.com/fedora-iot/greenboot/pull/181
   * ci: fix rahide failure by @yih-redhat in https://github.com/fedora-iot/greenboot/pull/183
   * ci: fix podman retry issue by @yih-redhat in https://github.com/fedora-iot/greenboot/pull/185
   * ci: add centos-stream-9 support by @yih-redhat in https://github.com/fedora-iot/greenboot/pull/187
   * ci: add rhel 9.6 support by @yih-redhat in https://github.com/fedora-iot/greenboot/pull/190
   * ci: fix rhel 9.6 anaconda case failure by @yih-redhat in https://github.com/fedora-iot/greenboot/pull/193
   * ci: fix secret error by @yih-redhat in https://github.com/fedora-iot/greenboot/pull/195
   * specfile: Stop building on ix86 by @travier in https://github.com/fedora-iot/greenboot/pull/197
   * rollback: if no bootc, fallback to rpm-ostree by @runcom in https://github.com/fedora-iot/greenboot/pull/199
   * fix:fail early for any required script failure by @say-paul in https://github.com/fedora-iot/greenboot/pull/198
   * Release 0.15.8 by @runcom in https://github.com/fedora-iot/greenboot/pull/202

   * @travier made their first contribution in https://github.com/fedora-iot/greenboot/pull/197

   **Full Changelog**: https://github.com/fedora-iot/greenboot/compare/v0.15.7...v0.15.8
  - Resolves: RHEL-78244


author: Paul Whalen <pwhalen@fedoraproject.org> - 0.16.0-2
changelog:
  - Update src to greenboot-rs, binaries remain greenboot
  - Obsoletes/Conflicts for bash greenboot, Provides greenboot


author: Sayan Paul <saypaul@redhat.com> - 0.16.1
changelog:
  - Ensure rollback trigger runs before systemd-update-done and only on updates
  - Log the correct system type when reporting rollback decisions
  - Fix CI/tests (Ansible callback config, GI deps) to keep gating green
  - Refresh Packit release config for Fedora delivery


author: Sayan Paul <saypaul@redhat.com> - 0.16.2
changelog:
  - restrict manual restart of healthcheck service
  - fixed error while running healtcheck inside container
  - removed bootupd dependency
  - fixed CI tests


author: Tomas Popela <tpopela@redhat.com> - 40.0-6
changelog:
  - Require the Source Code Pro font instead of only recommending it to not break
    systems updated from 9.0.0.
    Resolves: rhbz#2093975


author: Wim Taymans <wtaymans@redhat.com> - 1.22.1-2
changelog:
  - Patch CVE-2023-44429: AV1 codec parser heap-based buffer overflow
  - Patch CVE-2023-44446: MXF demuxer use-after-free
  - Resolves: RHEL-17030, RHEL-17039


author: Wim Taymans <wtaymans@redhat.com> - 1.22.1-4
changelog:
  - CVE-2023-40474: Integer overflow leading to heap overwrite in MXF
  - CVE-2023-40475: Integer overflow leading to heap overwrite in MXF
  - CVE-2023-40476: Integer overflow in H.265 video parser
  - ZDI-CAN-22300: buffer overflow vulnerability
  - Resolves: RHEL-19501, RHEL-19505, RHEL-19506, RHEL-20201


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-4.1
changelog:
  - Fix for CVE-2026-52720: validate framebuffer update rectangles
    in librfb plugin
    Resolves: RHEL-184459


author: Tomas Pelka <tpelka@redhat.com> - 1.22.12-7.1
changelog:
  - Sync with c9s release -5..-7: fix for CVE-2026-2923, CVE-2026-3082
    in dvbsuboverlay and jpegparser
    Resolves: RHEL-156242, RHEL-156255


author: Wim Taymans <wtaymans@redhat.com> - 1.22.1-3
changelog:
  - Fixes for CVE-2024-47538, CVE-2024-47607, CVE-2024-47615
    Resolves: RHEL-70979, RHEL-71015, RHEL-70991


author: Wim Taymans <wtaymans@redhat.com> - 1.22.12-4
changelog:
  - Bump version
  - Apply patches for CVE-2024-47538, CVE-2024-47541, CVE-2024-47542,
    CVE-2024-47600, CVE-2024-47607, CVE-2024-47615, CVE-2024-47835
    Resolves: RHEL-70983, RHEL-71035, RHEL-70932, RHEL-71037
    Resolves: RHEL-71019, RHEL-70995, RHEL-71163


author: Wim Taymans <wtaymans@redhat.com> - 1.18.4-6
changelog:
  - Fixes for CVE-2022-1920, CVE-2022-1921, CVE-2022-1922, CVE-2022-1923,
    CVE-2022-1924, CVE-2022-1925, CVE-2022-2122
    Resolves: rhbz#2131034, rhbz#2131039, rhbz#2131045, rhbz#2131049,
              rhbz#2131054, rhbz#2131060, rhbz#2131064


author: Wim Taymans <wtaymans@redhat.com> - 1.22.1-2
changelog:
  - CVE-2023-37327: integer overflow leading to heap overwrite in FLAC
    image tag handling
  - Resolves: RHEL-19471


author: Wim Taymans <wtaymans@redhat.com> - 1.22.1-3
changelog:
  - CVE-2024-47537, CVE-2024-47539, CVE-2024-47540, CVE-2024-47606,
    CVE-2024-47613
    Resolves: RHEL-70954, RHEL-70967, RHEL-70941, RHEL-71027,
    Resolves: RHEL-71003


author: Wim Taymans <wtaymans@redhat.com> - 1.22.12-4
changelog:
  - Apply patches for CVE-2024-47537, CVE-2024-47539, CVE-2024-47540
    CVE-2024-47543, CVE-2024-47544, CVE-2024-47545, CVE-2024-47546,
    CVE-2024-47596, CVE-2024-47597, CVE-2024-47598, CVE-2024-47599,
    CVE-2024-47601, CVE-2024-47602, CVE-2024-47603, CVE-2024-47606,
    CVE-2024-47613, CVE-2024-47774, CVE-2024-47775, CVE-2024-47776,
    CVE-2024-47777, CVE-2024-47778, CVE-2024-47834
  - Resolves: RHEL-70958, RHEL-70971, RHEL-71033, RHEL-71195
  - Resolves: RHEL-71210, RHEL-71202, RHEL-71171, RHEL-71200
  - Resolves: RHEL-71206, RHEL-71173, RHEL-71198, RHEL-71204
  - Resolves: RHEL-71208, RHEL-71031, RHEL-71007, RHEL-71039
  - Resolves: RHEL-71169, RHEL-71192, RHEL-71161, RHEL-71167
  - Resolves: RHEL-71189


author: Tomas Pelka <tpelka@redhat.com> - 1.22.12-7.1
changelog:
  - Rebase rhel-9.8.0 from 1.18.4 to 1.22.12 to resync with rhel-9.7.0/c9s
    (this branch had regressed to a stale pre-1.22.12 base)
    Resolves: RHEL-156269, RHEL-156270
  - Fix CVE-2026-53705: integer overflow in wavpack decoder, re-applied
    on top of the correct 1.22.12 base
    Resolves: RHEL-184477


author: Yaakov Selkowitz <yselkowi@redhat.com> - 1.22.8-2
changelog:
  - Enable asfdemux, dvdlpcmdec, dvdsub, and realmedia plugins
  - Disable AMR plugins in RHEL builds
  - Resolves: rhbz#2236889


author: Kalev Lember <klember@redhat.com> - 3.24.3-1
changelog:
  - Update to 3.24.3
  - Use https source URLs
  - Re-enable LTO now that we have upstream fix in place (#1898054)
  - Switch to meson build system
  - Tighten soname globs


author: Richard W.M. Jones <rjones@redhat.com> - 1.48.2-5
changelog:
  - Rebase to guestfs-tools 1.48.2
    resolves: rhbz#2059286
  - Default to --selinux-relabel in various tools
    resolves: rhbz#2075718, rhbz#2089748
  - Add lvm system.devices cleanup operation to virt-sysprep
    resolves: rhbz#2072493
  - Refactor virt-customize --install, --update options in common submodule
  - Add support for Clevis & Tang
    resolves: rhbz#1809453
  - Fix CVE-2022-2211 Denial of Service in --key parameter
    resolves: rhbz#2102721
  - Fix virt-sysprep and LUKS-on-LVM guests
    resolves: rhbz#2106286


author: Richard W.M. Jones <rjones@redhat.com> - 1.48.2-8
changelog:
  - Support Rocky Linux in virt-customize
    resolves: rhbz#2133443
  - Disable OpenSUSE repo in virt-builder
    resolves: rhbz#2145160


author: Richard W.M. Jones <rjones@redhat.com> - 1.50.1-1
changelog:
  - Rebase to guestfs-tools 1.50.1
    resolves: rhbz#2168626
  - Fix virt-drivers inspection of RHEL 9.2 guests
    resolves: rhbz#2184963


author: Laszlo Ersek <lersek@redhat.com> - 1.50.1-3
changelog:
  - let virt-inspector recognize "--key /dev/mapper/VG-LV:key:password"
  - reenable "make check"; we now use "-cpu max" (libguestfs 30f74f38bd6e)
    resolves: rhbz#2209280


author: Richard W.M. Jones <rjones@redhat.com> - 1.51.6-2
changelog:
  - Rebase to guestfs-tools 1.51.6
  - Implement --key all:...
    resolves: RHEL-19030
  - Fix crash because of off-by-one error
    resolves: RHEL-19062
  - Fix virt-customize --chown invalid format
    resolves: RHEL-21899


author: Richard W.M. Jones <rjones@redhat.com> - 1.51.6-4
changelog:
  - Add support for nbd+unix:// URIs
    resolves: RHEL-33956
  - customize: Implement --inject-blnsvr operation
    resolves: RHEL-36634


author: Richard W.M. Jones <rjones@redhat.com> - 1.52.2-2
changelog:
  - Rebase to guestfs-tools 1.52.2
    resolves: RHEL-56811
  - Replace Jansson with json-c
    resolves: RHEL-65294


author: Tom Stellard <tstellar@redhat.com> - 5.3.3-3
changelog:
  - Fix warning building with clang
  - non-void function 'stp_paths_copy_with_prefix' should return a value [-Wreturn-type]


author: Jindrich Novy <jnovy@redhat.com> - 6:0.7.1-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.7.1
  - Related: Jira:RHEL-2112


author: Jindrich Novy <jnovy@redhat.com> - 6:0.7.4-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.7.4
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 6:0.7.5-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.7.5
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 6:0.8.0-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.0
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 6:0.8.1-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.1
  - Resolves: RHEL-69761


author: Jindrich Novy <jnovy@redhat.com> - 6:0.8.2-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.2
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 6:0.8.3-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.3
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 6:0.8.4-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.4
  - Resolves: RHEL-83036


author: Jindrich Novy <jnovy@redhat.com> - 6:0.8.5-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.5
  - Related: RHEL-80816


author: Jindrich Novy <jnovy@redhat.com> - 6:0.8.6-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.6
  - Related: RHEL-80816


author: Jindrich Novy <jnovy@redhat.com> - 6:0.8.7-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.7
  - Resolves: RHEL-112184


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-16
changelog:
  - fence_openstack: add support for reading config from clouds.yaml
    and openrc
    Resolves: rhbz#2041933, rhbz#2041935


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 2.4.22-3.1
changelog:
  - Always clear retry flags in read/write functions to avoid CPU
    usage spikes
  - Fix "unable to load certificate chain from file" issue
    Resolves: RHEL-72955, RHEL-72952


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 2.4.22-4
changelog:
  - Always clear retry flags in read/write functions to avoid CPU
    usage spikes
  - Fix "unable to load certificate chain from file" issue
    Resolves: RHEL-71925, RHEL-68780


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 2.8.14-2
changelog:
  - Add tmpfiles.d file to make systemd-tmpfiles create/set correct
    ownership/permissions of /var/lib/haproxy
    Resolves: RHEL-120178


author: Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-6
changelog:
  - Resolves:rh#2103849 CVE-2022-33068
    harfbuzz: integer overflow in the component hb-ot-shape-fallback.c


author: Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-7
changelog:
  - Resolves:rh#2103849 CVE-2022-33068
  - Fix Covscan compiler warning for inclusion of parenthesis
  - Update tests.yaml


author: Filip Januš <fjanus@redhat.com> - 1.5-1
changelog:
  - Nwe upstream version 1.5
  - Add patch to solve inconsistency between configure.ac and filename
  - Add Build requirement autoconf


author: Davide Caratti <dcaratti@redhat.com> - 2.9-15
changelog:
  - Disable 'badfuncs' in rpminspect tests
  - Build with -fPIE, and enable verbose build log
  - enable CONFIG_SUITEB192


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.20.11-5
changelog:
  - 1925259 - %pre scriptlet enables and starts cups.service, which is unnecessary
  - 1919556 - hp-fab crashed: QFileDialog.getOpenFileName is not used correctly


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.21.2-6.1
changelog:
  - CVE-2026-8632 hplip: Privilege escalation and arbitrary code execution
    via OS command injection in Is_Process_Running()


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.21.2-6.2
changelog:
  - CVE-2026-8631 hplip: HPLIP: Arbitrary code execution and privilege escalation
    via integer overflow in hpcups


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-2
changelog:
  - Resolves: #2186645 - Fix issue found by covscan in httpd package
  - Resolves: #2173295 - Include Apache httpd module mod_authnz_fcgi


author: Joe Orton <jorton@redhat.com> - 2.4.57-6
changelog:
  - Resolves: RHEL-5071 - mod_dav_fs: add DavLockDBType
  - mod_dav_fs: add global mutex around lockdb interaction


author: Joe Orton <jorton@redhat.com> - 2.4.57-8
changelog:
  - mod_xml2enc: fix media type handling
    Resolves: RHEL-17686
  - mod_dav: add DavBasePath
    Resolves: RHEL-6600


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-9
changelog:
  - Resolves: RHEL-45766 -  httpd: null pointer dereference in
    mod_proxy (CVE-2024-38477)
  - Resolves: RHEL-45749 - httpd: Potential SSRF in mod_rewrite (CVE-2024-39573)
  - Resolves: RHEL-45818 - httpd: Substitution encoding issue in
    mod_rewrite (CVE-2024-38474)
  - Resolves: RHEL-45771 - httpd: Improper escaping of output in
    mod_rewrite (CVE-2024-38475)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-11.1
changelog:
  - Resolves: RHEL-46047 - httpd: Security issues via backend applications whose
    response headers are malicious or exploitable (CVE-2024-38476)
  - Resolves: RHEL-53021 - Regression introduced by CVE-2024-38474 fix


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-1
changelog:
  - Resolves: #2184403 - rebase httpd to 2.4.57
  - Resolves: #2177753 - CVE-2023-25690 httpd: HTTP request splitting with
    mod_rewrite and mod_proxy


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-11
changelog:
  - Resolves: #2162500 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write
    of zero byte
  - Resolves: #2162486 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting
  - Resolves: #2162510 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request
    smuggling


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.59-1
changelog:
  - new version 2.4.59
  - Resolves: RHEL-14668 - RFE: httpd rebase to 2.4.59
  - Resolves: RHEL-31856 - httpd: HTTP response splitting
    (CVE-2023-38709)
  - Resolves: RHEL-31859 - httpd: HTTP Response Splitting in multiple
    modules (CVE-2024-24795)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-1.2
changelog:
  - Resolves: RHEL-73580 - RewriteRule proxying to UDS (unix domain socket)
    configured in .htaccess doesn't work on httpd-2.4.62-1


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-4
changelog:
  - Resolves: RHEL-66488 - Apache HTTPD no longer parse PHP files with unicode
    characters in the name


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-7
changelog:
  - Resolves: RHEL-99815 - stickysession field does not work when specifying
    it in the query parameter after upgrade to 9.5
  - Resolves: RHEL-99953 - httpd: HTTP Session Hijack via a TLS
    upgrade (CVE-2025-49812)
  - Resolves: RHEL-99968 - httpd: access control bypass by trusted
    clients is possible using TLS 1.3 session resumption (CVE-2025-23048)
  - Resolves: RHEL-99977 - httpd: insufficient escaping of user-supplied
    data in mod_ssl (CVE-2024-47252)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-8
changelog:
  - Resolves: RHEL-114501 Image mode: The dir /var/www is not created when
    updating system in image mode


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-9
changelog:
  - Resolves: RHEL-105446 - mod_proxy_hcheck may stop healthchecks after a child
    process is reclaimed


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-10
changelog:
  - Resolves: RHEL-119000 - mod_ssl: allow more fine grained SSL SNI vhost check
    to avoid unnecessary 421 errors after CVE-2025-23048 fix
  - mod_ssl: add conf.d/snipolicy.conf to set 'SSLVHostSNIPolicy authonly' default


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-12
changelog:
  - Resolves: RHEL-135064 - httpd: Apache HTTP Server: mod_userdir+suexec bypass
    via AllowOverride FileInfo (CVE-2025-66200)
  - Resolves: RHEL-135049 - httpd: Apache HTTP Server: CGI environment variable
    override (CVE-2025-65082)
  - Resolves: RHEL-134481 - httpd: Apache HTTP Server: Server Side Includes adds
    query string to #exec cmd=... (CVE-2025-58098)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-13.1
changelog:
  - Resolves: RHEL-173555 - httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary
    code execution via heap-based buffer overflow (CVE-2026-28780)
  - Resolves: RHEL-175080 - httpd: NULL pointer dereference can cause a child
    process crash (CVE-2026-33007)
  - Resolves: RHEL-175100 - httpd: off-by-one out-of-bounds reads in AJP getter
    functions (CVE-2026-33857)
  - Resolves: RHEL-175028 - httpd: heap-based buffer over-read due to missing
    null-termination check (CVE-2026-34032)
  - Resolves: RHEL-175062 - httpd: heap-based buffer over-read and memory
    disclosure in ajp_parse_data() (CVE-2026-34059)


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.4.62-13.3
changelog:
  - Resolves: RHEL-186186 - httpd: mod_proxy_html buffer handling
    vulnerability (CVE-2026-34355)
  - Resolves: RHEL-175636 - httpd: mod_dav_lock uses wrong lock discovery
    (CVE-2026-29169)
  - Resolves: RHEL-186196 - mod_xml2enc: fix bblen accounting in fix_skipto
    (CVE-2026-42536)
  - Resolves: RHEL-186164 - httpd: fix OCSP write buffer advancement
    bug in mod_ssl (CVE-2026-44185)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-13.4
changelog:
  - Resolves: RHEL-186217 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
    via malicious backend servers (CVE-2026-34356)
  - Resolves: RHEL-182578 - httpd: incomplete fix
    for CVE-2023-38709 (CVE-2024-42516)
  - Also addresses CVE-2026-24072, CVE-2026-33006, CVE-2026-42535, CVE-2026-43951,
    CVE-2026-44119, CVE-2026-44186


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-3
changelog:
  - Resolves: RHEL-68660 - RewriteRule proxying to UDS (unix domain socket)
    configured in .htaccess doesn't work on httpd-2.4.62-1


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-4.1
changelog:
  - Resolves: RHEL-99972 - CVE-2024-47252 httpd: insufficient escaping of
    user-supplied data in mod_ssl
  - Resolves: RHEL-99963 - CVE-2025-23048 httpd: access control bypass by trusted
    clients is possible using TLS 1.3 session resumption
  - Resolves: RHEL-102079 - stickysession field does not work when specifying it
    in the query parameter after upgrade to 9.5


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-7.1
changelog:
  - Resolves: RHEL-125884 - mod_ssl: allow more fine grained SSL SNI vhost check
    to avoid unnecessary 421 errors after CVE-2025-23048 fix
  - mod_ssl: add conf.d/snipolicy.conf to set 'SSLVHostSNIPolicy authonly' default


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-7.2
changelog:
  - Resolves: RHEL-123850 - mod_proxy_hcheck may stop healthchecks after a child
    process is reclaimed


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-7.3
changelog:
  - Resolves: RHEL-135063 - httpd: Apache HTTP Server: mod_userdir+suexec bypass
    via AllowOverride FileInfo (CVE-2025-66200)
  - Resolves: RHEL-135048 - httpd: Apache HTTP Server: CGI environment variable
    override (CVE-2025-65082)
  - Resolves: RHEL-134480 - httpd: Apache HTTP Server: Server Side Includes adds
    query string to #exec cmd=... (CVE-2025-58098)


author: Parag Nemade <pnemade AT redhat DOT com> - 5.1-3
changelog:
  - Resolves:rhbz#1967646 - Correct the License: tag to LGPLv3+ based on LICENSE.txt file
  - Added gating tests


author: Parag Nemade <pnemade AT redhat DOT com> - 1.0.3-21
changelog:
  - Remove the duplicate source file committed to this package git repository
  - Update URL tag and files section to be more verbose


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.38.20190303git
changelog:
  - hpvd-Enable-build-on-aarch64.patch [bz#2020148]
  - Resolves: bz#2020148
    ([Hyper-V][RHEL9.0][ARM] No hyperv-daemons package built for aarch64 platform)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.39.20190303git
changelog:
  - hpvd-hv_set_ifconfig.sh-Use-nmcli-commands.patch [bz#2026371]
  - hpvd-Use-filename-for-connection-profile.patch [bz#2026371]
  - Resolves: bz#2026371
    ([RHEL9][Hyper-V]The /usr/libexec/hypervkvpd/hv_set_ifconfig need update for RHEL9 since the ifdown/ifup was not supported on RHEL9)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.40.20190303git
changelog:
  - hpvd-hypervkvpd.service-ordering-fixes.patch [bz#2103188]
  - Resolves: bz#2103188
    ([Hyper-V][RHEL-9] hypervkvpd.service service ordering)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.41.20190303git
changelog:
  - hpvd-redhat-hv_set_if_config-Workaround-for-gateway-numbe.patch [bz#2122115]
  - hpvd-tools-hv-Remove-an-extraneous-the.patch [bz#2139457]
  - hpvd-tools-hv-kvp-remove-unnecessary-void-conversions.patch [bz#2139457]
  - Resolves: bz#2122115
    ([Hyper-V][RHEL-9] Cannot set gateway properly when set static IPADDR0,NETMASK0,GATEWAY in ifcfg-eth0)
  - Resolves: bz#2139457
    ([Hyper-V][RHEL9.2] Update Hyper-V-Daemons)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.42.20190303git
changelog:
  - hpvd-vmbus_testing-fix-wrong-python-syntax-for-integer-va.patch [bz#2218931]
  - Resolves: bz#2218931
    ([Hyper-V] [RHEL-9] /usr/sbin/vmbus_testing python script prints: "SyntaxWarning: "is" with a literal.")


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.43.20190303git
changelog:
  - hpvd-hv-hv_kvp_daemon-Support-for-keyfile-based-connectio.patch [RHEL-9902]
  - hpvd-hv-hv_kvp_daemon-Some-small-fixes-for-handling-NM-ke.patch [RHEL-9902]
  - hpvd-hv-hv_kvp_daemon-Handle-IPv4-and-Ipv6-combination-fo.patch [RHEL-9902]
  - hpvd-Changes-for-adding-keyfile-support-in-RHEL-specific-.patch [RHEL-9902]
  - Resolves: RHEL-9902
    ([Hyper-V][RHEL-9] hyperv-daemons write incompatible IPv6 prefix (IPV6NETMASK) in ifcfg)


author: Jon Maloy <jmaloy@redhat.com> - 0-0.44.20190303git
changelog:
  - hpvd-tools-hv-Enable-debug-logs-for-hv_kvp_daemon.patch [RHEL-95812]
  - Resolves: RHEL-95812
    ([Hyper-V][RHEL-9]Backport tools: hv: Enable debug logs for hv_kvp_daemon for RHEL 9)


author: Peter Robinson <pbrobinson@fedoraproject.org> - 4.2-2
changelog:
  - Move eeprog to i2c-tools (shouldn't have been in eepromer sub package)
  - Drop/obsolete eepromer subpackage, deprecated for 6 years
  - Drop python2 conditionals
  - Minor cleanups


author: Kamal Heib <kheib@redhat.com> - 46.0-1
changelog:
  - Rebase to upstream release v46.0
  - Resolves: rhbz#2159650, rhbz#2167513, rhbz#2170367, rhbz#2189721 rhbz#2209688


author: Kamal Heib <kheib@redhat.com> - 57.0-1
changelog:
  - Rebase to upstream release v57.0
  - Resolves: RHEL-76570, RHEL-45644, RHEL-72077, RHEL-68506, RHEL-94449


author: Kamal Heib <kheib@redhat.com> - 60.0-1
changelog:
  - Rebase to upstream release v60.0
  - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331


author: Kamal Heib <kheib@redhat.com> - 60.0-2
changelog:
  - bump release to rebuild in sidetag
  - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331


author: Kamal Heib <kheib@redhat.com> - 60.0-3
changelog:
  - bump release to rebuild in sidetag
  - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331


author: Kamal Heib <kheib@redhat.com> - 61.0-1
changelog:
  - Rebase to upstream release v61.0
  - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331


author: Mike FABIAN <mfabian@redhat.com> - 1.4.2-1
changelog:
  - Update to  1.4.2
  - New translations: tr (Turkish) 100%, uk (Ukrainian) 100%,
    id (Indonesian) 100%, ja_JP (Japanese) 100%.
  - Translation updates: zh_CN, pt_BR


author: Mike FABIAN <mfabian@redhat.com> - 1.12.4-1
changelog:
  - Update to 1.12.4
  - Update translations from Weblate (updated es, cs, fa, pt_BR, zh_CN).
    zh_CN is 100% complete now.


author: Mike FABIAN <mfabian@redhat.com> - 1.12.5-1
changelog:
  - Update to 1.12.5
  - Return False in _execute_command_commit_candidate_number(self, number)
    if number out of range
  - Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/21
  - remove Use-from-unittest-import-mock-instead-of-just-import.patch
    (included upstream)
  - Update translations from Weblate (New translation for Sinhala (si) started)


author: Mike FABIAN <mfabian@redhat.com> - 1.12.5-3
changelog:
  - Resolves: rhbz#1974631 Delete ibus write-cache in scriptlet
  - Improve CI tests and add gating.yaml


author: Mike FABIAN <mfabian@redhat.com> - 1.8.3-1
changelog:
  - Update to 1.8.3
  - Turned cangjie 3 and 5's DYNAMIC_ADJUST to FALSE
    Resolves: https://github.com/definite/ibus-table-chinese/pull/14
  - Add SUGGESTION_MODE = TRUE to the wubi tables
    Resolves: https://github.com/definite/ibus-table-chinese/pull/15
  - Support pinyin mode also for stroke5 table
    Resolves: https://github.com/definite/ibus-table-chinese/pull/12
  - Use nicer values for symbol and status prompt
    Resolves: https://github.com/definite/ibus-table-chinese/pull/8
  - update jyutping table; add cantonyale table
    Resolves: https://github.com/definite/ibus-table-chinese/pull/11
  - Update jyutping and cantonese tables
    Resolves: https://github.com/definite/ibus-table-chinese/pull/9


author: Mike FABIAN <mfabian@redhat.com> - 2.10.4-1
changelog:
  - Update to 2.10.4
  - Use “from unittest import mock” instead of just “import mock”.
  - Update emoji annotations from CLDR
  - Translation update from Weblate for zh_CN (still 100% complete)


author: Mike FABIAN <mfabian@redhat.com> - 2.10.5-1
changelog:
  - Update to 2.10.5
  - Run the voikko tests only for libvoikko version >= 4.3
  - Adapt voikko test cases to the newest voikko version
    libvoikko-4.3-3, python3-libvoikko-4.3-3, voikko-fi-2.4-3
  - Log a warning when language is “fi” and “import libvoikko” failed
  - Return an empty list [] in spellcheck_suggest_voikko() when libvoikko was not imported
  - Update emoji annotations from CLDR, switching “no” and “nb”
    See: https://unicode-org.atlassian.net/browse/CLDR-2698
  - Remove icon in emoji-picker.appdata.xml (to avoid warnings
    from appstream-util and appstreamcli).


author: Mike FABIAN <mfabian@redhat.com> - 2.10.5-2
changelog:
  - Use the voikko build requires only for Fedora. They are only
    needed to run the voikko test cases during build.


author: Mike FABIAN <mfabian@redhat.com> - 2.10.5-3
changelog:
  - Remove gnome-desktop-testing and ibus-desktop-testing from the requires
    of the ibus-typing-booster-tests subpackage


author: Mike FABIAN <mfabian@redhat.com> - 2.11.0-1
changelog:
  - Update to 2.11.0
  - Use sensitivity feature of buttons in the setup tool tab where shortcuts are defined
  - Don’t let dialog action area of setup tool expand.
  - Improve the setup tool to make it possible to enter multi-line expansions of shortcuts
  - Resolves https://github.com/mike-fabian/ibus-typing-booster/issues/158
  - Elide extremely long candidates in the lookup table in the middle.
  - If a candidate contains newlines, replace the newlines with arrows in the lookup table.
  - If a commit string contains new-lines, commit it in several chunks
    and forward Return between the chunks.
  - Update emoji annotations from CLDR
  - Put the remote icon back in emoji-picker.appdata.xml, it was a
    false positive by appstreamcli
  - Translation update from Weblate (pt_PT updated, 100% complete now)
  - Skip the inscript2 test cases if these transliterations are not available.


author: Mike FABIAN <mfabian@redhat.com> - 2.11.0-3
changelog:
  - Resolves: rhbz#1974636 Delete ibus write-cache in scriptlet
  - Improve CI tests and add gating.yaml


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 5.0.2-1
changelog:
  - Rebase to JSS 5.0.2
  - Bug 2029838 - SHA1withRSA being listed in signing certificates while approving certificate via Agent page in browser


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 5.0.3-1
changelog:
  - Rebase to JSS 5.0.3
  - Bug 2046023 - CVE-2021-4213 jss: memory leak in TLS connection leads to OOM [rhel-9.0]


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 5.2.1-1
changelog:
  - Rebase to JSS 5.2.1
  - Bug 2100807 - pki-tomcat/kra unable to decrypt when using RSA-OAEP padding in RHEL9 with FIPS enabled


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 5.3.0-0.3.beta2
changelog:
  - Rebase to JSS 5.3.0-beta2
  - Bug 2017098 - pki pkcs12-cert-add command failing with 'Unable to validate PKCS #12 file: Digests do not match' exception


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 11.2.0-0.4.beta3
changelog:
  - Rebase to PKI 11.2.0-beta3
  - Bug #2062808 Drop SHA-1 use from authentication challenges [rhel-9.1.0]


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 11.2.0-1
changelog:
  - Rebase to PKI 11.2.0
  - Bug #2084639 ipa cert-request ssl error
  - Bug #2099312 SKI field is not reflected back in generated CSR
  - Bug #2095197 PKI cert-fix operation failing


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 11.2.1-1
changelog:
  - Rebase to PKI 11.2.1
  - Bug #2107336 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE [rhel-9.1.0]


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 11.3.0-0.2.beta1
changelog:
  - Rebase to PKI 11.3.0-beta1
  - Bug #1849834 - [RFE] Provide EST Responder (RFC 7030)
  - Bug #1883477 - [RFE] Automatic expired certificate purging
  - Bug #2091999 - Error displayed should be user friendly in case RSNv3 certificate serial number collision
  - Bug #2106452 - softhsm2: Unable to create cert: Private key not found
  - Bug #2106459 - CVE-2022-2393 pki-core: Improper authentication/authorization with caServerKeygen_DirUserCert profile


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 11.3.0-1
changelog:
  - Rebase to PKI 11.3.0
  - Bug #2091993 - IdM Install fails on RHEL 8.5 Beta when DISA STIG is applied
  - Bug #2122409 - pki-tomcat/kra unable to decrypt when using RSA-OAEP padding in RHEL9 with FIPS enabled


author: Jeff Law <law@redhat.com> - 2.3.0-3
changelog:
  - Touch a couple autoconf related files to prevent undesired rebuilding
    if %configure changes one or more configure files.


author: Sohan Kunkerkar <skunkerk@redhat.com> - 2.13.0-2
changelog:
  - Rename -validate-nonlinux subpackage to -validate-redistributable
  - Add static Linux binaries to -redistributable
  - Fix macro invocation in comment
  - Avoid kernel lockdown on VMware when running with secure boot


author: Benjamin Gilbert <bgilbert@redhat.com> - 2.14.0-1
changelog:
  - New release
  - Add ignition-apply symlink
  - Add ignition-rmcfg symlink and ignition-delete-config.service


author: Miguel Martín <mmartinv@redhat.com> - 2.19.0-3
changelog:
  - Update ignition-edge commit to support FIPS
      - https://github.com/fedora-iot/ignition-edge/pull/2


author: Yasmin Valim <ydesouza@redhat.com> - 2.21.0-1
changelog:
  - Re-sync with upstream changes adding ignition-grub subpackage
    and a few minor changes
  - New release


author: Steven Presti <spresti@redhat.com> - 2.23.0-2
changelog:
  - Build Ignition with GOEXPERIMENT=strictfipsruntime
    Ignition-validate non-FIPS
  - Backport https://github.com/coreos/ignition/pull/2159


author: Packit <hello@packit.dev> - 20-1
changelog:
  Changes with 20
  ----------------
    * deps: update (#219)
      * Author: Simon de Vlieger, Reviewers: Achilleas Koutsou

  — Somewhere on the Internet, 2025-05-30


author: Packit <hello@packit.dev> - 21-1
changelog:
  Changes with 21
  ----------------
    * image-builder: fix cross-arch uploading (#218)
      * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Simon de Vlieger
    * packit: rename epel9-next (#224)
      * Author: Simon de Vlieger, Reviewers: Lukáš Zapletal

  — Somewhere on the Internet, 2025-06-11


author: Packit <hello@packit.dev> - 22-1
changelog:
  Changes with 22
  ----------------
    * GHA: add the common-stale-action (#225)
      * Author: Tomáš Hozza, Reviewers: Lukáš Zapletal, Simon de Vlieger
    * chore: bump `images` (#228)
      * Author: Simon de Vlieger, Reviewers: Tomáš Hozza

  — Somewhere on the Internet, 2025-06-22


author: Packit <hello@packit.dev> - 23-1
changelog:
  Changes with 23
  ----------------
    * cmd/describe: ensure that all image types can be described (HMS-7044) (#231)
      * Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Simon de Vlieger

  — Somewhere on the Internet, 2025-06-25


author: Packit <hello@packit.dev> - 24-1
changelog:
  Changes with 24
  ----------------
    * Always set rhsm.Facts when generating manifests (#239)
      * Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Simon de Vlieger
    * doc/01-usage.md: avoid multiple h1 in one document (#235)
      * Author: Florian Schüller, Reviewers: Michael Vogt, Simon de Vlieger
    * doc/10-faq.md: add image types documentation (#236)
      * Author: Florian Schüller, Reviewers: Michael Vogt, Simon de Vlieger
    * docs: subscription basic info (#205)
      * Author: Lukáš Zapletal, Reviewers: Brian C. Lane, Michael Vogt
    * readme: mention mount for container (#232)
      * Author: Simon de Vlieger, Reviewers: Brian C. Lane, Jelle van der Waa, Michael Vogt

  — Somewhere on the Internet, 2025-07-09


author: Martin Kolman <mkolman@redhat.com> - 0.3.86-1
changelog:
  - Drop python-nose from the dependencies (#1916799) (vponcova)
  - Add the makeupdates script (vponcova)
  - Remove deprecated support for add-ons (vponcova)
  - Don't run installation tasks of add-ons in a meta task (vponcova)
  - Migrate COPR builds from Jenkins to Packit (jkonecny)
  - Add documentation for the new test solution (jkonecny)
  - Add support for custom Anaconda COPR repository (jkonecny)
  - Use `make test` to run TMT tests locally (jkonecny)
  - Add TMT configuration to get Anaconda COPR build (jkonecny)
  - Add Packit support for initial-setup (jkonecny)
  - Update and use setup.py for archive creation (jkonecny)
  - Fix ChangeLog generation in Makefile (jkonecny)


author: Martin Kolman <mkolman@redhat.com> - 0.3.89-1
changelog:
  - Include scripts in the updates image (vponcova)
  - Drop build time dependency on the anaconda package (mkolman)


author: Martin Kolman <mkolman@redhat.com> - 0.3.90.1-1
changelog:
  - Add gnome-kiosk to window managers usable by initial-setup (#1962198) (vponcova)
    Resolves: rhbz#1962198


author: Martin Kolman <mkolman@redhat.com> - 0.3.90.2-1
changelog:
  - Disable multi TTY handler when running in SSH session (#1951577) (mkolman)
    Resolves: rhbz#1951577


author: Florence Blanc-Renaud <flo@redhat.com> - 4.11.0-2
changelog:
  - Resolves: RHEL-14292 Backport latest test fixes in python3-ipatests
  - Resolves: RHEL-15443 Server install: failure to install with externally signed CA because of timezone issue
  - Resolves: RHEL-15444 Minimum length parameter in pwpolicy cannot be removed with empty string
  - Resolves: RHEL-14842 Upstream xmlrpc tests are failing in RHEL9.4


author: Florence Blanc-Renaud <flo@redhat.com> - 4.11.0-5
changelog:
  - Resolves: RHEL-12589 ipa: Invalid CSRF protection
  - Resolves: RHEL-19748 ipa hbac-test did not report that it hit an arbitrary search limit
  - Resolves: RHEL-21059 'DogtagCertsConfigCheck' fails, displaying the error message 'Malformed directive: ca.signing.certnickname=caSigningCert cert-pki-ca'
  - Resolves: RHEL-21804 ipa client 4.10.2 - Failed to obtain host TGT
  - Resolves: RHEL-21809 CA less servers are failing to be added in topology segment for domain suffix
  - Resolves: RHEL-21810 ipa-client-install --automount-location does not work
  - Resolves: RHEL-21811 Handle change in behavior of pki-server ca-config-show in pki 11.5.0
  - Resolves: RHEL-21812 Backport latest test fixes in ipa
  - Resolves: RHEL-21813 krb5kdc fails to start when pkinit and otp auth type is enabled in ipa
  - Resolves: RHEL-21815 IPA 389ds plugins need to have better logging and tracing
  - Resolves: RHEL-21937 Make sure a default NetBIOS name is set if not passed in by ADTrust instance constructor


author: 2024 Florence Blanc-Renaud <flo@redhat.com> - 4.11.0-6
changelog:
  - Resolves: RHEL-23627 IPA stops working if HTTP/... service principal was created before FreeIPA 4.4.0 and never modified
  - Resolves: RHEL-23625 sidgen plugin does not ignore staged users
  - Resolves: RHEL-23621 session cookie can't be read
  - Resolves: RHEL-22372 Gating-DL1 test failure in test_integration/test_dns_locations.py::TestDNSLocations::()::test_ipa_ca_records
  - Resolves: RHEL-21809 CA less servers are failing to be added in topology segment for domain suffix
  - Resolves: RHEL-17996 Memory leak in IdM's KDC


author: Florence Blanc-Renaud <flo@redhat.com> - 4.11.0-7
changelog:
  - Resolves: RHEL-25260 tier-1-upstream-dns-locations failed on RHEL8.8 gating
  - Resolves: RHEL-25738 ipa-kdb: Cannot determine if PAC generator is available
  - Resolves: RHEL-25815 Backport latest test fixes in python3-ipatests


author: Florence Blanc-Renaud <flo@redhat.com> - 4.11.0-8
changelog:
  - Resolves: RHEL-12143 'ipa vault-add is failing with ipa: ERROR: an internal error has occurred in FIPS mode
  - Resolves: RHEL-25738 ipa-kdb: Cannot determine if PAC generator is available


author: Florence Blanc-Renaud <flo@redhat.com> - 4.11.0-9
changelog:
  - Resolves: RHEL-28258 vault fails on non-fips client if server is in FIPS mode
  - Resolves: RHEL-26154 ipa: freeipa: specially crafted HTTP requests potentially lead to DoS or data exposure


author: Florence Blanc-Renaud <flo@redhat.com> - 4.11.0-10
changelog:
  - Resolves: RHEL-23377 Enforce OTP for ldap bind (in some scenarios)
  - Resolves: RHEL-29745 Unable to re-add broken AD trust - NT_STATUS_INVALID_PARAMETER
  - Resolves: RHEL-30905 Backport latest test fixes in ipa


author: Florence Blanc-Renaud <flo@redhat.com> - 4.10.2-4
changelog:
  - Resolves: rhbz#2231847 RHEL 8.8 & 9.2 fails to create AD trust with STIG applied
  - Resolves: rhbz#2232056 Include latest test fixes in python3-ipatests


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.0-1
changelog:
  - Resolves: RHEL-39140 Rebase ipa to the latest 4.12 version for RHEL 9.5
  - Resolves: RHEL-34757 The change for preventing deletion of the admin user caused a regression in disable
  - Resolves: RHEL-30553 Depend on nfsv4-client-utils or nfs-utils
  - Resolves: RHEL-29762 IPA sidgen fails to create SID for manually set ID for a new range [rhel-9.5.0]
  - Resolves: RHEL-26261 Fix replica connection check for use with AD administrator
  - Resolves: RHEL-18062 ipa ca-show NAME --certificate-out=file creates empty file when NAME does not exist
  - Resolves: RHEL-12149 traceback in ipaserver/dcerpc.py
  - Resolves: RHEL-4810 [RFE] FreeIPA-to-FreeIPA migration
  - Resolves: RHEL-4807 [RFE] Support in IPA for HSM boxes


author: Julien Rische <jrische@redhat.com> - 4.12.0-4
changelog:
  - Resolves: RHEL-29928 CVE-2024-3183 freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force
  - Resolves: RHEL-29691 CVE-2024-2698 freeipa: delegation rules allow a proxy service to impersonate any user to access another target service


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.0-5
changelog:
  - Resolves: RHEL-37285 IPA Web UI not showing replication agreement for non-admin users
  - Resolves: RHEL-42703 PSKC.xml issues with ipa_otptoken_import.py
  - Resolves: RHEL-41194 ipa-client rpm post script creates always ssh_config.orig even if nothing needs to be changed
  - Resolves: RHEL-39477 kdc.crt certificate not getting automatically renewed by certmonger in IPA Hidden replica
  - Resolves: RHEL-46559 Include latest fixes in python3-ipatests packages
  - Resolves: RHEL-22188 [RFE] Allow IPA SIDgen task to continue if it finds an entity that SID can't be assigned to


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.0-6
changelog:
  - Resolves: RHEL-47292 Include latest fixes in python3-ipatests packages
  - Resolves: RHEL-47146 Syntax error uninstalling the selinux-luna subpackage
  - Resolves: RHEL-46009 ipa-migrate with -Z option fails with ValueError: option error
  - Resolves: RHEL-46003 ipa-migrate -V options fails to display version
  - Resolves: RHEL-45463 ipa-migrate stage-mode is failing with error: Modifying a mapped attribute in a managed entry is not allowed
  - Resolves: RHEL-40890 ipa-server-install: token_password_file read in kra.install_check after calling hsm_validator in ca.install_check
  - Resolves: RHEL-40661 Adjust "ipa config-mod --addattr ipaconfigstring=EnforceLDAPOTP" to allow for non OTP users in some cases


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.0-7
changelog:
  - Resolves: RHEL-53500 adtrustinstance only prints issues in check_inst() and does not log them
  - Resolves: RHEL-52306 Unconditionally add MS-PAC to global config
  - Resolves: RHEL-52300 RFE - Keep the configured value for the "nsslapd-ignore-time-skew" after a "force-sync"
  - Resolves: RHEL-52222 ipa-replica/server-install with softhsm needs to check permission/ownership of /var/lib/softhsm/tokens to avoid install failure
  - Resolves: RHEL-51944 Include latest fixes in python3-ipatests packages
  - Resolves: RHEL-50804 ipa-migrate -Z with invalid cert options fails with 'ValueError: option error'
  - Resolves: RHEL-49602 misleading warning for missing ipa-selinux-nfast package on luna hsm h/w
  - Resolves: RHEL-27856 'Unable to log in as uid=admin-replica.testrealm.test,ou=people,o=ipaca' during replica install


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-1
changelog:
  - Resolves: RHEL-54546 Covscan issues: Resource Leak
  - Resolves: RHEL-49602 misleading warning for missing ipa-selinux-nfast package on luna hsm h/w
  - Resolves: RHEL-40359 With unreachable AD, ipa trust returns an internal error


author: Eduard Abdullin <eabdullin@almalinux.org> - 4.12.2-1.2.alma.1
changelog:
  - Add ipa-idrange-fix
  - ipatests: Add missing comma in
   test_idrange_no_rid_bases_reversed
  - ipatests: Fixes for ipa-idrange-fix testsuite
  - Do not let user with an expired OTP token to log in if only
   OTP is allowed


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-1.3
changelog:
  - Resolves: RHEL-69928 add support for python cryptography 44.0.0
  - Resolves: RHEL-70258 Upgrade to ipa-server-4.12.2-1.el9 OTP-based bind to LDAP without enforceldapotp is broken
  - Resolves: RHEL-70482 ipa-server-upgrade fails after established trust with ad
  - Resolves: RHEL-67192 CVE-2024-11029 ipa: Administrative user data leaked through systemd journal


author: Thomas Woerner <twoerner@redhat.com> - 4.12.2-11
changelog:
  - Resolves: RHEL-67913 Add DNS over TLS Support, Require bind9.18 32:9.18.29-2 and new bind-dyndb-ldap 11.11-1


author: Thomas Woerner <twoerner@redhat.com> - 4.12.2-14
changelog:
  - Resolves: RHEL-80345 Use new bind9.18-dyndb-ldap and bind9.18 only for DNS over TLS with the ipa-server-encrypted-dns package


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-14.1
changelog:
  - Resolves: RHEL-89908
    EMBARGOED CVE-2025-4404 ipa: Privilege escalation from host to domain admin in FreeIPA
  - Resolves: RHEL-89144
    kdb: ipadb_get_connection() succeeds but returns null LDAP context


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-14.4
changelog:
  - Resolves: RHEL-110068
    EMBARGOED CVE-2025-7493 ipa: Privilege escalation from host to domain admin in FreeIPA


author: EL Errata <el-errata_ww@oracle.com> - 4.12.2-14.0.1.5
changelog:
  - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674]
  - Add bind to ipa-server-common Requires [Orabug: 36518596]


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-6
changelog:
  - Resolves: RHEL-68448 ipa trust-add fails in FIPS mode with an internal error has occurred
  - Resolves: RHEL-69301 Support GSSAPI in Cockpit on IPA servers


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-7
changelog:
  - Resolves: RHEL-70760 Fix typo in ipa-migrate log file i.e 'Privledges' to 'Privileges'
  - Resolves: RHEL-70481 ipa-server-upgrade fails after established trust with ad
  - Resolves: RHEL-69927 add support for python cryptography 44.0.0
  - Resolves: RHEL-69908 All user groups are not being included during HSM token validation
  - Resolves: RHEL-69900 Upgrade to ipa-server-4.12.2-1.el9 OTP-based bind to LDAP without enforceldapotp is broken


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-8
changelog:
  - Resolves: RHEL-73022 A slow HSM can cause IPA server installation to fail setting up certificate tracking [rhel-9]
  - Resolves: RHEL-71261 [RHEL-9.6] Include latest fixes in python3-ipatests package
  - Resolves: RHEL-67191 CVE-2024-11029 ipa: Administrative user data leaked through systemd journal [rhel-9.6]
  - Resolves: RHEL-59040 KRA installation failure caused by a certificate mismatch in NSS DB and configuration file.


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-9
changelog:
  - Resolves: RHEL-74465 kinit with external idp user is failing
  - Resolves: RHEL-75656 Include latest fixes in python3-ipatests package


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-10
changelog:
  - Resolves: RHEL-73022 A slow HSM can cause IPA server installation to fail setting up certificate tracking


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-5
changelog:
  - Resolves: RHEL-67414 ipa dns-zone --allow-query '!198.18.2.0/24;any;' fails with Unrecognized IPAddress flags
  - Resolves: RHEL-67410 ipa-migrate should also migrate DNS forward zones
  - Resolves: RHEL-67409 ipa-migrate in stage mode fails with TypeError: 'NoneType' object is not iterable
  - Resolves: RHEL-66964 Include latest fixes in python3-ipatests packages
  - Resolves: RHEL-64135 IDP configuration in the IdM WebUI shows Organization is required


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-15
changelog:
  - Resolves: RHEL-84481 Protect all IPA service principals
  - Resolves: RHEL-84277 [RFE] IDM support UIDs up to 4,294,967,293
  - Resolves: RHEL-84276 Ipa client --raw --structured throws internal error
  - Resolves: RHEL-82707 Search size limit tooltip has Search time limit tooltip text
  - Resolves: RHEL-82089 IPU 9 -> 10: ipa-server breaks the in-place upgrade due to failed scriptlet
  - Resolves: RHEL-68800 ipa-migrate with LDIF file from backup of remote server, fails with error 'change collided with another change'
  - Resolves: RHEL-30658 ipa-cacert-manage install fails with CAs having the same subject DN (subject key mismatch info)


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-16
changelog:
  - Resolves: RHEL-88900 [RFE] Add check on CA cert expiry for ipa-cert-fix
  - Resolves: RHEL-88037 Server installation: dot-forwarder not added as a forwarder
  - Resolves: RHEL-86483 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-41178 ipa-sidgen: fix memory leak in ipa_sidgen_add_post_op()


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-17
changelog:
  - Resolves: RHEL-95010 [RFE] Give warning when adding user with UID out of any ID range
  - Resolves: RHEL-93890 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-93887 ipa idrange-add --help should be more clear about required options
  - Resolves: RHEL-93483 Unable to modify IPA config; --ipaconfigstring="" causes internal error
  - Resolves: RHEL-88834 kdb: ipadb_get_connection() succeeds but returns null LDAP context
  - Resolves: RHEL-68800 ipa-migrate with LDIF file from backup of remote server, fails with error 'change collided with another change'


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-19
changelog:
  - Resolves: RHEL-100450 eDNS: multiple issues during encrypted DNS setup
  - Resolves: RHEL-89907 Privilege escalation from host to domain admin in FreeIPA
  - Resolves: RHEL-99315 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-98565 ipa-idrange-fix: 'Env' object has no attribute 'basedn'
  - Resolves: RHEL-96920 Nightly test failure (rawhide) in test_trust.py::TestTrust::test_server_option_with_unreachable_ad
  - Resolves: RHEL-31907 kdb: support storing and retrieving multiple master keys


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-20
changelog:
  - Resolves: RHEL-106285 Incorrect use of external IdP GitHub trademark
  - Resolves: RHEL-106026 Include fixes in python3-ipatests package
  - Resolves: RHEL-105512 kdb: prevent double crash in RBCD ACL free
  - Resolves: RHEL-101707 ipatests: use "sos report" instead of "sosreport" command
  - Resolves: RHEL-101544 ipa-client-encrypted-dns does not ensure bind-utils >= 9.18 for DoT-compatible nsupdate
  - Resolves: RHEL-100450 eDNS: multiple issues during encrypted DNS setup


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-22
changelog:
  - Resolves: RHEL-107483 ipa-ca-install fails on CA-less replica due to inadequate key usage in master certificate


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-22.2
changelog:
  - Resolves: RHEL-141322 Memory leaks in IPA plugins
  - Resolves: RHEL-141314 AddressSanitizer: SEGV ipa-pwd-extop/common.c:584 in ipapwd_gen_checks
  - Resolves: RHEL-129963 Fix ipatests for kdcproxy after CVE-2025-59088 fix
  - Resolves: RHEL-124424 test_cacert_manage fails due to expired Let's Encrypt R3 certificate


author: David Hanina <dhanina@redhat.com> - 4.12.2-22.4
changelog:
  - Resolves: RHEL-155038 Pagure #9953: Adding a group with 32Bit Idrange fails.
  - Resolves: RHEL-153628 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-153621 Pagure #9854: Erroneous case-sensitivity in offline DSE lookup


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-24
changelog:
  - Resolves: RHEL-118448 CVE-2025-7493 ipa: Privilege escalation from host to domain admin in FreeIPA


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-25
changelog:
  - Resolves: RHEL-128238 [RFE] Support storing LWCA private keys on an HSM [rhel-9]
  - Resolves: RHEL-126515 RFE: Enable external password reset agents to use ipa_pwd_extop in RHEL IdM [rhel-9]
  - Resolves: RHEL-73399 RFE: Update IdM password policy configurations to meet M-22-09 by restricting spaces and require number character class
  - Resolves: RHEL-128241 ATTR_NAME_BY_OID is missing OID 2.5.4.97, organizationIdentifier [rhel-9]
  - Resolves: RHEL-126514 [RFE] ipa-client-automount should have an option to include domain of the machine. [rhel-9]
  - Resolves: RHEL-124171 Include latest fixes in python3-ipatests package 
  - Resolves: RHEL-120514 Include fixes in python3-ipatests [rhel-9.8]
  - Resolves: RHEL-118609 test_cacert_manage fails due to expired Let's Encrypt R3 certificate


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.0-1
changelog:
  - Resolves: RHEL-134542 Add modern WebUI as submodule and enable routing in Apache 
  - Resolves: RHEL-134540 Switch IPA to use the PKI python API directly rather than RPC calls
  - Resolves: RHEL-134196 After upgrade from 9.7 to 9.8 ipactl restart fails to restart winbind service 
  - Resolves: RHEL-132334 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-129224 Fix ipatests for kdcproxy after CVE-2025-59088 fix
  - Resolves: RHEL-126974 Minor typo in ipa_idrange_fix.py
  - Resolves: RHEL-120954 Rebase ipa to latest 4.13.x version for RHEL 9.8


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-1
changelog:
  - Resolves: RHEL-141446 [RFE] Command that retrieve and install new CA certificates
  - Resolves: RHEL-140584 Support replaceable WebUI artwork for RHEL and CentOS
  - Resolves: RHEL-141297 Memory leaks in IPA plugins
  - Resolves: RHEL-141054 IPA fails to sign zone
  - Resolves: RHEL-138570 AddressSanitizer: SEGV ipa-pwd-extop/common.c:584 in ipapwd_gen_checks
  - Resolves: RHEL-138473 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-137585 ipa-server-upgrade succeeds but ipactl restart fails due to ipa-dnskeysyncd service failure caused by SELinux AVC denial on RHEL 9.8


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-2
changelog:
  - RHEL-147191 ipa uninstallation is failing with message "'NoneType' object has no attribute 'lower'"
  - RHEL-146185 Names of domains from a trusted forest should be compared case-insentive
  - RHEL-146184 ipa-advise client script requires keytab (should just require root access on client system)
  - RHEL-145854 Include latest fixes in python3-ipatests package
  - RHEL-143684 When using xmlrpc, ipa server failed with assert type(value) in (unicode, float, int, bool, type(None))
  - RHEL-141500 ipa use systemd-sysusers


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-3
changelog:
  - RHEL-148282 ipa-replica-conncheck fails with "an internal error has occured"
  - RHEL-148481 Pruning is enabled by default with RSN on RHEL 9.8


author: David Hanina <dhanina@redhat.com> - 4.13.1-3.1
changelog:
  - Resolves: RHEL-166865 Include latest fixes in python3-ipatests package [rhel-9.8.z]
  - Resolves: RHEL-155037 Pagure #9953: Adding a group with 32Bit Idrange fails. [rhel-9.8.z]
  - Resolves: RHEL-153146 IdM password policy Min lifetime is not enforced when high minlife is set [rhel-9.8.z]
  - Resolves: RHEL-168047 ipa ca-show ipa --all failing to list RSN version


author: Rob Crittenden <rcritten@redhat.com> - 0.9-7
changelog:
  - debug='True' in ipahealthcheck.conf doesn't enable debug output (#2079861)
  - Validate value formats in the ipahealthcheck.conf file (#2079739)
  - Validate output_type options from ipahealthcheck.conf file (#2079698)


author: Rob Crittenden <rcritten@redhat.com> - 0.16-2
changelog:
  - Don't fail if a service name cannot be looked up in LDAP
  - Disable the ipa-ods-exporter service check


author: Rob Crittenden <rcritten@redhat.com> - 0.19-1
changelog:
  - Update to 0.19 release
    - Add a message if not a trust agent/controller (RHEL-116896)
    - Check that expected NSS token matches the current FIPS state (RHEL-116897)
    - Add /etc/pki/tls/certs/ directory to file checker (RHEL-116898)
    - Check that allowed_uids in the SSSD config is valid (RHEL-79092)


author: Phil Sutter <psutter@redhat.com> - 7.11-8
changelog:
  - Ship iptables-translate utility with ipset package
  - Add missing function to libipset.map and bump library version
  - Fix all debug mode warnings
  - ipset-translate: allow invoking with a path name
  - Fix IPv6 sets nftables translation
  - Fix typo in ipset-translate man page
  - tests: add tests ipset to nftables
  - add ipset to nftables translation infrastructure
  - lib: Detach restore routine from parser
  - lib: split parser from command execution


author: Phil Sutter <psutter@redhat.com> [1.8.10-3.el9]
changelog:
  - extensions: libxt_sctp: Add an extra assert() (Phil Sutter) [RHEL-40928]
  - spec: Add symlinks for merged extension DSOs (Phil Sutter) [RHEL-32463]
  - nft: Fix for broken recover_rule_compat() (Phil Sutter) [RHEL-26619]
  - spec: Ship ebtables-translate and man page (Phil Sutter) [RHEL-32922]


author: Phil Sutter <psutter@redhat.com> [1.8.10-5.el9]
changelog:
  - xtables-monitor: Ignore ebtables policy rules unless tracing (Phil Sutter) [RHEL-47264]
  - xtables-monitor: Fix for ebtables rule events (Phil Sutter) [RHEL-47264]
  - tests: shell: New xtables-monitor test (Phil Sutter) [RHEL-47264]
  - xtables-monitor: Support arptables chain events (Phil Sutter) [RHEL-47264]
  - xtables-monitor: Align builtin chain and table output (Phil Sutter) [RHEL-47264]
  - xtables-monitor: Flush stdout after all lines of output (Phil Sutter) [RHEL-47264]
  - xtables-monitor: Proper re-init for rule's family (Phil Sutter) [RHEL-47264]
  - nft: Fix for zeroing existent builtin chains (Phil Sutter) [RHEL-49497]
  - nft: cache: Annotate faked base chains as such (Phil Sutter) [RHEL-49497]
  - nft: Fix for zeroing non-existent builtin chains (Phil Sutter) [RHEL-49497]


author: Phil Sutter <psutter@redhat.com> - 1.8.7-29
changelog:
  - libxtables: Boost rule target checks by announcing chain names
  - libxtables: Implement notargets hash table
  - nft: Reject standard targets as chain names when restoring
  - xshared: Merge and share parse_chain()
  - xshared: Prefer xtables_chain_protos lookup over getprotoent
  - nft: Speed up immediate parsing
  - nft: Simplify immediate parsing


author: Phil Sutter <psutter@redhat.com> - 1.8.8-5
changelog:
  - nft: un-break among match with concatenation
  - nft: fix ebtables among match when mac+ip addresses are used


author: Phil Sutter <psutter@redhat.com> [1.8.10-1.el9]
changelog:
  - spec: Support for _excludedocs macro in alternatives installation (Phil Sutter) [RHEL-5810]
  - Rebase onto version 1.8.10 (Phil Sutter) [RHEL-14147]


author: Jan Macku <jamacku@redhat.com> - 20210202-10
changelog:
  - arping: Fix 1s delay on exit for unsolicited arpings (RHEL-34110)
  - arping: exit 0 if running in deadline mode and we see replies (RHEL-27718)
  - ping: Print reply with wrong source with warning & some follow-up fixes (RHEL-12789, RHEL-13480)
  - ping: Fix socket error reporting (RHEL-4608)


author: Jan Macku <jamacku@redhat.com> - 20210202-11.1
changelog:
  - Fix CVE-2025-47268 iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping (RHEL-94335)


author: Jan Macku <jamacku@redhat.com> - 20210202-12
changelog:
  - Fix CVE-2025-47268 iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping (RHEL-94334)


author: Cole Robinson <aintdiscole@gmail.com> - 20200823-1.git4bd064de.git
changelog:
  - Update to newer git snapshot, synced with qemu.git
  - Re-enable HTTPS support, with edk2 fix included (bz 1820836)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200823-4.git4bd064de
changelog:
  - ipxe-Skip-some-QEMU-ROMs-when-building-for-RHEL.patch [bz#1956931]
  - ipxe-spec-combine-BIOS-and-EFI-roms-using-util-catrom.pl.patch [bz#1957246]
  - Resolves: bz#1956931
    (ipxe-roms-qemu list: Clean out old ROMs)
  - Resolves: bz#1957246
    (boot vm from pxe failed)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200823-5.git4bd064de
changelog:
  - ipxe-Disable-SHA-1.patch [bz#1935932]
  - ipxe-Replace-genisoimage-with-xorriso.patch [bz#1971981]
  - ipxe-spec-Drop-disabled-efi-ia32-build-infrastructure.patch [bz#1980138]
  - ipxe-spec-Generate-qemu-compatible-rom-filenames.patch [bz#1980138]
  - Resolves: bz#1935932
    (ipxe implements and/or uses the deprecated SHA-1 algorithm by default ()
  - Resolves: bz#1971981
    (Please replace genisoimage with xorriso)
  - Resolves: bz#1980138
    (install qemu rom symlinks so qemu doesn't have to)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200823-6.git4bd064de
changelog:
  - ipxe-Add-ping-command-support.patch [bz#1985658]
  - ipxe-Add-VLAN-tagging-support.patch [bz#1985658]
  - ipxe-netdevice-Strip-802.Q-VLAN-0-priority-tags.patch [bz#1985658]
  - ipxe-Provide-snponly.efi-rom.patch [bz#1985658]
  - ipxe-Build-hwcert-subpackage.patch [bz#1985658]
  - Resolves: bz#1985658
    (carry forward rhel8 ipxe packaging changes)


author: Fabio Valentini <decathorpe@gmail.com> - 1.2.2-1
changelog:
  - Update to version 1.2.2.
  - Drop custom maven-compiler-plugin overrides in favor of upstream settings.


author: Marian Koncek <mkoncek@redhat.com> - 2.3.3-4
changelog:
  - Avoid possible NullPointerException
  - Resolves: rhbz#1993889
  - Load native library from the correct location
  - Resolves: rhbz#1994935


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b05-2
changelog:
  - Update to shenandoah-jdk8u382-b05 (GA)
  - Update release notes for shenandoah-8u382-b05.
  - Sync the copy of the portable specfile with the latest update
  - Add note at top of spec file about rebuilding
  - Use tapsets from the misc tarball on portable builds
  - Make sure root installation directory is created first
  - Use in-place substitution for all but the first of the tapset changes
  - The 'prelease' variable should refer to 'portablerelease', not 'rpmrelease'
  - Bump release number so we are newer than 9.0
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b01-1
changelog:
  - Update to shenandoah-jdk8u392-b01 (GA)
  - Update release notes for shenandoah-8u392-b01.
  - Sync the copy of the portable specfile with the latest update
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Related: RHEL-12209


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-2
changelog:
  - Update to shenandoah-jdk8u392-b08 (GA)
  - Update release notes for shenandoah-8u392-b08.
  - Sync the copy of the portable specfile with the latest update
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Regenerate PR2462 patch following JDK-8315135
  - Bump version of bundled libpng to 1.6.39
  - Add backport of JDK-8312489 heading upstream for 8u402 (see OPENJDK-2095)
  - Add missing JFR, alt-java, jre-* and java-* alternative ghosts
  - Move jcmd to the headless package
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12208
  - Resolves: RHEL-13587
  - Resolves: RHEL-13590
  - Resolves: RHEL-13593
  - Resolves: RHEL-13583
  - Resolves: RHEL-13605
  - Resolves: RHEL-13615


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b06-0.2.ea
changelog:
  - Update to shenandoah-jdk8u402-b06 (GA)
  - Update release notes for shenandoah-8u402-b06.
  - Sync NEWS with vanilla branch version.
  - Sync the copy of the portable specfile with the latest update
  - Drop local copy of JDK-8312489 which is now included upstream
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-17918
  - Resolves: RHEL-20987


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:1.8.0.412.b01-0.2.ea
changelog:
  - Invoke xz in multi-threaded mode
  - generate_source_tarball.sh: Add WITH_TEMP environment variable
  - generate_source_tarball.sh: Multithread xz on all available cores
  - generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
  - generate_source_tarball.sh: Update comment about tarball naming
  - generate_source_tarball.sh: Reformat comment header
  - generate_source_tarball.sh: Reformat and update help output
  - generate_source_tarball.sh: Do a shallow clone, for speed
  - generate_source_tarball.sh: Eliminate some removal prompting
  - generate_source_tarball.sh: Make tarball reproducible
  - generate_source_tarball.sh: Prefix temporary directory with temp-
  - generate_source_tarball.sh: Remove temporary directory exit conditions
  - generate_source_tarball.sh: Set compile-command in Emacs
  - generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
  - generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
  - generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - generate_source_tarball.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: shellcheck: Do not use -a (SC2166)
  - generate_source_tarball.sh: shellcheck: Do not use $ on arithmetic variables (SC2004)
  - Use backward-compatible patch syntax
  - generate_source_tarball.sh: Ignore -ga tags with OPENJDK_LATEST
  - generate_source_tarball.sh: Remove trailing period in echo
  - generate_source_tarball.sh: Use long-style argument to grep
  - generate_source_tarball.sh: Add license
  - generate_source_tarball.sh: Add indentation instructions for Emacs
  - Related: RHEL-30934


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.2.ea
changelog:
  - Turn off xz multi-threading on i686 as it fails with an out of memory error
  - Move to upstream tag style (shenandoah8ux-by) in preparation for eventually moving back to official sources
  - generate_source_tarball.sh: Rename JCONSOLE_JS_PATCH{,_DEFAULT} to JCONSOLE_PATCH{,_DEFAULT} for brevity
  - generate_source_tarball.sh: Adapt OPENJDK_LATEST logic to work with 8u Shenandoah fork
  - generate_source_tarball.sh: Adapt version logic to work with 8u
  - generate_source_tarball.sh: Add quoting for SCRIPT_DIR and JCONSOLE_PATCH (SC2086)
  - generate_source_tarball.sh: Update examples in header for clarity
  - generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
  - generate_source_tarball.sh: Only add --depth=1 on non-local repositories
  - Move maintenance scripts to a scripts subdirectory
  - icedtea_sync.sh: Update with a VCS mode that retrieves sources from a Mercurial repository
  - discover_trees.sh: Set compile-command and indentation instructions for Emacs
  - discover_trees.sh: shellcheck: Do not use -o (SC2166)
  - discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: Add authorship
  - icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
  - icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
  - icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: Set compile-command and indentation instructions for Emacs
  - openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
  - openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
  - Remove obsolete file generate_singlerepo_source_tarball.sh
  - Remove obsolete file get_sources.sh
  - Remove obsolete file update_main_sources.sh
  - generate_source_tarball.sh: Handle an existing checkout
  - generate_source_tarball.sh: Sync indentation with java-21-openjdk version
  - generate_source_tarball.sh: Support using a subdirectory via TO_COMPRESS
  - Sync patch set with portable build
  - Related: RHEL-30934


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b07-0.2.ea
changelog:
  - Update to shenandoah-jdk8u412-b07 (EA)
  - Require tzdata 2024a due to upstream inclusion of JDK-8322725
  - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-30934


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b08-2
changelog:
  - Update to shenandoah-jdk8u412-b08 (GA)
  - Update release notes for shenandoah-8u412-b08.
  - Complete release note for Certainly roots
  - Switch to GA mode.
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
  - Resolves: RHEL-32409


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.422.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u422-b01 (EA)
  - Update release notes for shenandoah-8u422-b01.
  - Switch to EA mode.
  - Sync the copy of the portable specfile with the latest update
  - Update NEWS file and rename remove-intree-libraries.sh so portable can be rebuilt
  - Document policy repacking script and rename to correct spelling and style
  - Limit Java only tests to one architecture using jdk_test_arch
  - Temporarily include Zero-based architectures in jdk_test_arch until they are portable
  - Related: RHEL-46860
  - Resolves: RHEL-47069
  - Resolves: RHEL-47090


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.422.b05-1.1
changelog:
  - Update to shenandoah-jdk8u422-b05 (GA)
  - Update release notes for shenandoah-8u422-b05.
  - Rebase PR2462 patch following patched hunk being removed by JDK-8322106
  - Switch to GA mode.
  - Sync the copy of the portable specfile with the latest update
  - Actually require tzdata 2024a now it is available in the buildroot
  - Add missing build dependencies on zlib-devel and tar
  - Update LCMS version to match JDK-8245400
  - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
  - Resolves: RHEL-46860
  - Resolves: RHEL-47011


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.432.b06-1
changelog:
  - Update to shenandoah-jdk8u432-b06 (GA)
  - Update release notes for shenandoah-8u432-b06.
  - Drop JDK-828109{6,7,8}/PR3836 patch following integration of upstream version
  - Regenerate JDK-8199936/PR3533 patch following JDK-828109{6,7,8} integration
  - Bump version of bundled zlib to 1.3.1 following JDK-8324632
  - Include backport of JDK-8328999 to update giflib to 5.2.2
  - Bump version of bundled giflib to 5.2.2 following JDK-8328999
  - Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-58794
  - Resolves: RHEL-62280
  - Resolves: RHEL-61287
  - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.432.b06-3
changelog:
  - Rebuild RPM for 9.5 0day release
  - Related: RHEL-58794
  - Related: RHEL-62280
  - Related: RHEL-61287


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b05-0.2.ea
changelog:
  - Update to 8u442-b05 (EA).
  - Update release notes for 8u442-b05.
  - Switch to EA mode for pre-release.
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-73998


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b05-0.3.ea
changelog:
  - Add zero_arches to the portable_build_arches now that the portable build bundles libffi
  - Temporarily workaround libffi.so not being in lib/%{archinstall} by copying it
  - Exclude libffi.so from the debugedit run
  - Add a simple -version check on both the JDK and JRE bin/java
  - Add libffi.so to the filelist, including expanding the lib/%{archinstall} contents as with jre/lib
  - Sync the copy of the portable specfile and new patches with the latest update
  - Resolves: RHEL-74305


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b06-2
changelog:
  - Update to 8u442-b06 (GA)
  - Update release notes for 8u442-b06.
  - Switch to GA mode for final release
  - Revise JDK-8141590 backport to install libffi.so* in lib as well as jre/lib
  - Sync the copy of the portable specfile with the latest update
  - Remove libffi.so copying workaround now the portable build installs it in lib
  - Add bundled libffi.so to _privatelibs
  - Remove libffi.so copy if we are building on the same platform as the portable
  - Resolves: RHEL-73551
  - Related: RHEL-74305


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.452.b09-1
changelog:
  - Update to 8u452-b09 (GA)
  - Update release notes for 8u452-b09.
  - Remove long option documentation from JDK-8335912/JDK-8337499 as not present in 8u
  - Require tzdata 2025a due to upstream inclusion of JDK-8347965
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-04-15 @ 1pm PT. **
  - Resolves: RHEL-86976
  - Resolves: RHEL-86618


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.462.b08-1
changelog:
  - Update to 8u462-b08 (GA)
  - Update release notes for 8u462-b08.
  - Require tzdata 2025b due to upstream inclusion of JDK-8352716
  - Add early backport of JDK-8339414
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
  - Resolves: RHEL-101657
  - Resolves: RHEL-102311
  - Resolves: RHEL-102910


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.452.b09-2
changelog:
  - Update to 8u452-b09 (GA)
  - Update release notes for 8u452-b09.
  - Remove long option documentation from JDK-8335912/JDK-8337499 as not present in 8u
  - Require tzdata 2025a due to upstream inclusion of JDK-8347965
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-04-15 @ 1pm PT. **
  - Resolves: RHEL-86967
  - Resolves: RHEL-86620


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.462.b08-3
changelog:
  - Update to 8u462-b08 (GA)
  - Update release notes for 8u462-b08.
  - Require tzdata 2025b due to upstream inclusion of JDK-8352716
  - Add early backport of JDK-8339414
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
  - Resolves: RHEL-101648
  - Resolves: RHEL-102312
  - Resolves: RHEL-97496


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.462.b08-4
changelog:
  - Bump rpmrelease for CentOS build
  - Remove obsolete hack to hardcode newer portable version on RHEL
  - Related: RHEL-101648
  - Related: RHEL-102312
  - Related: RHEL-97496


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.462.b08-5
changelog:
  - Update get_bundle_versions.sh to match other scripts
  - * get_bundle_versions.sh: Add license
  - * get_bundle_versions.sh: Set compile-command in Emacs
  - * get_bundle_versions.sh: Use different error codes for different failures
  - * get_bundle_versions.sh: Remove unneeded '.' in JPEG version
  - * get_bundle_versions.sh: shellcheck: Double-quote variable references (SC2086)
  - * get_bundle_versions.sh: shellcheck: Drop use of cat and pass file to awk directly (SC2002)
  - Add OpenJDK 8u support to get_bundle_versions.sh
  - Print bundle updates and backouts at end of openjdk_news.sh output
  - Refer user to get_bundle_versions.sh when bundle updates are found by openjdk_news.sh
  - Add timezone data update check to openjdk_news.sh
  - Add duplicate check to openjdk_news.sh
  - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-119329


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.472.b08-1
changelog:
  - Update to 8u472-b08 (GA).
  - Update release notes for 8u472-b08.
  - Drop local JDK-8339414 fix as this is now included upstream
  - Reset rpmrelease to 1 now there are no other RPM builds on RHEL 9
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. **
  - Resolves: RHEL-118767
  - Resolves: RHEL-119455


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.472.b08-2
changelog:
  - Bump rpmrelease for CentOS build
  - Add scripts to handle tagging of portable-based RPMs
  - Related: RHEL-118767
  - Related: RHEL-119455
  - Related: RHEL-118775


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.482.b08-1
changelog:
  - Update to 8u482-b08 (GA).
  - Update release notes for 8u482-b08.
  - Remove generated-configure.sh changes from JDK-8141590 & FIPS patch as we already autogenerate this
  - Turn on system FreeType as on later JDK versions and add to _privatelibs
  - Set bundled FreeType version to 2.13.2 following JDK-8316028
  - Bump LCMS 2 version to 2.14.0 following JDK-8297088
  - Bump libpng version to 1.6.51 following JDK-8372534
  - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT
  - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **
  - Resolves: RHEL-142687
  - Resolves: RHEL-139534
  - Resolves: RHEL-131588
  - Resolves: RHEL-131600
  - Resolves: RHEL-142875
  - Resolves: RHEL-142697


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.482.b08-2
changelog:
  - Bump rpmrelease for CentOS build
  - Related: RHEL-142687
  - Related: RHEL-139534
  - Related: RHEL-131588
  - Related: RHEL-131600
  - Related: RHEL-142875
  - Related: RHEL-142697


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.482.b08-3
changelog:
  - Update tagging scripts to include signature checks and correctly handle gating
  - Add gating scripts to simplify obtaining results and waiving issues
  - Resolves: RHEL-147634
  - Resolves: RHEL-151197


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.492.b09-1
changelog:
  - Update to 8u492-b09 (GA)
  - Update release notes for 8u492-b09.
  - Add missing CVEs for 8u482.
  - Regenerate JDK-8199936/PR3533 patch following JDK-8374917
  - Regenerate JDK-8186464/RH1433262 patch following JDK-8370986
  - Drop local giflib 5.2.2 patch now JDK-8328999 is included upstream
  - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158
  - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078
  - Bump LCMS 2 version to 2.15.0 following JDK-8303482
  - Bump libpng version to 1.6.57 following JDK-8375063, JDK-8377526, JDK-8380959 & JDK-8382047
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
  - Resolves: RHEL-169446
  - Resolves: RHEL-133291
  - Resolves: RHEL-147348
  - Resolves: RHEL-148407
  - Resolves: RHEL-148981
  - Resolves: RHEL-161303
  - Resolves: RHEL-161452
  - Resolves: RHEL-157139
  - Resolves: RHEL-157156


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:1.8.0.502.b07-1.1
changelog:
  - Make headless own /usr/share/doc/java-1.8.0-openjdk
  - Make javadoc-zip own /usr/share/javadoc/java-1.8.0-openjdk
  - Do not overwrite slowdebug __provides_exclude_from and __requires_exclude_from regexps
  - Resolves: RHEL-212327
  - Resolves: RHEL-212328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.502.b07-1.1
changelog:
  - Update to 8u502-b07 (GA).
  - Update release notes for 8u502-b07.
  - Bump lcms2 version to 2.19.1 following JDK-8321489, JDK-8348110, JDK-8375065 & JDK-8383354
  - Bump zlib version to 1.3.2 following JDK-8378631
  - Require tzdata 2026b due to upstream inclusion of JDK-8383175
  - Add attempted patch for JDK-8385876 to fix -Wnonnull build failure with s390x Zero on CentOS 9
  - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file
  - Explictly define supported architectures
  - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field
  - Make zone string debug output optional in TestTranslations
  - Change javadoc-zip to just own the top-level directory, not include the entire subtree
  - Update tagged versions to include 9.8.0-z & 9.9.0.
  - Cleanup tagging and gating scripts to appease shellcheck:
  - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg.
  - * scripts/builds/check_signatures.sh: Quote variable usage.
  - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage.
  - * scripts/builds/waive_leapp_issue.sh: Likewise.
  - * scripts/builds/waive_rpminspect.sh: Likewise.
  - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable.
  - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage.
  - Obsolete old RHEL releases (8.2.0-z, 9.0.0-z, 9.7.0-z)
  - Sync the copy of the portable specfile with the latest update
  - Sync portable naming with later JDKs, due to adoption of <compatiblename> by portable
  - Drop <pversion> which is a redundant alias for version now
  - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. **
  - Resolves: RHEL-212095
  - Resolves: RHEL-188852
  - Resolves: RHEL-149784
  - Resolves: RHEL-212316
  - Resolves: RHEL-212318
  - Related: RHEL-212327
  - Resolves: RHEL-212329
  - Resolves: RHEL-212330


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.502.b07-1.2
changelog:
  - Bump release for PQC build
  - Related: RHEL-212095
  - Related: RHEL-188852
  - Related: RHEL-149784
  - Related: RHEL-212316
  - Related: RHEL-212318
  - Related: RHEL-212329
  - Related: RHEL-212330
  - Related: RHEL-212327
  - Related: RHEL-212328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-1
changelog:
  - Update to jdk-11.0.20.0+8 (GA)
  - Update release notes to 11.0.20.0+8
  - Drop local inclusion of JDK-8274864 & JDK-8305113 as they are included in 11.0.20+1
  - Bump tzdata requirement to 2023c now it is available in the buildroot
  - Bump bundled LCMS version to 2.15 as in jdk-11.0.20+1.
  - Bump bundled HarfBuzz version to 7.0.1 as in jdk-11.0.20+7
  - Use tapsets from the misc tarball
  - Introduce 'prelease' for the portable release versioning, to handle EA builds
  - Make sure root installation directory is created first
  - Use in-place substitution for all but the first of the tapset changes
  - Sync the copy of the portable specfile with the latest update
  - Add note at top of spec file about rebuilding
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2217715
  - Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-3
changelog:
  - Fix tzdata requirement copy-and-paste error that led to two BuildRequires and no Requires
  - Resolves: rhbz#2224420


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.1.1-1
changelog:
  - Update to jdk-11.0.20.1+1 (GA)
  - Add backport of JDK-8312489 already upstream in 11.0.22 (see OPENJDK-2095)
  - Add backport of JDK-8243210 already upstream in 11.0.21 (see RH2229269)
  - Update openjdk_news script to specify subdirectory last
  - Add missing discover_trees script required by openjdk_news
  - Resolves: rhbz#2236590


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-2
changelog:
  - Update to jdk-11.0.21+9 (GA)
  - Sync the copy of the portable specfile with the latest update
  - Re-generate FIPS patch against 11.0.21+1 following backport of JDK-8155246
  - Re-generate SHA3 patch following backport of JDK-8242151
  - Bump libpng version to 1.6.39 following JDK-8305815
  - Bump HarfBuzz version to 7.2.0 following JDK-8307301
  - Bump freetype version to 2.13.0 following JDK-8306881
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Apply all patches using -p1
  - Drop local backport of JDK-8243210 which is upstream from 11.0.21+2
  - Add missing JFR alternative ghost
  - Move jcmd to the headless package
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12214
  - Resolves: RHEL-13526
  - Resolves: RHEL-13529
  - Resolves: RHEL-13532
  - Resolves: RHEL-13536
  - Resolves: RHEL-13539


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.7-1
changelog:
  - Update to jdk-11.0.22+7 (GA)
  - Sync the copy of the portable specfile with the latest update
  - Drop local copy of JDK-8312489 which is now included upstream
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-20991


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.9-1
changelog:
  - Update to jdk-11.0.23+9 (GA)
  - Update release notes to 11.0.23+9
  - Switch to GA mode for release
  - Require tzdata 2024a due to upstream inclusion of JDK-8322725
  - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
  - Resolves: RHEL-30920


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.24.0.8-1
changelog:
  - Update to jdk-11.0.24+8 (GA)
  - Update release notes to 11.0.24+8
  - Adjusted DTLS & RPATH NEWS entries to match OpenJDK 17 & 21 release notes
  - Switch to GA mode for release
  - Fix Provides to reflect up to date component versions
  - Add zlib build required or bundled version (1.3.1), depending on system_libs setting
  - Resolves: RHEL-45202
  - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **


author: Antonio Vieiro <avieirov@redhat.com> - 1:11.0.25.0.6-0.2.ea
changelog:
  - Update to jdk-11.0.25+6 (EA)
  - Update release notes to 11.0.25+6
  - Switch to EA mode
  - Bump giflib version to 5.2.2 following JDK-8328999
  - Bump libpng version to 1.6.43 following JDK-8329004
  - Related: RHEL-58775


author: Antonio Vieiro <avieirov@redhat.com> - 1:11.0.25.0.7-0.3.ea
changelog:
  - RHJDKBP-875 - Added gating.yaml and/or rpminspect.yaml
  - RHJDKBP-874 - Removed 
  - Related: RHEL-58775


author: Antonio Vieiro <avieirov@redhat.com> - 1:11.0.25.0.9-2
changelog:
  - Update to jdk-11.0.25+9 (GA)
  - Update release notes to 11.0.25+9
  - Switch to GA mode for release
  - Related: RHEL-58775
  - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **


author: Antonio Vieiro <avieirov@redhat.com> - 1:11.0.25.0.9-3
changelog:
  - Make java-11-openjdk NOT the default JDK in rhel-9.2.0.z, rhel-9.4.z, rhel-9.5.z
  - Resolves: RHEL-63042 
  - See-Also: RHEL-63043 RHEL-63044


author: Antonio Vieiro <avieirov@redhat.com> - 1:11.0.25.0.9-3
changelog:
  - Make java-11-openjdk NOT the default JDK in rhel-9.2.0.z, rhel-9.4.z, rhel-9.5.z
  - Resolves: RHEL-63042 
  - See-Also: RHEL-63043
  - See-Also: RHEL-63044


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.25.0.9-6
changelog:
  - Make java-11-openjdk the default JDK only on RHEL x86_32
  - Drop system timezone data dependency from base RHEL 11u builds
  - Resolves: RHEL-70599
  - See-Also: RHEL-70600
  - See-Also: RHEL-70601
  - Resolves: RHEL-71242
  - See-Also: RHEL-71243
  - See-Also: RHEL-71244


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.25.0.9-3
changelog:
  - Adapted to newest copy-jdk-configs to fix issue with rpm 4.17
  - Disable copy-jdk-configs for Flatpak builds
  - Removed copy-jdk-configs backward compatibility to fix when both rpm 4.16 and 4.17 are in transaction
  - Resolves: RHEL-73880
  - See-Also: RHEL-73881
  - See-Also: RHEL-73882
  - See-Also: RHEL-73873


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.0.6-0.1.ea
changelog:
  - Update to jdk-17.0.8+6 (EA)
  - Sync the copy of the portable specfile with the latest update
  - Resolves: rhbz#2217716


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.0.7-1
changelog:
  - Update to jdk-17.0.8+7 (GA)
  - Update release notes to 17.0.8+7
  - Switch to GA mode for final release.
  - Sync the copy of the portable specfile with the latest update
  - Add note at top of spec file about rebuilding
  - * This tarball is embargoed until 2023-07-18 @ 1pm PT. *
  - Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.1.1-1
changelog:
  - Update to jdk-17.0.8.1+1 (GA)
  - Update release notes to 17.0.8.1+1
  - Add backport of JDK-8312489 already upstream in 17.0.10 (see OPENJDK-2095)
  - Update openjdk_news script to specify subdirectory last
  - Add missing discover_trees script required by openjdk_news
  - Synchronise runtime and buildtime tzdata requirements
  - Resolves: rhbz#2236592


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.9.0.9-1
changelog:
  - Update to jdk-17.0.9+9 (GA)
  - Sync the copy of the portable specfile with the latest update
  - Re-generate FIPS patch against 17.0.9+1 following backport of JDK-8209398
  - Bump libpng version to 1.6.39 following JDK-8305815
  - Bump HarfBuzz version to 7.2.0 following JDK-8307301
  - Bump freetype version to 2.13.0 following JDK-8306881
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Sync generate_tarball.sh with 11u version
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Use upstream release URL for OpenJDK source
  - Apply all patches using -p1
  - Temporarily turn off 'fresh_libjvm' due to removal of JVM_IsThreadAlive (JDK-8305425)
  - Add missing JFR and jpackage alternative ghosts
  - Move jcmd to the headless package
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12226
  - Resolves: RHEL-13662
  - Resolves: RHEL-13673
  - Resolves: RHEL-13683
  - Resolves: RHEL-13648
  - Resolves: RHEL-13651


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.10.0.7-1
changelog:
  - Update to jdk-17.0.10+6 (EA)
  - fips-17u-d63771ea660.patch: Regenerate from gnu-andrew branch
  - generate_source_tarball.sh: Add WITH_TEMP environment variable
  - generate_source_tarball.sh: Multithread xz on all available cores
  - generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
  - generate_source_tarball.sh: Update comment about tarball naming
  - generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
  - generate_source_tarball.sh: Set compile-command in Emacs
  - generate_source_tarball.sh: Reformat comment header
  - generate_source_tarball.sh: Reformat and update help output
  - generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
  - generate_source_tarball.sh: Do a shallow clone, for speed
  - generate_source_tarball.sh: Append -ea designator when required
  - generate_source_tarball.sh: Eliminate some removal prompting
  - generate_source_tarball.sh: Make tarball reproducible
  - generate_source_tarball.sh: Prefix temporary directory with temp-
  - generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash
  - generate_source_tarball.sh: shellcheck: Double-quote variable references
  - generate_source_tarball.sh: shellcheck: Do not use -a
  - generate_source_tarball.sh: shellcheck: Do not use $ in expression
  - generate_source_tarball.sh: Remove temporary directory exit conditions
  - generate_source_tarball.sh: Add note on network usage of OPENJDK_LATEST
  - Related: RHEL-20995


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.10.0.7-1
changelog:
  - Update to jdk-17.0.10+7 (GA)
  - Sync the copy of the portable specfile with the latest update
  - Move to -P<n> usage for patch macro which works on all RPM versions
  - Remove RH1648644 patch not in portable build (and so not applied to binary used)
  - Re-enable DEFAULT_PROMOTED_VERSION_PRE check disabled for the July 2023 release
  - generate_source_tarball.sh: Add --sort=name to tar invocation for reproducibility
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-20995


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.7-0.2.ea
changelog:
  - Update to jdk-17.0.11+7 (EA)
  - Update buildjdkver to match the featurever
  - Use featurever macro to specify fips patch
  - Explain patchN syntax situation in a comment
  - Sync generate_source_tarball.sh
  - Require tzdata 2023d (JDK-8322725)
  - openjdk_news.sh: Use grep -E instead of egrep
  - Remove RH1649512 patch for libjpeg-turbo FAR macro
  - Move pcsc-lite-libs patch to in-need-of-upstreaming section
  - Related: RHEL-30939


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.9-2
changelog:
  - Update to jdk-17.0.11+9 (GA)
  - Add openjdk-17.0.11+9.tar.xz to .gitignore
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
  - Update buildver from 7 to 9
  - Update portablerelease from 1 to 3
  - Change is_ga from 0 to 1 to enable GA mode for release
  - Update tzdata Requires comment to mention that 2024a is not yet in the buildroot
  - Update tzdata BuildRequires comment to mention that 2024a is not yet in the buildroot
  - Update tzdata BuildRequires from 2023c to 2023d
  - Update sources from openjdk-17.0.11+7-ea.tar.xz to openjdk-17.0.11+9.tar.xz
  - Resolves: RHEL-30939
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.6-0.1.ea
changelog:
  - Update to jdk-17.0.12+6 (EA)
  - Add openjdk-17.0.12+6-ea.tar.xz to .gitignore
  - Set updatever to 12
  - Set buildver to 6
  - Set rpmrelease to 1
  - Set is_ga to 0
  - Update sources to openjdk-17.0.12+6-ea.tar.xz
  - Require tzdata-java 2024a at runtime and for build (JDK-8325150)
  - Update lcms2 bundled provides to 2.16.0
  - Add zlib 1.3.1 bundled provides and zlib-devel build requirement (OPENJDK-3065)
  - Label as error a designator mismatch
  - Change a fix-me comment to a note instead
  - Sync generate_source_tarball.sh from Fedora rawhide


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.12.0.6-0.1.ea
changelog:
  - generate_source_tarball.sh: Update examples in header for clarity
  - generate_source_tarball.sh: Cleanup message issued when checkout already exists
  - generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
  - generate_source_tarball.sh: Only add --depth=1 on non-local repositories
  - icedtea_sync.sh: Reinstate from rhel-8.9.0 branch
  - Move maintenance scripts to a scripts subdirectory
  - discover_trees.sh: Set compile-command and indentation instructions for Emacs
  - discover_trees.sh: shellcheck: Do not use -o (SC2166)
  - discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: Add authorship
  - icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
  - icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
  - icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: Set compile-command and indentation instructions for Emacs
  - openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
  - openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
  - generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
  - generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
  - generate_source_tarball.sh: Avoid empty DEPTH reference while still appeasing shellcheck


