# changelog

author: Andrew Lukoshko <alukoshko@almalinux.org> [5.14.0-611.5.1.el9_7]
changelog:
  - Update RHEL_RELEASE, ZSTREAM, and DIST (Andrew Lukoshko)
  - kernel-5.14.0-611.5.1.el9_7 (Augusto Caringi)
  - Merge: kabi: add symbols to stablelist and enable check-kabi (Augusto Caringi) [RHEL-113010]
  - Merge tag 'kernel-5.14.0-611.4.1.el9_7' into main (Patrick Talbert)
  - Merge tag 'kernel-5.14.0-611.2.1.el9_7' from 9.7 (Augusto Caringi)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.50.1.el9_7]
changelog:
  - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158987]
  - md/raid1: fix data lost for writemostly rdev (Nigel Croxon) [RHEL-143624]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.51.1.el9_7]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167016] {CVE-2026-31402}
  - i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121643]
  - devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121643]
  - i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121643]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.53.1.el9_7]
changelog:
  - tracing: Fix a warning when allocating buffered events fails (CKI KWF BOT) [RHEL-169366]
  - tracing: Fix a possible race when disabling buffered events (CKI KWF BOT) [RHEL-169366]
  - tracing: Fix incomplete locking when disabling buffered events (CKI KWF BOT) [RHEL-169366]
  - thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-104807]
  - thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-104807]
  - thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-104807]
  - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155311]
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157327] {CVE-2026-23270}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.54.1.el9_7]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172201]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172201]
  - crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172201]
  - crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172201]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172201] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172201]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172201] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172201]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.55.1.el9_7]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174561] {CVE-2026-43284}


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-611.55.1
changelog:
  - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500)
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers
    (CVE-2026-46300 "Fragnesia")
  - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe
    replacement for upstream 31e62c2ebbfd, Qualys Security Advisory)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.6.1.el9_8]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
  - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
  - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
  - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
  - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
  - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.7.1.el9_8]
changelog:
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
  - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
  - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
  - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
  - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
  - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
  - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
  - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
  - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
  - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
  - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-687.8.1.el9_8]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-687.9.1.el9_8]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.10.1.el9_8]
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
  - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
  - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
  - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
  - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.10.1
changelog:
  - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable
    backports (SOURCES/1100-1196)
  - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL
    backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto
    authencesn/algif)
  - Keep the smb cifs.spnego ahead-fix (retained as 1197)
  - RHEL changelog for 687.6.1..687.10.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.11.1.el9_8]
changelog:
  - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
  - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
  - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
  - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
  - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
  - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
  - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
  - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
  - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
  - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
  - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
  - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
  - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
  - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
  - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
  - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
  - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
  - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
  - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
  - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
  - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
  - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
  - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
  - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
  - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
  - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
  - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
  - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
  - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
  - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
  - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
  - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
  - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
  - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
  - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.12.1.el9_8]
changelog:
  - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
  - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
  - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
  - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
  - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
  - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
  - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
  - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
  - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
  - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.12.1
changelog:
  - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable
    backports (SOURCES/1198-1252)
  - RHEL changelog for 687.11.1..687.12.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.13.1.el9_8]
changelog:
  - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
  - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
  - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
  - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
  - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
  - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
  - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
  - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
  - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
  - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
  - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
  - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
  - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
  - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
  - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
  - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
  - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
  - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.13.1
changelog:
  - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269)
  - RHEL changelog for 687.13.1 follows:


author: Tanishi Srivastava <tsrivast@redhat.com> [5.14.0-687.14.1.el9_8]
changelog:
  - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
  - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
  - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
  - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
  - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
  - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
  - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
  - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
  - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
  - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
  - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
  - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
  - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
  - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
  - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
  - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
  - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
  - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
  - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
  - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
  - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
  - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
  - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.15.1.el9_8]
changelog:
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
  - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.15.1
changelog:
  - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284)
  - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822)
  - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files)
  - RHEL changelog for 687.14.1..687.15.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.16.1.el9_8]
changelog:
  - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
  - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
  - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
  - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
  - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
  - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
  - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
  - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
  - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
  - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
  - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
  - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
  - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
  - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
  - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
  - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
  - dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
  - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
  - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
  - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.17.1.el9_8]
changelog:
  - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
  - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
  - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
  - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
  - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
  - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
  - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
  - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.17.1
changelog:
  - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311)
  - RHEL changelog for 687.16.1..687.17.1 follows:


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.17.1
changelog:
  - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.18.1.el9_8]
changelog:
  - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
  - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
  - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
  - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
  - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
  - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
  - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
  - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
  - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
  - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
  - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
  - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
  - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
  - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
  - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
  - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
  - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
  - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
  - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
  - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
  - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
  - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
  - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
  - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
  - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
  - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
  - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
  - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
  - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
  - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
  - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
  - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
  - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
  - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
  - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
  - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
  - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
  - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
  - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
  - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
  - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
  - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
  - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
  - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
  - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
  - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
  - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
  - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
  - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
  - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
  - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
  - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
  - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
  - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
  - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
  - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
  - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
  - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
  - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
  - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
  - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
  - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
  - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
  - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
  - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
  - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
  - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
  - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
  - net: Fix typos (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
  - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
  - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
  - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
  - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
  - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
  - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
  - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
  - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
  - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
  - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
  - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
  - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
  - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
  - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
  - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
  - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
  - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
  - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
  - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
  - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
  - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
  - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
  - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
  - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
  - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
  - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
  - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.19.1.el9_8]
changelog:
  - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
  - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
  - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
  - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
  - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
  - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
  - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
  - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
  - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
  - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
  - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
  - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
  - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
  - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
  - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
  - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
  - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.19.1
changelog:
  - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695)
  - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312)
  - RHEL changelog for 687.18.1..687.19.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.20.1.el9_8]
changelog:
  - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
  - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
  - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
  - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
  - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
  - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
  - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
  - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
  - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
  - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
  - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
  - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
  - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
  - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.20.1
changelog:
  - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709)
  - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312)
  - RHEL changelog for 687.19.1..687.20.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.21.1.el9_8]
changelog:
  - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
  - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
  - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
  - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
  - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
  - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.22.1.el9_8]
changelog:
  - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
  - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
  - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
  - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
  - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
  - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.22.1
changelog:
  - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735)
  - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll
    ep_remove use-after-free CVE-2026-46242 (1712)
  - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux
    ahead-patch (1312) is retained and RHEL's duplicate copy omitted
  - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263)
  - RHEL changelog for 687.21.1..687.22.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.23.1.el9_8]
changelog:
  - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
  - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
  - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773]
  - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
  - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
  - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
  - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
  - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
  - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
  - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
  - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
  - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
  - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
  - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
  - epoll: annotate racy check (Ian Kent) [RHEL-180773]
  - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
  - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.23.1
changelog:
  - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755)
  - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by
    RHEL's eventpoll series carrying the same fix and is dropped
  - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738)
  - RHEL changelog for 687.23.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.24.1.el9_8]
changelog:
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
  - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.24.1
changelog:
  - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760)
  - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are
    superseded by RHEL's copies and dropped
  - RHEL changelog for 687.24.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.25.1.el9_8]
changelog:
  - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
  - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
  - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
  - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
  - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
  - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
  - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
  - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.25.1
changelog:
  - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769)
  - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499
    (1756, 1757) are superseded by RHEL's copies and dropped
  - RHEL changelog for 687.25.1 follows:


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.26.1
changelog:
  - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770)
  - RHEL changelog for 687.26.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.27.1.el9_8]
changelog:
  - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
  - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
  - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
  - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
  - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
  - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
  - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
  - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
  - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
  - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
  - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
  - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
  - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
  - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
  - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
  - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
  - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
  - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
  - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
  - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
  - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
  - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
  - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
  - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
  - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.28.1.el9_8]
changelog:
  - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.29.1.el9_8]
changelog:
  - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
  - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
  - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
  - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]


author: Eduard Abdullin <eabdullin@almalinux.org> - 5.14.0-687.29.1
changelog:
  - Use AlmaLinux OS secure boot cert
  - Debrand for AlmaLinux OS
  - Add KVM support for ppc64le
  - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.29.1
changelog:
  - proc: fix a dentry lock race between release_task and lookup
  - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
  - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
  - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
  - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024
  - qla4xxx: bring back deprecated PCI ids
  - lpfc: bring back deprecated PCI ids
  - be2iscsi: bring back deprecated PCI ids
  - kernel/rh_messages.h: enable all disabled pci devices by moving to
    unmaintained


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.30.1.el9_8]
changelog:
  - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807}
  - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468]
  - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468]
  - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468]
  - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277]
  - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026}
  - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412]
  - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950}
  - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950}
  - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950}
  - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950}
  - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006}
  - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976}
  - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.31.1.el9_8]
changelog:
  - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017}
  - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017}
  - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973}
  - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729]
  - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729]
  - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797}
  - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797}
  - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281}
  - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342]
  - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002}
  - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257]
  - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-686.el9]
changelog:
  - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489]
  - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508]
  - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508]
  - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548]
  - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.el9]
changelog:
  - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619]
  - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619]
  - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619]
  - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619]
  - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762]
  - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762]
  - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762]
  - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762]
  - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.1.1.el9_8]
changelog:
  - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100}
  - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765]
  - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883}
  - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765]
  - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765]
  - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845}
  - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765]
  - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844}
  - redhat: update self-test data (Patrick Talbert)
  - redhat: set defaults for 9.8 (Patrick Talbert)
  - gitlab-ci: disttag override for 9.8 (Patrick Talbert)
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.2.1.el9_8]
changelog:
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111}
  - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171}
  - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938]
  - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938]
  - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126]
  - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126]
  - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126]
  - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126]
  - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126]
  - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126]
  - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126]
  - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126]
  - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126]
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126]
  - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126]
  - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126]
  - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.3.1.el9_8]
changelog:
  - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
  - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
  - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
  - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
  - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
  - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
  - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
  - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
  - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
  - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
  - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
  - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
  - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
  - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
  - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.4.1.el9_8]
changelog:
  - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
  - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
  - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
  - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
  - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
  - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
  - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
  - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
  - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
  - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
  - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
  - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
  - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
  - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
  - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
  - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.5.1.el9_8]
changelog:
  - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
  - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
  - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
  - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
  - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]


author: Andrew Lukoshko <alukoshko@almalinux.org> [5.14.0-687.5.1.el9_8]
changelog:
  - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
  - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko)
  - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
  - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert)
  - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert)


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.5.3
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284)
  - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500)
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers
    (CVE-2026-46300 "Fragnesia")
  - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe
    replacement for upstream 31e62c2ebbfd, Qualys Security Advisory)
  - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431)


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.5.4
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers
    (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300
    "Fragnesia")
  - smb: client: reject userspace cifs.spnego descriptions (upstream commit
    3da1fdf4efbc)


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.0-2
changelog:
  - Rebuild with openssl3, presumably in a buildroot with xmlsec1
    linked against openssl3
  - Resolves: rhbz#1962052 - lasso: Port to OpenSSL 3.0


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.0-4
changelog:
  - Resolves: rhbz#1935987 - lasso implements and/or uses the deprecated
                             SHA-1 algorithm by default


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.0-5
changelog:
  - Don't run configure twice
  - Resolves: rhbz#1935987 - lasso implements and/or uses the deprecated
                             SHA-1 algorithm by default


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.0-7
changelog:
  - Fix dead code issue
  - Resolves: rhbz#1966606: CVE-2021-28091 lasso: XML signature wrapping
                            vulnerability when parsing SAML responses


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.0-6
changelog:
  - Resolves: rhbz#1984822 - lasso: FTBFS in test suite due to short test
                             timeout (potentially OpenSSL-related)


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.0-9
changelog:
  - Bump the test timeout again
  - Related: rhbz#1984822 - lasso: FTBFS in test suite due to short test
                             timeout (potentially OpenSSL-related)


author: Tomas Halman <thalman@redhat.com> - 2.7.0-12
changelog:
  - Fixing CVE-2025-47151
    Resolves: RHEL-126685 CVE-2025-47151 lasso: Type confusion in Entr'ouvert Lasso


author: Petr Menšík <pemensik@redhat.com> - 1.7.1-2
changelog:
  - Use make_build and make_install macro instead of make
  - https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make


author: Richard Lescak <rlescak@redhat.com> - 1.7.1-9
changelog:
  - Fix for CVE-2020-19860 ldns: heap overread vulnerability (#2051211)
  - Added also patch for deprecated distutils Python module used in build


author: Dominik 'Rathann' Mierzejewski <rpm@greysector.net> 1.0.12-1
changelog:
  - update to 1.0.12 (#1827949)
  - drop obsolete patch
  - fixes CVE-2020-11863, CVE-2020-11864, CVE-2020-11865, CVE-2020-11866


author: Olivier Fourdan <ofourdan@redhat.com> - 2.0.3-12.1
changelog:
  - CVE fix for: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003
    Resolves: https://redhat.atlassian.net/browse/RHEL-191886
    Resolves: https://redhat.atlassian.net/browse/RHEL-191933
    Resolves: https://redhat.atlassian.net/browse/RHEL-191938


author: Dodji Seketeli <dodji@redhat.com> - 2.1-1
changelog:
  - Update to upstream 2.1 release.
  - Remove the now useless text about getting the source from git.
  - Update the license reference.
  - Resolves: rhbz#1944096


author: Dodji Seketeli <dodji@redhat.com> - 2.3-1
changelog:
  - Update to upstream 2.3
  - Remove the dos2unix surgery as it's now useless
  - Update for the soname bump
  - Resolves: RHELPLAN-154803


author: Dodji Seketeli <dodji@redhat.com> - 2.4-1
changelog:
  - Update to upstream 2.4
  - Use SPDX licensing naming
  - Build BTF support
  - Add BuildRequires: libbpf-devel
  - Update for SONAME bump
  - Show details about the check and check-self-targets targets
    separatly.
  - Resolves: RHEL-12491


author: Dodji Seketeli <dodji@redhat.com> - 2.4-2
changelog:
  - Apply patch: 0001-Bug-31045-Don-t-try-setting-translation-unit-for-uni.patch
    Resolves: https://issues.redhat.com/browse/RHEL-16614
  - Apply patch: 0002-suppression-Add-has_strict_flexible_array_data_membe.patch
    Resolves: https://issues.redhat.com/browse/RHEL-16629
  - Add git as a build requirement as we need git to apply the patches
    aboves that apply binaries.
  - Use %autosetup to handle applying the patches using git.
  - autoreconf after the patches touched at least one Makefile.am file.


author: Dodji Seketeli <dodji@redhat.com> - 2.5-1
changelog:
  - Update to upstream 2.5 tarball
  - Drop patches (as they are now upstream):
    0001-Bug-31045-Don-t-try-setting-translation-unit-for-uni.patch
    0002-suppression-Add-has_strict_flexible_array_data_membe.patch
  - Add BuildRequires: python3-devel
  - Remove BuildRequires: %{_bindir}/python3


author: Dodji Seketeli <dodji@redhat.com> - 2.6.1
changelog:
  - Update to upstream 2.6 tarball
  - Update to changing SONAME (libabigail.so.5.0.0)
  - Add BuildRequires xxhash-devel
  - Disable abidb as its dependencies are not present in RHEL 9.6
  - Resolves https://issues.redhat.com/browse/RHEL-64069


author: Dodji Seketeli <dodji@redhat.com> - 2.7-1
changelog:
  - Update to upstream 2.7 tarball
  - Add binutils-devel as buildrequire to potentially enable the CTF
    backend.  This will allow the enabling of the CTF backend for
    binutils-devel > 2.35.2
  - Update to changing SONAME (libabigail.so.6.0.0)
  - Add --enable-ctf to the configure command line


author: RHEL Packaging Agent <jotnar@redhat.com> - 2.9-1
changelog:
  - Update to upstream 2.9 tarball
  - Update to changing SONAME (libabigail.so.8.0.0)
  - Simplify the %check section
  - Resolves: RHEL-121666


author: Tomas Popela <tpopela@redhat.com> - 1.42.2-1
changelog:
  - Initial RHEL packaging based on Fedora package with rpmautospec disabled,
    disabled documentation (no gi-docgen in RHEL 9) and downstream patch to
    be able to compile with glib2 2.68 (thanks to Milan Crha)
  - Resolves: RHEL-3234


author: Richard Hughes <richard@hughsie.com> 0.7.16-1
changelog:
  - Update to 0.7.15
  - Add UPL short name to SPDX conversion
  - Allow parsing desktop files using as_app_parse_data()
  - Do not preserve restrictive permissions when installing AppStream files
  - Modernize the validation requirements
  - Remove relative path from icon names
  - Support loading YAML from as_store_from_bytes()
  - Update list of allowed metadata licences
  - Update the SPDX license list to v3.5


author: Richard Hughes <richard@hughsie.com> 0.7.17-1
changelog:
  - New upstream release
  - Add "icon-theme" as recognised component type
  - Fix CI by moving 'future' back a bit
  - Make default content rating values match OARS semantics
  - Properly initialize unique_id_mutex


author: Richard Hughes <richard@hughsie.com> 0.7.18-1
changelog:
  - New upstream release
  - Add content rating system APIs from gnome-software
  - Add "validate-version" command
  - Allow timestamp in the future in validate-relax
  - Don't ignore localized strings that are the same as original
  - Fix crash with invalid children of <ul/>
  - Properly initialize mutexes
  - Test launchable tags in validation


author: Richard Hughes <richard@hughsie.com> 0.7.18-5
changelog:
  - Backport a patch from upstream to fix handling unknown tags in AppStream metadata
  - Resolves: #RHEL-34564


author: Alexey Tikhonov <atikhono@redhat.com> - 0.6.1-51
changelog:
  - Resolves: rhbz#1938708 - review of important potential issues detected by static analyzers in ding-libs-0.6.1-47.el9


author: Stefan Hajnoczi <stefanha@redhat.com> - 1.2.2-1
changelog:
  - Import Fedora rpm 1.2.2-4 spec file with license updates (https://src.fedoraproject.org/rpms/libblkio/pull-request/1)


author: Stefan Hajnoczi <stefanha@redhat.com> - 1.2.2-2
changelog:
  - Remove 
  %setup       -q


  /usr/bin/git init -q
  /usr/bin/git config user.name "rpm-build"
  /usr/bin/git config user.email "<rpm-build>"
  /usr/bin/git config gc.auto 0
  /usr/bin/git add --force .
  /usr/bin/git commit -q --allow-empty -a\
  	--author "rpm-build <rpm-build>" -m "libblkio-1.3.0 base"


author: Stefan Hajnoczi <stefanha@redhat.com> - 1.2.2-2
changelog:
  - Remove 
  %setup       -q


  /usr/bin/git init -q
  /usr/bin/git config user.name "rpm-build"
  /usr/bin/git config user.email "<rpm-build>"
  /usr/bin/git config gc.auto 0
  /usr/bin/git add --force .
  /usr/bin/git commit -q --allow-empty -a\
  	--author "rpm-build <rpm-build>" -m "libblkio-1.5.0 base"


author: Vojtech Trefny <vtrefny@redhat.com> - 2.2-1
changelog:
  - Require the same version of python3-bytesize in libbytesize-tools (v.podzimek)
  - src/gettext: fix warning if gettext is already present (giulio.benetti)
  - Update README.md (vpodzime)
  - fix build on shells where test == fails (tbier)
  - Add POT file to git and do not rebuild it during every build (vtrefny)


author: Vojtech Trefny <vtrefny@redhat.com> - 2.3-1
changelog:
  - Fix memory leak in bs_size_new_from_str (vtrefny)
  - Translated using Weblate (Turkish) (oguzersen)
  - add translation platform widget (jean-baptiste)
  - Update translation files (noreply)
  - Do not regenerate POT file during 'make release' (vtrefny)
  - Remove Zanata from our build and release processes (vtrefny)
  - Add PO files to git (vtrefny)
  - Sync spec with downstream (vtrefny)


author: Vojtech Trefny <vtrefny@redhat.com> - 2.4-1
changelog:
  - Add Travis build status badge (vtrefny)
  - Add Travis CI config and Dockerfiles for running tests (vtrefny)
  - Add ansible playbook for installing test dependencies (vtrefny)
  - remove msgcat dependency (Aduskett)
  - Translated using Weblate (Bengali (India)) (akarshan.biswas)
  - Update translation files (noreply)
  - Added translation using Weblate (Bengali (India)) (akarshan.biswas)
  - Fix library version in pkgconfig file (vtrefny)


author: Vojtech Trefny <vtrefny@redhat.com> - 2.5-1
changelog:
  - Translated using Weblate (Hebrew) (sh.yaron)
  - Added translation using Weblate (Hebrew) (sh.yaron)
  - Add support to ppc64le for debian build (74309971+gururajrkatti)
  - Translated using Weblate (Finnish) (ricky.tigg)
  - tools: Read input from stdin when not running in a tty (vtrefny)
  - travis: Print logs after failed tests (vtrefny)
  - tests: Run pylint and pycodestyle on bscalc (vtrefny)
  - bscalc: Add option to print only single "human readable" result (vtrefny)
  - travis: Add --nogpgcheck when using dnf on Fedora (vtrefny)
  - Translated using Weblate (Asturian) (fitoschido)
  - Update translation files (noreply)
  - Translated using Weblate (Spanish) (fitoschido)
  - Sync spec with downstream (vtrefny)


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.1.16-1
changelog:
  - Update to 0.1.16
  - Fix a crash when clearing COMPS_ObjRTree (RhBug:1888343)
  - Fix memory leaks and resource leaks


author: Filip Januš <fjanus@redhat.com> - 5.3.28-54
changelog:
  - Add db_converter into -utils subpackage
  - It allowes to convert BerkeleyDB database format to GDBM/LMDB format
  - Resolves: RHEL-35607


author: Jaroslav Rohel <jrohel@redhat.com> - 0.69.0-7
changelog:
  - filterAdvisory: match installed_solvables sort with lower_bound (RhBug:2212838, RHEL-12123)
  - hawkey.subject: get_best_selectors only obsoleters of latest (RhBug:2183279, RHEL-6304)
  - Avoid reinstalling installonly packages marked for ERASE (RhBug:2163474, RHEL-12124)


author: Petr Pisar <ppisar@redhat.com> - 0.69.0-9
changelog:
  - Grow memory if applying a query after increasing a number of available
    packages (RHEL-27657)
  - Fix a memory leak in get_best_solution() (RHEL-26226)
  - Fix destructing libdnf::TransactionItem from a base class (RHEL-26240)


author: Petr Pisar <ppisar@redhat.com> - 0.69.0-11
changelog:
  - Fix reinstalling packages which conflicts with themselves in
    dnf_transaction_commit() (RHEL-1454)


author: Evan Goode <egoode@redhat.com> - 0.69.0-16
changelog:
  - Introduce $releasever_major, $releasever_minor variables, shell-style
    variable substitution (RHEL-95006)


author: Ales Matej <amatej@redhat.com> - 0.69.0-18
changelog:
  - Fix a crash when parsing multiple key files fails (RHEL-145618)
  - Mark all protected packages as user installed for all transactions (RHEL-76112)
  - Add `filterUnneededExtraUserinstalled` and Python version to the API
  - Describe all problems even when there are protected removals (RHEL-115194)
  - Clearer error for protected package broken dependencies


author: Lukas Hrazky <lhrazky@redhat.com> - 0.69.0-1
changelog:
  - Update to 0.69.0
  - Expose librepo max_downloads_per_mirror configuration
  - Fix listing a repository without cpeid (RhBug:2066334)
  - Gracefully handle failure to open repo primary file
  - context: Fix doc dnf_context_install/remove/update/distrosync
  - context: dnf_context_remove accepts `<package-spec>` as dnf, unify code
  - dnf-context: Disconnect signal handler before dropping file monitor ref


author: Jan Grulich <jgrulich@redhat.com> - 0.6.22-6.1
changelog:
  - Fix integer underflow in MakerNote decoding (CVE-2026-40386)
  - Fix integer overflow in Nikon MakerNote handling (CVE-2026-40385)
    Resolves: RHEL-170253, RHEL-170234


author: Michal Schmidt <mschmidt@redhat.com> - 1.15.1-1
changelog:
  - Update to upstream release 1.15.1
  - Disable LTO on x86_64 due to memory issues (copied from Fedora)
  - Resolves: rhbz#2040454


author: Karel Zak <kzak@redhat.com> 2.37.4-10
changelog:
  - fix #2165981 - fstrim -av fails to trim root filesystem on Red Hat Coreos
  - fix #2141970 - add --cont-clock feature for libuuid and uuidd
  - fix #2133385 - uuidd returns time-based UUIDs when asked for random UUIDs.
  - fix #2156946 - agetty does not handle the \l sequence in /etc/issue correctly
  - fix #2166653 - last(1) should be more robust with work with strings
  - fix #2120246 - use {_tmpfilesdir} also in install section
  - fix #2134143 - publish libsmartcols-devel subpackages to C9S yum repos


author: Karel Zak <kzak@redhat.com> 2.37.4-12
changelog:
  - fix #2133396 - Internal testsuite for cramfs fails on s390x
  - fix #2174748 - enable uuidd cont-clock by default
  - fix #2182169 - lscpu: backport ARM human-readable names from upstream
  - fix #2189947 - libuuid - downport cache related patch
  - fix #2203324 - zram module does not have algorithms mentioned in zramctl command
  - fix #2209267 - Add additional documentation on devices being auto-mounted if a device exists within fstab.
  - fix #2215082 - For the 'sfdisk' man page to further clarify the expected behavior and intended use of the -d option


author: Karel Zak <kzak@redhat.com> 2.37.4-16
changelog:
  - fix RHEL-16048 - uninitialized memory in SCM_CREDENTIALS in logger(1)
  - fix RHEL-21257 - logger sending process start time not current time with log messages
  - fix RHEL-16071 - issues in libblkid
  - fix RHEL-12783 - lscpu -e doesn't show the current real frequency value
  - fix RHEL-14612 - Userspace mount options are not preserved for NFS


author: Karel Zak <kzak@redhat.com> 2.37.4-19
changelog:
  - fix RHEL-34165 - lsipc: fix semaphore USED counter
  - fix RHEL-25265 - libblkid: Check offset in LUKS2 header
  - fix RHEL-25559 - more: fix poll() use


author: Karel Zak <kzak@redhat.com> 2.37.4-21
changelog:
  - fix RHEL-56354 - lib/timeutils: parse_timestamp: fix second parsing
  - fix RHEL-56983 - sulogin: fix POSIX locale use


author: Karel Zak <kzak@redhat.com> 2.37.4-21.el9_7
changelog:
  - fix RHEL-134269 - libblkid: use snprintf() instead of sprintf()
  - fix RHEL-133955 - login-utils: fix setpwnam() buffer use [CVE-2025-14104]


author: Karel Zak <kzak@redhat.com> 2.37.4-22
changelog:
  - fix RHEL-113638 - lscpu: update ARM identifiers
  - fix RHEL-108386 - libblkid: (jmicron_raid) backport checksum verification


author: Karel Zak <kzak@redhat.com> 2.37.4-23
changelog:
  - fix RHEL-123527 - mount: improve --all documentation
  - fix RHEL-123531 - libblkid: use snprintf() instead of sprintf()
  - fix RHEL-123536 - libfdisk: (dos) fix off-by-one in maximum last sector calculation


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.6.0-6
changelog:
  - Gating rebuild [bz#1974188]
  - Resolves: bz#1974188
    (Define tests, including gating tests, for dtc)


author: Arjun Shankar <arjun@redhat.com> - 2.6.4-6
changelog:
  - Re-work flex subpackages and provide shared libraries (#1327851):
  - Remove and obsolete the flex-devel subpackage containing static libraries
  - Provide shared libraries in a new subpackage named libfl2
  - Provide development files in a new subpackage named libfl-devel
  - Provide static libraries in a new subpackage named libfl-static


author: Kalev Lember <klember@redhat.com> - 0.12.2-2
changelog:
  - Remove no longer needed ldconfig_scriptlets macro call
  - Remove explicit byte compilation as the automatic works for flatpak builds now


author: Florian Weimer <fweimer@redhat.com> - 11.5.0-10
changelog:
  - Exception handling performance improvements (RHEL-105072)
  - libgcc: Use _dl_find_object to find DWARF data in unwinder
  - libgcc: Use lock-free data structures for run-time unwinder registration


author: David Malcolm <dmalcolm@redhat.com> - 11.5.0-14
changelog:
  - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding
    branches and calls to gcov output, but not conditions (RHEL-105416).


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.48.4-2
changelog:
  - Rebase to new stable branch version 1.48.4
    resolves: rhbz#2059285
  - Disable 5-level page tables when using -cpu max
    resolves: rhbz#2084568
  - SELinux relabelling should not stop on ext4 immutable bits
    resolves: rhbz#1794518
  - Ignore "iface" in add-drive variants
    resolves: rhbz#1844341
  - Lift protocol limit on guestfs_readdir()
    resolves: rhbz#1674392
  - Check return values from librpm calls (2089623)
  - Document limitations of encrypted RBD disks
    resolves: rhbz#2033247
  - Fix lvm-set-filter failed in guestfish with the latest lvm2 package
    resolves: rhbz#1965941
  - Enable PHP bindings
    resolves: rhbz#2097718
  - Add support for Clevis & Tang
    resolves: rhbz#1809453
  - Fix CVE-2022-2211 Denial of Service in --key parameter
    resolves: rhbz#2101281
  - Add clevis-luks to BRs, required for Clevis & Tang
    related: rhbz#1809453
  - Add zstd support to guestfs_file_architecture
    resolves: rhbz#2117004


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.48.4-4
changelog:
  - New API: guestfs_inspect_get_build_id
  - Add support for detecting Windows >= 10, returned through osinfo
    resolves: rhbz#2012658


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.50.1-4
changelog:
  - Rebase libguestfs to 1.50.1
    resolves: rhbz#2168625
  - Use q35 machine type for libguestfs appliance
    resolves: rhbz#2168578
  - Run SELinux relabelling in parallel [for virt-v2v]
    resolves: rhbz#2190276


author: Laszlo Ersek <lersek@redhat.com> - 1:1.50.1-5
changelog:
  - let "guestfish -i" recognize "--key /dev/mapper/VG-LV:key:password"
  - reenable quickcheck; we now use "-cpu max" (upstream 30f74f38bd6e)
    resolves: rhbz#2209279


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.50.1-7
changelog:
  - Add --key all:... selector
    resolves: RHEL-19367
  - Add miscellaneous other upstream fixes since 1.50.1


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.54.0-3
changelog:
  - Rebase to libguestfs 1.54.0
    resolves: RHEL-56809
  - Fix osinfo for Windows Server 2025
    resolves: RHEL-62935
  - Replace Jansson with json-c
    resolves: RHEL-65292


author: Richard Hughes <richard@hughsie.com> 0.3.8-1
changelog:
  - New upstream version
  - Add new API requested by fwupd
  - Add the GUsbEndpoint methods to the docs
  - Fix hotplug handling and signal emission during enumerate
  - Do not double-reference USB devices
  - Resolves: rhbz#1965885


author: Peter Robinson <pbrobinson@fedoraproject.org> - 4.2-2
changelog:
  - Move eeprog to i2c-tools (shouldn't have been in eepromer sub package)
  - Drop/obsolete eepromer subpackage, deprecated for 6 years
  - Drop python2 conditionals
  - Minor cleanups


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.19.3-6
changelog:
  - Add support for the Wacom Intuos Pro (RHEL-105483)
  - Rename existing patches for better order clarity


author: Robert Scheck <robert@fedoraproject.org> 1.5.2-5
changelog:
  - Don't ship API docs twice (devel and doc subpackages)
  - Reworked spec file to build libisoburn1 for RHEL >= 8


author: Richard Hughes <richard@hughsie.com> 0.1.6-1
changelog:
  - New upstream release
  - Fall back to the AliasId for validation
  - Fix jcat_context_verify_blob() to use self verify for checksums


author: Christine Caulfield <ccaulfie@redhat.com> - 1.24-2
changelog:
  - Fix libnozzle tests failing & covscan warning on api_knet_handle_new test
    Resolves: rhbz#2024090


author: Christine Caulfield <ccaulfie@redhat.com> - 1.28-1
changelog:
  Rebase to 1.28 for startup and performance fixes
     threads: add config check to match min value with pong timeouts
     rx: allow links to be active faster
     links: fix ping interval and pong timeout value checking
     crypto: Try crypt and decrypt on crypto_init
     tx: Remove expensive memsets
     log: Add a TRACE log level
    Resolves: #RHEL-11787


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.21.3-12
changelog:
  - resolves: RHEL-101766 - Fix DC discovery after Windows netlogon hardening
    (follow-up, main fix is in samba-4.21.3-7)


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.4-5
changelog:
  - resolves: RHEL-101761 - Fix DC discovery after Windows netlogon hardening
    (follow-up, main fix is in samba-4.22.2-4.el9)


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.5-1
changelog:
  - Update to version 4.23.5
  - resolves: RHEL-143401 - Fix winbind group resolution
  - resolves: RHEL-141027 - Fix winbind crash


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.5-9
changelog:
  - Security release for CVE-2026-1933 CVE-2026-2340  CVE-2026-3012
    CVE-2026-4480 CVE-2026-40170 CVE-2026-4408
  - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba:
    various flaws
  - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing
  - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2
  - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.4-1
changelog:
  - Update to version 4.23.4
  - resolves: RHEL-114548 - Update to version 4.23.4
  - resolves: RHEL-132995 - Fix Time Machine backup
  - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba


author: Sergio Correia <scorreia@redhat.com> - 9-6
changelog:
  - Define log callback function to use with libcryptsetup
    Logs from libcryptsetup now go to stderr and this prevents issues like
    the one reported in https://bugzilla.redhat.com/show_bug.cgi?id=1770395


author: Michal Ruprich <mruprich@redhat.com> - 1.4.3-1
changelog:
  - Update to 1.4.3
  - Resolves: #1758843 - libmaxminddb-devel i686 can't be installed in parallel to x86_64
  - Fix for CVE-2020-28241


author: Remi Collet <remi@remirepo.net> - 1.1.0-5
changelog:
  - fix missing HAVE_SSIZE_T macro using patch from
    https://github.com/awesomized/libmemcached/pull/117


author: Stephen Gallagher <sgallagh@redhat.com> - 2.11.1-1
changelog:
  - Release 2.11.1
  - Ignore Packager documents when running ModuleIndex.update_from_*()
  - Add python overrides for XMD in PackagerV3
  - Add python override to ignore the GType return when reading packager files
  - Add PackagerV3.get_mdversion()


author: Stephen Gallagher <sgallagh@redhat.com> - 2.11.2-1
changelog:
  - Release 2.11.2
  - Extend read_packager_[file|string]() to support overriding the module name
    and stream.


author: Stephen Gallagher <sgallagh@redhat.com> - 2.11.2-2
changelog:
  - Fix issue with ModuleIndex when input contains only Obsoletes documents
  - Fix import issue when built with Python 2 support


author: Richard W.M. Jones <rjones@redhat.com> - 1.10.5-1
changelog:
  - Rebase to new stable branch version 1.10.5
    resolves: rhbz#2011708
  - Map uint32_t to OCaml int64 to avoid signedness problems
    resolves: rhbz#2040610
  - CVE-2022-0485 nbdcopy destination image corruption
  - New upstream API to control initialization of pread buffer
    resolves: rhbz#2046194


author: Richard W.M. Jones <rjones@redhat.com> - 1.12.6-1
changelog:
  - Rebase to new stable branch version 1.12.6
    resolves: rhbz#2059288
  - New tool: nbddump
  - nbdcopy: Use preferred block size for copying
    related: rhbz#2047660
  - Fix remote TLS failures
    resolves: rhbz#2111524
    (and 2111813)


author: Richard W.M. Jones <rjones@redhat.com> - 1.20.2-2
changelog:
  - Rebase to libnbd 1.20.2
    resolves: RHEL-31883
  - Fix multiple flaws in TLS server certificate checking
    resolves: RHEL-49801
  - Print full NBD error from server
    resolves: RHEL-50665


author: Adrian Reber <areber@redhat.com> - 1.2-5
changelog:
  - Repack tarball to remove problematic license from unused code
  - Apply fixes for warnings found by gcc -fanalyzer


author: Adrian Reber <areber@redhat.com> - 1.2-7
changelog:
  - Apply upstream patch to fix 3 findings from static application security testing
    Resolves: RHEL-27656


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.4-101
changelog:
  - resolves: rhbz#2216712 - Fix broken symlink for libwbclient
  - resolves: rhbz#2214327 - Fix segfault of winbind child when listing users with `winbind scan trusted domains = yes`
  - resolves: rhbz#2211605 - Fix access of Samba share with veto files = /.*/
  - resolves: rhbz#2207692 - Fix Python tarfile extraction to avoid a warning


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.5-100
changelog:
  - resolves: rhbz#2222895 - Fix CVE-2022-2127 CVE-2023-3347 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968


author: Andreas Schneider <asn@redhat.com> - 4.18.6-100
changelog:
  - related: rhbz#2190415 - Update to version 4.18.6
  - resolves: rhbz#2211617 - Fix the rpcclient dfsgetinfo command


author: Andreas Schneider <asn@redhat.com> - 4.19.3-100
changelog:
  - resolves: RHEL-16476 - Update to version 4.19.3
  - resolves: RHEL-11362 - Fix security issues:
    CVE-2023-4091 CVE-2023-42669
  - resolves: RHEL-18030 - Logging Format Enhancement
  - resolves: RHEL-1960 - Fix smbget issues with DFS shares
  - resolves: RHEL-2118 - Fix force user/group issues with 'allow trusted domains = yes'
  - resolves: RHEL-16875 - Fix memory corruption in libnss_winbind
  - resolves: RHEL-19243 - Fix smbget password interactive authentication


author: Andreas Schneider <asn@redhat.com> - 4.19.4-100
changelog:
  - related: RHEL-16476 - Update to version 4.19.4
  - resolves: RHEL-2109 - Add support for certificate auto enrollment
  - resolves: RHEL-20761 - Add missing requirements for samba-gpupdate
  - resolves: RHEL-19566 - Fix smbget interactive authentication
  - resolves: RHEL-21001 - Fix samba-gpupdate paths for RHEL


author: Andreas Schneider <asn@redhat.com> - 4.19.4-102
changelog:
  - resolves: RHEL-22157 - Don't require NDES for samba-gpupdate
  - resolves: RHEL-20897 - Fix site name fetching for samba-gpupdate


author: Pavel Filipenský <pfilipen@redhat.com> - 4.20.0-102
changelog:
  - resolves: RHEL-2109  - Support Certificate Auto Enrollment in Samba
  - resolves: RHEL-22157 - Fix root cert import for samba-gpupdate


author: Pavel Filipenský <pfilipen@redhat.com> - 4.20.1-1
changelog:
  - related: RHEL-33645 - Update to version 4.20.1
  - resolves: RHEL-26337 - Fix site lookup for samba-gpupdate
  - resolves: RHEL-5846 - Fix warning messages while upgrading libwbclient


author: Pavel Filipenský <pfilipen@redhat.com> - 4.20.2-1
changelog:
  - related: RHEL-33645 - Update to version 4.20.2
  - resolves: RHEL-45841 - Fix KDC IP address lookup in case of trusted domain
  - resolves: RHEL-23814 - Fix smbclient to enumerate the printers


author: Phil Sutter <psutter@redhat.com> - 1.0.9-1
changelog:
  - expect/conntrack: Avoid spurious covscan overrun warning
  - conntrack: fix build with kernel 5.15 and musl
  - New version 1.0.9


author: Steve Dickson <steved@redhat.com> 2.5.4-16
changelog:
  - nfsd.man: Explain that setting nfsv4=n turns off all v4 versions (bz 2042362)
  - mount.nfs: fix NULL pointer derefernce in nfs_parse_square_bracket (bz 2136807)


author: Steve Dickson <steved@redhat.com> 2.5.4-19
changelog:
  - Don't allow junction tests to trigger automounts (bz 2148353)
  - Fix typo in man page nfs.conf.man (bz 2203092)


author: Steve Dickson <steved@redhat.com> 2.5.4-21
changelog:
  - gssd: fix handling DNS lookup failure (RHEL-15035)
  - gssd: handle KRB5_AP_ERR_BAD_INTEGRITY errors (RHEL-15034)


author: Steve Dickson <steved@redhat.com> 2.5.4-22
changelog:
  - nfsmount.conf: Fix typo of the attribute name (RHEL-7904)
  - Update to support for the NFS RPC-with-TLS (RHEL-14754)


author: Steve Dickson <steved@redhat.com> 2.5.4-23
changelog:
  - Typos and documentation fixes (RHEL-22654)
  - blkmapd: fix coredump in bl_add_disk (RHEL-7941)
  - rpcdebug: avoid buffer underflow (RHEL-7931)


author: Steve Dickson <steved@redhat.com> 2.5.4-28
changelog:
  -  Makefile.am: allow mount.nfs to be writeable by owner (RHEL-68701)
  -  mount.nfs: retry NFSv3 mount after NFSv4 failure in auto negotiation (RHEL-68574)


author: Scott Mayhew <smayhew@redhat.com> 2.5.4-30
changelog:
  - fix ownership of /var/lib/nfs/statd/state (RHEL-72823)
  - /var/lib/nfs/{etab,rmtab} should not be marked as config files (RHEL-64340)


author: Scott Mayhew <smayhew@redhat.com> 2.5.4-31
changelog:
  - nfsdcld: prevent from accessing /var/lib/nfs/nfsdcld in read-only file system during boot (RHEL-78177)
  - Replace functional gating tests with the ones from RHEL10 (RHEL-78110)
  - Add explicit version requirement for libnfsidmap (RHEL-78107)
  - Add --disable-sbin-override for when /sbin is a symlink (RHEL-69771)
  - Move remaining binaries from /sbin to /usr/sbin (RHEL-69771)


author: Scott Mayhew <smayhew@redhat.com> 2.5.4-32
changelog:
  - Undo 'Add explicit version requirement for libnfsidmap' from previous build (RHEL-78107)
  - Undo 'Add --disable-sbin-override for when /sbin is a symlink' from previous build (RHEL-69771)
  - Undo 'Move remaining binaries from /sbin to /usr/sbin' from previous build (RHEL-69771)


author: Steve Dickson <steved@redhat.com> 2.5.4-35
changelog:
  - nfs(5): Add new rdirplus functionality, clarify (RHEL-87143)
  - nfsd: allow more than 64 backlogged connections (RHEL-87752)


author: Steve Dickson <steved@redhat.com> 2.5.4-37
changelog:
  - gssd.man: add documentation for use-gss-proxy nfs.conf option (RHEL-85408)
  - gssd: do not use krb5_cc_initialize (RHEL-85412)


author: Scott Mayhew <smayhew@redhat.com> 2.5.4-38.2
changelog:
  - Replace statfs64 with statfs (RHEL-127104)
  - NFS export symlink vulnerability fix (RHEL-127104)
  - mountd: Minor refactor of get_rootfh() (RHEL-127104)
  - mountd: Separate lookup of the exported directory and the mount path (RHEL-127104)
  - support: Add a mini-library to extract and apply RPC credentials (RHEL-127104)
  - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127104)
    Resolves: CVE-2025-12801


author: Scott Mayhew <smayhew@redhat.com> 2.5.4-42
changelog:
  - Replace statfs64 with statfs (RHEL-127105)
  - NFS export symlink vulnerability fix (RHEL-127105)
  - mountd: Minor refactor of get_rootfh() (RHEL-127105)
  - mountd: Separate lookup of the exported directory and the mount path (RHEL-127105)
  - support: Add a mini-library to extract and apply RPC credentials (RHEL-127105)
  - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127105)
  - Add requires for selinux-policy (RHEL-127105)
    Resolves: CVE-2025-12801


author: Phil Sutter <psutter@redhat.com> [1.2.6-1.el9]
changelog:
  - set: Do not leave free'd expr_list elements in place (Phil Sutter) [RHEL-14149]
  - Rebase onto version 1.2.6 (Phil Sutter) [RHEL-14149]


author: Phil Sutter <psutter@redhat.com> [1.2.6-3.el9]
changelog:
  - tests: Fix objref test case (Phil Sutter) [RHEL-28515]
  - expr: Respect data_len when setting attributes (Phil Sutter) [RHEL-28515]
  - obj: Respect data_len when setting attributes (Phil Sutter) [RHEL-28515]
  - utils: Introduce and use nftnl_set_str_attr() (Phil Sutter) [RHEL-28515]
  - obj: Enforce attr_policy compliance in nftnl_obj_set_data() (Phil Sutter) [RHEL-28515]
  - obj: Introduce struct obj_ops::attr_policy (Phil Sutter) [RHEL-28515]
  - obj: Call obj_ops::set with legal attributes only (Phil Sutter) [RHEL-28515]
  - obj: Repurpose struct obj_ops::max_attr field (Phil Sutter) [RHEL-28515]
  - obj: Return value on setters (Phil Sutter) [RHEL-28515]
  - object: getters take const struct (Phil Sutter) [RHEL-28515]
  - utils: Fix for wrong variable use in nftnl_assert_validate() (Phil Sutter) [RHEL-28515]
  - obj: synproxy: Use memcpy() to handle potentially unaligned data (Phil Sutter) [RHEL-28515]
  - obj: Do not call nftnl_obj_set_data() with zero data_len (Phil Sutter) [RHEL-28515]
  - table: Validate NFTNL_TABLE_OWNER, too (Phil Sutter) [RHEL-28515]
  - set: Validate NFTNL_SET_ID, too (Phil Sutter) [RHEL-28515]
  - obj: Validate NFTNL_OBJ_TYPE, too (Phil Sutter) [RHEL-28515]
  - flowtable: Validate NFTNL_FLOWTABLE_SIZE, too (Phil Sutter) [RHEL-28515]
  - table: Validate NFTNL_TABLE_USE, too (Phil Sutter) [RHEL-28515]
  - chain: Validate NFTNL_CHAIN_USE, too (Phil Sutter) [RHEL-28515]
  - expr: Enforce attr_policy compliance in nftnl_expr_set() (Phil Sutter) [RHEL-28515]
  - expr: Introduce struct expr_ops::attr_policy (Phil Sutter) [RHEL-28515]
  - include: Sync nf_log.h with kernel headers (Phil Sutter) [RHEL-28515]
  - expr: Call expr_ops::set with legal types only (Phil Sutter) [RHEL-28515]
  - expr: Repurpose struct expr_ops::max_attr field (Phil Sutter) [RHEL-28515]
  - udata: incorrect userdata buffer size validation (Phil Sutter) [RHEL-28515]
  - obj: ct_timeout: setter checks for timeout array boundaries (Phil Sutter) [RHEL-28515]
  - set_elem: use nftnl_data_cpy() in NFTNL_SET_ELEM_{KEY,KEY_END,DATA} (Phil Sutter) [RHEL-28515]
  - set: buffer overflow in NFTNL_SET_DESC_CONCAT setter (Phil Sutter) [RHEL-28515]
  - expr: fix buffer overflows in data value setters (Phil Sutter) [RHEL-28515]


author: Ana Cabral <acabral@redhat.com> - 1.8.36-1
changelog:
  - Update to 1.8.36 release  (rh #2066742)
  - Include OWE wireless security (rh #2066737)
  - Fix OWE wireless security entry in Hidden Networks dialog (rh #2057512)


author: Tomáš Mráz <tmraz@redhat.com> 1.4.3-1
changelog:
  - Multiple translation updates
  - Add usersubstr check for substrings of N characters from the username
    patch by Danny Sauer


author: Paul Wouters <pwouters@redhat.com> - 1.4.4-2
changelog:
  - Resolves rhbz#1919026 libpwquaily rpm requires cracklib-dict to function but RPM missing requirement


author: Kaleb S. KEITHLEY <kkeithle[at]redhat.com> - 2:16.1.0-0.5.snapshot
changelog:
  - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb)
  -  rpmbuild apparently unable to automatically derive 'Requires: rocksdb' from 'BuildRequires: rocksdb-devel' for librocksdb.so.6.13


author: Neal Gompa <ngompa@datto.com> - 1.6.0-1
changelog:
  - Update to upstream 1.6.0
    resolves: rhbz#1883910
  - Enable all missing features
  - Fix linking to external lz4 library
  - Minor spec cleanups


author: Attila Lakatos <alakatos@redhat.com> - 1.10.0-4
changelog:
  - Replace GNUTLS_SHUT_RDWR by GNUTLS_SHUT_WR when ending TLS connections
    resolves: rhbz#1990735
  - Add patch to comply with crypto policies
  - Forward return code from relpEngineSetTLSLib to relpEngineSetTLSLibByName
  - Enable openssl
    resolves: rhbz#1972067


author: Caolán McNamara <caolanm@redhat.com> - 1:7.1.8.1-8
changelog:
  - Resolves: rhbz#2134759 Untrusted Macros
  - Resolves: rhbz#2134757 Weak Master Keys
  - Resolves: rhbz#2134755 Static Initialization Vector
  - Resolves: rhbz#2134761 Macro URL arbitrary script execution


author: Stephan Bergmann <sbergman@redhat.com> - 1:7.1.8.1-11
changelog:
  - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula
    Parsing
  - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded
    without prompt via IFrame
  - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write


author: Eduard Abdullin <eabdullin@almalinux.org> - 1:7.1.8.1-12.alma
changelog:
  - escape url passed to gstreamer
  - add some protocols that don't make sense as floating frame
   targets
  - warn about exotic protocols as well
  - default to ignoring libreoffice special-purpose protocols
   in calc hyperlink
  - reuse AllowedLinkProtocolFromDocument in writer
  - reuse AllowedLinkProtocolFromDocument in impress/draw
  - CVE-2023-6186 backporting


author: Tomas Popela <tpopela@redhat.com> - 1:7.1.8.1-15.el9_8.1
changelog:
  - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of
    the spec has
  - Resolves: RHEL-176576


author: Tomas Popela <tpopela@redhat.com> - 1:7.1.8.1-15.el9_8.2
changelog:
  - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in
    formula compilation
  - Resolves: RHEL-186062


author: Lukas Hrazky <lhrazky@redhat.com> - 1.14.5-1
changelog:
  - Update to 1.14.5
  - Detailed error message when using non-existing TMPDIR (RhBug:2019993)
  - Make error messages about repodata and rpm mismatch more user friendly


author: Petr Pisar <ppisar@redhat.com> - 0.0.3-7.1
changelog:
  - Correct a License tag to LGPLv2+ (RHEL-21336)
  - Fix relocating certificate paths to /etc/rhsm-host (RHEL-21335)


author: Petr Pisar <ppisar@redhat.com> - 0.0.3-8
changelog:
  - Correct a License tag to LGPLv2+ (RHEL-16103)
  - Fix relocating certificate paths to /etc/rhsm-host (RHEL-14224)


author: Petr Lautrbach <plautrba@redhat.com> - 3.3-3
changelog:
  - allow spaces in user/group names (#2049665)
  - Fall back to semanage_copy_dir when rename() fails (#2068085)


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 4.3.1-3
changelog:
  - Fix CVE-2020-29129 CVE-2020-29130 out-of-bounds access while processing ARP/NCSI packets
    rhbz#1902232


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 4.4.0-3
changelog:
  - Fix CVE-2021-3592 CVE-2021-3593 CVE-2021-3594 CVE-2021-3595 out-of-bounds access
    Resolves: rhbz#1970826 rhbz#1970839 rhbz#1970857 rhbz#1970847


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.20-1
changelog:
  - Update to 0.7.20
  - new SOLVER_EXCLUDEFROMWEAK job to ignore pkgs for weak dependencies
  - support for environments in comps parser
  - fix misparsing of '&' in attributes with libxml2
  - choice rules: treat orphaned packages as newest
  - fix compatibility with Python 3.10


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.22-1
changelog:
  - Update to 0.7.22
  - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
  - support zstd compressed control files in debian packages
  - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20)
  - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata
  - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck
  - support solv files with an idarray block
  - allow accessing the toolversion at runtime
  - support parsing of Debian's Multi-Arch indicator
  - fix segfault on conflict resolution when using bindings
  - fix split provides not working if the update includes a forbidden vendor change
  - reworked choice rule generation to cover more usecases
  - support SOLVABLE_PREREQ_IGNOREINST in the ordering code


author: Jaroslav Rohel <jrohel@redhat.com> - 0.7.24-1
changelog:
  - Update to 0.7.24
  - Backport Treat condition both as positive and negative literal in pool_add_pos_literals_complex_dep
    (RhBug:2185061,2190136)


author: Petr Pisar <ppisar@redhat.com> - 0.7.24-3
changelog:
  - Some static analysis fixes for unitialized structs
    Resolves: RHEL-25498
  - Fix a memory leak in parse_package() of repo conda (RHEL-25496)


author: Marek Blaha <mblaha@redhat.com> - 0.7.24-5
changelog:
  - Backport "choice rules: also do solver_choicerulecheck for package downgrades"
    Resolves: RHEL-141449


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.7-1
changelog:
  - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7
  - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9]
  - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID
  - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9]
  - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.7-3
changelog:
  - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9]
  - Resolves: RHEL-103434 - cache_credentials = true not working


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.7-4
changelog:
  - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9]
    Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted.


author: Tomas Halman <thalman@redhat.com> - 2.9.8-1
changelog:
  - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8
  - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites
  - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name 
  - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none'
  - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so
  - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges
  - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux
  - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache


author: Justin Stephenson <jstephen@redhat.com> - 2.9.8-5
changelog:
  - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation
  - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.3-1
changelog:
  - Resolves: RHEL-2632 - Rebase SSSD for RHEL 9.4
  - Resolves: RHEL-14427 - Expected cn in RDN, got uid
  - Resolves: RHEL-12229 - HANA validation on RHEL 9.2 issue possibly related to libc/nss_sss behaviour
  - Resolves: RHEL-3925 - SSSD goes offline when, while reading a single user, misses a required attribute (i.e. SID)
  - Resolves: RHEL-2319 - Passkey authentication for centrally managed users
  - Resolves: RHEL-4146 - Incorrect handling of reverse IPv6 update results in update failure
  - Resolves: RHEL-4971 - sssd-kcm does not appear to expire Kerberos tickets (RFE: sssd_kcm should have the option to automatically delete the expired tickets)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-1
changelog:
  - Resolves: RHEL-2632 - Rebase SSSD for RHEL 9.4
  - Resolves: RHEL-18395 - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users
  - Resolves: RHEL-17498 - New sssd.conf seems not to be backwards compatible (wrt SmartCard auth of local users using 'files provider') [rhel-9]
  - Resolves: RHEL-21079 - SSSD GPO lacks group resolution on hosts [rhel-9]
  - Resolves: RHEL-19211 - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest [rhel-9]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-2
changelog:
  - Resolves: RHEL-12503 - AD users are unable to log in due to case sensitivity of user because the domain is found as an alias to the email address. 
  - Resolves: RHEL-22288 - ssh pubkey stored in ldap/AD no longer works to authenticate via sssd
  - Resolves: RHEL-22194 - gdm smartcard login fails with sssd-2.9.3 in case of multiple identities


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-6
changelog:
  - Resolves: RHEL-27209 - Race condition during authorization leads to GPO policies functioning inconsistently [rhel-9.4.0]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.2-1
changelog:
  - Resolves: RHEL-2632 - Rebase SSSD for RHEL 9.4
  - Resolves: RHEL-2319 - Passkey authentication for centrally managed users
  - Resolves: rhbz#2234829 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working)
  - Resolves: rhbz#2236119 - dbus and crond getting terminated with SIGBUS in sss_client code


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.5-1
changelog:
  - Resolves: RHEL-36586 - Rebase SSSD for RHEL 9.5
  - Resolves: RHEL-27716 - SSSD fails to process AD groups with 'Global Scope' correctly causing incomplete group-membership on RHEL if cache is empty
  - Resolves: RHEL-17659 - [RfE] SSSD Failover Enhancements
  - Resolves: RHEL-35781 - Passkey errors when handling multiple altSecurityIdentities values
  - Resolves: RHEL-30142 - sssd_pac is crashing
  - Resolves: RHEL-22206 - Errors in krb5_child.log every time a user authenticates - Pre-authentication failed: No pkinit_anchors supplied
  - Resolves: RHEL-32595 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest
  - Resolves: RHEL-28666 - sssctl config-check is reporting false positive error msg
  - Resolves: RHEL-29454 - NULL dereference in inotify handling
  - Resolves: RHEL-1654 - Improve documentation for allowing e-mail address as username


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.5-2
changelog:
  - Resolves: RHEL-40742 - passkey_child with wrong owner
  - Resolves: RHEL-41047 - sssd is skipping GPO evaluation with auto_private_groups
  - Resolves: RHEL-40570 - GPO access the wrong memory location


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.5-4
changelog:
  - Resolves: RHEL-49711 - SYSDB: remove index on dataExpireTimestamp
  - Resolves: RHEL-49811 - 2FA is being enforced after upgrading 2.9.1->2.9.4


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.5-4.1
changelog:
  - Resolves: RHEL-59876 - EL9/CentOS Stream 9 lost offline smart card authentication
  - Resolves: RHEL-50912 - possible regression of rhbz#2196521


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 2.9.5-4.4
changelog:
  - Resolves: RHEL-67670 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-9]
  - Resolves: RHEL-68369 - sssd backend process segfaults when krb5.conf is invalid
  - Resolves: RHEL-66266 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-9]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.6-1
changelog:
  - Resolves: RHEL-70189 - Rebase SSSD for RHEL 9.6
  - Resolves: RHEL-67670 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-9]
  - Resolves: RHEL-68369 - sssd backend process segfaults when krb5.conf is invalid
  - Resolves: RHEL-66266 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-9]


author: Tomas Halman <thalman@redhat.com - 2.9.7.4.1
changelog:
  - Resolves: RHEL-120298 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation
    on AD-joined Linux systems


author: Christopher Engelhard <ce@lcts.de> - 2.1.1-1
changelog:
  - Update to 2.1.1
  - Remove all patches merged upstream
  - Switched build to autotools
  - Include upstream pkgconfig module
  - Sysfsutils no longer includes /usr/bin/get_module


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-6
changelog:
  - Fix CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570 CVE-2022-3598
    CVE-2022-3627
  - Resolves: CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570
    CVE-2022-3598 CVE-2022-3627


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-8
changelog:
  - Fix CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804
    CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798 CVE-2023-0799
    CVE-2022-48281
  - Resolves: CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803
    CVE-2023-0804 CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798
    CVE-2023-0799 CVE-2022-48281


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-10
changelog:
  - Fix CVE-2023-26965 CVE-2023-3316 CVE-2023-26966 CVE-2023-3576
  - Resolves: CVE-2023-26965 CVE-2023-3316 CVE-2023-26966 CVE-2023-3576


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-11
changelog:
  - Fix CVE-2023-40090 CVE-2023-3618 CVE-2023-40745 CVE-2023-41175
  - Resolves: RHEL-5458 RHEL-5455 RHEL-5405 RHEL-5450


author: RHEL Packaging Agent <jotnar@redhat.com> - 4.4.0-13.2
changelog:
  - fix CVE-2025-8176 off-by-one error skipping first line in tiffdither
    and tiffmedian
  - Resolves: RHEL-120243


author: Michal Hlavinka <mhlavink@redhat.com> - 4.4.0-14
changelog:
  - fix CVE-2023-52356: libtiff could crash in TIFFReadRGBATileExt when parsing crafted tiff file (RHEL-17337)


author: Michal Hlavinka <mhlavink@redhat.com> - 4.4.0-16
changelog:
  - fix CVE-2025-9900: Out-of-Bounds Write in TIFFReadRGBAImageOriented (RHEL-112543)
  - fix CVE-2025-8176: use after free in tiffmedian (RHEL-120238)


author: Steve Dickson <steved@redhat.com> - 1.3.3-1
changelog:
  - bindresvport.c: fix a potential resource leakage (bz 2135405)
  - clnt_raw.c: fix a possible null pointer dereference (bz 2138317)


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.4-8
changelog:
  - iscsi: CHAP auth algorithm selection fixes (#2188916)
  - tests: Use stronger passphrases for LUKS tests (#2188750,#2188752)
  - integration-test: Fix scsi_debug cd drive read-only detection (#2211191)
  - lvm2: Improve uevent processing (#2031673)
  - tests: Mark test_job.UdisksJobTest.test_job as unstable (#2148844)


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.4-11
changelog:
  - udiskslinuxblockobject: Try issuing BLKRRPART ioctl harder
  - lvm2: Refactor udisks_daemon_util_lvm2_wipe_block()


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.4-1
changelog:
  - Version 2.9.4 (#2010363)
  - CVE-2021-3802: Harden the default mount options for ext filesystems (#2004423)
  - Fix double free on daemon exit (unaligned fastbin chunk) (#2001549)


author: Mike FABIAN <mfabian@redhat.com> - 0.9.10-12
changelog:
  - Fix memory leak in vasnprint. Resolves: rhbz#1938800
    (Backported from upstream: https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=4d288a80bf7ebe29334b9805cdcc70eacb6059c1)


author: Jeff Moyer <jmoyer@redhat.com> - 2.12-1.el9
changelog:
  - Rebase to version 2.12.  Follow fedora and get rid of explicit %
    attr for library files
  - Resolves: RHEL-114115


author: Jiri Denemark <jdenemar@redhat.com> - 9.5.0-5
changelog:
  - Revert "qemu_passt: Actually use @logfd" (rhbz#2209191)
  - Revert "qemu_passt: Precreate passt logfile" (rhbz#2209191)


author: Jiri Denemark <jdenemar@redhat.com> - 9.5.0-6
changelog:
  - tests: Use DO_TEST_CAPS_*_ABI_UPDATE() for ppc64 (rhbz#2196178)
  - tests: Switch to firmware autoselection for hvf (rhbz#2196178)
  - tests: Use virt-4.0 machine type for aarch64 (rhbz#2196178)
  - tests: Consistently use /path/to/guest_VARS.fd (rhbz#2196178)
  - tests: Turn abi-update.xml into a symlink (rhbz#2196178)
  - tests: Rename firmware-auto-efi-nvram-path (rhbz#2196178)
  - qemu: Fix return value for qemuFirmwareFillDomainLegacy() (rhbz#2196178)
  - qemu: Fix lookup against stateless/combined pflash (rhbz#2196178)
  - tests: Add some more DO_TEST*ABI_UPDATE* macros (rhbz#2196178)
  - tests: Add more tests for firmware selection (rhbz#2196178)
  - tests: Update firmware descriptor files (rhbz#2196178)
  - tests: Drop tags from BIOS firmware descriptor (rhbz#2196178)
  - tests: Include microvm in firmwaretest (rhbz#2196178)
  - qemu: Don't overwrite NVRAM template for legacy firmware (rhbz#2196178)
  - qemu: Generate NVRAM path in more cases (rhbz#2196178)
  - qemu: Filter firmware based on loader.readonly (rhbz#2196178)
  - qemu: Match NVRAM template extension for new domains (rhbz#2196178)
  - conf: Don't default to raw format for loader/NVRAM (rhbz#2196178)
  - tests: Rename firmware-auto-efi-format-loader-qcow2-nvram-path (rhbz#2196178)
  - tests: Reintroduce firmware-auto-efi-format-mismatch (rhbz#2196178)
  - rpm: Reorder scriptlets (rhbz#2210058)
  - rpm: Reduce use of with_modular_daemons (rhbz#2210058)
  - rpm: Remove custom libvirtd restart logic (rhbz#2210058)
  - rpm: Introduce new macros for handling of systemd units (rhbz#2210058)
  - rpm: Switch to new macros for handling of systemd units (rhbz#2210058)
  - rpm: Delete unused macros (rhbz#2210058)


author: Jiri Denemark <jdenemar@redhat.com> - 9.9.0-1
changelog:
  - Rebased to libvirt-9.9.0 (rhbz#RHEL-15267)
  - The rebase also fixes the following bugs:
      rhbz#RHEL-7525, rhbz#RHEL-7570, rhbz#RHEL-7542, rhbz#RHEL-7568, rhbz#RHEL-7545
      rhbz#RHEL-3231, rhbz#RHEL-7382, rhbz#RHEL-7345, rhbz#RHEL-1717, rhbz#RHEL-7528
      rhbz#RHEL-1833, rhbz#RHEL-7569, rhbz#RHEL-4432, rhbz#RHEL-974, rhbz#RHEL-4994
      rhbz#RHEL-7419


author: Jiri Denemark <jdenemar@redhat.com> - 9.10.0-1
changelog:
  - Rebased to libvirt-9.10.0 (rhbz#RHEL-15267)
  - The rebase also fixes the following bugs:
      rhbz#RHEL-16878, rhbz#RHEL-14611, rhbz#RHEL-7384, rhbz#RHEL-16870, rhbz#RHEL-18439
      rhbz#RHEL-16751, rhbz#RHEL-4452, rhbz#RHEL-17841, rhbz#RHEL-15288, rhbz#RHEL-7040


author: Jiri Denemark <jdenemar@redhat.com> - 10.0.0-1
changelog:
  - Rebased to libvirt-10.0.0 (RHEL-15267)
  - The rebase also fixes the following bugs:
      RHEL-18782, RHEL-735, RHEL-18165, RHEL-4607, RHEL-700
      RHEL-7100, RHEL-15480, RHEL-7416, RHEL-20609, RHEL-7570
      RHEL-20444, RHEL-17596, RHEL-7569


author: Jiri Denemark <jdenemar@redhat.com> - 10.0.0-2
changelog:
  - tests: Add hostcpudata for machine with CPU clusters (RHEL-7043)
  - conf: Report CPU clusters in capabilities XML (RHEL-7043)
  - conf: Allow specifying CPU clusters (RHEL-7043)
  - qemu: Introduce QEMU_CAPS_SMP_CLUSTERS (RHEL-7043)
  - qemu: Use CPU clusters for guests (RHEL-7043)
  - tests: Add test case for CPU clusters (RHEL-7043)
  - qemu: Make monitor aware of CPU clusters (RHEL-7043)
  - tests: Verify handling of CPU clusters in QMP data (RHEL-7043)
  - build: Make daemons depend on generated *_protocol.[ch] (RHEL-15267)
  - domain_validate: Check for domain address conflicts fully (RHEL-4452)
  - qemu_hotplug: Don't lose 'created' flag in qemuDomainChangeNet() (RHEL-22714)


author: Jiri Denemark <jdenemar@redhat.com> - 10.0.0-3
changelog:
  - remote_driver: Restore special behavior of remoteDomainGetBlockIoTune() (RHEL-22800)
  - conf: Introduce dynamicMemslots attribute for virtio-mem (RHEL-15316)
  - qemu_capabilities: Add QEMU_CAPS_DEVICE_VIRTIO_MEM_PCI_DYNAMIC_MEMSLOTS capability (RHEL-15316)
  - qemu_validate: Check capability for virtio-mem dynamicMemslots (RHEL-15316)
  - qemu_command: Generate cmd line for virtio-mem dynamicMemslots (RHEL-15316)
  - qemu_snapshot: fix detection if non-leaf snapshot isn't in active chain (RHEL-23212)
  - qemu_snapshot: create: refactor external snapshot detection (RHEL-22797)
  - qemu_snapshot: create: don't require disk-only flag for offline external snapshot (RHEL-22797)
  - remoteDispatchAuthPolkit: Fix lock ordering deadlock if client closes connection during auth (RHEL-20337)
  - util: virtportallocator: Add VIR_DEBUG statements for port allocations and release (RHEL-21543)
  - qemu: migration: Properly handle reservation of manually specified NBD port (RHEL-21543)
  - qemuMigrationDstStartNBDServer: Refactor cleanup (RHEL-21543)
  - virPCIVPDResourceIsValidTextValue: Adjust comment to reflect actual code (RHEL-22314)
  - util: pcivpd: Refactor virPCIVPDResourceIsValidTextValue (RHEL-22314)
  - virNodeDeviceCapVPDFormatCustom*: Escape unsanitized strings (RHEL-22314)
  - virNodeDeviceCapVPDFormat: Properly escape system-originated strings (RHEL-22314)
  - schema: nodedev: Adjust allowed characters in 'vpdFieldValueFormat' (RHEL-22314)
  - tests: Test the previously mishandled PCI VPD characters (RHEL-22314)
  - Don't overwrite error message from 'virXPathNodeSet' (RHEL-22314)
  - tests: virpcivpdtest: Remove 'testVirPCIVPDReadVPDBytes' case (RHEL-22314)
  - util: virpcivpd: Unexport 'virPCIVPDReadVPDBytes' (RHEL-22314)
  - util: pcivpd: Unexport virPCIVPDParseVPDLargeResourceFields (RHEL-22314)
  - tests: virpcivpd: Remove 'testVirPCIVPDParseVPDStringResource' case (RHEL-22314)
  - util: virpcivpd: Unexport 'virPCIVPDParseVPDLargeResourceString' (RHEL-22314)
  - virPCIVPDResourceGetKeywordPrefix: Fix logging (RHEL-22314)
  - util: virpcivpd: Remove return value from virPCIVPDResourceCustomUpsertValue (RHEL-22314)
  - conf: virNodeDeviceCapVPDParse*: Remove pointless NULL checks (RHEL-22314)
  - virpcivpdtest: testPCIVPDResourceBasic: Remove tests for uninitialized 'ro'/'rw' section (RHEL-22314)
  - util: virPCIVPDResourceUpdateKeyword: Remove impossible checks (RHEL-22314)
  - conf: node_device: Refactor 'virNodeDeviceCapVPDParseCustomFields' to fix error reporting (RHEL-22314)
  - virNodeDeviceCapVPDParseXML: Fix error reporting (RHEL-22314)
  - util: virpcivpd: Remove return value from virPCIVPDResourceUpdateKeyword (RHEL-22314)
  - virPCIDeviceHasVPD: Refactor "debug" messages (RHEL-22314)
  - virPCIDeviceGetVPD: Fix multiple error handling bugs (RHEL-22314)
  - virPCIDeviceGetVPD: Handle errors in callers (RHEL-22314)
  - virPCIVPDReadVPDBytes: Refactor error handling (RHEL-22314)
  - virPCIVPDParseVPDLargeResourceString: Properly report errors (RHEL-22314)
  - virPCIVPDParseVPDLargeResourceFields: Merge logic conditions (RHEL-22314)
  - virPCIVPDParseVPDLargeResourceFields: Remove impossible 'default' switch case (RHEL-22314)
  - virPCIVPDParseVPDLargeResourceFields: Refactor processing of read data (RHEL-22314)
  - virPCIVPDParseVPDLargeResourceFields: Refactor return logic (RHEL-22314)
  - virPCIVPDParseVPDLargeResourceFields: Report proper errors (RHEL-22314)
  - virPCIVPDParse: Do reasonable error reporting (RHEL-22314)
  - virt-admin: Add warning when connection to default daemon fails (RHEL-23170)


author: Jiri Denemark <jdenemar@redhat.com> - 10.0.0-4
changelog:
  - Set stubDriverName from hostdev driver model attribute during pci device setup (RHEL-25858)
  - qemuMigrationDstPrepareStorage: Use 'switch' statement to include all storage types (RHEL-24825)
  - qemuMigrationDstPrepareStorage: Properly consider path for 'vdpa' devices (RHEL-24825)
  - domain_validate: Account for NVDIMM label size properly when checking for memory conflicts (RHEL-4452)


author: Eduard Abdullin <eabdullin@almalinu.org> - 10.0.0-6.alma.1
changelog:
  - cpu: x86: Add support for adding features to existing CPU models
  - qemu: domain: Check arch in qemuDomainMakeCPUMigratable
  - conf: cpu: Introduce virCPUDefListFeatures
  - qemu: domain: Drop added features from migratable CPU
  - Add vmx-* features to Broadwell*
  - Add vmx-* features to Cascadelake*
  - Add vmx-* features to Conroe
  - Add vmx-* features to Cooperlake
  - Add vmx-* features to core2duo
  - Add vmx-* features to Haswell*
  - Add vmx-* features to Icelake*
  - Add vmx-* features to IvyBridge*
  - Add vmx-* features to kvm*
  - Add vmx-* features to Nehalem*
  - Add vmx-* features to Penryn
  - Add vmx-* features to SandyBridge*
  - Add vmx-* features to SapphireRapids
  - Add vmx-* features to Skylake*
  - Add vmx-* features to Snowridge
  - Add vmx-* features to Westmere*
  - qemu: virtiofs: do not crash if cgroups are missing
  - qemu: virtiofs: set correct label when creating the socket
  - qemu: virtiofs: error out if getting the group or user name fails


author: Eduard Abdullin <eabdullin@almalinu.org> - 10.0.0-6.2.el9_4.alma.1
changelog:
  - Fix off-by-one error in udevListInterfacesByStatus
  - remote: check for negative array lengths before allocation
  - qemu: Fix migration with custom XML


author: Eduard Abdullin <eabdullin@almalinux.org> - 10.0.0-6.6.el9_4.alma.1
changelog:
  - vmx: Do not require all ID data for VMWare Distributed Switch
  - vmx: Do not require DVS Port ID
  - rpc: ensure temporary GSource is removed from client event
   loop
  - qemu: Fix migration with disabled vmx-* CPU features


author: Jiri Denemark <jdenemar@redhat.com> - 9.5.0-4
changelog:
  - storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' (CVE-2023-3750, rhbz#2221851)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-8
changelog:
  - remote: add sysusers file to create 'libvirt' group (RHEL-81749)
  - qemu: Avoid crash in qemuDomainCheckCPU with unknown host CPU (RHEL-81747)
  - qemu_snapshot: allow reverting to external disk only snapshot (RHEL-21549)
  - qemu: snapshot: error out early when reverting snapshot for VM with non-file disk (RHEL-30971)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-9
changelog:
  - util: introduce object for holding a system inhibitor lock (RHEL-83064)
  - src: convert drivers over to new virInhibitor APIs (RHEL-83064)
  - rpc: remove logind support for virNetDaemon (RHEL-83064)
  - util: fix off-by-1 in inhibitor constants (RHEL-83064)
  - util: don't attempt to acquire logind inhibitor if not requested (RHEL-83064)
  - network: Free inhibitor in networkStateCleanup() (RHEL-83064)
  - conf: introduce support for multiple ACPI tables (RHEL-81041)
  - src: validate permitted ACPI table types in libxl/qemu drivers (RHEL-81041)
  - src: introduce 'raw' and 'rawset' ACPI table types (RHEL-81041)
  - qemu: support 'raw' ACPI table type (RHEL-81041)
  - libxl: support 'rawset' ACPI table type (RHEL-81041)
  - conf: support MSDM ACPI table type (RHEL-81041)
  - qemu: support MSDM ACPI table type (RHEL-81041)
  - qemuxmlconftest: Include shared memory 'net-vhostuser' test cases (RHEL-84133)
  - qemuValidateDomainDeviceDefNetwork: Require shared memory for all vhost-user interfaces (RHEL-84133)
  - qemu: process: Remove un-updated 'qemuProcessStartWarnShmem' (RHEL-84133)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-10
changelog:
  - esxConnectListAllDomains: Don't propagate failure to lookup a single domain (RHEL-80606)
  - conf: parse interface/source/@dev for all interface types (with backend type='passt') (RHEL-82539)
  - libvirt-host: Clarify/fix description of the CPU frequency field (RHEL-86197)
  - virNodeGetInfo: Improve description of the case when fake data is reported (RHEL-86197)
  - manpages: virsh: Use disclaimer from 'virNodeGetInfo()' for 'virsh nodeinfo' (RHEL-86197)
  - esx: Accept empty "path" URI component same way as "/" (RHEL-86459)
  - qemu: Rename outgoingMigration parameter in various TPM functions (RHEL-86800)
  - qemu: Properly propagate migration state to TPM cleanup code (RHEL-86800)
  - qemuDomainBlockCopyCommon: Don't revoke access to file twice on failure (RHEL-7357)
  - qemuxmlconftest: Drop s390-default-cpu-...ccw-virtio-2.7 test cases (RHEL-72976)
  - tests: add capabilities for QEMU 10.0.0 on s390x (RHEL-72976)
  - qemu: Do NOT autoadd NUMA node for s390 (RHEL-72976)
  - qemu_command: Use qemuBuildVirtioDevProps() to build cmd line for virtio-mem and virtio-pmem (RHEL-72976)
  - qemuxmlconftest: Introduce memory-hotplug-virtio-mem-pci-s390x.xml (RHEL-72976)
  - qemu_caps: Introduce QEMU_CAPS_DEVICE_VIRTIO_MEM_CCW (RHEL-72976)
  - qemu: Validate virtio-mem-ccw (RHEL-72976)
  - qemu: Allow virtio-mem on CCW (RHEL-72976)
  - qemuxmlconftest: Introduce memory-hotplug-virtio-mem-ccw-s390x.xml (RHEL-72976)
  - qemu_domain_address: fix CCW virtio-mem hotplug (RHEL-72976)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-11
changelog:
  - Add load average information type into virDomainGetGuestInfo (RHEL-88447)
  - qemu_agent: Add qemuAgentGetLoadAvg() (RHEL-88447)
  - qemu: Add support for VIR_DOMAIN_GUEST_INFO_LOAD (RHEL-88447)
  - virsh: Add support for VIR_DOMAIN_GUEST_INFO_LOAD (RHEL-88447)
  - qemu_capabilities: Fetch caps for virtio-mem-ccw too (RHEL-87532)
  - cpu_map: Add avx10* CPU features (RHEL-87796)
  - cpu_map: Add GraniteRapids-v2 CPU model (RHEL-87796)
  - cpu_map: Add sha512, sm3, and sm4 CPU features (RHEL-87796)
  - virsh: Introduce new hypervisor-cpu-models command (RHEL-11435)
  - qemu: remove nonsensical sanity check in processNetdevStreamDisconnectedEvent() (RHEL-80169)
  - qemu: make processNetDevStreamDisconnectedEvent() reusable (RHEL-80169)
  - qemu: respond to NETDEV_VHOST_USER_DISCONNECTED event (RHEL-80169)
  - qemu: put vhost-user code that's special for passt in a helper function (RHEL-80169)
  - qemu: make passt+vhostuser reconnect behave identically to passt+user (RHEL-80169)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-12
changelog:
  - qemuMonitorJSONGetCPUModelExpansion: refactor parsing functions (RHEL-89415)
  - qemu: parse deprecated-props from query-cpu-model-expansion response (RHEL-89415)
  - qemu_capabilities: query deprecated features for host-model (RHEL-89415)
  - libvirt-domain: introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES (RHEL-89415)
  - qemu_capabilities: filter deprecated features if requested (RHEL-89415)
  - virsh: add --disable-deprecated-features flag to domcapabilities (RHEL-89415)
  - conf: add deprecated_features attribute (RHEL-89415)
  - redhat: Restore hunks in tests/qemucapabilitiesdata/caps_10.0.0_s390x.* (RHEL-89415)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-14
changelog:
  - qemu: introduce QEMU_CAPS_AMD_IOMMU (RHEL-50560)
  - qemu: introduce QEMU_CAPS_PCI_ID (RHEL-50560)
  - docs: formatdomain: document intel-only IOMMU attributes (RHEL-50560)
  - qemu: add IOMMU model amd (RHEL-50560)
  - conf: add passthrough and xtsup attributes for IOMMU (RHEL-50560)
  - esx: Allow specifying different CA bundle for remote connections (RHEL-97440)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-15
changelog:
  - qemu: fix order of VNC TLS config entries (RHEL-106276)
  - qemu: sanitize blank lines in config file (RHEL-106276)
  - qemu: add ability to set TLS priority string with QEMU (RHEL-106276)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-15.1.el9_7
changelog:
  - tools: Secure guest check for Intel in virt-host-validate (RHEL-111840)
  - qemu: Check if INTEL Trust Domain Extention support is enabled (RHEL-111840)
  - qemucapabilitiesdata: Document '+inteltdx' variant (RHEL-111840)
  - qemucapabilitiestest: Add data for the qemu-10.1.0 dev cycle on x86_64 for the '+inteltdx' variant (RHEL-111840)
  - qemu: Add QEMU_CAPS_TDX_GUEST capability (RHEL-111840)
  - conf: Expose TDX feature in domain capabilities (RHEL-111840)
  - conf: Add tdx as launch security type (RHEL-111840)
  - conf: Validate TDX launchSecurity element mrConfigId/mrOwner/mrOwnerConfig (RHEL-111840)
  - qemu: Add command line and validation for TDX type (RHEL-111840)
  - conf: Expose TDX type in domain launch security capability (RHEL-111840)
  - qemu: Force special parameters enabled for TDX guest (RHEL-111840)
  - qemu: log the crash information for TDX (RHEL-111840)
  - qemu_firmware: Pick the right firmware for TDX guests (RHEL-111840)
  - conf: Add Intel TDX Quote Generation Service(QGS) support (RHEL-111840)
  - qemu: Add command line for TDX Quote Generation Service(QGS) (RHEL-111840)
  - qemu: Add FakeReboot support for TDX guest (RHEL-111840)
  - qemu: Support reboot command in guest (RHEL-111840)
  - qemu: Avoid duplicate FakeReboot for secure guest (RHEL-111840)
  - qemu: Send event VIR_DOMAIN_EVENT_[STOPPED|STARTED] during recreation (RHEL-111840)
  - qemu: Support domain reset command for TDX guest (RHEL-111840)
  - qemuxmlconftest: Add latest version of 'launch-security-tdx*' test data (RHEL-111840)
  - docs: domain: Add documentation for Intel TDX guest (RHEL-111840)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-15.2.el9_7
changelog:
  - virBitmapFormat: Don't check return value (RHEL-122930)
  - domain_conf: Make virDomainMemoryDefFormat() return void (RHEL-122930)
  - domain_conf: Switch to virXMLFormatElement() in virDomainMemoryDefFormat() (RHEL-122930)
  - conf: Introduce virDomainMemoryIsVirtioModel() (RHEL-122930)
  - qemu: Use virDomainMemoryIsVirtioModel() (RHEL-122930)
  - conf: Introduce virtio options for virtio memory models (RHEL-122930)
  - qemu_command: Generate virtio options for memory device (RHEL-122930)
  - domain_conf: Avoid memory leak in virDomainMemoryDefFree() (RHEL-122930)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-15.3.el9_7
changelog:
  - conf: Do not parse hyperv features with passthrough mode (RHEL-122930)
  - src: Drop needless typecast to virDomainTimerNameType (RHEL-122930)
  - conf: Introduce virDomainDefHasTimer() (RHEL-122930)
  - qemuxmlconfdata: Adjust hv-stimer related tests (RHEL-122930)
  - qemu_validate: Reflect dependencies of hv-synic (RHEL-122930)
  - qemu_validate: Reflect dependencies of hv-stimer (RHEL-122930)
  - qemu_validate: Reflect dependencies of hv-tlbflush (RHEL-122930)
  - qemu_validate: Reflect dependencies of hv-ipi (RHEL-122930)
  - qemu_validate: Reflect dependencies of hv-evmcs (RHEL-122930)
  - qemu_validate: Reflect dependencies of hv-tlbflush-direct (RHEL-122930)
  - virxml: Introduce virXPathTristateSwitch() (RHEL-122930)
  - virxml: Introduce virXPathTristateBool() (RHEL-122930)
  - qemu: Use virXPathTristateBool() (RHEL-122930)
  - domain_conf: Move format of hyperv features into a function (RHEL-122930)
  - domain_conf: Use virXMLFormatElement() to format hyperv features (RHEL-122930)
  - qemu_caps: Prefer VIR_DOMAIN_CAPS_ENUM_IS_SET() (RHEL-122930)
  - qemu_command: Move hyperv cmd line generation into a function (RHEL-122930)
  - qemu_command: Prefer virBufferAddLit() in qemuBuildCpuHypervCommandLine() (RHEL-122930)
  - conf: More hyperv related members into a single struct (RHEL-122930)
  - conf: Report default hyperv values in domain capabilities (RHEL-122930)
  - qemu_capabilities: Format and parse new hyperv domcaps members (RHEL-122930)
  - qemu_capabilities: Fetch new hyperv domcaps (RHEL-122930)
  - qemu_caps: Introduce virQEMUCapsGetHypervCapabilities() (RHEL-122930)
  - conf: Introduce hyperv host-model mode (RHEL-122930)
  - qemu_process: Populate hyperv features for host-model (RHEL-122930)
  - RHEL: Remove patches from invalid 10.10.0-15.2.el9_7 build (RHEL-122930)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-15.4.el9_7
changelog:
  - cpu_conf: Make virCPUDefFilterFeatures return void (RHEL-126096)
  - qemu_domain: Simplify qemuDomainFixupCPUs (RHEL-126096)
  - qemu_domain: Fix qemuDomainFixupCPUs (RHEL-126096)
  - qemu_process: Always fix CPUs on reconnect (RHEL-126096)
  - qemu_monitor: Filter CPU features reported by QEMU (RHEL-126096)
  - qemu: Ignore "ht" CPU feature (RHEL-126096)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-15.7.el9_7
changelog:
  - qemu_validate: Drop VIR_DOMAIN_HYPERV_SYNIC dependency on VIR_DOMAIN_HYPERV_VPINDEX (RHEL-140916)
  - qemu_validate: Drop VIR_DOMAIN_HYPERV_STIMER dependency on VIR_DOMAIN_HYPERV_VPINDEX (RHEL-140916)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-15.9.el9_7
changelog:
  - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-154551)
  - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-154551)
  - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-154551)
  - docs: Clarify host-model description in domain capabilities (RHEL-154551)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-7
changelog:
  - qemu_migration: Refactor qemuMigrationSrcRestoreDomainState (RHEL-79168)
  - qemu_migration: Do not automatically resume domain after I/O error (RHEL-79168)
  - qemucapabilitiestest: Add data for the qemu-10.0 dev cycle on x86_64 (RHEL-79095)
  - qemucapabilitiestest: Update 'caps_10.0.0_x86_64' to 'v9.2.0-1636-gffaf7f0376' (RHEL-79095)
  - qemu: capabilies: Introduce QEMU_CAPS_BLOCKDEV_SET_ACTIVE (RHEL-79095)
  - qemu: monitor: Add monitor backend for 'blockdev-set-active' (RHEL-79095)
  - qemu: migration: Reactivate block nodes after migration if VM is left paused (RHEL-79095)
  - conf: change virDomainHostdevInsert() to return void (RHEL-69455)
  - qemu: fix qemu validation to forbid guest-side IP address for type='vdpa' (RHEL-69455)
  - qemu: validate that model is virtio for vhostuser and vdpa interfaces in the same place (RHEL-69455)
  - qemu: automatically set model type='virtio' for interface type='vhostuser' (RHEL-69455)
  - qemu: do all vhostuser attribute validation in qemu driver (RHEL-69455)
  - conf/qemu: make <source> element *almost* optional for type=vhostuser (RHEL-69455)
  - qemu: use switch instead of if in qemuProcessPrepareDomainNetwork() (RHEL-69455)
  - qemu: make qemuPasstCreateSocketPath() public (RHEL-69455)
  - qemu: complete vhostuser + passt support (RHEL-69455)
  - qemu: fail validation if a domain def has vhostuser/passt but no shared mem (RHEL-69455)
  - docs: improve type='user' docs to higlight differences between SLIRP and passt (RHEL-69455)
  - docs: document using passt backend with <interface type='vhostuser'> (RHEL-69455)
  - utils: Canonicalize paths before comparing them (RHEL-79166)


author: Jiri Denemark <jdenemar@redhat.com> - 10.9.0-1
changelog:
  - Rebased to libvirt-10.9.0 (RHEL-50574)
  - The rebase also fixes the following bugs:
      RHEL-7036, RHEL-7122, RHEL-35752, RHEL-46870, RHEL-52314
      RHEL-60030, RHEL-60033, RHEL-64341


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-1
changelog:
  - Rebased to libvirt-10.10.0 (RHEL-50574)
  - The rebase also fixes the following bugs:
      RHEL-23607, RHEL-24850, RHEL-29267, RHEL-30842, RHEL-53963
      RHEL-54325, RHEL-54326, RHEL-55240, RHEL-64341, RHEL-65372
      RHEL-65780, RHEL-65844, RHEL-67702, RHEL-67836, RHEL-68614
      RHEL-69417


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-2
changelog:
  - util: Fix typo in virNetDevOpenvswitchInterfaceSetQos (RHEL-69938)
  - qemu: tpm: do not update profile name for transient domains (RHEL-71072)
  - qemu: Enable I/O APIC if needed (RHEL-65844)
  - cpu_map: Sort data files in meson.build (RHEL-70052)
  - sync_qemu_models_i386: Update meson.build (RHEL-70052)
  - sync_qemu_models_i386: Generate missing -v1 variants (RHEL-70052)
  - cpu_map: Add 486-v1 CPU model (RHEL-70052)
  - cpu_map: Add pentium-v1 CPU model (RHEL-70052)
  - cpu_map: Add pentium2-v1 CPU model (RHEL-70052)
  - cpu_map: Add pentium3-v1 CPU model (RHEL-70052)
  - cpu_map: Add coreduo-v1 CPU model (RHEL-70052)
  - cpu_map: Add n270-v1 CPU model (RHEL-70052)
  - cpu_map: Add core2duo-v1 CPU model (RHEL-70052)
  - cpu_map: Add qemu32-v1 CPU model (RHEL-70052)
  - cpu_map: Add kvm32-v1 CPU model (RHEL-70052)
  - cpu_map: Add qemu64-v1 CPU model (RHEL-70052)
  - cpu_map: Add kvm64-v1 CPU model (RHEL-70052)
  - cpu_map: Add Conroe-v1 CPU model (RHEL-70052)
  - cpu_map: Add Penryn-v1 CPU model (RHEL-70052)
  - cpu_map: Add KnightsMill-v1 CPU model (RHEL-70052)
  - cpu_map: Add athlon-v1 CPU model (RHEL-70052)
  - cpu_map: Add phenom-v1 CPU model (RHEL-70052)
  - cpu_map: Add Opteron_G1-v1 CPU model (RHEL-70052)
  - cpu_map: Add Opteron_G2-v1 CPU model (RHEL-70052)
  - cpu_map: Add Opteron_G3-v1 CPU model (RHEL-70052)
  - cpu_map: Add Opteron_G4-v1 CPU model (RHEL-70052)
  - cpu_map: Add Opteron_G5-v1 CPU model (RHEL-70052)
  - cpu_map: Add EPYC-Genoa-v1 CPU model (RHEL-70052)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-4
changelog:
  - conf, docs: Add support for direct and extended tlbflush features (RHEL-7122)
  - qemu: Add support for direct and extended tlbflush features (RHEL-7122)
  - conf: refactor hyperv features formatting (RHEL-7122)
  - conf: Adjust hyperv tlbflush formatting (RHEL-7122)
  - qemu_migration: Do not consider post-copy active in postcopy-recover (RHEL-73085)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-5
changelog:
  - qemu: allow migration of guest with mdev vGPU to VF vGPU (RHEL-68064)
  - storage_file: Refuse qcow2 images with empty string as 'data_file' (RHEL-73504)
  - virstoragetest: Add case for qcow2 image with empty string as 'data_file' (RHEL-73504)
  - qemu: snapshot: delete disk image only if parent snapshot is external (RHEL-74041)
  - storage_file: de-modularize the local file backend (RHEL-73507)
  - libvirt.spec: Move ownership of 'storage-file' backends directory to gluster (RHEL-73507)
  - qemu: re-use existing ActualNetDef for more interface types during update-device (RHEL-7036)
  - tools: ssh-proxy: Check for domain status before parsing its CID (RHEL-75577)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-6
changelog:
  - build: Bump minimum glib2 version to 2.66.0 (RHEL-77884)
  - qemuProcessHandleIOError: Refactor to extract 'priv' instead of 'driver' (RHEL-77884)
  - qemu: Handle quirks of 'device' field of BLOCK_IO_ERROR event in monitor code (RHEL-77884)
  - qemu: Rename 'diskAlias' to 'device' in qemu IO error event handling (RHEL-77884)
  - qemuProcessHandleIOError: Rename local variables (RHEL-77884)
  - qemuMonitorJSONHandleIOError: Do not munge 'reason' field of IO error event (RHEL-77884)
  - qemuProcessHandleIOError: Prefer lookup by node name (RHEL-77884)
  - qemuMonitorJSONHandleIOError: Propagate new 'qom-path' field (RHEL-77884)
  - virStorageSource: Add fields for storing last I/O error message (RHEL-77884)
  - qemuProcessHandleIOError: Populate I/O error reason to virStorageSource (RHEL-77884)
  - qemuProcessHandleIOError: Log IO errors in the VM log file (RHEL-77884)
  - libxlDomainGetMessages: Add existing flags to 'virCheckFlags' (RHEL-77884)
  - virDomainObjGetMessages: Refactor using GPtrArray (RHEL-77884)
  - virDomainGetMessages: Introduce VIR_DOMAIN_MESSAGE_IOERRORS (RHEL-77884)
  - include: libvirt-domain: Reword documentation for @reason of VIR_DOMAIN_EVENT_ID_IO_ERROR_REASON (RHEL-77884)
  - include: libvirt-domain: Add 'message' @reason of VIR_DOMAIN_EVENT_ID_IO_ERROR_REASON (RHEL-77884)
  - qemuSnapshotForEachQcow2: Don't initialize 'nrollback' (RHEL-73315)
  - qemu: process: Export qemuPrepareNVRAM for use in snapshot code (RHEL-73315)
  - qemu: snapshot: Ensure that NVRAM image exists when taking inactive internal snapshot (RHEL-73315)
  - qemuxmlconftest: Allow testing of the 'writable' flag for passed FDs for disks (RHEL-37519)
  - qemuxmlconftest: Add testing of FDs with 'writable' flag in 'disk-source-fd' (RHEL-37519)
  - qemu: domain: Initialize FD passthrough for a virStorageSource before using it (RHEL-37519)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-7.2.el9_6
changelog:
  - util: introduce object for holding a system inhibitor lock (RHEL-83076)
  - src: convert drivers over to new virInhibitor APIs (RHEL-83076)
  - rpc: remove logind support for virNetDaemon (RHEL-83076)
  - util: fix off-by-1 in inhibitor constants (RHEL-83076)
  - util: don't attempt to acquire logind inhibitor if not requested (RHEL-83076)
  - network: Free inhibitor in networkStateCleanup() (RHEL-83076)
  - conf: parse interface/source/@dev for all interface types (with backend type='passt') (RHEL-84689)
  - qemu: remove nonsensical sanity check in processNetdevStreamDisconnectedEvent() (RHEL-84782)
  - qemu: make processNetDevStreamDisconnectedEvent() reusable (RHEL-84782)
  - qemu: respond to NETDEV_VHOST_USER_DISCONNECTED event (RHEL-84782)
  - qemu: put vhost-user code that's special for passt in a helper function (RHEL-84782)
  - qemu: make passt+vhostuser reconnect behave identically to passt+user (RHEL-84782)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-7.3.el9_6
changelog:
  - Add load average information type into virDomainGetGuestInfo (RHEL-88449)
  - qemu_agent: Add qemuAgentGetLoadAvg() (RHEL-88449)
  - qemu: Add support for VIR_DOMAIN_GUEST_INFO_LOAD (RHEL-88449)
  - virsh: Add support for VIR_DOMAIN_GUEST_INFO_LOAD (RHEL-88449)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-7.4.el9_6
changelog:
  - qemuMonitorJSONGetCPUModelExpansion: refactor parsing functions (RHEL-89977)
  - qemu: parse deprecated-props from query-cpu-model-expansion response (RHEL-89977)
  - qemu_capabilities: query deprecated features for host-model (RHEL-89977)
  - libvirt-domain: introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES (RHEL-89977)
  - qemu_capabilities: filter deprecated features if requested (RHEL-89977)
  - virsh: add --disable-deprecated-features flag to domcapabilities (RHEL-89977)
  - conf: add deprecated_features attribute (RHEL-89977)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-7.7.el9_6
changelog:
  - qemu: fix order of VNC TLS config entries (RHEL-106277)
  - qemu: sanitize blank lines in config file (RHEL-106277)
  - qemu: add ability to set TLS priority string with QEMU (RHEL-106277)
  - qemuxmlconftest: Include shared memory 'net-vhostuser' test cases (RHEL-106504)
  - qemuValidateDomainDeviceDefNetwork: Require shared memory for all vhost-user interfaces (RHEL-106504)
  - qemu: process: Remove un-updated 'qemuProcessStartWarnShmem' (RHEL-106504)


author: Jiri Denemark <jdenemar@redhat.com> - 10.4.0-1
changelog:
  - Rebased to libvirt-10.4.0 (RHEL-7489)
  - The rebase also fixes the following bugs:
      RHEL-29642, RHEL-30373, RHEL-32182, RHEL-33044, RHEL-33082
      RHEL-34615, RHEL-35948, RHEL-36565, RHEL-36721, RHEL-39271
      RHEL-39400


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-1
changelog:
  - Rebased to libvirt-10.5.0 (RHEL-21381)
  - The rebase also fixes the following bugs:
      RHEL-23833, RHEL-29642, RHEL-37542, RHEL-39969, RHEL-40899
      RHEL-43309


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-2
changelog:
  - vmx: Do not require all ID data for VMWare Distributed Switch (RHEL-46099)
  - tests: vhostuser: add virtiofsd json descriptor (RHEL-7108, RHEL-40135)
  - tests: qemuxmlconf: adjust test case to new virtiofsd (RHEL-7108, RHEL-40135)
  - qemu: fill capabilities for virtiofsd (RHEL-7108, RHEL-40135)
  - qemu: do not use deprecated options for new virtiofsd (RHEL-7108)
  - qemu: migration: allow migration for virtiofs (RHEL-40135)
  - virt-host-validate: Drop extra "PASS" (RHEL-46868)
  - qemu: Don't leave beingDestroyed=true on inactive domain (RHEL-43309)


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-5
changelog:
  - qemu: virtiofs: cache: use 'never' instead of 'none' (RHEL-50329)
  - qemu_domain: Strip <acpi/> from s390(x) definitions (RHEL-49516)
  - qemuxmlconftest: Add tests for the ACPI stripping hack on s390 (RHEL-49516)
  - vsh: Allow vshReadlineInit() to be called multiple times (RHEL-53560)


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-6
changelog:
  - udevListInterfaces: Honour array length for zero-length NULL arrays (CVE-2024-8235) (CVE-2024-8235, RHEL-55373)


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-7
changelog:
  - qemu: Refactor default panic model (RHEL-56451)
  - qemu: Sometimes the default panic model doesn't exist (RHEL-56451)
  - qemu: Use pvpanic by default on aarch64 (RHEL-56451)


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-7.1.el9_5
changelog:
  - qemu: migration: Pre-create QCOW2 images for non-shared storage with 0 allocation (RHEL-61177)
  - virTypedParamsFilter: Adjust return type and docs (RHEL-61177)
  - virTypedParamsGetStringList: Refactor and adjust docs (RHEL-61177)
  - virTypedParamsFilter: Introduce option to filter also by type (RHEL-61177)
  - virTypedParamsGetStringList: Ensure that returned array is NULL if there are no matching fields (RHEL-61177)
  - virTypedParamsGetStringList: Ensure that returned string list is NULL-terminated (RHEL-61177)
  - qemuMigrationSrcBeginPhaseBlockDirtyBitmaps: Use qemuMigrationAnyCopyDisk() (RHEL-61177)
  - qemu: migration: Don't log 'nmigrate_disks' (RHEL-61177)
  - qemu: migration: Avoid use of 'nmigration_disks' (RHEL-61177)
  - qemu: migration: Extract validation of disk target list (RHEL-61177)
  - qemu: migration: Remove 'nmigration_disks' variable from all places (RHEL-61177)
  - qemu: Introduce and wire in 'VIR_MIGRATE_PARAM_MIGRATE_DISKS_DETECT_ZEROES' (RHEL-61177)
  - virsh: Add support for VIR_MIGRATE_PARAM_MIGRATE_DISKS_DETECT_ZEROES migration parameter (RHEL-61177)
  - qemu: migration: Fix blockdev config with VIR_MIGRATE_PARAM_MIGRATE_DISKS_DETECT_ZEROES (RHEL-61177)
  - docs: Add warning about using a cleared image with VIR_MIGRATE_PARAM_MIGRATE_DISKS_DETECT_ZEROES_ZEROES (RHEL-61177)
  - util: Look for newer name of cpu wait time statistic (RHEL-61511)
  - vmx: Allow '*' to appear in VMX file keys (RHEL-58677)


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-7.2.el9_5
changelog:
  - qemu: Add support for postcopy-recover-setup migration state (RHEL-63877)
  - qemu: Avoid false failure when resuming post-copy migration (RHEL-63877)


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-7.3.el9_5
changelog:
  - libvirt_private.syms: Export virDomainIOMMUDefNew() (RHEL-69725)
  - qemu: Turn EIM IOMMU on automagically (RHEL-69725)
  - qemu_domain: Automagically add IOMMU if needed (RHEL-69725)


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-7.4.el9_5
changelog:
  - qemu: Enable I/O APIC if needed (RHEL-69725)
  - qemu: Enable I/O APIC even more frequently (RHEL-69725)


author: Jiri Denemark <jdenemar@redhat.com> - 10.0.0-7
changelog:
  - qemu: virtiofs: do not crash if cgroups are missing
  - qemu: virtiofs: set correct label when creating the socket
  - qemu: virtiofs: error out if getting the group or user name fails
  - Fix off-by-one error in udevListInterfacesByStatus (CVE-2024-1441)
  - remote: check for negative array lengths before allocation (CVE-2024-2494)
  - qemu: Fix migration with custom XML (RHEL-30622)


author: Jiri Denemark <jdenemar@redhat.com> - 10.3.0-1
changelog:
  - Rebased to libvirt-10.3.0 (RHEL-29642)
  - The rebase also fixes the following bugs:
      RHEL-25993, RHEL-7101, RHEL-7461, RHEL-16333, RHEL-7343
      RHEL-28808, RHEL-32880, RHEL-35879, RHEL-34112, RHEL-30373
      RHEL-23416, RHEL-23608, RHEL-26276, RHEL-22728


author: Eduard Abdullin <eabdullin@almalinux.org> - 10.5.0-7.alma.1
changelog:
  - qemu: Use pvpanic by default on aarch64
  - qemu: Refactor default panic model
  - qemu: Sometimes the default panic model doesn't exist
  - udevListInterfaces: Honour array length for zero-length NULL
   arrays (CVE-2024-8235)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-5
changelog:
  - qemublocktest: Iterate all nodenames in 'testQemuDetectBitmaps' (RHEL-145770)
  - qemu: monitor: Detect list of bitmaps from 'qcow2' format specific data (RHEL-145770)
  - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Fix check for existing bitmaps (RHEL-145770)
  - qemu: migration: Always offer block dirty bitmaps during migration (RHEL-145770)
  - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Always consider offered bitmaps (RHEL-145770)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-6
changelog:
  - qemu: Implement support for associating iommufd to hostdev (RHEL-126345)
  - qemu: Introduce privateData for hostdevs (RHEL-126345)
  - qemu: Support per-process memory accounting for iommufd (RHEL-126345)
  - qemu: open VFIO FDs from libvirt backend (RHEL-126345)
  - qemu: open iommufd FD from libvirt backend (RHEL-126345)
  - qemu: Update Cgroup, namespace, and seclabel for iommufd (RHEL-126345)
  - tests: qemuxmlconfdata: provide iommufd sample XML and CLI args (RHEL-126345)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-9
changelog:
  - qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices (RHEL-140614)
  - qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR (RHEL-140614)
  - RHEL-ONLY: backport test data for 'migrate-pr' capability of 'scsi-block' (RHEL-140614)
  - qemu: Implement support for persistent reservation migration control (RHEL-140614)
  - qemu: Extract disk setup done via QMP into a separate helper (RHEL-147866)
  - qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' (RHEL-147866)
  - qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' (RHEL-147866)
  - Expose latency histograms via 'virConnectGetAllDomainStats' (RHEL-147866)
  - qemu: monitor: Add handlers for 'block-latency-histogram-set' (RHEL-147866)
  - docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element (RHEL-147866)
  - docs: formatdomain: Reword section about the '<statistics>' element under disk driver (RHEL-147866)
  - Introduce support for disk operation latency histogram collection (RHEL-147866)
  - qemu: Setup disk latency histograms on startup/hotplug/update (RHEL-147866)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-10
changelog:
  - qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD (RHEL-150353)
  - qemu: Move IOMMUFD validation to qemu_validate (RHEL-150353)
  - util: Move openning IOMMU device to viriommufd (RHEL-150353)
  - qemu_process: Refactor qemuProcessOpenIommuFd (RHEL-150353)
  - util: Move openning VFIO device to virpci (RHEL-150353)
  - qemu_process: Refactor qemuProcessOpenVfioDeviceFd (RHEL-150353)
  - util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath (RHEL-150353)
  - conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD (RHEL-150353)
  - conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD (RHEL-150353)
  - qemu_domain: Add missing IOMMUFD cleanup (RHEL-150353)
  - qemu_process: Fix FD leak with multiple host devices using IOMMUFD (RHEL-150353)
  - qemu_process: Refactor qemuProcessOpenVfioFds (RHEL-150353)
  - qemuxmlconftest: Refactor host device preparation (RHEL-150353)
  - qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData (RHEL-150353)
  - qemuxmlconftest: Set fake FD for IOMMUFD (RHEL-150353)
  - qemu: Convert IOMMUFD to qemuFDPassDirect (RHEL-150353)
  - qemu: Convert vfioDeviceFd to qemuFDPassDirect (RHEL-150353)
  - qemu_command: Don't use host property if IOMMUFD is used (RHEL-150353)
  - qemu: Save IOMMUFD state into status XML (RHEL-150353)
  - qemu_hotplug: Remove iommufd object if no longer needed (RHEL-150353)
  - qemu_command: Extract building IOMMUFD props to function (RHEL-150353)
  - qemu_hotplug: Add support to hotplug host device with IOMMUFD (RHEL-150353)
  - conf: Introduce iommufd enum for domaincaps (RHEL-138544)
  - qemu: Fill iommufd domain capability (RHEL-138544)
  - tests: properly mock VFIO and IOMMU checks (RHEL-138544)
  - iommufd: fix FD leak in case of error (RHEL-150353)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-11
changelog:
  - domain_conf: initialize network hostdev private data (RHEL-151953)
  - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151953)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-12.1.el9_8
changelog:
  - conf: Parse hyperv features even for host-model (RHEL-151684)
  - qemu: Wire up new hyperv host-model mode behavior (RHEL-151684)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-12.2.el9_8
changelog:
  - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-154552)
  - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-154552)
  - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-154552)
  - docs: Clarify host-model description in domain capabilities (RHEL-154552)
  - security_apparmor: Use g_auto* in AppArmorSetSecurityHostdevLabel (RHEL-159913)
  - security: Cleanup hostdev label error logic (RHEL-159913)
  - qemu: Fix IOMMUFD and VFIO security labels (RHEL-159913)
  - viriommufd: Set IOMMU_OPTION_RLIMIT_MODE only when running privileged (RHEL-159174)
  - conf: Move and rename virStorageSourceFDTuple object (RHEL-159174)
  - conf: Refactor virHostdevIsPCIDevice (RHEL-159174)
  - hypervisor: Fix virHostdevNeedsVFIO detection (RHEL-159174)
  - qemu: Expand call to qemuDomainNeedsVFIO (RHEL-159174)
  - qemu: Update qemuDomainNeedsVFIO to ignore PCI hostdev with IOMMUFD (RHEL-159174)
  - src: Use virHostdevIsPCIDeviceWith* to check for IOMMUFD (RHEL-159174)
  - conf: Introduce domain iommufd element (RHEL-159174)
  - qemu: Implement iommufd (RHEL-159174)
  - conf: Add iommufd fdgroup support (RHEL-159174)
  - qemu: Implement iommufd fdgroup (RHEL-159174)
  - tests: Add iommufd fdgroup test (RHEL-159174)
  - hypervisor: Call virWaitForDevices() after detaching host devices (RHEL-159174)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-12.3.el9_8
changelog:
  - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-178822)
  - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-178822)
  - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel (RHEL-178822)
  - qemu_capabilities: Always sort features in host-model CPU (RHEL-178822)
  - qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel (RHEL-178822)
  - qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel (RHEL-178822)
  - qemu_capabilities: Cache expanded CPU (RHEL-178822)
  - domaincapstest: Test EXPAND_CPU_FEATURES flag (RHEL-178822)
  - util: Publish and mock virHostCPUGetMSRFromKVM (RHEL-178822)
  - cpu_x86: Introduce virCPUx86DataAddMSR (RHEL-178822)
  - cpu: Introduce virCPUUpdateFeatures (RHEL-178822)
  - Fix documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-178822)
  - Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES flag (RHEL-178822)
  - virsh: Add --supported-cpu-features option for domcapabilities (RHEL-178822)
  - domaincapstest: Test SUPPORTED_CPU_FEATURES flag (RHEL-178822)
  - qemu_capabilities: Fix domain capabilities on AMD CPUs (RHEL-178822)
  - distro: Replace old gating with tmt


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-4
changelog:
  - qemuSecurityMoveImageMetadata: Move seclabels only to virStorageSource of same type (RHEL-140624)
  - qemuDomainSetThrottleGroup: Enforce non-zero 'groupname' string length (RHEL-144010)
  - qemuDomainSetBlockIoTuneField: Move setting of 'group_name' out of the loop (RHEL-144010)
  - qemuDomainSetThrottleGroup: Always honour thottle group name passed as argument (RHEL-144010)
  - qemuDomainSetThrottleGroup: Don't put group name into the 'tunable' event twice (RHEL-144010)
  - qemuSnapshotDiskHasBackingDisk: Avoid call of virStorageSourceIsSameLocation with NULL argument (RHEL-144090)
  - qemuSnapshotUpdateBackingStore: Remove stale comment (RHEL-144090)
  - qemuSnapshotDiskHasBackingDisk: Use proper 'max_depth' when calling 'virStorageSourceGetMetadata' (RHEL-144090)
  - virDomainSnapshotDefAssignExternalNames: Improve error message (RHEL-144090)
  - qemuSnapshotUpdateBackingStore: Retry as curent user if qemu-img fails (RHEL-144090)


author: Kalev Lember <klember@redhat.com> - 1:0.4.0-31
changelog:
  - Use make_build/make_install macros
  - Drop unneeded ldconfig_scriptlets macro call
  - Remove a no longer needed -mmmx CFLAGS addition
  - Disable strict aliasing


author: Ville-Pekka Vainio <vpvainio AT iki.fi> - 4.3-1
changelog:
  - Update to 4.3
  - Add GPG signature check for the source
  - Fix pycached stuff
  - Remove old python_provide macro
  - Remove ldconfig_scriptlets macro
  - Only use VFST for now, HFST can be provided in a later update


author: Ville-Pekka Vainio <vpvainio AT iki.fi> - 4.3-2
changelog:
  - Bump release for a new Copr build
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild


author: Ville-Pekka Vainio <vpvainio AT iki.fi> - 4.3-3
changelog:
  - The dictionary data directory will now be /usr/lib/voikko on all architectures
  - Create and own /usr/lib/voikko, so different dictionary packages can own the subdirectories there
  - This was suggested in the review of the voikko-fi package, see rhbz#1919688
  - Use the license macro


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.12.1-2
changelog:
  - Drop libwacom-show-stylus, it's a debugging tool that requires extra
    dependencies that we shouldn't pull in everywhere (#2044710)


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.12.1-4
changelog:
  - Add support for the Cintiq Pro 27 (RHEL-101886)
  - Add support for the Intuos Pro 3rd Gen series (RHEL-101881)


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.12.1-5
changelog:
  - Rearrange the OSD buttons for the Intuos Pro 3rd Gen (RHEL-101881)
  - Use separate Ring/Ring2 assignments


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.12.1-6
changelog:
  - Add stylus definitions for the propen group (RHEL-122207)
  - Add tablet definitions for the latest Cintiqs (RHEL-122206)
  - Fix the overlap for button assignments in the SVG (RHEL-126355)


author: Tomas Popela <tpopela@redhat.com> - 1.2.0-6
changelog:
  - Add fix for mzbz#1819244
  - Fix tools subpackage dependency
  - Bump the release to "6" to accommodate the 9.1.0.z release bumps


author: Tomas Popela <tpopela@redhat.com> - 1.2.0-7
changelog:
  - Bump the release to "7" to accommodate the 9.1.0.z release bumps as
    libwebp-1.2.0-6.el9 < libwebp-1.2.0-6.el9_1


author: Caolán McNamara <caolanm@redhat.com> - 0.2.12-6
changelog:
  - document that libwmf bundles a modified old copy of gd 2.0.1
    https://fedoraproject.org/wiki/Bundled_Libraries#Requirement_if_you_bundle


author: Wolfgang Ulbrich <fedora@raveit.de> - 40.0-2
changelog:
  - revert https://gitlab.gnome.org/GNOME/libwnck/-/commit/3456b74
  - fixes rhbz #1971048
  - and https://github.com/mate-desktop/mate-panel/issues/1230


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-1
changelog:
  - Update to openwsman-2.8.1
    Resolves: RHEL-97643
  - Add libwsman-client.so.4 for backward compatibility
    Related: RHEL-97643


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-2
changelog:
  - Support added for post-quantum cryptography
    Resolves: RHEL-127516
  - Fix bogus 'sscg' arguments
    Related: RHEL-118292


author: Toke Høiland-Jørgensen <toke@redhat.com> 1.5.7-1
changelog:
  - Upstream version bump
  - Add annocheck exceptions for BPF objects (Felix)
  - Re-enable debug builds (Felix)
  - Add libcap-ng-devel to BuildDepends


author: Richard Hughes <richard@hughsie.com> 0.3.0-1
changelog:
  - New upstream release
  - Add a new object to contain query context data
  - Allow collapsing empty XML tags if no children or text
  - Allow marking elements as tokenized from xb-tool
  - Allow optimized searching when comparing tokens
  - Cancel the GFileMonitor before unreffing it
  - Do not allocate a 128Mb buffer for each xb_builder_source_ctx_get_bytes()
  - Do not error when creating a query if the element doesn’t exist
  - Fix a parse failure for a double comment
  - Fix various errors or missing annotations in docs
  - Make handling of single-result queries more robust
  - Support mmap()ing the source file to get bytes
  - Support query caching with xb_silo_lookup_query()
  - Support UTF-8 for upper-case() and lower-case()
  - Use g_str_match_string() for non-ASCII search queries
  - Write search tokens into the built silo


author: Richard Hughes <richard@hughsie.com> 0.3.3-1
changelog:
  - New upstream release
  - Add locking for file monitors
  - Add support for LZMA decompression
  - Clarify GMainContext usage and signal emission
  - Respect XB_BUILDER_NODE_FLAG_IGNORE when exporting
  - Use the chosen chunk size when reading from a stream
  - Use the correct pkgconfig export package name in the GIR file
  - Always run xb-tool queries with the optimizer
  - Ensure tokens handling works when XbOpcode is not zero-inited
  - Use stack-allocated XbStack instances for running a machine
  - Resolves: rhbz#1965891


author: Neal Gompa <ngompa@centosproject.org> - 0.3.10-1
changelog:
  - New upstream release
  - Fix dumping and exporting multiple files from the CLI
  - Watch files before loading them into the builder
  - Fix potential double free when filtering by language
  - Fix the crash for when the root tree has no children
  - Fix the crash when getting the element for the [empty] root
  - Install xb-tool into bindir
  - Ensure reproducible results when importing a node
  - Ignore all hidden files when using _WATCH_DIRECTORY
  - Show the value bindings when using XB_SILO_PROFILE_FLAG_XPATH
  - Ensure _IS_TOKENIZED is set if tokens are added manually
  - Ensure we never add too many tokens to the silo
  - Put tail after the node when exporting XbBuilderNode
  - Remove the G_ALIGNOF checks to fix compile with old GLib versions
  - Add a flag to require the XbBuilderSource to have no siblings
  - Add iterator for XbNode attributes and children
  - Allow removing XbBuilderNode text
  - Allow stripping builder node inner text
  - Resolves: rhbz#2134794


author: RHEL Packaging Agent <jotnar@redhat.com> - 0.3.24-1
changelog:
  - Rebase to 0.3.24
  - Add missing libzstd-devel BuildRequires
  - Add missing files to the %files tests section
  - Resolves: RHEL-116442


author: John Eckersberg <jeckersb@redhat.com> - 0.2.5-4
changelog:
  - Add BuildRequires for make
    (re: https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot)


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1:3.6.3-22
changelog:
  - Implement new non-conflicting Java bindings
  - Resolves: RHEL-54068, RHEL-54070, RHEL-54071, RHEL-54072


author: Michal Schorm <mschorm@redhat.com> - 0.996-3.4
changelog:
  - Bump version for package rebuild
    We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'CRB' repo
  - Resolves: #2182069


author: Koichiro Iwao <meta@almalinux.org> - 23.3.3-1.alma.1
changelog:
  - Enable vc4 and v3d for Raspberry Pi graphics in AlmaLinux
    Resolves: https://github.com/AlmaLinux/raspberry-pi/issues/32


author: José Expósito <jexposit@redhat.com> - 24.1.2-3
changelog:
  - Match mesa-libEGL version
    Cherry-picked from: https://src.fedoraproject.org/rpms/mesa/pull-request/24
    Resolves: https://issues.redhat.com/browse/RHEL-50229


author: Koichiro Iwao <meta@almalinux.org> - 24.1.2-3.alma.1
changelog:
  - Enable vc4 and v3d for Raspberry Pi graphics in AlmaLinux (Resolves:
    https://github.com/AlmaLinux/raspberry-pi/issues/32)


author: Koichiro Iwao <meta@almalinux.org> - 24.1.2-3.alma.2
changelog:
  - Add support for Raspberry Pi 2712D0 stepping
    Resolves: https://bugs.almalinux.org/view.php?id=497


author: José Expósito <jexposit@redhat.com> - 24.2.8-2
changelog:
  - AMD Navi4x support
    Backport fixes for radeonsi and disable GFX12 on radv
    Resolves: https://issues.redhat.com/browse/RHEL-53419


author: Anusha Srivatsa <asrivats@redhat.com> - 24.2.8-3
changelog:
  - NV dGFX fix for firefox crashing
    Backport fixes for NV dGFX driver crashing firefox
    Resolves: https://issues.redhat.com/browse/RHEL-107885


author: Anusha Srivatsa <asrivats@redhat.com> - 25.0.7-2
changelog:
  - NV dGFX fix for firefox crashing
    Backport fixes for NV dGFX driver crashing firefox
    Resolves: https://issues.redhat.com/browse/RHEL-93219


author: Konstantin Kostiuk <kkostiuk@redhat.com> - 2.78.0-1
changelog:
  - Bump glib2 version 2.78.0
  - Drop DesktopQE gating 
  - Fix CVEs: CVE-2023-32636, CVE-2023-29499, CVE-2023-32611, CVE-2023-32665, DoS
  - Resolves: RHEL-5019
  - Resolves: RHEL-5020
  - Resolves: RHEL-5092
  - Resolves: RHEL-5093
  - Resolves: RHEL-5094


author: Konstantin Kostiuk <kkostiuk@redhat.com> - 0.42.2-3
changelog:
  - Bump pixman version 0.42.2
  - Drop DesktopQE gating 
  - Fix CVEs: CVE-2022-44638
  - Resolves: RHEL-5013


author: Tomas Halman <thalman@redhat.com> - 0.17.0-9
changelog:
  - Fixing mellon_create_metadata.sh script
    Resolves: RHEL-35898
  - Publishing diagnostic module in CRB repository
    Resolves: RHEL-33585


author: Charalampos Stratakis <cstratak@redhat.com> - 2.5.1-1
changelog:
  - Import into RHEL
  - Fedora contributions by:
        Charalampos Stratakis <cstratak@redhat.com>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Jan Vcelak <jvcelak@fedoraproject.org>
        Jaroslav Škarvada <jskarvad@redhat.com>
        Jeff Law <law@redhat.com>
        Lukas Zachar <lzachar@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Tom Stellard <tstellar@redhat.com>


author: Miro Hrončok <mhroncok@redhat.com> - 2.5.1-3
changelog:
  - Split libmpdec++ into a mpdecimal++ subpackage
  - This prevents packages only using the libmpdec library from transitively depending on libstdc++


author: Gerd Pokorra <gp@zimt.uni-siegen.de> - 0.5.13-6
changelog:
  - updating line in /usr/lib/tmpfiles.d/munge.conf: /var/run/munge → /run/munge
  - add license tag
  - add requires logrotate


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.5.13-8
changelog:
  - Provide a sysusers.d file to get user() and group() provides
    (see https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format).


author: Ray Strode <rstrode@redhat.com> - 40.9-18
changelog:
  - Don't allow applications on other workspaces to steal
    focus, unless their timestamps are pristine
    Resolves: RHEL-29537


author: Jonas Ådahl <jadahl@redhat.com> - 40.9-20
changelog:
  - Fix positioning when using always-on-top windows
    Resolves: RHEL-45998
  - Improve handling of always-on-visible-workspace windows
    Resolves: RHEL-45366


author: Jonas Ådahl <jadahl@redhat.com> - 40.9-22
changelog:
  - Fix crash when moving window while switching workspace
    Resolves: RHEL-62997
  - Improve app discovery for workspace logic
    Resolves: RHEL-63000


author: Tomas Pelka <tpelka@redhat.com> - 40.9-25
changelog:
  - Bumping the release and rebuilding in correct build target
  - Backport fix for screen not refreshing properly
    Resolves: RHEL-101894


author: Olivier Fourdan <ofourdan@redhat.com> - 40.9-31
changelog:
  - Backport linux-dmabuf v4 support to restore hardware acceleration
    in Xwayland 24.1 with Mesa 25.2
    Resolves: RHEL-129832


author: Lars Tangvald <lars.tangvald@oracle.com> - 8.0.30-1
changelog:
  - Update to MySQL 8.0.30
  - Remove patches now upstream:
    chain certs, OpenSSL 3, s390 and robin hood
  - Add a new plugin


author: Lars Tangvald <lars.tangvald@oracle.com> - 8.0.34-1
changelog:
  - Update to MySQL 8.0.34
  - Add patch from upstream bug#110569
  - Add patch to fix binlog format issue
  - Use --skip-combinations over --binlog-format=mixed
  - Add alignment patch upstream bug#110752


author: Richard W.M. Jones <rjones@redhat.com> - 1.28.5-1
changelog:
  - Rebase to new stable branch version 1.28.5
    resolves: rhbz#2011709
  - Move nbdkit-null-plugin to nbdkit-server package
    resolves: rhbz#2021154
  - Add asynchronous support in nbdkit-vddk-plugin
  - Drop obsolete documentation related to thread model in vddk plugin
    resolves: rhbz#2018463
  - Switch to xorriso (instead of genisoimage)
  - Distribute README.VDDK in nbdkit-vddk-plugin subpackage
  - Fix nbdkit-cow-filter cow-block-size=4096
  - file: Fix implementation of cache=none for writes
    resolves: rhbz#2029751
  - vddk: Implement VMDK creation


author: Richard W.M. Jones <rjones@redhat.com> - 1.30.8-1
changelog:
  - Rebase to new stable branch version 1.30.8
    resolves: rhbz#2059289
  - Add automatic provides generator and subpackage nbdkit-srpm-macros
    resolves: rhbz#2059291
  - New filters: blocksize-policy, protect, retry-request
  - Fix license of bash-completion subpackage
  - vddk: Fix use of uninitialized memory when computing block size
    resolves: rhbz#2066655
  - Skip vsock tests unless the vsock_loopback module is loaded
    resolves: rhbz#2069558
  - Add support for ssh create remote file.
  - Suppress excess messages from nbdkit-nbd-plugin
    resolves: rhbz#2083498
  - Suppress incorrect VDDK error when converting guests from vCenter
    resolves: rhbz#2083617
  - Backport new readahead filter from 1.32.
  - Backport new LUKS filter from 1.32.
  - Backport new scan filter from 1.32.
  - Add new Python binding for nbdkit_parse_size from 1.32
  - Add new rate filter burstiness setting from 1.32
  - vddk: Suppress new VDDK "phone home" messages
    resolves: rhbz#2104720
  - vddk: Clearer error message when thumbprint is wrong
    resolves: rhbz#1905772
  - Fix memory allocator=malloc,mlock=true
    resolves: rhbz#2044432
  - Fix multiple Coverity problems
  - Fix bounds error in nbdkit-checkwrite-filter
    resolves: rhbz#2108545


author: Richard W.M. Jones <rjones@redhat.com> - 1.32.5-4
changelog:
  - Rebase to new stable branch version 1.32.5
    resolves: rhbz#2135765
  - Move stats filter to new subpackage.
  - Improve error message when PasswordAuthentication is set to 'no'
    resolves: rhbz#2158300
  - luks: Avoid crash when image does not contain a LUKS header
    resolves: rhbz#2159581
  - curl: Enable multi-conn for read-only connections
    resolves: rhbz#2166686


author: Richard W.M. Jones <rjones@redhat.com> - 1.34.2-1
changelog:
  - Rebase to 1.34.2
    resolves: rhbz#2168629
  - Backport nbdkit-curl-plugin "multi" interface support
    resolves: rhbz#2228131


author: Richard W.M. Jones <rjones@redhat.com> - 1.36.2-1
changelog:
  - Rebase to 1.36.2
    resolves: RHEL-14475
  - partition: Suggest alternate partition-sectorsize
    resolves: RHEL-19815


author: Richard W.M. Jones <rjones@redhat.com> - 1.38.3-1
changelog:
  - Rebase to 1.38.3 (along stable branch)
  - Send the last error to the NBD client
    resolves: RHEL-50664


author: Richard W.M. Jones <rjones@redhat.com> - 1.38.3-2
changelog:
  - vddk: Avoid reading partial chunk beyond the end of the disk
    resolves: RHEL-82831
  - Fix tests/test-ext2-exportname.sh.


author: Richard W.M. Jones <rjones@redhat.com> - 1.38.5-6
changelog:
  - Add extra system call checking and debugging to nbdkit-file-plugin
    resolves: RHEL-85510
  - Allow nbdkit-file-plugin to zero and trim block devices
    resolves: RHEL-89353


author: Richard W.M. Jones <rjones@redhat.com> - 1.38.5-10
changelog:
  - CVE-2025-47711 denial of service attack by client sending maximum size block
    status
  - CVE-2025-47712 denial of service attack by client sending large unaligned
    size block status
    resolves: RHEL-95814


author: Phil Sutter <psutter@redhat.com> [1.0.4-8.el9]
changelog:
  - monitor: Sanitize startup race condition (Phil Sutter) [2130721]
  - evaluate: set eval ctx for add/update statements with integer constants (Phil Sutter) [2094894]
  - src: allow anon set concatenation with ether and vlan (Phil Sutter) [2094887]
  - evaluate: search stacked header list for matching payload dep (Phil Sutter) [2094887]
  - netlink_delinearize: also postprocess OP_AND in set element context (Phil Sutter) [2094887]
  - tests: add a test case for ether and vlan listing (Phil Sutter) [2094887]
  - debug: dump the l2 protocol stack (Phil Sutter) [2094887]
  - proto: track full stack of seen l2 protocols, not just cumulative offset (Phil Sutter) [2094887]
  - netlink_delinearize: postprocess binary ands in concatenations (Phil Sutter) [2094887]
  - netlink_delinearize: allow postprocessing on concatenated elements (Phil Sutter) [2094887]
  - intervals: check for EXPR_F_REMOVE in case of element mismatch (Phil Sutter) [2115627]
  - intervals: fix crash when trying to remove element in empty set (Phil Sutter) [2115627]
  - scanner: don't pop active flex scanner scope (Phil Sutter) [2113874]
  - parser: add missing synproxy scope closure (Phil Sutter) [2113874]
  - tests/py: Add a test for failing ipsec after counter (Phil Sutter) [2113874]
  - doc: Document limitations of ipsec expression with xfrm_interface (Phil Sutter) [1806431]


author: Phil Sutter <psutter@redhat.com> [1.0.4-9.el9]
changelog:
  - tests: add a test case for map update from packet path with concat (Phil Sutter) [2094894]
  - netlink_linearize: fix timeout with map updates (Phil Sutter) [2094894]
  - netlink_delinearize: fix decoding of concat data element (Phil Sutter) [2094894]


author: Phil Sutter <psutter@redhat.com> [1.0.4-10.el9]
changelog:
  - netlink_delinearize: Sanitize concat data element decoding (Phil Sutter) [2160049]
  - optimize: Clarify chain_optimize() array allocations (Phil Sutter) [2160049]
  - optimize: Do not return garbage from stack (Phil Sutter) [2160049]
  - netlink: Fix for potential NULL-pointer deref (Phil Sutter) [2160049]
  - meta: parse_iso_date() returns boolean (Phil Sutter) [2160049]
  - mnl: dump_nf_hooks() leaks memory in error path (Phil Sutter) [2160049]
  - owner: Fix potential array out of bounds access (Phil Sutter) [2160049]


author: Phil Sutter <psutter@redhat.com> [1.0.4-11.el9]
changelog:
  - rule: check address family in set collapse (Phil Sutter) [RHEL-5908]
  - spec: Rename variables to avoid a clash (Phil Sutter) [INTERNAL]


author: Phil Sutter <psutter@redhat.com> [1.0.9-1.el9]
changelog:
  - spec: Utilize pyproject-rpm-macros for the python sub-package (Phil Sutter) [RHEL-14191]
  - Rebase onto version 1.0.9 (Phil Sutter) [RHEL-14191]


author: Phil Sutter <psutter@redhat.com> [1.0.9-4.el9]
changelog:
  - parser_json: fix handle memleak from error path (Phil Sutter) [RHEL-88181]
  - json: deal appropriately with multidevice in chain (Phil Sutter) [RHEL-88181]


author: Phil Sutter <psutter@redhat.com> [1.0.9-5.el9]
changelog:
  - tests: py: missing json output in never merge across non-expression statements (Phil Sutter) [RHEL-114095]
  - tests: py: add missing json.output data (Phil Sutter) [RHEL-114095]
  - tests: py: remove huge-limit test cases (Phil Sutter) [RHEL-114095]
  - datatype: rt_symbol_table_init() to search for iproute2 configs (Phil Sutter) [RHEL-114095]
  - tests: shell: connect chains to hook point (Phil Sutter) [RHEL-114095]
  - tests: shell: Fix sets/reset_command_0 for current kernels (Phil Sutter) [RHEL-114095]


author: Phil Sutter <psutter@redhat.com> [1.0.9-6.el9]
changelog:
  - Revert doc/ part of "exthdr: add boolean DCCP option matching" (Phil Sutter) [RHEL-126817]
  - Revert doc/ part of "meta: introduce meta broute support" (Phil Sutter) [RHEL-126817]
  - Revert doc/ part of "src: add tcp option reset support" (Phil Sutter) [RHEL-126817]
  - spec: Update expected test suite results (Phil Sutter) [RHEL-126817]


author: Phil Sutter <psutter@redhat.com> [1.0.9-7.el9]
changelog:
  - src: fix reset element support for interval set type (Phil Sutter) [RHEL-153461]
  - src: netlink: fix crash when ops doesn't support udata (Phil Sutter) [RHEL-153461]


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.1-10
changelog:
  - Resolves: #1975747 - CVE-2021-3618 nginx: ALPACA: Application Layer Protocol
    Confusion - Analyzing and Mitigating Cracks in TLS Authentication


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.1-14.1
changelog:
  - Resolves: RHEL-12516 - nginx: HTTP/2: Multiple HTTP/2 enabled web 
    servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.1-16
changelog:
  - Resolves: RHEL-12518 - nginx: HTTP/2: Multiple HTTP/2 enabled web servers are
    vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-17
changelog:
  - bump package epoch to resolve RHEL-33939
  - Resolves: RHEL-33939 - Update path for nginx broken for existing CS
    installations


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-22.1
changelog:
  - Resolves: RHEL-84339 - nginx: Nginx: Specially crafted file may cause
    Denial of Service (CVE-2024-7347)


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-22.2
changelog:
  - Resolves: RHEL-85550 - nginx: Memory disclosure in the
    ngx_http_mp4_module (CVE-2022-41742)
  - Resolves: RHEL-85527 - nginx: Memory corruption in the
    ngx_http_mp4_module (CVE-2022-41741)


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-22.3
changelog:
  - Resolves: RHEL-89991 - SSL-errors 0A000126 / NS_NET_ERROR_PARTIAL_TRANSFER at
    nginx with reverse-proxy


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-23
changelog:
  - Resolves: RHEL-6786 - SSL-errors 0A000126 / NS_NET_ERROR_PARTIAL_TRANSFER
    at nginx with reverse-proxy


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-24
changelog:
  - Resolves: RHEL-84477 - nginx: specially crafted MP4 file may cause
    denial of service (CVE-2024-7347)
  - Resolves: RHEL-85556 - nginx: Memory disclosure in the
    ngx_http_mp4_module (CVE-2022-41742)
  - Resolves: RHEL-91446 - nginx: Memory corruption in the
    ngx_http_mp4_module (CVE-2022-41741)


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-24.1
changelog:
  - Resolves: RHEL-146525 - nginx: NGINX: Data injection via man-in-the-middle
    attack on TLS proxied connections (CVE-2026-1642)


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:1.20.1-24.2
changelog:
  - Resolves: RHEL-159557 - CVE-2026-27654 nginx: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module
  - Resolves: RHEL-159536 - CVE-2026-27784 nginx: NGINX: Denial of Service due to memory corruption via crafted MP4 file
  - Resolves: RHEL-159444 - CVE-2026-27651 nginx: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled
  - Resolves: RHEL-157885 - CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files


author: Jonathan Wright <jonathan@almalinux.org> - 2:1.20.1-24.2.alma.2
changelog:
  - Fix CVE-2026-42945 nginx: NGINX: Buffer overrun in rewrite module via
    arguments in replacement strings


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-25
changelog:
  - Resolves: RHEL-114935 - Image mode: The dir /var/lib and /var/log
    is not created when updating system in image mode


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-28
changelog:
  - Resolves: RHEL-146528 - CVE-2026-1642 nginx: NGINX: Data injection via
    man-in-the-middle attack on TLS proxied connection


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:1.20.1-28.1
changelog:
  - RHEL-159560 CVE-2026-27654 nginx: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module
  - RHEL-159539 CVE-2026-27784 nginx: NGINX: Denial of Service due to memory corruption via crafted MP4 file
  - RHEL-159447 CVE-2026-27651 nginx: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled
  - RHEL-157888 CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-28.3
changelog:
  - Resolves: RHEL-178684 - nginx: code execution and denial of
    service (CVE-2026-9256)
  - Resolves: RHEL-182553 - nginx: HTTP/2: Remote Denial of Service via
    compression bomb and Slowloris-style attack


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-28.4
changelog:
  - Resolves: RHEL-190800 - nginx: "HTTP/2 bomb" nginx fix breaks module ABI
    causing crashes
  - Resolves: RHEL-188418 - nginx: NGINX: Arbitrary code execution or 
    Denial of Service via heap-based buffer overflow with crafted HTTP/2
    headers (CVE-2026-42055)


author: Matej Focko <mfocko@redhat.com> - 1.2.14-1
changelog:
  - New release 1.2.14 (Gris Ge)
  - bond: support changing bond mode (Gris Ge)
  - Reorganize the code structure (Gris Ge)
  - CI: Enable VRF and ethool pause test (Gris Ge)
  - CI: Upgrade the version of github action tasks (Gris Ge)
  - test: Fix ethtool link mode test on Ubuntu (Gris Ge)
  - Github CI: Install extra module of running kernel (Gris Ge)
  - macsec: add base_iface property (Fernando Fernandez Mancera)
  - macsec: add MACsec interface support (Fernando Fernandez Mancera)
  - Bump netlink-packet-route to 0.17.1 (Fernando Fernandez Mancera)


author: Gris Ge <fge@redhat.com> - 2.2.27-1
changelog:
  - N/A

   - Support TCP congestion window(cwnd) in route. (59f99632)
   - Support query interface driver. (67817c23)
   - New API to generate changed state. (fe5327a2)

   - Include driver information for `persist-nic-names` subcommand. (1129e46b)
   - nm: Protect global DNS config in checkpoint. (881373ba)
   - route rule: Append rule instead of overriding when iface defined. (88d3d3ef)
  - Resolves RHEL-19409


author: Gris Ge <fge@redhat.com> - 2.2.33-1
changelog:
  - Upgrade to 2.2.33
  - Fix validation of controller overbook. RHEL-40683
  - Support DNS and route in kernel mode. RHEL-37665


author: Gris Ge <fge@redhat.com> - 2.2.35-1
changelog:
  - Upgrade to 2.2.35
  - Fix gen_diff on VLAN ID change. RHEL-38623
  - Fix Nmpolicy on mac-address identifier. RHEL-54292
  - Fix reapply. RHEL-50556


author: Gris Ge <fge@redhat.com> - 2.2.38-1
changelog:
  - Upgrade to 2.2.38
  - Fix gc mode on blackhole route. RHEL-58666
  - Only search desired interface for storing route rule. RHEL-60261


author: Wen Liang <wenliang@redhat.com> - 2.2.39-1
changelog:
  - Upgrade to 2.2.39
  - Fix VLAN interface being removed unnecessarily due to route mismatches triggering deactivations. RHEL-65031


author: Íñigo Huguet <ihuguet@redhat.com> - 2.2.40-1
changelog:
  - Upgrade to 2.2.40
  - Provide an option to disable only nmstate log in python API (RHEL-76316)
  - Remove down up workaround for route removal in Nmstate (RHEL-75151)


author: Gris Ge <fge@redhat.com> - 2.2.41-1
changelog:
  - Upgrade to 2.2.41.
  - Support nm connection with empty connection.interface-name (RHEL-82661)
  - Fix ovsdb purging issue (RHEL-79176)


author: Gris Ge <fge@redhat.com> - 2.2.36-1
changelog:
  - Upgrade to 2.2.36
  - Support route source. RHEL-56258
  - Fix setting empty MPTCP flags. RHEL-38607
  - Fix gc mode on blackhole route. RHEL-56727
  - Support ipsec require-id-on-certificate. RHEL-50696
  - Reselect iface DNS if desired. RHEL-56557


author: Gris Ge <fge@redhat.com> - 2.2.38-1
changelog:
  - Upgrade to 2.2.38
  - Preserve current IP setting for multiconnect profile. RHEL-61890
  - Fix profile name changing. RHEL-59239
  - IPvlan support. RHEL-43438
  - Handle ipv6.method: ignore. RHEL-58406


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 2.2.40-1
changelog:
  - Upgrade to 2.2.40
  - Do not deactivate connection when removing routes. RHEL-70138
  - Use specific libnmstate logger. RHEL-72016
  - Do not deactivate connection if mptcp flags didn't change. RHEL-53211


author: Gris Ge <fge@redhat.com> - 2.2.41-1
changelog:
  - Upgrade to 2.2.41
  - Fix the lose of OVS DB system-id. RHEL-78652
  - Support overriding interface config. RHEL-59935


author: Wen Liang <wenliang@redhat.com> - 2.2.43-1
changelog:
  - Upgrade to 2.2.43
  - Support ethtool Forward Error Correction (FEC). RHEL-80786
  - Support nm connection with empty connection.interface-name. RHEL-82662


author: Mingyu Shi <mshi@redhat.com> - 2.2.43-1
changelog:
  - Upgrade to 2.2.43
  - Support for vlan-egress-priority-map configuration. RHEL-67631
  - Support FEC. RHEL-80725
  - Support quickack. RHEL-80418


author: Gris Ge <fge@redhat.com> - 2.2.44-1
changelog:
  - Upgrade to 2.2.44
  - Refer route next hop interface by MAC. RHEL-32495
  - Support reapply on mac-ref interface. RHEL-87794


author: Gris Ge <fge@redhat.com> - 2.2.46-1
changelog:
  - Upgrade to 2.2.46
  - Store DNS to both iface and global DNS. RHEL-96176
  - Support nmpolicy against down iface. RHEL-88992
  - Support removal VLAN connection with empty ifname. RHEL-93145


author: Gris Ge <fge@redhat.com> - 2.2.48-1
changelog:
  - Upgrade to 2.2.48
  - Fix SRIOV VF reference. RHEL-93179
  - Apply dispatch changes first. RHEL-101741


author: Gris Ge <fge@redhat.com> - 2.2.52-1
changelog:
  - Upgrade to 2.2.52
  - Support interface alternative names. RHEL-110777
  - Support IPv4 forwarding. RHEL-110786
  - Support IPSec `leftsendcert` option. RHEL-110633


author: Gris Ge <fge@redhat.com> - 2.2.54-1
changelog:
  - Upgrade to 2.2.54.
  - Support matching interface via PCI address. RHEL-121109
  - Fix OVSDB query failure on database bigger than 20KiB. RHEL-121990


author: Gris Ge <fge@redhat.com> - 2.2.46-1
changelog:
  - Upgrade to 2.2.46
  - Store DNS to both iface and global DNS. RHEL-91291
  - Support nmpolicy against down iface. RHEL-88989
  - Support removal VLAN connection with empty ifname. RHEL-93146


author: Gris Ge <fge@redhat.com> - 2.2.48-1
changelog:
  - Upgrade to 2.2.48
  - Validate OVN bridge mapping. RHEL-85787
  - Support bond `lacp_active` and `ns_ip6_target`. RHEL-85784
  - Support matching by PCI adress. RHEL-88993
  - Apply dispatch changes first. RHEL-101742
  - Fix SRIOV VF reference. RHEL-93180


author: Rahul Rajesh <rrajesh@redhat.com> - 2.2.49-1
changelog:
  - Upgrade to 2.2.49
  - Ignore desired MAC for bonds with fail_over_mac. RHEL-107526
  - Fix setting DNS only with search or option. RHEL-104797


author: Gris Ge <fge@redhat.com> - 2.2.52-1
changelog:
  - Upgrade to 2.2.52
  - Support IPSec `leftsendcert` option. RHEL-110634
  - Support interface alternative names. RHEL-110778


author: Gris Ge <fge@redhat.com> - 2.2.54-1
changelog:
  - Upgrade to 2.2.54.
  - Support matching interface via PCI address. RHEL-121110
  - Fix OVSDB query failure on database bigger than 20KiB. RHEL-121991


author: Gris Ge <fge@redhat.com> - 2.2.57-1
changelog:
  - Upgrade to 2.2.57
  - Use global DNS even for static IP with static DNS. (RHEL-126730)
  - Add libreswan leftprotoport and rightprotoport support. (RHEL-130911


author: Mingyu Shi <mshi@redhat.com> - 2.2.50-1
changelog:
  - Upgrade to 2.2.50
  - Support MAC referring for VLAN in gen_conf. RHEL-110369
  - Introduce state: ignore for route. RHEL-107130
  - Support PCI address matching in gen_conf. RHEL-110369
  - Support MacSec interface in gen_conf. RHEL-110369


author: Gris Ge <fge@redhat.com> - 2.2.54-1
changelog:
  - Upgrade to 2.2.54.
  - Automatically set HSR port MAC address. RHEL-122171
  - Fix OVSDB query failure on database bigger than 20KiB. RHEL-121992


author: Gris Ge <fge@redhat.com> - 2.2.56-1
changelog:
  - Upgrade to 2.2.56
  - Allow using VRF name to specify route table. RHEL-123541
  - Support OVS-DPDK dpdk-lsc-interrupt in nmstate. RHEL-125052
  - Applying desired state with static DNS with static IP will touch `br-ex` even not mentioned. RHEL-126731
  - Support rightca ipsec option. RHEL-123542


author: Mingyu Shi <mshi@redhat.com> - 2.2.58-1
changelog:
  - Upgrade to 2.2.58
  - vrf: Handle ignore interface when verifying desired state. RHEL-141606
  - alt-name: Remove alt-names when interface marked as absent. RHEL-141602
  - hsr: Automatically disable IP on hsr port. RHEL-141609
  - hsr: add support for configuring "interlink" property. RHEL-141608
  - Support referring interface name using its alternative name. RHEL-141601


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 6.9.6-0.3.rc3
changelog:
  - Apply upstream patch for upstream bug 221
    - Revert change for false CVE-2020-26159 issue
      https://github.com/kkos/oniguruma/issues/221


author: François Cami <fcami@fedoraproject.org> - 1.19.1-9
changelog:
  - Fix FTBFS (rhbz#1865148)
  - Set __cmake_in_source_build
  - BR qt5-qtbase-devel to keep the GUI frontend


author: Than Ngo <than@redhat.com> - 3.18.0-4
changelog:
  - Related: #2044179, do not touch opencryptoki.conf if it is in place already and even if it is unchanged


author: Than Ngo <than@redhat.com> - 3.19.0-1
changelog:
  - Resolves: #2126294, opencryptoki fails after generating > 500 RSA keys
  - Resolves: #2110314, rebase to 3.19.0
  - Resolves: #2110989, openCryptoki key generation with expected MKVP only on CCA and EP11 tokens
  - Resolves: #2110476, openCryptoki ep11 token: master key consistency
  - Resolves: #2018458, openCryptoki ep11 token: vendor specific key derivation


author: Than Ngo <than@redhat.com> - 3.21.0-3
changelog:
  - Resolves: #2110497, concurrent MK rotation for cca token
  - Resolves: #2110498, concurrent MK rotation for ep11 token
  - Resolves: #2110499, ep11 token: PKCS #11 3.0 - support AES_XTS
  - Resolves: #2111010, cca token: protected key support 
  - Resolves: #2160061, rebase to 3.21.0
  - Resolves: #2160105, pkcsslotd hardening
  - Resolves: #2160107, p11sak support Dilithium and Kyber keys
  - Resolves: #2160109, ica and soft tokens: PKCS #11 3.0 - support AES_XTS


author: Than Ngo <than@redhat.com> - 3.21.0-8
changelog:
  - Resolves: #2222592, p11sak tool: slot option does not accept argument 0 for slot index 0
  - Resolves: #2222596, p11sak fails as soon as there reside non-key objects


author: Than Ngo <than@redhat.com> - 3.22.0-2
changelog:
  - timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)
  Resolves: RHEL-22792


author: Than Ngo <than@redhat.com> - 3.23.0-1
changelog:
  - Resolves: RHEL-23671, ep11 token: support protected keys for extractable keys
  - Resolves: RHEL-23672, ep11 token support for FIPS 2021-session bound EP11 keys
  - Resolves: RHEL-23673, update to 3.23.0


author: Than Ngo <than@redhat.com> - 3.24.0-1
changelog:
  - Resolves: RHEL-50064, update to 3.24.0
  - Resolves: RHEL-50063, opencryptoki CCA Token support for x86_64 and ppc64le
  - Resolves: RHEL-50058, openCryptoki CCA token support of Dilithium
  - Resolves: RHEL-50056, openCryptoki cca token SHA3 support
  - Resolves: RHEL-50057, openCryptoki cca token RSA OAEP v2.1 support


author: Than Ngo <than@redhat.com> - 3.25.0-1
changelog:
  - Resolves: RHEL-73344, upgrade openCryptoki
  - Resolves: RHEL-90590, basic support of AES-GCM
  - Resolves: RHEL-72965, cca token support cipher keys
  - Resolves: RHEL-72969, support for CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens
  - Resolves: RHEL-75141, add a tool to import/export PKCS #11 keys from to a KMIP server
  - Resolves: RHEL-75762, ep11 token: import and export of secure key objects
  - Resolves: RHEL-85375, cca token: Support ECDH to derive AES keys
  - Resolves: RHEL-85377, ep11 token: PKCS #11 3.0 - support SHA3


author: Than Ngo <than@redhat.com> - 3.25.0-2
changelog:
  - Related: RHEL-73344, Fix detection of EC curve not supported by OpenSSL-3.5.x
  - Related: RHEL-77147, Fix the image mode issue again as bootc expects to use /run/lock


author: Than Ngo <than@redhat.com> - 3.25.0-3
changelog:
  - Fix incorrect effective group id of pkcsslotd daemon
  - Fix covscan findings
    Resolves: RHEL-104602


author: Than Ngo <than@redhat.com> - 3.25.0-4
changelog:
  - Fix pkcsslotd fails to start in FIPS
  - Drop tier1 test as it mostly provides duplicate results
  - Enable ci test for FIPS mode
    Resolves: RHEL-109050


author: Than Ngo <than@redhat.com> - 3.25.0-4.1
changelog:
  - Fix unwrapping of attribute bound EC keys
  - Fix private secure key blob import
    Resolves: RHEL-131644


author: Than Ngo <than@redhat.com> - 3.26.0-1
changelog:
  - Resolves: RHEL-75139, ep11 token BLS support
  - Resolves: RHEL-85381, ep11 token: ML-KEM and ML-DSA support
  - Resolves: RHEL-85384. cca token: ML-KEM and ML-DSA support
  - Resolves: RHEL-100059, openCryptoki 3.26.0


author: Ondřej Sloup <osloup@redhat.com> - 1.3.2-71
changelog:
  - Add %verify to ignore modified socket file after install
  - Remove unused OpenSP-1.5 from sources
    Related: rhbz#2193429


author: Ondrej Sloup <osloup@redhat.com> - 1.3.2-72
changelog:
  - Add an environment variable to prevent gating from complaining about rpaths  (rhbz#2193429)
    Related: RHEL-11772


author: Jan Černý <jcerny@redhat.com> - 1:1.3.6-4
changelog:
  - Fix potential invalid scan results in OpenSCAP (rhbz#2109485)
  - Remove oscap-remediate service (rhbz#2111358)


author: Jan Černý <jcerny@redhat.com> - 1:1.3.7-1
changelog:
  - Upgrade to the latest upstream release (rhbz#2159286)
  - Fix error when processing OVAL filters (rhbz#2126883)
  - Don't emit xmlfilecontent items if XPath doesn't match (rhbz#2138884)


author: Evgenii Kolesnikov <ekolesni@redhat.com> - 1.3.8-1
changelog:
  - Upgrade to the latest upstream release (rhbz#2217442)
  - Fix systemd* probes unit enumeration (rhbz#2219532)


author: Jan Černý <jcerny@redhat.com> - 1:1.3.10-1
changelog:
  - Rebase to the latest upstream version (RHEL-29172)
  - Fix OVAL results file name (RHEL-7050)
  - Add ability to define a limit of collected items (RHEL-4141)
  - Add ability to refine rules in autotailor (RHEL-1477)
  - Improve the formatting of Blueprint remediations (RHEL-1476)


author: Jan Černý <jcerny@redhat.com> - 1:1.3.11-1
changelog:
  - Upgrade to the latest upstream release (RHEL-76355)
  - Introduce "oscap-im", a tool for building hardened bootable container images
  - Fix RPM probes in bootable container images build environment (RHEL-55251)


author: Matthew Burket <mburket@redhat.com> - 1:1.3.13-1
changelog:
  - Upgrade to the latest upstream release (RHEL-133976)
  - Fix Filepath and Pattern Fields inversion (RHEL-104073)
  - Fix verbose flag (RHEL-53859)


author: Joseph Marrero <jmarrero@fedoraproject.org> - 2023.5-1
changelog:
  - https://github.com/ostreedev/ostree/releases/tag/v2023.5
    backport: https://github.com/ostreedev/ostree/commit/7f70614a1ac1950ebde3df0e26cc9ab1d72b2f1f
    Resolves: rhbz#2221997


author: Colin Walters <walters@verbum.org> - 2024.4-3
changelog:
  - Backport
    https://github.com/ostreedev/ostree/pull/3205/commits/e47b37096343efa3bea8295f3f44c4dc90cc04e2


author: Joseph Marrero <jmarrero@fedoraproject.org> - 2025.2-2
changelog:
  - Backport https://github.com/ostreedev/ostree/pull/3472
    Backport https://github.com/ostreedev/ostree/pull/3473
    Resolves: #RHEL-108923


author: Joseph Marrero <jmarrero@fedoraproject.org> - 2025.7-1
changelog:
  - Rebase to 2025.7
    Backport https://github.com/ostreedev/ostree/pull/3555
    Resolves: #RHEL-129049


author: Benjamin A. Beasley <code@musicinmybrain.net> - 2.42.2-3
changelog:
  - Use pkgconfig to BR the required cairomm API/ABI version 1.0 (vs. 1.16); use
    cairomm1.0, which may be a virtual Provides, in the manual lib Requires


author: RHEL Packaging Agent <jotnar@redhat.com> - 7.2.0-1
changelog:
  - Rebase to papi 7.2.0
  - Update license tag to BSD-3-Clause
  - Remove old patches and add new patches for 7.2.0 compatibility
  - Update configure options and package files
  - Resolves: RHEL-121673


author: Brian C. Lane <bcl@redhat.com> - 3.4-4
changelog:
  - Fix issues that covscan classifies as important
    Resolves: rhbz#1938836
  - Work around a mkswap bug


author: Brian C. Lane <bcl@redhat.com> - 3.5-1
changelog:
  - Rebase to upstream release 3.5
  - Drop patches included in new upstream tar
  - Add upstream patches for new type command
  - Add upstream patch for swap flag on DASD
    Resolves: rhbz#1999333


author: Brian C. Lane <bcl@redhat.com> - 3.5-3
changelog:
  - tests: Add test for dvh with a bad checksum (bcl)
    Related: RHEL-73217
  - libparted: Fix dvh disklabel unhandled exception (bcl)
    Related: RHEL-73217
  - tests: Add test for SUN disklabel handling (bcl)
    Related: RHEL-73217
  - libparted: Fix sun disklabel unhandled exception (bcl)
    Resolves: RHEL-73217


author: Petr Pisar <ppisar@redhat.com> - 8.43-3
changelog:
  - Make erroroffset initializion in a POSIX wrapper thread-safe
    (upstream bug #2447)
  - Fix an integer overflow when parsing numbers after "(?C" (upstream bug #2463)
  - Fix shifting integer bits and a NULL pointer dereferce in pcretest tool
    (upstream bug #2380)


author: Jakub Jelen <jjelen@redhat.com> - 1.9.4-1
changelog:
  - Rebase to current version from Fedora (#2017828)
  - Use of upstrea polkit policy preventing unneeded prompts


author: Paul Howarth <paul@city-fan.org> - 7.17-1
changelog:
  - Update to 7.17
    - Work around antique openssl version in RHEL-7 by formatting dh parameters
      differently
    - Add t/13_weaken.t


author: Petr Pisar <ppisar@redhat.com> - 7.17-6
changelog:
  - Conditionalize POE support
  - Conditionalize Tk support
  - Conditionalize Glib support
  - Conditionalize Event support


author: Paul Howarth <paul@city-fan.org> - 2.13-1
changelog:
  - Update to 2.13
    - Bypass prototypes when testing for lvalue attribute
    - Fixed a class name in tests to avoid conflicting with a core module


author: Paul Howarth <paul@city-fan.org> - 1.6-1
changelog:
  - Update to 1.6
    - Fixed confusing Changes entry about Perl's licensing terms (CPAN RT#132843)
    - Added optional Changes testing (skipped unless AUTHOR_TESTING)
    - Reformatted Changes file as per CPAN::Changes::Spec
    - Added optional POD coverage testing (skipped unless AUTHOR_TESTING)
    - Added optional Perl::Critic testing (skipped unless AUTHOR_TESTING)
    - Made code Perl::Critic clean
    - Added optional POD testing (skipped unless AUTHOR_TESTING)
    - Included GitHub repository URLs in metadata now that source code has been
      uploaded to GitHub (as of version 1.5)
    - Included META.json file in addition to META.yml
    - Set minimum required ExtUtils::MakeMaker version to 6.64 to ensure that all
      parameters used are supported, to save jumping through hoops to support
      earlier versions (this should not be a problem since ExtUtils::MakeMaker
      6.64 is easily installed into Perl 5.8.1 and above, that being the whole
      point of the new choice of minimum supported Perl version)
    - Set minimum required Perl version to 5.8.1; this is in line with the
      minimum requirement of the "Perl Toolchain"
    - Corrected typo in a comment (CPAN RT#86336)
  - Use author-independent source URL
  - Specify all build dependencies
  - Drop redundant buildroot cleaning in %install section
  - Simplify find command using -delete
  - Fix permissions verbosely
  - Package Artistic, Copying and LICENCE licence files


author: Emmanuel Seyman <emmanuel@seyman.fr> - 0.318-1
changelog:
  - Update to 0.318
  - Add perl(File::Slurper) as a dependency
  - Use /usr/bin/perl instead of perl
  - Use %{make_install} instead of make pure_install
  - Use %{make_build} instead of make


author: Paul Howarth <paul@city-fan.org> - 2:1.52-1
changelog:
  - Update to 1.52
    - Added a $dt->is_between($dt1, $dt2) method (based on GH#97)
    - Simplify the calculation of leap seconds in XS (GH#91); this is a little
      more efficient for most use cases (anything with future or recent past
      datetimes)


author: Paul Howarth <paul@city-fan.org> - 0.8200-4
changelog:
  - Fix License: tag to reflect content of actual shipped files, not just what
    the LICENSE file says (#1600504, CPAN RT#125832)


author: Paul Howarth <paul@city-fan.org> - 1:1.77-1
changelog:
  - Update to 1.77
    - When the parsed string contained an invalid time zone offset (parsed with
      "%z") like "-9999", the error handling set in the parser's constructor was
      ignored and an exception was always thrown (GH#25)
  - Use %{make_build} and %{make_install}


author: Paul Howarth <paul@city-fan.org> - 1:1.78-1
changelog:
  - Update to 1.78
    - Fix tests for new failure caused by locale data changes in DateTime::Locale
      1.29 (GH#28)
    - Added a warning about using locale-specific patterns; some of these patterns
      can change quite a bit as the locale data is updated, so using them for
      parsing does not produce stable results across time - this is what caused
      the test failures that this release fixes


author: Michal Josef Spacek <mspacek@redhat.com> - 1:1.79-1
changelog:
  - Update to 1.79
    - Fix too-strict type checking for time zones: this module now uses the same
      check as DateTime itself, which allows for things that don't subclass
      DateTime::TimeZone as long as they provide the same API (GH#30) (rhbz#1964546)


author: Paul Howarth <paul@city-fan.org> - 0.11-18
changelog:
  - Spec tidy-up
    - Use author-independent source URL
    - Drop support for building with Test::More < 0.88
    - Specify all build dependencies
    - Drop redundant buildroot cleaning in %install section
    - Simplify find command using -delete
    - Fix permissions verbosely
    - Use %license where possible


author: Paul Howarth <paul@city-fan.org> - 0.3.4-1
changelog:
  - Update to 0.3.4
    - Now at https://github.com/shlomif/perl-file-find-object
    - tidyall
    - Add *~ files to MANIFEST.SKIP (GH#1)


author: Paul Howarth <paul@city-fan.org> - 0.3.5-1
changelog:
  - Update to 0.3.5
    - Rebuild for order of 'NAME' and 'VERSION' sections in the generated POD
      documentation (VERSION used to appear before NAME)
  - Use %{make_build} and %{make_install}


author: Paul Howarth <paul@city-fan.org> - 1.14-1
changelog:
  - Update to 1.14
    - Remove MAP_TARGET from Makefile.PL (CPAN RT#91590)
    - Fix for Solaris setuid when root running as other user (CPAN RT#88271)
    - Add strict/warnings to Tty.pm
    - Fix pod errors
    - Typo: s/dependend/dependent/
    - Prevent spurious warning from get_winsize()
    - Fix usage of setsid
    - Github actions testing; Windows is off of course
    - Make README.md
  - Use author-independent source URL
  - Fix permissions verbosely


author: Paul Howarth <paul@city-fan.org> - 1.14-5
changelog:
  - Fix FTBFS due to false detection of strlcpy() and _getpty()
    https://github.com/toddr/IO-Tty/pull/24
  - Modernize spec using %{make_build} and %{make_install}


author: Paul Howarth <paul@city-fan.org> - 1.15-1
changelog:
  - Update to 1.15
    - Skip winsize test on Solaris and QNX NTO (GH#22)
    - Make function tests more robust (GH#24)
    - Work around a header name collision on util.h; this is breaking on recent
      OSX (GH#26)


author: Paul Howarth <paul@city-fan.org> - 1.16-1
changelog:
  - Update to 1.16
    - Switch to GitHub for issue tracker
    - Switch to testsuite CI workflow
    - Tidy


author: Paul Howarth <paul@city-fan.org> - 2.112-1
changelog:
  - Update to 2.112
    - Added the change log from any prior source that could be found, and
      formatted the log to fit metacpan.org loose standards
    - Change use vars qw() to our $whatever instead
    - Hide IO::WrapTie subclasses from PAUSE
    - Rebuild Makefile.PL to contain all of the prerequisites
    - Convert README to README.md
    - Fix the documentation in the main module, IO::Stringy to better indicate
      where to get info and how to use the module
    - Fix the dist's META information to indicate the original author and license
    - Add a LICENSE file
    - Add AppVeyor CI testing
    - Add Travis CI testing
    - Update t/IO_InnerFile.t to use Test::More and a proper TEMP file
      (CPAN RT#103895)
  - Use author-independent source URL
  - Simplify find command using -delete
  - Add Provides: for perl-IO-Stringy
  - Fix permissions verbosely


author: Paul Howarth <paul@city-fan.org> - 2.113-1
changelog:
  - Update to 2.113
    - Get rid of use of Common and TBone in all tests
    - Convert to Dist::Zilla for authoring
    - Cleaned up some of the docs (needs more)


author: Paul Howarth <paul@city-fan.org> - 20200505.0-1
changelog:
  - Update to 20200505.0
    - Fix syntax errors in POD examples (GH#125)
    - Switch Readonly testing requirement to a recommends (GH#127)
    - Fix full_result to always return $? (GH#129)
    - kill_kill: Immediately KILL the child process as documented for Win32 (GH#136)
    - Switch to GitHub actions for CI testing
    - Re-structure shipped files into eg/
    - Move author tests into xt/ and test them separately


author: Paul Howarth <paul@city-fan.org> - 2.18-1
changelog:
  - Update to 2.18
    - Update with newest data
    - Mojo 6.0 changed types() into mapping()
    - Mojo 7.94 adds experimental file_type()
    - Mojo 7.94 adds experimental content_type()


author: Paul Howarth <paul@city-fan.org> - 0.39-1
changelog:
  - Update to 0.39
    - Updated distribution metadata and packaging
    - Configuration phase now uses ExtUtils::HasCompiler


author: Paul Howarth <paul@city-fan.org> - 0.112-1
changelog:
  - Update to 0.112
    - Another test fix on Windows, possibly due to a behavior change in
      Cwd::getdcwd


author: Paul Howarth <paul@city-fan.org> - 0.118-1
changelog:
  - Update to 0.118
    - Skip symlink tests on Windows by actually testing symlinks, as Perl 5.33.5
      adds notional support but it's not possible without elevated privileges


author: Paul Howarth <paul@city-fan.org> - 0.008-1
changelog:
  - Update to 0.008
    - Make unread by :crlf on top of :utf8_strict reliable
  - Use author-independent source URL


author: Paul Howarth <paul@city-fan.org> - 0.47-1
changelog:
  - Update to 0.47
    - Change Specio constraint object's stringification overloading to return the
      type name rather than the default Perl object stringification, which gives
      you something like
      "Specio::Constraint::Parameterized=HASH(0x564d258efb48)"; anonymous are
      special cased to return something you can print
    - All types now overload the 'eq' comparison operator: Moose expects types to
      be comparable in this manner when doing role summation (GH#18)


author: Paul Howarth <paul@city-fan.org> - 0.26-1
changelog:
  - Update to 0.26
    - %DB::sub is now populated correctly for sub names with wide characters or
      nulls (GH#9)
    - Better Perl 5.6 compatibility by lowering prereqs of core modules
    - Test for renaming lexical subs, which should work on Perl 5.22+ (GH#10)
    - Small internal changes to bring implementation in line with changes to
      Sub::Util
    - Fix "Undefined symbol "DPPP_my_croak_xs_usage"" error on some perls
      (CPAN RT#125158)
  - Use author-independent source URL
  - Fix permissions verbosely


author: Paul Howarth <paul@city-fan.org> - 1.130-1
changelog:
  - Update to 1.128
    - Allow 'use Test::Deep' while other modules use Test::Deep::NoTest (GH#76)
    - Added true/false optional imports (GH#41, GH#44)
    - Documentation fixes (GH#79)
  - Use author-independent source URL


author: Paul Howarth <paul@city-fan.org> - 0.016-1
changelog:
  - Update to 0.016
    - Add default descriptions to tests
    - Work on ancient Test::Builder code
  - Use author-independent source URL
  - Simplify find command using -delete
  - Fix permissions verbosely


author: Paul Howarth <paul@city-fan.org> - 0.11-1
changelog:
  - Update to 0.11
    - Re-packaging
  - Drop running of extra tests at package build time to avoid need for
    bootstrapping
  - Use %{make_build} and %{make_install}


author: Paul Howarth <paul@city-fan.org> - 0.027-1
changelog:
  - Update to 0.027
    - New :fail_on_warning feature, for more easily seeing where the surprising
      warning appeared during testing
  - Use author-independent source URL
  - Simplify find command using -delete


author: Paul Howarth <paul@city-fan.org> - 0.029-1
changelog:
  - Update to 0.029
    - New :report_warnings feature, for printing all of the (unexpected) warning
      content when had_no_warnings() is called (GH#10)


author: Paul Howarth <paul@city-fan.org> - 0.030-1
changelog:
  - Update to 0.030
    - Fix tests that can fail when there is already an installed module named
      Foo::Bar::Baz (CPAN RT#132140)


author: Paul Howarth <paul@city-fan.org> - 1.01-1
changelog:
  - Update to 1.01
    - Implement Types::Serialiser::as_bool
    - Slight documentation tweaks
  - Drop redundant buildroot cleaning in %install section
  - Simplify find command using -delete
  - Fix permissions verbosely


author: Paul Howarth <paul@city-fan.org> - 0.002-2
changelog:
  - Incorporate feedback from package review (#1776513)
    - BR: findutils
    - BR: perl(CPAN::Meta::Prereqs)
    - Need perl(ExtUtils::MakeMaker) >= 6.76
    - Add reference to upstream ticket about unnecessary build requirements
      https://github.com/atoomic/XString/issues/2
    - Add run-time dependency on perl(XSLoader)


author: Paul Howarth <paul@city-fan.org> - 0.005-1
changelog:
  - Update to 0.005
    - Fix cstring for Perl 5.32 (GH#6, GH#7)
    - Remove unneeded module dependencies (GH#2)
    - Add compatibility with Perl 5.8 (GH#9)


author: Jitka Plesnikova <jplesnik@redhat.com> - 1:0.81-1
changelog:
  - Update to 0.81
    - Breaking Change: Set $YAML::XS::LoadBlessed default to false to make it
      more secure


author: Paul Howarth <paul@city-fan.org> - 1:0.82-1
changelog:
  - Update to 0.82
    - Updated libyaml sources to 0.2.4; changes affecting YAML::XS are:
      - Output '...' at the stream end after a block scalar with trailing empty
        lines
      - Accept '%YAML 1.2' directives (they are ignored and do not change
        behaviour though)


author: Paul Howarth <paul@city-fan.org> - 3.7.5-1
changelog:
  - Update to 3.75
    - Make build (more) reproducible
    - Removed "portable" from the warnings list, as 32-bit perls (as opposed to
      32-bit platforms) are practically extinct and it warns about a weird subset
      of operations, e.g. 64-bit hex() is not ok, 64-bit addition is fine, makes
      no sense; additionally, other than hex/oct etc. harassment, there is
      nothing in this category that otherwise could be useful
  - Specify all build dependencies
  - Drop ancient obsoletes/provides for removed tests sub-package
  - Drop redundant buildroot cleaning in %install section
  - Simplify find command using -delete
  - Fix permissions verbosely


author: Paul Howarth <paul@city-fan.org> - 0.29-1
changelog:
  - Update to 0.29
    - Switch from Test::Requires to Test::Needs
    - Report on the installed versions of more optional modules


author: Mat Booth <mat.booth@redhat.com> - 0.0.7-29
changelog:
  - Unecessary restriction on plexus-util, with the patch it's actually still
    source compatible with older versions


author: Masahiro Matsuya <mmatsuya@redhat.com> - 13.13-1
changelog:
  - Update to 13.13
  - Fixes CVE-2023-5868, CVE-2023-5869, CVE-2023-5870, and CVE-2023-39417
  - Resolves: RHEL-16098


author: Petr Khartskhaev <pkhartsk@redhat.com> - 13.23-3
changelog:
  - Backport fix for CVE-2026-6478 from PostgreSQL 14.23
  - Backport fixes for CVE-2026-6637, CVE-2026-6477, CVE-2026-6475, CVE-2026-6473
  - Resolves: RHEL-179799
  - Resolves: RHEL-181866
  - Resolves: RHEL-181950
  - Resolves: RHEL-181964


author: Jan Rybar <jrybar@redhat.com> - 3.3.17-6
changelog:
  - free: backport new 'used' calculation
  - sysctl: backport support of systemd glob patterns
  - Resolves: rhbz#2003033
  - Resolves: rhbz#2052536


author: Jan Rybar <jrybar@redhat.com> - 3.3.17-7
changelog:
  - sysctl: backport - keys with dots instead of slashes again
  - Resolves: rhbz#2116977
  - Related: rhbz#2052536


author: Adrian Reber <adrian@lisas.de> - 3.14.0-6
changelog:
  - Reintroduce the emacs subpackage to avoid file conflicts between
    protobuf-compiler.x86_64 and protobuf-compiler.i686
  - Disable LTO to fix annobin errors


author: Adrian Reber <areber@redhat.com> - 3.14.0-14
changelog:
  - Applied patch for CVE-2022-1941 (#RHEL-40872)
  - Applied patch to make emacs dependency optional (#RHEL-40572)


author: Petr Viktorin <pviktori@redhat.com> - 1.1-1
changelog:
  - Update to 1.1 to fix Python 3.8 compatibility in tests
    https://bugzilla.redhat.com/show_bug.cgi?id=1758446


author: Miro Hrončok <mhroncok@redhat.com> - 2.6.2-6
changelog:
  - Introduce epoch to pybind11-devel to sort newer than python3.11-pybind11-devel
  - Resolves: RHEL-38108


author: Tomas Orsava <torsava@redhat.com> - 2.6.2-4
changelog:
  - Add automatically generated Obsoletes tag with the python39- prefix
    for smoother upgrade from RHEL8
  - Manually add Provides and Obsoletes for python39-pybind11-devel
  - Related: rhbz#1990421


author: Lumír Balhar <lbalhar@redhat.com> - 1.6.3-1
changelog:
  - Remove .dist-info directory at the end of %pyproject_buildrequires
  - An incomplete .dist-info directory in $PWD can confuse tests in %check


author: Miro Hrončok <mhroncok@redhat.com> - 1.7.0-1
changelog:
  - %pyproject_buildrequires: Redirect stdout to stderr via Shell
  - Dependencies are recorded to a text file that is catted at the end


author: Miro Hrončok <mhroncok@redhat.com> - 1.8.0-1
changelog:
  - %pyproject_buildrequires: Add support for self-referential extras requirements
  - Deprecate the provisional %{pyproject_build_lib} macro
    See https://lists.fedoraproject.org/archives/list/python-devel@lists.fedoraproject.org/thread/HMLOPAU3RZLXD4BOJHTIPKI3I4U6U7OE/


author: Miro Hrončok <mhroncok@redhat.com> - 1.8.1-1
changelog:
  - On Python older than 3.11, use tomli instead of deprecated toml
  - Fix literal % handling in %{pyproject_files} on RPM 4.19


author: Python Maint <python-maint@redhat.com> - 1.10.0-1
changelog:
  - Add %_pyproject_check_import_allow_no_modules for automated environments
  - Fix handling of tox 4 provision without an explicit tox minversion
  - Fixes: rhbz#2240590


author: Miro Hrončok <mhroncok@redhat.com> - 1.11.0-1
changelog:
  - Add the -l/-L flag to %pyproject_save_files
  - The -l flag can be used to assert at least 1 License-File was detected
  - The -L flag explicitly disables this check (which remains the default)
  - Prevent incorrect usage of %pyproject_buildrequires -R with -x/-e/-t
  - Fixes: rhbz#2244282
  - Show a better error message when %pyproject_install finds no wheel
  - Fixes: rhbz#2242452
  - Fix %pyproject_buildrequires -w when the build backend is already installed and pip isn't
  - Fixes: rhbz#2169855


author: Miro Hrončok <miro@hroncok.cz> - 1.12.0-1
changelog:
  - Namespace pyproject-rpm-macros generated text files with %{python3_pkgversion}
  - That way, a single-spec can be used to build packages for multiple Python versions
  - Fixes: rhbz#2209055


author: Miro Hrončok <mhroncok@redhat.com> - 1.12.1-1
changelog:
  - Add a temporary workaround for RPM 4.20 alpha 2 leaking \x1f (unit separators)
  - Related: rhbz#2284187


author: Miro Hrončok <mhroncok@redhat.com> - 1.13.0-1
changelog:
  - Properly escape weird characters from paths in %{pyproject_files} (RPM 4.19+ only)
  - Revert the temporary workaround for RPM 4.20 alpha 2 leaking \x1f (unit separators)
  - Fixes: rhbz#1990879


author: Python Maint <python-maint@redhat.com> - 1.15.0-1
changelog:
  - Add a possibility to read runtime requirements from pyproject.toml [project] table
  - Fixes: rhbz#2261939
  - Don't generate a dependency on pip when %pyproject_buildrequires -N is used
  - Fixes: rhbz#2294510
  - Even when %_auto_set_build_flags is disabled, set all compiler flags when building wheels
  - Fixes: rhbz#2293616


author: Miro Hrončok <mhroncok@redhat.com> - 1.16.0-1
changelog:
  - %pyproject_buildrequires: Add support for dependency groups (PEP 735), via the -g flag
  - This is implied when used tox testenvs depend on dependency groups (requires tox 4.22+)
  - Fixes: rhbz#2318849


author: Miro Hrončok <miro@hroncok.cz> - 1.16.1-1
changelog:
  - Support for setuptools 70+
  - wheel is no longer generated as a dependency of the default build system


author: Miro Hrončok <miro@hroncok.cz> - 1.17.0-1
changelog:
  - Add the -M flag to %pyproject_save_files
  - The flag can be used to indicate no Python modules should be saved


author: Miro Hrončok <mhroncok@redhat.com> - 1.18.0-1
changelog:
  - Make %pyproject_buildrequires -t/-e and %tox fail when no suitable tox configuration exists
  - The %pyproject_buildrequires -t/-e case is temporarily allowed on Fedora 40-42
  - Requires tox-current-env >= 0.0.16


author: Miro Hrončok <mhroncok@redhat.com> - 1.18.3-1
changelog:
  - %pyproject_buildrequires: Do not generate BuildRequires from Requires core metadata fields
  - That field is deprecated and should include importable module names, not distribution packages
  - Related: rhbz#2378463


author: Miro Hrončok <mhroncok@redhat.com> - 1.18.4-1
changelog:
  - Don't exit from pyproject-srpm-macros implementation of %pyproject_buildrequires
  - Fixes: rhbz#2391290
  - On RPM 4.20+ don't put pyproject-macros-specific files in %buildsubdir
  - Works around https://github.com/rpm-software-management/rpm/issues/3890
  - Speed %pyproject_save_files up significantly


author: Miro Hrončok <mhroncok@redhat.com> - 1.18.5-1
changelog:
  - %pyproject_extras_subpkg: Only %ghost the dist-info directory, not the content
  - That way, accidentally unpackaged files within are reported as errors
  - %pyproject_save_files: Also save top level typing stub files (.pyi)


author: Jerry James <loganjerry@gmail.com> - 0.5.0-1
changelog:
  - Version 0.5.0
  - Drop upstreamed -script patch
  - Do not even link to fonts; modify the CSS to point to system fonts
  - Remove all traces of html5shiv


author: Charalampos Stratakis <cstratak@redhat.com> - 3.9.14-1
changelog:
  - Update to 3.9.14
  - Security fixes for CVE-2020-10735 and CVE-2021-28861
  Resolves: rhbz#2120642, rhbz#1834423, rhbz#2128249


author: Charalampos Stratakis <cstratak@redhat.com> - 3.9.16-1
changelog:
  - Update to 3.9.16
  - Security fixes for CVE-2022-42919 and CVE-2022-45061
  Resolves: rhbz#2138705, rhbz#2144072


author: Charalampos Stratakis <cstratak@redhat.com> - 3.9.18-3.1
changelog:
  - Security fixes for CVE-2023-6597 and CVE-2024-0450
  - Fix tests for XMLPullParser with Expat with fixed CVE
  Resolves: RHEL-33887, RHEL-34287


author: Charalampos Stratakis <cstratak@redhat.com> - 3.9.19-1
changelog:
  - Update to 3.9.19
  - Security fixes for CVE-2023-6597 and CVE-2024-0450
  - Fix tests for XMLPullParser with Expat with fixed CVE
  Resolves: RHEL-33679, RHEL-33691


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.21-1
changelog:
  - Update to 3.9.21
  - Security fix for CVE-2024-11168 and CVE-2024-9287
  Resolves: RHEL-64888
  Resolves: RHEL-67259


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.21-1
changelog:
  - Update to 3.9.21
  - Security fix for CVE-2024-11168 and CVE-2024-9287
  Resolves: RHEL-64889
  Resolves: RHEL-69942


author: Charalampos Stratakis <cstratak@redhat.com> - 3.9.21-2.1
changelog:
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98053, RHEL-98025, RHEL-98243, RHEL-98195, RHEL-98219


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.23-1
changelog:
  - Update to 3.9.23
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98051, RHEL-98024, RHEL-98242, RHEL-98193, RHEL-98218


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.25-3.1
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143108 RHEL-143169 RHEL-144893


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.25-4
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143117
  Resolves: RHEL-143174
  Resolves: RHEL-144897


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.25-5
changelog:
  - Rebuilding previous fixes for different build target
  Related: RHEL-143117, RHEL-143174, RHEL-144897


author: Miro Hrončok <mhroncok@redhat.com> - 3.9.25-7.1
changelog:
  - Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+
  Resolves: RHEL-194207


author: Tomas Popela <tpopela@redhat.com> - 1.20.1-1
changelog:
  - Update to 1.20.1
  - Resolves: rhbz#2016905
  - Ship python3-cairo-devel in CRB
  - Resolves: rhbz#2053665


author: Miro Hrončok <mhroncok@redhat.com> - 3.9.0-5
changelog:
  - Initial package for RHEL 9
  - Resolves: RHEL-12338
  - Fedora+EPEL contributions by:
        Charalampos Stratakis <cstratak@redhat.com>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Karolina Surma <ksurma@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Maxwell G <gotmax@e.email>
        Michel Alexandre Salim <salimma@fedoraproject.org>
        Miro Hrončok <miro@hroncok.cz>
        Mukundan Ragavan <nonamedotc@fedoraproject.org>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Yaakov Selkowitz <yselkowi@redhat.com>


author: Tomas Popela <tpopela@redhat.com> - 3.40.1-6
changelog:
  - Fix the multilib problems by backporting fixes done by mhroncok from Fedora:
  - Move pure Python modules to a noarch subpackage
  - Ensure Python bytecode installed in multilib packages is bit-to-bit identical
    Resolves: rhbz#1915764


author: Florence Blanc-Renaud <flo@redhat.com> - 4.11.0-2
changelog:
  - Resolves: RHEL-14292 Backport latest test fixes in python3-ipatests
  - Resolves: RHEL-15443 Server install: failure to install with externally signed CA because of timezone issue
  - Resolves: RHEL-15444 Minimum length parameter in pwpolicy cannot be removed with empty string
  - Resolves: RHEL-14842 Upstream xmlrpc tests are failing in RHEL9.4


author: Florence Blanc-Renaud <flo@redhat.com> - 4.11.0-5
changelog:
  - Resolves: RHEL-12589 ipa: Invalid CSRF protection
  - Resolves: RHEL-19748 ipa hbac-test did not report that it hit an arbitrary search limit
  - Resolves: RHEL-21059 'DogtagCertsConfigCheck' fails, displaying the error message 'Malformed directive: ca.signing.certnickname=caSigningCert cert-pki-ca'
  - Resolves: RHEL-21804 ipa client 4.10.2 - Failed to obtain host TGT
  - Resolves: RHEL-21809 CA less servers are failing to be added in topology segment for domain suffix
  - Resolves: RHEL-21810 ipa-client-install --automount-location does not work
  - Resolves: RHEL-21811 Handle change in behavior of pki-server ca-config-show in pki 11.5.0
  - Resolves: RHEL-21812 Backport latest test fixes in ipa
  - Resolves: RHEL-21813 krb5kdc fails to start when pkinit and otp auth type is enabled in ipa
  - Resolves: RHEL-21815 IPA 389ds plugins need to have better logging and tracing
  - Resolves: RHEL-21937 Make sure a default NetBIOS name is set if not passed in by ADTrust instance constructor


author: 2024 Florence Blanc-Renaud <flo@redhat.com> - 4.11.0-6
changelog:
  - Resolves: RHEL-23627 IPA stops working if HTTP/... service principal was created before FreeIPA 4.4.0 and never modified
  - Resolves: RHEL-23625 sidgen plugin does not ignore staged users
  - Resolves: RHEL-23621 session cookie can't be read
  - Resolves: RHEL-22372 Gating-DL1 test failure in test_integration/test_dns_locations.py::TestDNSLocations::()::test_ipa_ca_records
  - Resolves: RHEL-21809 CA less servers are failing to be added in topology segment for domain suffix
  - Resolves: RHEL-17996 Memory leak in IdM's KDC


author: Florence Blanc-Renaud <flo@redhat.com> - 4.11.0-7
changelog:
  - Resolves: RHEL-25260 tier-1-upstream-dns-locations failed on RHEL8.8 gating
  - Resolves: RHEL-25738 ipa-kdb: Cannot determine if PAC generator is available
  - Resolves: RHEL-25815 Backport latest test fixes in python3-ipatests


author: Florence Blanc-Renaud <flo@redhat.com> - 4.11.0-8
changelog:
  - Resolves: RHEL-12143 'ipa vault-add is failing with ipa: ERROR: an internal error has occurred in FIPS mode
  - Resolves: RHEL-25738 ipa-kdb: Cannot determine if PAC generator is available


author: Florence Blanc-Renaud <flo@redhat.com> - 4.11.0-9
changelog:
  - Resolves: RHEL-28258 vault fails on non-fips client if server is in FIPS mode
  - Resolves: RHEL-26154 ipa: freeipa: specially crafted HTTP requests potentially lead to DoS or data exposure


author: Florence Blanc-Renaud <flo@redhat.com> - 4.11.0-10
changelog:
  - Resolves: RHEL-23377 Enforce OTP for ldap bind (in some scenarios)
  - Resolves: RHEL-29745 Unable to re-add broken AD trust - NT_STATUS_INVALID_PARAMETER
  - Resolves: RHEL-30905 Backport latest test fixes in ipa


author: Florence Blanc-Renaud <flo@redhat.com> - 4.10.2-4
changelog:
  - Resolves: rhbz#2231847 RHEL 8.8 & 9.2 fails to create AD trust with STIG applied
  - Resolves: rhbz#2232056 Include latest test fixes in python3-ipatests


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.0-1
changelog:
  - Resolves: RHEL-39140 Rebase ipa to the latest 4.12 version for RHEL 9.5
  - Resolves: RHEL-34757 The change for preventing deletion of the admin user caused a regression in disable
  - Resolves: RHEL-30553 Depend on nfsv4-client-utils or nfs-utils
  - Resolves: RHEL-29762 IPA sidgen fails to create SID for manually set ID for a new range [rhel-9.5.0]
  - Resolves: RHEL-26261 Fix replica connection check for use with AD administrator
  - Resolves: RHEL-18062 ipa ca-show NAME --certificate-out=file creates empty file when NAME does not exist
  - Resolves: RHEL-12149 traceback in ipaserver/dcerpc.py
  - Resolves: RHEL-4810 [RFE] FreeIPA-to-FreeIPA migration
  - Resolves: RHEL-4807 [RFE] Support in IPA for HSM boxes


author: Julien Rische <jrische@redhat.com> - 4.12.0-4
changelog:
  - Resolves: RHEL-29928 CVE-2024-3183 freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force
  - Resolves: RHEL-29691 CVE-2024-2698 freeipa: delegation rules allow a proxy service to impersonate any user to access another target service


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.0-5
changelog:
  - Resolves: RHEL-37285 IPA Web UI not showing replication agreement for non-admin users
  - Resolves: RHEL-42703 PSKC.xml issues with ipa_otptoken_import.py
  - Resolves: RHEL-41194 ipa-client rpm post script creates always ssh_config.orig even if nothing needs to be changed
  - Resolves: RHEL-39477 kdc.crt certificate not getting automatically renewed by certmonger in IPA Hidden replica
  - Resolves: RHEL-46559 Include latest fixes in python3-ipatests packages
  - Resolves: RHEL-22188 [RFE] Allow IPA SIDgen task to continue if it finds an entity that SID can't be assigned to


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.0-6
changelog:
  - Resolves: RHEL-47292 Include latest fixes in python3-ipatests packages
  - Resolves: RHEL-47146 Syntax error uninstalling the selinux-luna subpackage
  - Resolves: RHEL-46009 ipa-migrate with -Z option fails with ValueError: option error
  - Resolves: RHEL-46003 ipa-migrate -V options fails to display version
  - Resolves: RHEL-45463 ipa-migrate stage-mode is failing with error: Modifying a mapped attribute in a managed entry is not allowed
  - Resolves: RHEL-40890 ipa-server-install: token_password_file read in kra.install_check after calling hsm_validator in ca.install_check
  - Resolves: RHEL-40661 Adjust "ipa config-mod --addattr ipaconfigstring=EnforceLDAPOTP" to allow for non OTP users in some cases


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.0-7
changelog:
  - Resolves: RHEL-53500 adtrustinstance only prints issues in check_inst() and does not log them
  - Resolves: RHEL-52306 Unconditionally add MS-PAC to global config
  - Resolves: RHEL-52300 RFE - Keep the configured value for the "nsslapd-ignore-time-skew" after a "force-sync"
  - Resolves: RHEL-52222 ipa-replica/server-install with softhsm needs to check permission/ownership of /var/lib/softhsm/tokens to avoid install failure
  - Resolves: RHEL-51944 Include latest fixes in python3-ipatests packages
  - Resolves: RHEL-50804 ipa-migrate -Z with invalid cert options fails with 'ValueError: option error'
  - Resolves: RHEL-49602 misleading warning for missing ipa-selinux-nfast package on luna hsm h/w
  - Resolves: RHEL-27856 'Unable to log in as uid=admin-replica.testrealm.test,ou=people,o=ipaca' during replica install


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-1
changelog:
  - Resolves: RHEL-54546 Covscan issues: Resource Leak
  - Resolves: RHEL-49602 misleading warning for missing ipa-selinux-nfast package on luna hsm h/w
  - Resolves: RHEL-40359 With unreachable AD, ipa trust returns an internal error


author: Eduard Abdullin <eabdullin@almalinux.org> - 4.12.2-1.2.alma.1
changelog:
  - Add ipa-idrange-fix
  - ipatests: Add missing comma in
   test_idrange_no_rid_bases_reversed
  - ipatests: Fixes for ipa-idrange-fix testsuite
  - Do not let user with an expired OTP token to log in if only
   OTP is allowed


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-1.3
changelog:
  - Resolves: RHEL-69928 add support for python cryptography 44.0.0
  - Resolves: RHEL-70258 Upgrade to ipa-server-4.12.2-1.el9 OTP-based bind to LDAP without enforceldapotp is broken
  - Resolves: RHEL-70482 ipa-server-upgrade fails after established trust with ad
  - Resolves: RHEL-67192 CVE-2024-11029 ipa: Administrative user data leaked through systemd journal


author: Thomas Woerner <twoerner@redhat.com> - 4.12.2-11
changelog:
  - Resolves: RHEL-67913 Add DNS over TLS Support, Require bind9.18 32:9.18.29-2 and new bind-dyndb-ldap 11.11-1


author: Thomas Woerner <twoerner@redhat.com> - 4.12.2-14
changelog:
  - Resolves: RHEL-80345 Use new bind9.18-dyndb-ldap and bind9.18 only for DNS over TLS with the ipa-server-encrypted-dns package


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-14.1
changelog:
  - Resolves: RHEL-89908
    EMBARGOED CVE-2025-4404 ipa: Privilege escalation from host to domain admin in FreeIPA
  - Resolves: RHEL-89144
    kdb: ipadb_get_connection() succeeds but returns null LDAP context


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-14.4
changelog:
  - Resolves: RHEL-110068
    EMBARGOED CVE-2025-7493 ipa: Privilege escalation from host to domain admin in FreeIPA


author: EL Errata <el-errata_ww@oracle.com> - 4.12.2-14.0.1.5
changelog:
  - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674]
  - Add bind to ipa-server-common Requires [Orabug: 36518596]


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-6
changelog:
  - Resolves: RHEL-68448 ipa trust-add fails in FIPS mode with an internal error has occurred
  - Resolves: RHEL-69301 Support GSSAPI in Cockpit on IPA servers


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-7
changelog:
  - Resolves: RHEL-70760 Fix typo in ipa-migrate log file i.e 'Privledges' to 'Privileges'
  - Resolves: RHEL-70481 ipa-server-upgrade fails after established trust with ad
  - Resolves: RHEL-69927 add support for python cryptography 44.0.0
  - Resolves: RHEL-69908 All user groups are not being included during HSM token validation
  - Resolves: RHEL-69900 Upgrade to ipa-server-4.12.2-1.el9 OTP-based bind to LDAP without enforceldapotp is broken


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-8
changelog:
  - Resolves: RHEL-73022 A slow HSM can cause IPA server installation to fail setting up certificate tracking [rhel-9]
  - Resolves: RHEL-71261 [RHEL-9.6] Include latest fixes in python3-ipatests package
  - Resolves: RHEL-67191 CVE-2024-11029 ipa: Administrative user data leaked through systemd journal [rhel-9.6]
  - Resolves: RHEL-59040 KRA installation failure caused by a certificate mismatch in NSS DB and configuration file.


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-9
changelog:
  - Resolves: RHEL-74465 kinit with external idp user is failing
  - Resolves: RHEL-75656 Include latest fixes in python3-ipatests package


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-10
changelog:
  - Resolves: RHEL-73022 A slow HSM can cause IPA server installation to fail setting up certificate tracking


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-5
changelog:
  - Resolves: RHEL-67414 ipa dns-zone --allow-query '!198.18.2.0/24;any;' fails with Unrecognized IPAddress flags
  - Resolves: RHEL-67410 ipa-migrate should also migrate DNS forward zones
  - Resolves: RHEL-67409 ipa-migrate in stage mode fails with TypeError: 'NoneType' object is not iterable
  - Resolves: RHEL-66964 Include latest fixes in python3-ipatests packages
  - Resolves: RHEL-64135 IDP configuration in the IdM WebUI shows Organization is required


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-15
changelog:
  - Resolves: RHEL-84481 Protect all IPA service principals
  - Resolves: RHEL-84277 [RFE] IDM support UIDs up to 4,294,967,293
  - Resolves: RHEL-84276 Ipa client --raw --structured throws internal error
  - Resolves: RHEL-82707 Search size limit tooltip has Search time limit tooltip text
  - Resolves: RHEL-82089 IPU 9 -> 10: ipa-server breaks the in-place upgrade due to failed scriptlet
  - Resolves: RHEL-68800 ipa-migrate with LDIF file from backup of remote server, fails with error 'change collided with another change'
  - Resolves: RHEL-30658 ipa-cacert-manage install fails with CAs having the same subject DN (subject key mismatch info)


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-16
changelog:
  - Resolves: RHEL-88900 [RFE] Add check on CA cert expiry for ipa-cert-fix
  - Resolves: RHEL-88037 Server installation: dot-forwarder not added as a forwarder
  - Resolves: RHEL-86483 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-41178 ipa-sidgen: fix memory leak in ipa_sidgen_add_post_op()


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-17
changelog:
  - Resolves: RHEL-95010 [RFE] Give warning when adding user with UID out of any ID range
  - Resolves: RHEL-93890 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-93887 ipa idrange-add --help should be more clear about required options
  - Resolves: RHEL-93483 Unable to modify IPA config; --ipaconfigstring="" causes internal error
  - Resolves: RHEL-88834 kdb: ipadb_get_connection() succeeds but returns null LDAP context
  - Resolves: RHEL-68800 ipa-migrate with LDIF file from backup of remote server, fails with error 'change collided with another change'


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-19
changelog:
  - Resolves: RHEL-100450 eDNS: multiple issues during encrypted DNS setup
  - Resolves: RHEL-89907 Privilege escalation from host to domain admin in FreeIPA
  - Resolves: RHEL-99315 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-98565 ipa-idrange-fix: 'Env' object has no attribute 'basedn'
  - Resolves: RHEL-96920 Nightly test failure (rawhide) in test_trust.py::TestTrust::test_server_option_with_unreachable_ad
  - Resolves: RHEL-31907 kdb: support storing and retrieving multiple master keys


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-20
changelog:
  - Resolves: RHEL-106285 Incorrect use of external IdP GitHub trademark
  - Resolves: RHEL-106026 Include fixes in python3-ipatests package
  - Resolves: RHEL-105512 kdb: prevent double crash in RBCD ACL free
  - Resolves: RHEL-101707 ipatests: use "sos report" instead of "sosreport" command
  - Resolves: RHEL-101544 ipa-client-encrypted-dns does not ensure bind-utils >= 9.18 for DoT-compatible nsupdate
  - Resolves: RHEL-100450 eDNS: multiple issues during encrypted DNS setup


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-22
changelog:
  - Resolves: RHEL-107483 ipa-ca-install fails on CA-less replica due to inadequate key usage in master certificate


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-22.2
changelog:
  - Resolves: RHEL-141322 Memory leaks in IPA plugins
  - Resolves: RHEL-141314 AddressSanitizer: SEGV ipa-pwd-extop/common.c:584 in ipapwd_gen_checks
  - Resolves: RHEL-129963 Fix ipatests for kdcproxy after CVE-2025-59088 fix
  - Resolves: RHEL-124424 test_cacert_manage fails due to expired Let's Encrypt R3 certificate


author: David Hanina <dhanina@redhat.com> - 4.12.2-22.4
changelog:
  - Resolves: RHEL-155038 Pagure #9953: Adding a group with 32Bit Idrange fails.
  - Resolves: RHEL-153628 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-153621 Pagure #9854: Erroneous case-sensitivity in offline DSE lookup


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-24
changelog:
  - Resolves: RHEL-118448 CVE-2025-7493 ipa: Privilege escalation from host to domain admin in FreeIPA


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-25
changelog:
  - Resolves: RHEL-128238 [RFE] Support storing LWCA private keys on an HSM [rhel-9]
  - Resolves: RHEL-126515 RFE: Enable external password reset agents to use ipa_pwd_extop in RHEL IdM [rhel-9]
  - Resolves: RHEL-73399 RFE: Update IdM password policy configurations to meet M-22-09 by restricting spaces and require number character class
  - Resolves: RHEL-128241 ATTR_NAME_BY_OID is missing OID 2.5.4.97, organizationIdentifier [rhel-9]
  - Resolves: RHEL-126514 [RFE] ipa-client-automount should have an option to include domain of the machine. [rhel-9]
  - Resolves: RHEL-124171 Include latest fixes in python3-ipatests package 
  - Resolves: RHEL-120514 Include fixes in python3-ipatests [rhel-9.8]
  - Resolves: RHEL-118609 test_cacert_manage fails due to expired Let's Encrypt R3 certificate


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.0-1
changelog:
  - Resolves: RHEL-134542 Add modern WebUI as submodule and enable routing in Apache 
  - Resolves: RHEL-134540 Switch IPA to use the PKI python API directly rather than RPC calls
  - Resolves: RHEL-134196 After upgrade from 9.7 to 9.8 ipactl restart fails to restart winbind service 
  - Resolves: RHEL-132334 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-129224 Fix ipatests for kdcproxy after CVE-2025-59088 fix
  - Resolves: RHEL-126974 Minor typo in ipa_idrange_fix.py
  - Resolves: RHEL-120954 Rebase ipa to latest 4.13.x version for RHEL 9.8


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-1
changelog:
  - Resolves: RHEL-141446 [RFE] Command that retrieve and install new CA certificates
  - Resolves: RHEL-140584 Support replaceable WebUI artwork for RHEL and CentOS
  - Resolves: RHEL-141297 Memory leaks in IPA plugins
  - Resolves: RHEL-141054 IPA fails to sign zone
  - Resolves: RHEL-138570 AddressSanitizer: SEGV ipa-pwd-extop/common.c:584 in ipapwd_gen_checks
  - Resolves: RHEL-138473 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-137585 ipa-server-upgrade succeeds but ipactl restart fails due to ipa-dnskeysyncd service failure caused by SELinux AVC denial on RHEL 9.8


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-2
changelog:
  - RHEL-147191 ipa uninstallation is failing with message "'NoneType' object has no attribute 'lower'"
  - RHEL-146185 Names of domains from a trusted forest should be compared case-insentive
  - RHEL-146184 ipa-advise client script requires keytab (should just require root access on client system)
  - RHEL-145854 Include latest fixes in python3-ipatests package
  - RHEL-143684 When using xmlrpc, ipa server failed with assert type(value) in (unicode, float, int, bool, type(None))
  - RHEL-141500 ipa use systemd-sysusers


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-3
changelog:
  - RHEL-148282 ipa-replica-conncheck fails with "an internal error has occured"
  - RHEL-148481 Pruning is enabled by default with RSN on RHEL 9.8


author: David Hanina <dhanina@redhat.com> - 4.13.1-3.1
changelog:
  - Resolves: RHEL-166865 Include latest fixes in python3-ipatests package [rhel-9.8.z]
  - Resolves: RHEL-155037 Pagure #9953: Adding a group with 32Bit Idrange fails. [rhel-9.8.z]
  - Resolves: RHEL-153146 IdM password policy Min lifetime is not enforced when high minlife is set [rhel-9.8.z]
  - Resolves: RHEL-168047 ipa ca-show ipa --all failing to list RSN version


author: Tomas Orsava <torsava@redhat.com> - 5.8.0-5
changelog:
  - Remove unnecessary test dependency on python3-mock
  - Remove unnecessary macro __provides_exclude_from


author: Dan Čermák <dan.cermak@cgc-instruments.com> - 0.7.1-5
changelog:
  - BuildRequire python3-setuptools besides python3-devel
    (see https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/GCPGM34ZGEOVUHSBGZTRYR5XKHTIJ3T7/)


author: Francisco Triviño <ftrivino@redhat.com> - 0.12.1-5
changelog:
  - Rebuilt needed for moving buildroot package to CRB
  - Resolves: RHEL-70463 python3-setuptools-rust is not signed
  - Resolves: RHEL-67341 move python3-setuptools-rust to CRB [rhel-9]


author: Francisco Triviño <ftrivino@redhat.com> - 0.12.1-6
changelog:
  - Rebuilt needed to trigger signing of the package
  - Resolves: RHEL-70463 python3-setuptools-rust is not signed


author: Miro Hrončok <mhroncok@redhat.com> - 1.2.4-3
changelog:
  - Update runtime and buildtime dependencies
  - Remove sqlalchemy, whoosh and xapian dependencies from RHEL9


author: Tomas Orsava <torsava@redhat.com> - 1:0.36.2-5
changelog:
  - Make the python-wheel-wheel subpackage versioned (python3-wheel-wheel),
    and move its contents to a versioned directory /usr/share/python3-wheels
  - Resolves: rhbz#1982668


author: Tomas Orsava <torsava@redhat.com> - 1:0.36.2-6
changelog:
  - Conflict with old Python versions that use the old unversioned wheel location
  - Resolves: rhbz#1982668


author: Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-1
changelog:
  - Rebase to 3.11.9
  - Security fixes for CVE-2023-6597 and CVE-2024-0450
  - Fix expat tests for the latest expat security release
  Resolves: RHEL-33677, RHEL-33689


author: Charalampos Stratakis <cstratak@redhat.com> - 3.11.11-2.1
changelog:
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  - Resolves: RHEL-98045, RHEL-98015, RHEL-98238, RHEL-98177, RHEL-98206


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.13-1
changelog:
  - Update to 3.11.13
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98044, RHEL-98014, RHEL-98237, RHEL-98176, RHEL-98205


author: Charalampos Stratakis <cstratak@redhat.com> - 3.11.13-2
changelog:
  - Fix PySSL_SetError handling SSL_ERROR_SYSCALL
  - This fixes random flakiness of test_ssl on stressed machines
  Resolves: RHEL-101551


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.13-6
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143110
  Resolves: RHEL-143170
  Resolves: RHEL-144894


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.13-7
changelog:
  - Rebuilding previous fixes for different build target
  Related: RHEL-143110, RHEL-143170, RHEL-144894


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.13-5.1
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143104 RHEL-143167 RHEL-144890


author: Charalampos Stratakis <cstratak@redhat.com> - 3.11.5-1
changelog:
  - Rebase to 3.11.5
  - Security fixes for CVE-2023-40217 and CVE-2023-41105
  Resolves: RHEL-3045, RHEL-3269


author: Charalampos Stratakis <cstratak@redhat.com> - 3.11.7-1.1
changelog:
  - Security fix for CVE-2023-6597
  - Fix tests for XMLPullParser with Expat with fixed CVE
  Resolves: RHEL-33884


author: Charalampos Stratakis <cstratak@redhat.com> - 0.29.32-1
changelog:
  - Initial package
  - Fedora contributions by:
        Alex Cobb <alex.cobb@smart.mit.edu>
        Bill Nottingham <notting@fedoraproject.org>
        Charalampos Stratakis <cstratak@redhat.com>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Gwyn Ciesla <gwync@protonmail.com>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Jesse Keating <jkeating@fedoraproject.org>
        Kevin Fenzi <kevin@fedoraproject.org>
        Marcel Plch <mplch@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        nbecker <ndbecker2@gmail.com>
        Neal D. Becker <ndbecker2@gmail.com>
        Orion Poplawski <orion@cora.nwra.com>
        Peter Robinson <pbrobinson@fedoraproject.org>
        Petr Viktorin <pviktori@redhat.com>
        Robert Kuska <rkuska@redhat.com>
        Scott Talbert <swt@techie.net>
        serge-sans-paille <sguelton@redhat.com>
        Thomas Spura <thomas.spura@gmail.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Toshio くらとみ <toshio@fedoraproject.org>


author: Charalampos Stratakis <cstratak@redhat.com> - 22.1.0-1
changelog:
  - Initial package
  - Fedora contributions by:
        Lumir Balhar <lbalhar@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Tomas Hrnciar <thrnciar@redhat.com>


author: Charalampos Stratakis <cstratak@redhat.com> - 1.0.0-1
changelog:
  - Initial package
  - Fedora contributions by:
        Alfredo Moralejo <amoralej@redhat.com>
        Karsten Hopp <karsten@redhat.com>
        Matthias Runge <mrunge@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Patrik Kopkan <pkopkan@redhat.com>
        Peter Robinson <pbrobinson@fedoraproject.org>
        Thomas Moschny <thm@fedoraproject.org>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Charalampos Stratakis <cstratak@redhat.com> - 2.9.3-1
changelog:
  - Initial package
  - Fedora contributions by:
        Bill Nottingham <notting@fedoraproject.org>
        Charalampos Stratakis <cstratak@redhat.com>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Devrim GÜNDÜZ <devrim@fedoraproject.org>
        Filip Januš <fjanus@redhat.com>
        Honza Horak <hhorak@redhat.com>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Jason Tibbitts <tibbs@math.uh.edu>
        Jesse Keating <jkeating@fedoraproject.org>
        Jozef Mlich <jmlich@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Ondřej Sloup <ondrej.sloup@protonmail.com>
        Patrik Novotný <panovotn@redhat.com>
        Pavel Raiskup <praiskup@redhat.com>
        Peter Robinson <pbrobinson@fedoraproject.org>
        Petr Kubat <pkubat@redhat.com>
        Slavek Kabrda <bkabrda@redhat.com>
        Todd Zullinger <tmz@fedoraproject.org>
        Tomas Hrnciar <thrnciar@redhat.com>
        Tom Lane <tgl@fedoraproject.org>


author: Charalampos Stratakis <cstratak@redhat.com> - 2.10.3-1
changelog:
  - Initial package
  - Fedora contributions by:
        Elliott Sales de Andrade <quantum.analyst@gmail.com>
        Jonathan <jonathan@knownhost.com>
        jonathanspw <jonathan@almalinux.org>
        Merlin Mathesius <mmathesi@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Susi Lehtola <jussilehtola@fedoraproject.org>
        Tom Stellard <tstellar@redhat.com>


author: Charalampos Stratakis <cstratak@redhat.com> - 3.0.7-1
changelog:
  - Initial package
  - Fedora contributions by:
        Alan Pevec <alan.pevec@redhat.com>
        Bill Nottingham <notting@fedoraproject.org>
        Charalampos Stratakis <cstratak@redhat.com>
        Dan Horák <dan@danny.cz>
        David King <amigadave@amigadave.com>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Iryna Shcherbina <shcherbina.iryna@gmail.com>
        Jesse Keating <jkeating@fedoraproject.org>
        José Abílio Oliveira Matos <jamatos@fedoraproject.org>
        José Matos <jamatos@fedoraproject.org>
        Lumir Balhar <lbalhar@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Petr Viktorin <pviktori@redhat.com>
        Robert Kuska <rkuska@redhat.com>
        Slavek Kabrda <bkabrda@redhat.com>
        Terje Røsten <terje.rosten@ntnu.no>
        Thomas Spura <thomas.spura@gmail.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Ville Skyttä <scop@fedoraproject.org>
        yatin <ykarel@redhat.com>
        Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Charalampos Stratakis <cstratak@redhat.com> - 7.2.0-1
changelog:
  - Initial package
  - Fedora contributions by:
        Charalampos Stratakis <cstratak@redhat.com>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Gwyn Ciesla <limburgher@gmail.com>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Lumir Balhar <lbalhar@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Nils Philippsen <nils@redhat.com>
        Orion Poplawski <orion@cora.nwra.com>
        Peter Robinson <pbrobinson@gmail.com>
        Petr Viktorin <pviktori@redhat.com>
        Richard Shaw <hobbes1069@gmail.com>
        Robert Kuska <rkuska@redhat.com>
        Thomas Moschny <thm@fedoraproject.org>


author: Charalampos Stratakis <cstratak@redhat.com> - 2.8.4-1
changelog:
  - Initial package
  - Fedora contributions by:
        Davide Cavalca <dcavalca@fedoraproject.org>
        Dennis Gilmore <dennis@ausil.us>
        Haikel Guemar <hguemar@fedoraproject.org>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Javier Pena <jpena@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Petr Viktorin <pviktori@redhat.com>


author: Charalampos Stratakis <cstratak@redhat.com> - 1.5.2-1
changelog:
  - Initial import
  - Fedora contributions by:
        Christian Heimes <cheimes@redhat.com>
        Gwyn Ciesla <limb@fedoraproject.org>
        Tomáš Hrnčiar <thrnciar@redhat.com>


author: Charalampos Stratakis <cstratak@redhat.com> - 0.38.4-1
changelog:
  - Initial package
  - Fedora contributions by:
        Charalampos Stratakis <cstratak@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Haikel Guemar <hguemar@fedoraproject.org>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Karolina Surma <ksurma@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Matej Stuchlik <mstuchli@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Robert Kuska <rkuska@redhat.com>
        Slavek Kabrda <bkabrda@redhat.com>
        Tomas Hrnciar <thrnciar@redhat.com>
        Tomas Orsava <torsava@redhat.com>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.1-1
changelog:
  - Initial package
  - Fedora contributions by:
        Björn Esser <besser82@fedoraproject.org>
        Bohuslav Kabrda <bkabrda@redhat.com>
        Charalampos Stratakis <cstratak@redhat.com>
        Dan Horák <dan@danny.cz>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Florian Weimer <fweimer@redhat.com>
        Gwyn Ciesla <limb@fedoraproject.org>
        Igor Gnatenko <ignatenko@redhat.com>
        Iryna Shcherbina <shcherbina.iryna@gmail.com>
        Jaroslav Škarvada <jskarvad@redhat.com>
        Jason ティビツ <tibbs@fedoraproject.org>
        Kalev Lember <klember@redhat.com>
        Karsten Hopp <karsten@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Marcel Plch <marcel.plch@protonmail.com>
        Matej Stuchlik <mstuchli@redhat.com>
        Michal Cyprian <m.cyprian@gmail.com>
        Michal Toman <mtoman@fedoraproject.org>
        Miro Hrončok <miro@hroncok.cz>
        Nicolas Chauvet <kwizart@gmail.com>
        Orion Poplawski <orion@cora.nwra.com>
        Patrik Kopkan <pkopkan@redhat.com>
        Peter Robinson <pbrobinson@gmail.com>
        Petr Šplíchal <psplicha@redhat.com>
        Petr Viktorin <pviktori@redhat.com>
        Rex Dieter <rdieter@fedoraproject.org>
        Richard W.M. Jones <rjones@redhat.com>
        Robert Kuska <rkuska@gmail.com>
        Sahana Prasad <sahana@redhat.com>
        Stephen Gallagher <sgallagh@redhat.com>
        Than Ngo <than@redhat.com>
        Thomas Spura <thomas.spura@gmail.com>
        Till Maas <opensource@till.name>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Tomas Mraz <tmraz@fedoraproject.org>
        Tomas Orsava <torsava@redhat.com>
        Tomas Radej <tradej@redhat.com>
        Toshio Kuratomi <toshio@fedoraproject.org>
        Victor Stinner <vstinner@python.org>
        Ville Skyttä <ville.skytta@iki.fi>
        Yaakov Selkowitz <yselkowi@redhat.com>
        Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Lumír Balhar <lbalhar@redhat.com> - 3.12.1-4.1
changelog:
  - Fix tests for XMLPullParser with Expat with fixed CVE
  - Enable importing of hash-based .pyc files under FIPS mode
  Resolves: RHEL-40773


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.8-1
changelog:
  - Update to 3.12.8
  - Security fix for CVE-2024-9287 and CVE-2024-12254
  Resolves: RHEL-64886, RHEL-70320


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.10-3
changelog:
  - Fix PySSL_SetError handling SSL_ERROR_SYSCALL
  - This fixes random flakiness of test_ssl on stressed machines
  Resolves: RHEL-88897


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.11-1
changelog:
  - Update to 3.12.11
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98057, RHEL-98019, RHEL-97811, RHEL-98183, RHEL-98210


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-4.1
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143106 RHEL-143168 RHEL-144891


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-5
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143112
  Resolves: RHEL-143172
  Resolves: RHEL-144895


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-6
changelog:
  - Rebuilding previous fixes for different build target
  Related: RHEL-143112, RHEL-143172, RHEL-144895


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.13-1
changelog:
  - Update to 3.12.13
  - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672
  Related: RHEL-168159, RHEL-167917


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.13-2
changelog:
  - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224
  Resolves: RHEL-168159, RHEL-167917


author: Lumír Balhar <lbalhar@redhat.com> - 3.12.2-3
changelog:
  - Move all test modules to the python3-test package, namely:
     - __phello__
     - _xxsubinterpreters
     - xxlimited
     - xxlimited_35
     - xxsubtype


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.9-1.1
changelog:
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  - Resolves: RHEL-98058, RHEL-98020, RHEL-97809, RHEL-98184, RHEL-98211


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 0.29.35-2
changelog:
  - Initial package
  - Fedora contributions by:
        Alex Cobb <alex.cobb@smart.mit.edu>
        Bill Nottingham <notting@fedoraproject.org>
        Charalampos Stratakis <cstratak@redhat.com>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Gwyn Ciesla <gwync@protonmail.com>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Igor Gnatenko <i.gnatenko.brain@gmail.com>
        Jesse Keating <jkeating@fedoraproject.org>
        Kevin Fenzi <kevin@fedoraproject.org>
        Marcel Plch <mplch@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Neal D. Becker <ndbecker2@gmail.com>
        Orion Poplawski <orion@cora.nwra.com>
        Peter Robinson <pbrobinson@fedoraproject.org>
        Petr Viktorin <pviktori@redhat.com>
        Robert Kuska <rkuska@redhat.com>
        Scott Talbert <swt@techie.net>
        serge-sans-paille <sguelton@redhat.com>
        Thomas Spura <thomas.spura@gmail.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Toshio くらとみ <toshio@fedoraproject.org>
        Yaakov Selkowitz <yselkowi@redhat.com>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.0-1
changelog:
  - Initial package
  - Fedora contributions by:
        Charalampos Stratakis <cstratak@redhat.com>
        Gwyn Ciesla <limb@fedoraproject.org>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Karolina Surma <ksurma@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Maxwell G <maxwell@gtmx.me>
        Miro Hrončok <miro@hroncok.cz>
        Mukundan Ragavan <nonamedotc@gmail.com>
        Tomas Hrcka <thrcka@redhat.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Yaakov Selkowitz <yselkowi@redhat.com>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 1.1.1-1
changelog:
  - Initial package
  - Fedora contributions by:
       Lumir Balhar <lbalhar@redhat.com>
       Miro Hrončok <miro@hroncok.cz>
       Tomas Hrnciar <thrnciar@redhat.com>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 23.2-1
changelog:
  - Initial package
  - Fedora contributions by:
        Charalampos Stratakis <cstratak@redhat.com>
        Iryna Shcherbina <shcherbina.iryna@gmail.com>
        Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com>
        Karolina Surma <ksurma@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Yaakov Selkowitz <yselkowi@redhat.com>
        Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 1.2.0-1
changelog:
  - Initial package
  - Fedora contributions by:
        Alfredo Moralejo <amoralej@redhat.com>
        Karolina Surma <ksurma@redhat.com>
        Karsten Hopp <karsten@redhat.com>
        Matthias Runge <mrunge@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Patrik Kopkan <pkopkan@redhat.com>
        Peter Robinson <pbrobinson@fedoraproject.org>
        Thomas Moschny <thm@fedoraproject.org>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 2.9.6-1
changelog:
  - Initial package
  - Fedora contributions by:
        Bill Nottingham <notting@fedoraproject.org>
        Charalampos Stratakis <cstratak@redhat.com>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Devrim Gündüz <devrim@gunduz.org>
        Filip Januš <fjanus@redhat.com>
        Honza Horak <hhorak@redhat.com>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Jason Tibbitts <tibbs@math.uh.edu>
        Jesse Keating <jkeating@fedoraproject.org>
        Jozef Mlich <jmlich@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Ondřej Sloup <ondrej.sloup@protonmail.com>
        Patrik Novotný <panovotn@redhat.com>
        Pavel Raiskup <praiskup@redhat.com>
        Peter Robinson <pbrobinson@fedoraproject.org>
        Petr Kubat <pkubat@redhat.com>
        Slavek Kabrda <bkabrda@redhat.com>
        Todd Zullinger <tmz@fedoraproject.org>
        Tomas Hrnciar <thrnciar@redhat.com>
        Tom Lane <tgl@fedoraproject.org>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 2.11.1-1
changelog:
  - Initial package
  - Fedora contributions by:
        Elliott Sales de Andrade <quantum.analyst@gmail.com>
        Jonathan <jonathan@knownhost.com>
        Merlin Mathesius <mmathesi@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Pavel Šimovec <psimovec@redhat.com>
        Susi Lehtola <jussilehtola@fedoraproject.org>
        Tom Stellard <tstellar@redhat.com>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 7.4.2-1
changelog:
  - Initial package
  - Fedora contributions by:
        Charalampos Stratakis <cstratak@redhat.com>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Gwyn Ciesla <limburgher@gmail.com>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Lumir Balhar <lbalhar@redhat.com>
        Maxwell G <maxwell@gtmx.me>
        Miro Hrončok <miro@hroncok.cz>
        Nils Philippsen <nils@redhat.com>
        Orion Poplawski <orion@cora.nwra.com>
        Peter Robinson <pbrobinson@gmail.com>
        Petr Viktorin <pviktori@redhat.com>
        Richard Shaw <hobbes1069@gmail.com>
        Robert Kuska <rkuska@redhat.com>
        Stephen Gallagher <sgallagh@redhat.com>
        Thomas Moschny <thm@fedoraproject.org>
        Tomáš Hrnčiar <thrnciar@redhat.com>


author: Charalampos Stratakis <cstratak@redhat.com> - 1.11.1-1
changelog:
  - Initial package
  - Fedora contributions by:
        Antonio Trande <anto.trande@gmail.com>
        Bill Nottingham <notting@fedoraproject.org>
        Björn Esser <me@besser82.io>
        Charalampos Stratakis <cstratak@redhat.com>
        Christian Dersch <lupinix@mailbox.org>
        David Malcolm <dmalcolm@redhat.com>
        Deji Akingunola <deji@fedoraproject.org>
        Dennis Gilmore <dennis@ausil.us>
        Elliott Sales de Andrade <quantum.analyst@gmail.com>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Iñaki Úcar <iucar@fedoraproject.org>
        Jef Spaleta <jspaleta@fedoraproject.org>
        Jerry James <loganjerry@gmail.com>
        Jesse Keating <jkeating@fedoraproject.org>
        Jitka Plesnikova <jplesnik@redhat.com>
        Jonathan Wakely <jwakely@redhat.com>
        Jon Ciesla <limb@fedoraproject.org>
        Kalev Lember <klember@redhat.com>
        Kevin Fenzi <kevin@scrye.com>
        Lumir Balhar <lbalhar@redhat.com>
        Mamoru TASAKA <mtasaka@fedoraproject.org>
        Marcel Plch <mplch@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Nikola Forró <nforro@redhat.com>
        Nils Philippsen <nils@redhat.com>
        Orion Poplawski <orion@cora.nwra.com>
        Pavel Šimovec <psimovec@redhat.com>
        Peter Robinson <pbrobinson@fedoraproject.org>
        Petr Viktorin <pviktori@redhat.com>
        Robert Kuska <rkuska@redhat.com>
        Than Ngo <than@redhat.com>
        Thomas Spura <thomas.spura@gmail.com>
        Tomas Tomecek <ttomecek@redhat.com>
        Toshio Kuratomi <toshio@fedoraproject.org>
        Troy Dawson <tdawson@fedoraproject.org>
        Yaakov Selkowitz <yselkowi@redhat.com>
        Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 1.7.0-1
changelog:
  - Initial package
  - Fedora contributions by:
        Christian Heimes <cheimes@redhat.com>
        Fabio Valentini <decathorpe@gmail.com>
        Gwyn Ciesla <limb@fedoraproject.org>
        Maxwell G <maxwell@gtmx.me>
        Miro Hrončok <miro@hroncok.cz>
        Tomáš Hrnčiar <thrnciar@redhat.com>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 68.2.2-1
changelog:
  - Initial package
  - Fedora contributions by:
        Bill Nottingham <notting@fedoraproject.org>
        Charalampos Stratakis <cstratak@redhat.com>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Haikel Guemar <hguemar@fedoraproject.org>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Jesse Keating <jkeating@fedoraproject.org>
        Karolina Surma <ksurma@redhat.com>
        Kevin Fenzi <kevin@scrye.com>
        Konstantin Ryabitsev <icon@fedoraproject.org>
        Lumir Balhar <lbalhar@redhat.com>
        Matej Stuchlik <mstuchli@redhat.com>
        Michal Cyprian <mcyprian@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Nils Philippsen <nils@redhat.com>
        Orion Poplawski <orion@cora.nwra.com>
        Petr Viktorin <pviktori@redhat.com>
        Pierre-Yves Chibon <pingou@pingoured.fr>
        Ralph Bean <rbean@redhat.com>
        Randy Barlow <randy@electronsweatshop.com>
        Robert Kuska <rkuska@redhat.com>
        Thomas Spura <thomas.spura@gmail.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Tomas Orsava <torsava@redhat.com>
        Tomas Radej <tradej@redhat.com>
        Toshio Kuratomi <toshio@fedoraproject.org>
        Troy Dawson <tdawson@redhat.com>
        Ville Skyttä <scop@fedoraproject.org>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 0.41.2-1
changelog:
  - Initial package.
  - Fedora contributions by:
        Charalampos Stratakis <cstratak@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Haikel Guemar <hguemar@fedoraproject.org>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Karolina Surma <ksurma@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Matej Stuchlik <mstuchli@redhat.com>
        Maxwell G <maxwell@gtmx.me>
        Miro Hrončok <miro@hroncok.cz>
        Robert Kuska <rkuska@redhat.com>
        Slavek Kabrda <bkabrda@redhat.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Tomas Orsava <torsava@redhat.com>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.14.0-2
changelog:
  - Initial package
  - Fedora contributions by:
        Björn Esser <besser82@fedoraproject.org>
        Bohuslav Kabrda <bkabrda@redhat.com>
        Charalampos Stratakis <cstratak@redhat.com>
        Dan Horák <dan@danny.cz>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Florian Weimer <fweimer@redhat.com>
        Gwyn Ciesla <limb@fedoraproject.org>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Iryna Shcherbina <shcherbina.iryna@gmail.com>
        Jaroslav Škarvada <jskarvad@redhat.com>
        Jason ティビツ <tibbs@fedoraproject.org>
        Kalev Lember <klember@redhat.com>
        Karolina Surma <ksurma@redhat.com>
        Karsten Hopp <karsten@redhat.com>
        Lukáš Zachar <lzachar@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Marcel Plch <mplch@redhat.com>
        Matej Stuchlik <mstuchli@redhat.com>
        Michal Cyprian <mcyprian@redhat.com>
        Michal Toman <mtoman@fedoraproject.org>
        Miro Hrončok <mhroncok@redhat.com>
        Nicolas Chauvet <kwizart@gmail.com>
        Orion Poplawski <orion@cora.nwra.com>
        Patrik Kopkan <pkopkan@redhat.com>
        Peter Robinson <pbrobinson@gmail.com>
        Petr Šplíchal <psplicha@redhat.com>
        Petr Viktorin <pviktori@redhat.com>
        Rex Dieter <rdieter@fedoraproject.org>
        Richard W.M. Jones <rjones@redhat.com>
        Robert Kuska <rkuska@redhat.com>
        Sahana Prasad <sahana@redhat.com>
        Stephen Gallagher <sgallagh@redhat.com>
        Than Ngo <than@redhat.com>
        Thomas Spura <thomas.spura@gmail.com>
        Till Maas <opensource@till.name>
        Tom Stellard <tstellar@redhat.com>
        Tomas Mraz <tmraz@fedoraproject.org>
        Tomas Orsava <torsava@redhat.com>
        Tomas Radej <tradej@redhat.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Toshio Kuratomi <toshio@fedoraproject.org>
        U2FsdGVkX1 <U2FsdGVkX1@gmail.com>
        Victor Stinner <vstinner@redhat.com>
        Ville Skyttä <ville.skytta@iki.fi>
        Yaakov Selkowitz <yselkowi@redhat.com>
        Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Karolina Surma <ksurma@redhat.com> - 3.14.3-1
changelog:
  - Update to Python 3.14.3
  - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865,
  CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367
  Resolves: RHEL-144896, RHEL-143115, RHEL-143173


author: Karolina Surma <ksurma@redhat.com> - 3.14.4-1
changelog:
  - Update to Python 3.14.4
  - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865
  Related: RHEL-167918, RHEL-168160


author: Charalampos Stratakis <cstratak@redhat.com> - 3.14.4-2
changelog:
  - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100
  Resolves: RHEL-167918, RHEL-168160


author: Miro Hrončok <mhroncok@redhat.com> - 3.14.5~rc1-1
changelog:
  - Update to 3.14.5rc1
  - Move back to the generational from the incremental garbage collector
  - Security fix for CVE-2026-6019
  Resolves: RHEL-180642


author: Tomáš Hrnčiar <thrciar@redhat.com> - 1.6.0-3
changelog:
  - Initial package
  - Fedora contributions by:
        Alfredo Moralejo <amoralej@redhat.com>
        Karolina Surma <ksurma@redhat.com>
        Karsten Hopp <karsten@redhat.com>
        Matthias Runge <mrunge@redhat.com>
        Miro Hrončok <mhroncok@redhat.com>
        Patrik Kopkan <pkopkan@redhat.com>
        Peter Robinson <pbrobinson@fedoraproject.org>
        Priscila Gutierres <pgutier@redhat.com>
        Thomas Moschny <thomas.moschny@gmx.de>
        Tomas Orsava <torsava@redhat.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 2.9.10-3
changelog:
  - Initial package
  Fedora contributions by:
      Ales Nezbeda <anezbeda@redhat.com>
      Bill Nottingham <notting@fedoraproject.org>
      Bohuslav Kabrda <bkabrda@redhat.com>
      Charalampos Stratakis <cstratak@redhat.com>
      David Malcolm <dmalcolm@redhat.com>
      Dennis Gilmore <dennis@ausil.us>
      Devrim Gündüz <devrim@gunduz.org>
      Filip Januš <fjanus@redhat.com>
      Honza Horak <hhorak@redhat.com>
      Ignacio Vazquez-Abrams <ivazqueznet+rpm@gmail.com>
      Igor Gnatenko <ignatenkobrain@fedoraproject.org>
      Jason L Tibbitts III <tibbs@math.uh.edu>
      Jesse Keating <jkeating@fedoraproject.org>
      Jozef Mlich <jmlich@redhat.com>
      Lumír Balhar <lbalhar@redhat.com>
      Miro Hrončok <mhroncok@redhat.com>
      Ondřej Sloup <ondrej.sloup@protonmail.com>
      Patrik Novotný <panovotn@redhat.com>
      Pavel Raiskup <praiskup@redhat.com>
      Petr Kubat <pkubat@redhat.com>
      Peter Robinson <pbrobinson@fedoraproject.org>
      Todd Zullinger <tmz@pobox.com>
      Tomas Hrnciar <thrnciar@redhat.com>
      Tom Lane <tgl@redhat.com>


author: Cristian Le <git@lecris.dev> - 2.13.6-7
changelog:
  - Refactor the build script
  - Drop the python3-python2 distinction
  - Use standard cmake and pyproject macros (rhbz#2377381)
  - Allow to build with arbitrary generator (rhbz#2381106)


author: Lukáš Zachar <lzachar@redhat.com> - 78.1.1-3
changelog:
  - Adjust gating
  - Generic gating.yaml for all rhel
  - Use CS repos instead of Fedora
  - Remove python versions not available on c9s
  - use python-isort to test


author: Vladislav Dronov <vdronov@redhat.com> - 1.0.0-1
changelog:
  - Update to qat-zstd-plugin 1.0.0 @ 1e8b930c (RHEL-72905)
  - NUMA node aware mem allocations and other Code optimizations
  - Bug Fixes and Static analysis Fixes (OpenScanhub and Latest Coverity)
  - Support ZSTD v1.5.7 and README refactor
  - Spec file updates for RPM Packaging


author: Vladis Dronov <vdronov@redhat.com> - 24.02.0-1
changelog:
  - Update to qatlib 24.02.0 (RHEL-20174)
  - Add zuc_sample to qatlib-tests package
  - Use proper SPDX license identifiers


author: Vladis Dronov <vdronov@redhat.com> - 24.09.0-1
changelog:
  - Update to qatlib 24.09.0 @ 36fb0903 (RHEL-40255)
  - Add pciutils as a dependency of the qatlib-service subpackage
  - Add numactl-devel as a dependency since it is required by qatlib-24.09.0


author: Vladislav Dronov <vdronov@redhat.com> - 25.08.0-1
changelog:
  - Update to qatlib 25.08.0 @ 686d209b (RHEL-91078)
  - Add autoconf-archive as a dependency
  - Add update_sample to qatlib-tests
  - Add manpage for cpa_sample_code
  - Add sysusers.d config file to allow rpm to create users/groups automatically


author: Vladis Dronov <vdronov@redhat.com> - 1.0.7-1
changelog:
  - Rebuild for qatzip v1.0.7
  - Fix snprintf truncation check (bz 2046925)
  - Add -fstack-protector-strong build option (bz 2044889)


author: Vladis Dronov <vdronov@redhat.com> - 1.0.9-1
changelog:
  - Rebuild for qatzip v1.0.9 (bz 2047744)
  - Update to require qatlib-devel >= 22.07.0 due to soversion bump


author: Vladis Dronov <vdronov@redhat.com> - 1.1.2-1
changelog:
  - Update to qatzip 1.1.2 (bz 2082438)
  - Update README, update driver configure files
  - Fix some bugs
  - Add support for pkgconfig


author: Vladis Dronov <vdronov@redhat.com> - 1.3.1-1
changelog:
  - Update to qatzip 1.3.1 @ 10dbadba (RHEL-73091, RHEL-50460)
  - Fix qatzip docker file build broken issue
  - Support Latency sensitive mode for qatzip
  - Add a suit of comp/decomp API to support Async offloading
  - Support zlib format and end of stream flag
  - Fix some bugs


author: Jan Grulich <jgrulich@redhat.com> - 5.15.9-4
changelog:
  - Fix specific overflow in qtextlayout
  - Fix incorrect parsing of the strict-transport-security (HSTS) header
  - Fix buffer over-read via a crafted reply from a DNS server
    Resolves: bz#2209492


author: Jan Grulich <jgrulich@redhat.com> - 5.15.9-5
changelog:
  - Don't allow remote attacker to bypass security restrictions caused by
    flaw in certificate validation (CVE-2023-34410)
    Resolves: bz#2212754


author: Jan Grulich <jgrulich@redhat.com> - 5.15.9-6
changelog:
  - Don't allow remote attacker to bypass security restrictions caused by
    flaw in certificate validation (CVE-2023-34410) (version #2)
    Resolves: bz#2212754


author: Jan Grulich <jgrulich@redhat.com> - 5.15.2-9
changelog:
  - Sync with Fedora:
    - sync kde/5.15 branch fixes
    - pull in candidate fix QTBUG-83890
    Resolves: bz#1988934


author: Jan Grulich <jgrulich@redhat.com> - 5.15.3-4
changelog:
  - Rebuild (LLVM-15)
    Resolves: bz#2119003

  - Add versioned dependencies between subpackages
    Resolves: bz#2088352


author: Petr Pisar <ppisar@redhat.com> - 1:4.05-17
changelog:
  - Support grace period expirations past 2038 year for XFS
  - Add a synopsis for a project quota option in the quota tool
  - Add a --filesystem option to the quota tool
  - Complain that ext4 external quota files are deprecated


author: Petr Pisar <ppisar@redhat.com> - 1:4.06-2
changelog:
  - Remove a dead code from process_file() (upstream bug #54)
  - Fix a compilation warning in quotaops.c
  - Warn when kernel XFS large time stamp does fit into (32-bit) user-space
    time_t
  - Do not use a pointless compiler-internal __P() macro


author: Pavel Reichl <preichl@redhat.com> - 1:4.09-1
changelog:
  - Update to new upstream version
  - Add tmpfs quota support
  - Remove rhel-only patches that were merged upstream


author: Jarek Prokop <jprokop@redhat.com> - 3.0.4-160
changelog:
  - Upgrade to Ruby 3.0.4.
    Resolves: rhbz#2096347
  - OpenSSL test suite fixes due to disabled SHA1.
    Resolves: rbhz#2107696
  - Fix double free in Regexp compilation.
    Resolves: CVE-2022-28738
  - Fix buffer overrun in String-to-Float conversion.
    Resolves: CVE-2022-28739


author: Jun Aruga <jaruga@redhat.com> - 3.0.4-160
changelog:
  - Bypass git submodule test failure on Git >= 2.38.1.
  - Fix tests with Europe/Amsterdam pre-1970 time on tzdata version 2022b.
  - Fix for tzdata-2022g.
  - Fix File.utime test.


author: Jun Aruga <jaruga@redhat.com> - 3.0.4-161
changelog:
  - Fix OpenSSL.fips_mode and OpenSSL::PKey.read in OpenSSL 3 FIPS.
    Resolves: RHEL-12724
  - ssl: use ffdhe2048 from RFC 7919 as the default DH group parameters
    Related: RHEL-12724


author: Jun Aruga <jaruga@redhat.com> - 3.0.7-162
changelog:
  - Upgrade to Ruby 3.0.7.
    Resolves: RHEL-35740
  - Fix HTTP response splitting in CGI.
    Resolves: RHEL-35741
  - Fix ReDoS vulnerability in URI.
    Resolves: RHEL-35742
  - Fix ReDoS vulnerability in Time.
    Resolves: RHEL-35743
  - Fix buffer overread vulnerability in StringIO.
    Resolves: RHEL-35744
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    Resolves: RHEL-35746
  - Fix arbitrary memory address read vulnerability with Regex search.
    Resolves: RHEL-35747


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-164
changelog:
  - Undefine GC compaction methods on ppc64le.
    Resolves: RHEL-83135
  - Fix printing warnings when using IRB from a script.
    Resolves: RHEL-83137


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-165
changelog:
  - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219)
    Resolves: RHEL-87183
  - Fix ReDoS in CGI::Util#escapeElement. (CVE-2025-27220)
    Resolves: RHEL-87184


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-164
changelog:
  - Undefine GC compaction methods on ppc64le.
    Resolves: RHEL-83136
  - Fix printing warnings when using IRB from a script.
    Resolves: RHEL-83044


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-165
changelog:
  - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219)
    Resolves: RHEL-86104
  - Fix ReDoS in CGI::Util#escapeElement. (CVE-2025-27220)
    Resolves: RHEL-86130


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-166
changelog:
  - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316)
    Resolves: RHEL-171254


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-166
changelog:
  - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316)
    Resolves: RHEL-171256


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-167
changelog:
  - Fix information disclosure via MITM attack bypassing TLS in net-imap.
    (CVE-2026-42246)
    Resolves: RHEL-181763
  - Fix command injection via Symbol arguments in net-imap. (CVE-2026-42258)
    Resolves: RHEL-181802


author: Pavel Valena <pvalena@redhat.com> - 3.10.1-7
changelog:
  - Re-add Requires: rubygem(rake), as it's needed for runtime.
    Resolves: rhbz#1982410
    Resolves: rhbz#1982419


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.16.3-1
changelog:
  - Rebase to 1.16.3 [RHEL-19239]
  - Removed vgabios-qxl.bin [RHEL-383]
  - Resolves: RHEL-19239
    (Rebase seabios to 1.16.3)
  - Resolves: RHEL-383
    (remove vgabios-qxl.bin from seavgabios in rhel9)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.16.3-2
changelog:
  - seabios-add-hwerr_printf-function-for-threads.patch [RHEL-7110]
  - seabios-display-error-message-for-blocksizes-512.patch [RHEL-7110]
  - Resolves: RHEL-7110
    ([seabios] Can't boot from a disk with 4K sector size)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.16.3-2.1
changelog:
  - seabios-pciinit-don-t-misalign-large-BARs.patch [RHEL-67846]
  - Resolves: RHEL-67846
    (amdgpu failed to initialize when multiple AMD MI210 GPUs assigned and firmware is seabios [rhel-9])


author: Tomas Bzatek <tbzatek@redhat.com> - 1.47-7
changelog:
  - Fix sg_inq parsing in rescan-scsi-bus.sh (#2036005,#2035362)
  - Fix rescan-scsi-bus.sh summary print (#2035382)
  - sg_readcap --zbc man page switch fix (#2036718)
  - Various Covscan fixes (#2044433)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-7
changelog:
  - useradd: check if subid range exists for user. Resolves: #2179987
  - find_new_[gu]id: Skip over IDs that are reserved for legacy reasons. Resolves: #2179988


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-15
changelog:
  - nss.c: shadow_logfd to stderr. Resolves: RHEL-83431
  - vipw: restore the original terminal pgrp after editing. Resolves: RHEL-70844 and RHEL-72940


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-1
changelog:
  - Rebase to version 4.9. Resolves: #1989556
  - usermod: allow all group types with -G option. Resolves: #1975329
  - useradd: avoid generating an empty subid range
  - Clean spec file


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-3
changelog:
  - getsubids: provide system binary and man page. Resolves: #2013015
  - useradd: generate home and mail directories with selinux user attribute. Resolves: #1993081
  - useradd: revert fix memleak of grp. Resolves: #2020238
  - groupdel: fix SIGSEGV when passwd does not exist. Resolves: #2024834
  - pwck: fix segfault when calling fprintf()
  - newgrp: fix segmentation fault
  - Clean spec file: organize dependencies and move License location


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-4
changelog:
  - useradd: modify check ID range for system users. Resolves: #2004911
  - Fix release sources
  - Add subid requirement for subid-devel


author: Peter Jones <pjones@redhat.com> - 15.3-0~1
changelog:
  - Update to shim 15.3
    - Support for revocations via the ".sbat" section and SBAT EFI variable
    - A new unit test framework and a bunch of unit tests
    - No external gnu-efi dependency
    - Better CI
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Peter Jones <pjones@redhat.com> - 15.4-1
changelog:
  - Update to shim 15.4
    - Support for revocations via the ".sbat" section and SBAT EFI variable
    - A new unit test framework and a bunch of unit tests
    - No external gnu-efi dependency
    - Better CI
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Peter Jones <pjones@redhat.com> - 15.4-2
changelog:
  - Fix the ia32 build.
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Peter Jones <pjones@redhat.com> - 15.4-3
changelog:
  - Build with the correct certificate trust list for this OS.
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Peter Jones <pjones@redhat.com> - 15.4-4
changelog:
  - Fix the sbat data to actually match /this/ product.
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Martin Gieseking <martin.gieseking@uos.de> - 1.1.8-1
changelog:
  - Updated to new release.
  - Dropped version-related patch which has been applied upstream (BZ #1527850).


author: Tomas Korbar <tkorbar@redhat.com> - 1.2.0-11
changelog:
  - CVE-2020-23903 speex: divide by zero in read_samples() via crafted WAV file
  - Resolves: CVE-2020-23903


author: Tom Stellard <tstellar@redhat.com> - 4.0.2-2
changelog:
  - Use make macros
    https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - Disable Go tests


author: Robert-André Mauchin <zebob.m@gmail.com> - 4.0.2-16
changelog:
  - Rebuilt for CVE-2022-1996, CVE-2022-24675, CVE-2022-28327, CVE-2022-27191,
    CVE-2022-29526, CVE-2022-30629


author: systemd maintenance team <systemd-maint@redhat.com> - 252-30
changelog:
  - resolved: limit the number of signature validations in a transaction (RHEL-26643)
  - resolved: reduce the maximum nsec3 iterations to 100 (RHEL-26643)
  - efi: alignment of the PE file has to be at least 512 bytes (RHEL-26133)
  - units: change assert to condition to skip running in initrd/os (RHEL-16182)
  - ci: add configuration for regression sniffer GA (RHEL-1086)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-31
changelog:
  - bootctl: rework random seed logic to use open_mkdir_at() and openat() (RHEL-16952)
  - bootctl: properly sync fs before/after moving random seed file into place (RHEL-16952)
  - bootctl: when updating EFI random seed file, hash old seed with new one (RHEL-16952)
  - sha256: add helper than hashes a buffer *and* its size (RHEL-16952)
  - random-seed: don't refresh EFI random seed from random-seed.c anymore (RHEL-16952)
  - bootctl: downgrade graceful messages to LOG_NOTICE (RHEL-16952)
  - units: rename/rework systemd-boot-system-token.service → systemd-boot-random-seed.service (RHEL-16952)
  - bootctl: split out setting of system token into function of its own (RHEL-16952)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-32.2
changelog:
  - coredump: generate stacktraces also for processes running in containers w/o coredump forwarding (RHEL-34061)
  - test: add a couple of tests for systemd-coredump (RHEL-34061)
  - test: don't expand the subshell expression prematurely (RHEL-34061)
  - coredump filter: fix stack overflow with =all (RHEL-34061)
  - coredump filter: add mask for 'all' using UINT32_MAX, not UINT64_MAX (RHEL-34061)
  - test: add coverage for CoredumpFilter=all (RHEL-34061)
  - test: rotate journal before storing coredumps (RHEL-34061)
  - test: sync with the fake binary before killing it (RHEL-34061)
  - test: check coredump handling in containers & namespaces (RHEL-34061)
  - ukify: make the test happy with the latest OpenSSL (RHEL-34061)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-32.6
changelog:
  - cryptsetup: do not assert when unsealing token without salt (RHEL-40119)
  - cryptsetup: check the existence of salt by salt_size > 0 (RHEL-40119)
  - bootspec: fix null-dereference-read (RHEL-40119)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-24
changelog:
  - ci: use source-git-automation composite Action (RHEL-1086)
  - ci: increase the cron interval to 45 minutes (RHEL-1086)
  - ci: add all Z-Stream versions to array of allowed versions (RHEL-1086)
  - udev/net_id: introduce naming scheme for RHEL-9.4 (RHEL-22427)
  - basic/errno-util: add wrappers which only accept negative errno (RHEL-22443)
  - errno-util: allow ERRNO_IS_* to accept types wider than int (RHEL-22443)
  - udev: add new builtin net_driver (RHEL-22443)
  - udev/net_id: introduce naming scheme for RHEL-8.10 (RHEL-22427)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-27
changelog:
  - test: merge TEST-20-MAINPIDGAMES into TEST-07-PID1 (fixup) (RHEL-1086)
  - test: use the default nsec3-iterations value (RHEL-1086)
  - test: explicitly set nsec3-iterations to 0 (RHEL-1086)
  - core: mount namespaces: Remove auxiliary bind mounts directory after unit termination (RHEL-19483)
  - ci: deploy systemd man to GitHub Pages (RHEL-1086)
  - doc: add missing `<listitem>` to `systemd.net-naming-scheme.xml` (RHEL-7026)
  - man: reorder the list of supported naming schemes (RHEL-7026)
  - tree-wide: fix return value handling of base64mem() (RHEL-16182)
  - Consolidate various TAKE_* into TAKE_GENERIC(), add TAKE_STRUCT() (RHEL-16182)
  - pcrphase: add $SYSTEMD_PCRPHASE_STUB_VERIFY env var for overriding stub check (RHEL-16182)
  - pcrphase: gracefully exit if TPM2 support is incomplete (RHEL-16182)
  - tpm2-util: split out code that derives "good" TPM2 banks into an strv from pcrphase and generalize it in tpm2-util.c (RHEL-16182)
  - tpm2-util: split out code that extends a PCR from pcrphase (RHEL-16182)
  - tpm2-util: optionally do HMAC in tpm2_extend_bytes() in case we process sensitive data (RHEL-16182)
  - cryptsetup: add tpm2-measure-pcr= and tpm2-measure-bank= crypttab options (RHEL-16182)
  - man: document the new crypttab measurement options (RHEL-16182)
  - gpt-auto-generator: automatically measure root/var volume keys into PCR 15 (RHEL-16182)
  - blkid-util: define enum for blkid_do_safeprobe() return values (RHEL-16182)
  - pcrphase: make tool more generic, reuse for measuring machine id/fs uuids (RHEL-16182)
  - units: measure /etc/machine-id into PCR 15 during early boot (RHEL-16182)
  - generators: optionally, measure file systems at boot (RHEL-16182)
  - tpm2: add common helper for checking if we are running on UKI with TPM measurements (RHEL-16182)
  - man: document new machine-id/fs measurement options (RHEL-16182)
  - test: add simple integration test for checking PCR extension works as it should (RHEL-16182)
  - update TODO (RHEL-16182)
  - cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (RHEL-16182)
  - boot: Simplify object erasure (RHEL-16182)
  - tree-wide: use CLEANUP_ERASE() at various places (RHEL-16182)
  - dlfcn: add new safe_dclose() helper (RHEL-16182)
  - tpm2: rename tpm2 alg id<->string functions (RHEL-16182)
  - tpm2: rename struct tpm2_context to Tpm2Context (RHEL-16182)
  - tpm2: use ref counter for Tpm2Context (RHEL-16182)
  - tpm2: use Tpm2Context* instead of ESYS_CONTEXT* (RHEL-16182)
  - tpm2: add Tpm2Handle with automatic cleanup (RHEL-16182)
  - tpm2: simplify tpm2_seal() blob creation (RHEL-16182)
  - tpm2: add salt to pin (RHEL-16182)
  - basic/macro: add macro to iterate variadic args (RHEL-16182)
  - test/test-macro: add tests for FOREACH_VA_ARGS() (RHEL-16182)
  - basic/bitfield: add bitfield operations (RHEL-16182)
  - test/test-bitfield: add tests for bitfield macros (RHEL-16182)
  - tpm2: add tpm2_get_policy_digest() (RHEL-16182)
  - tpm2: add TPM2_PCR_VALID() (RHEL-16182)
  - tpm2: add/rename functions to manage pcr selections (RHEL-16182)
  - test/test-tpm2: add tests for pcr selection functions (RHEL-16182)
  - tpm2: add tpm2_pcr_read() (RHEL-16182)
  - tpm2: move openssl-required ifdef code out of policy-building function (RHEL-16182)
  - tpm2: add tpm2_is_encryption_session() (RHEL-16182)
  - tpm2: move policy building out of policy session creation (RHEL-16182)
  - tpm2: add support for a trusted SRK (RHEL-16182)
  - tpm2: fix nits from PR #26185 (RHEL-16182)
  - tpm2: replace magic number (RHEL-16182)
  - tpm2: add tpm2_digest_*() functions (RHEL-16182)
  - tpm2: replace hash_pin() with tpm2_digest_*() functions (RHEL-16182)
  - tpm2: add tpm2_set_auth() (RHEL-16182)
  - tpm2: add tpm2_get_name() (RHEL-16182)
  - tpm2: rename pcr_values_size vars to n_pcr_values (RHEL-16182)
  - tpm2: add tpm2_policy_pcr() (RHEL-16182)
  - tpm2: add tpm2_policy_auth_value() (RHEL-16182)
  - tpm2: add tpm2_policy_authorize() (RHEL-16182)
  - tpm2: use tpm2_policy_authorize() (RHEL-16182)
  - tpm2: add tpm2_calculate_sealing_policy() (RHEL-16182)
  - tpm: remove external calls to dlopen_tpm2() (RHEL-16182)
  - tpm2: remove all extern tpm2-tss symbols (RHEL-16182)
  - tpm2: add tpm2_get_capability(), tpm2_cache_capabilities(), tpm2_capability_pcrs() (RHEL-16182)
  - tpm2: verify symmetric parms in tpm2_context_new() (RHEL-16182)
  - tpm2: replace _cleanup_tpm2_* macros with _cleanup_() (RHEL-16182)
  - tpm2-util: use compound initialization when allocating tpm2 objects (RHEL-16182)
  - tpm2: add tpm2_get_capability_handle(), tpm2_esys_handle_from_tpm_handle() (RHEL-16182)
  - tpm2: add tpm2_read_public() (RHEL-16182)
  - tpm2: add tpm2_get_legacy_template() and tpm2_get_srk_template() (RHEL-16182)
  - tpm2: add tpm2_load() (RHEL-16182)
  - tpm2: add tpm2_load_external() (RHEL-16182)
  - tpm2: move local vars in tpm2_seal() to point of use (RHEL-16182)
  - tpm2: replace magic number in hmac_sensitive initialization (RHEL-16182)
  - tpm2: add tpm2_create() (RHEL-16182)
  - tpm2: replace tpm2_capability_pcrs() macro with direct c->capaiblity_pcrs use (RHEL-16182)
  - basic/alloc-util: add greedy_realloc_append() (RHEL-16182)
  - tpm2: cache the TPM supported commands, add tpm2_supports_command() (RHEL-16182)
  - tpm2: cache TPM algorithms (RHEL-16182)
  - tpm2: add tpm2_persist_handle() (RHEL-16182)
  - tpm2: add tpm2_get_or_create_srk() (RHEL-16182)
  - tpm2: move local vars in tpm2_unseal() to point of use (RHEL-16182)
  - tpm2: remove tpm2_make_primary() (RHEL-16182)
  - tpm2: use CreatePrimary() to create primary keys instead of Create() (RHEL-16182)
  - cryptsetup: downgrade a bunch of log messages that to LOG_WARNING (RHEL-16182)
  - boot/measure: replace TPM PolicyPCR session with calculation (RHEL-16182)
  - core: imply DeviceAllow=/dev/tpmrm0 with LoadCredentialEncrypted (RHEL-16182)
  - added more test cases (RHEL-16182)
  - test: fixed negative checks in TEST-70-TPM2. Use in-line error handling rather than redirections. Follow up on #27020 (RHEL-16182)
  - systemd-cryptenroll: add string aliases for tpm2 PCRs Fixes #26697. RFE. (RHEL-16182)
  - cryptenroll: fix an assertion with weak passwords (RHEL-16182)
  - man/systemd-cryptenroll: update list of PCRs, link to uapi docs (RHEL-16182)
  - tpm2: add debug logging to functions converting hash or asym algs to/from strings or ids (RHEL-16182)
  - tpm2: add tpm2_hash_alg_to_size() (RHEL-16182)
  - tpm2: change tpm2_tpm*_pcr_selection_to_mask() to return mask (RHEL-16182)
  - tpm2: add more helper functions for managing TPML_PCR_SELECTION and TPMS_PCR_SELECTION (RHEL-16182)
  - tpm2: add Tpm2PCRValue struct and associated functions (RHEL-16182)
  - tpm2: move declared functions in header lower down (RHEL-16182)
  - tpm2: declare tpm2_log_debug_*() functions in tpm2_util.h (RHEL-16182)
  - tpm2: change tpm2_calculate_policy_pcr(), tpm2_calculate_sealing_policy() to use Tpm2PCRValue array (RHEL-16182)
  - tpm2: change tpm2_parse_pcr_argument() parameters to parse to Tpm2PCRValue array (RHEL-16182)
  - tpm2: add TPM2B_*_MAKE(), TPM2B_*_CHECK_SIZE() macros (RHEL-16182)
  - tpm2: add tpm2_pcr_read_missing_values() (RHEL-16182)
  - openssl: add openssl_pkey_from_pem() (RHEL-16182)
  - openssl: add rsa_pkey_new(), rsa_pkey_from_n_e(), rsa_pkey_to_n_e() (RHEL-16182)
  - openssl: add ecc_pkey_new(), ecc_pkey_from_curve_x_y(), ecc_pkey_to_curve_x_y() (RHEL-16182)
  - test: add DEFINE_HEX_PTR() helper function (RHEL-16182)
  - openssl: add test-openssl (RHEL-16182)
  - tpm2: add functions to convert TPM2B_PUBLIC to/from openssl pkey or PEM (RHEL-16182)
  - tpm2: move policy calculation out of tpm2_seal() (RHEL-16182)
  - man: update systemd-cryptenroll man page with details on --tpm2-pcrs format change (RHEL-16182)
  - tpm2: update TEST-70-TPM2 to test passing PCR value to systemd-cryptenroll (RHEL-16182)
  - tpm2: change *alg_to_* functions to use switch() (RHEL-16182)
  - tpm2: lowercase TPM2_PCR_VALUE[S]_VALID functions (RHEL-16182)
  - tpm2: move cast from lhs to rhs in uint16_t/int comparison (RHEL-16182)
  - tpm2: in validator functions, return false instead of assert failure (RHEL-16182)
  - tpm2: in tpm2_pcr_values_valid() use FOREACH_ARRAY() (RHEL-16182)
  - tpm2: use SIZE_MAX instead of strlen() for unhexmem() (RHEL-16182)
  - tpm2: put !isempty() check inside previous !isempty() check (RHEL-16182)
  - tpm2: simplify call to asprintf() (RHEL-16182)
  - tpm2: check pcr value hash != 0 before looking up hash algorithm name (RHEL-16182)
  - tpm2: use strempty() (RHEL-16182)
  - tpm2: split TPM2_PCR_VALUE_MAKE() over multiple lines (RHEL-16182)
  - tpm2: remove ret_ prefix from input/output params (RHEL-16182)
  - tpm2: use memcpy_safe() instead of memcpy() (RHEL-16182)
  - openssl: use new(char, size) instead of malloc(size) (RHEL-16182)
  - tpm2: use table for openssl<->tpm2 ecc curve id mappings (RHEL-16182)
  - tpm2: use switch() instead of if-else (RHEL-16182)
  - tpm2: make logging level consistent at debug for some functions (RHEL-16182)
  - tpm2: remove unnecessary void* cast (RHEL-16182)
  - tpm2: add tpm2_pcr_values_has_(any|all)_values() functions (RHEL-16182)
  - tpm2: wrap (7) in UINT32_C() (RHEL-16182)
  - cryptenroll: change man page example to remove leading 0x and lowercase hex (RHEL-16182)
  - openssl: add log_openssl_errors() (RHEL-16182)
  - openssl: add openssl_digest_size() (RHEL-16182)
  - openssl: add openssl_digest_many() (RHEL-16182)
  - openssl: replace openssl_hash() with openssl_digest() (RHEL-16182)
  - openssl: add openssl_hmac_many() (RHEL-16182)
  - openssl: add rsa_oaep_encrypt_bytes() (RHEL-16182)
  - openssl: add kdf_kb_hmac_derive() (RHEL-16182)
  - openssl: add openssl_cipher_many() (RHEL-16182)
  - openssl: add ecc_edch() (RHEL-16182)
  - openssl: add kdf_ss_derive() (RHEL-16182)
  - dlfcn-util: add static asserts ensuring our sym_xyz() func ptrs match the types from the official headers (RHEL-16182)
  - tpm2: add tpm2_marshal_blob() and tpm2_unmarshal_blob() (RHEL-16182)
  - tpm2: add tpm2_serialize() and tpm2_deserialize() (RHEL-16182)
  - tpm2: add tpm2_index_to_handle() and tpm2_index_from_handle() (RHEL-16182)
  - tpm2: fix build failure without openssl (RHEL-16182)
  - tpm2-util: look for tpm2-pcr-signature.json directly in /.extra/ (RHEL-16182)
  - tpm2: downgrade most log functions from error to debug (RHEL-16182)
  - tpm2: handle older tpm enrollments without a saved pcr bank (RHEL-16182)
  - tpm2: allow tpm2_make_encryption_session() without bind key (RHEL-16182)
  - tpm2: update tpm2 test for supported commands (RHEL-16182)
  - tpm2: use GREEDY_REALLOC_APPEND() in tpm2_get_capability_handles(), cap max value (RHEL-16182)
  - tpm2: change tpm2_unseal() to accept Tpm2Context instead of device string (RHEL-16182)
  - tpm2: cache TPM's supported ECC curves (RHEL-16182)
  - tpm2-util: make tpm2_marshal_blob()/tpm2_unmarshal_blob() static (RHEL-16182)
  - tpm2-util: make tpm2_read_public() static, as we use it only internally in tpm2-util.c (RHEL-16182)
  - cryptenroll: allow specifying handle index of key to use for sealing (RHEL-16182)
  - test: add tests for systemd-cryptenroll --tpm2-seal-key-handle (RHEL-16182)
  - tpm2: do not call Esys_TR_Close() (RHEL-16182)
  - tpm2: don't use GetCapability() to check transient handles (RHEL-16182)
  - tpm2-util: pick up a few new symbols from tpm2-tss (RHEL-16182)
  - tpm2: add tpm2_get_pin_auth() (RHEL-16182)
  - tpm2: instead of adjusting authValue trailing 0(s), trim them as required by tpm spec (RHEL-16182)
  - tpm2-util: rename tpm2_calculate_name() → tpm2_calculate_pubkey_name() (RHEL-16182)
  - cryptenroll: do not implicitly verify with default tpm policy signature (RHEL-16182)
  - cryptenroll: drop deadcode (RHEL-16182)
  - tpm2: allow using tpm2_get_srk_template() without tpm (RHEL-16182)
  - tpm2: add test to verify srk templates (RHEL-16182)
  - tpm2: add tpm2_sym_alg_*_string() and tpm2_sym_mode_*_string() (RHEL-16182)
  - tpm2: add tpm2_calculate_seal() and helper functions (RHEL-16182)
  - tpm2: update test-tpm2 for tpm2_calculate_seal() (RHEL-16182)
  - cryptenroll: add support for calculated TPM2 enrollment (RHEL-16182)
  - test: update TEST-70 with systemd-cryptenroll calculated TPM2 enrollment (RHEL-16182)
  - openssl-util: avoid freeing invalid pointer (RHEL-16182)
  - creds-util: check for CAP_DAC_READ_SEARCH (RHEL-16182)
  - creds-util: do not try TPM2 if there is not support (RHEL-16182)
  - creds-util: merge the TPM2 detection for initrd (RHEL-16182)
  - cryptenroll: fix a memory leak (RHEL-16182)
  - sd-journal: introduce sd_journal_step_one() (RHEL-11591)
  - test: modernize test-journal-flush (RHEL-11591)
  - journal-file-util: do not fail when journal_file_set_offline() called more than once (RHEL-11591)
  - journal-file-util: Prefer punching holes instead of truncating (RHEL-11591)
  - test: add reproducer for SIGBUS issue caused by journal truncation (RHEL-11591)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-28
changelog:
  - random-seed: shorten a bit may_credit() (RHEL-16952)
  - random-seed: make one more use of random_write_entropy() (RHEL-16952)
  - random-seed: use getopt() (RHEL-16952)
  - random-seed: make the logic to calculate the number of bytes read from the random seed file clearer (RHEL-16952)
  - random-seed: no need to pass 'mode' argument when opening /dev/urandom (RHEL-16952)
  - random-seed: split out run() (RHEL-16952)
  - random_seed: minor improvement in run() (RHEL-16952)
  - random-seed: downgrade some messages (RHEL-16952)
  - random-seed: clarify one comment (RHEL-16952)
  - random-seed: make sure to load machine id even if the seed file is missing (RHEL-16952)
  - chase-symlinks: add new flag for prohibiting any following of symlinks (RHEL-16952)
  - bootctl,bootspec: make use of CHASE_PROHIBIT_SYMLINKS whenever we access the ESP/XBOOTLDR (RHEL-16952)
  - boot: implement kernel EFI RNG seed protocol with proper hashing (RHEL-16952)
  - random-seed: refresh EFI boot seed when writing a new seed (RHEL-16952)
  - random-seed: handle post-merge review nits (RHEL-16952)
  - boot: do not truncate random seed file (RHEL-16952)
  - bootctl: install system token on virtualized systems (RHEL-16952)
  - boot: remove random-seed-mode (RHEL-16952)
  - stub: handle random seed like sd-boot does (RHEL-16952)
  - efi: add efi_guid_equal() helper (RHEL-16952)
  - efi: add common implementation for loop finding EFI configuration tables (RHEL-16952)
  - boot: Detect hypervisors using SMBIOS info (RHEL-16952)
  - boot: Skip soft-brick warning when in a VM (RHEL-16952)
  - boot: Replace UINTN with size_t (RHEL-16952)
  - boot: Use unsigned for beep counting (RHEL-16952)
  - boot: Use unicode literals (RHEL-16952)
  - macro: add generic IS_ALIGNED32() anf friends (RHEL-16952)
  - meson: use 0|1 for SD_BOOT (RHEL-16952)
  - boot: Add printf functions (RHEL-16952)
  - boot: Use printf for error logging (RHEL-16952)
  - boot: Introduce log_wait (RHEL-16952)
  - boot: Add log_trace debugging helper (RHEL-16952)
  - tree-wide: Use __func__ in asserts (RHEL-16952)
  - boot: Drop use of xpool_print/SPrint (RHEL-16952)
  - boot: Drop use of Print (RHEL-16952)
  - boot: Rework GUID handling (RHEL-16952)
  - efi-string: Fix strchr() null byte handling (RHEL-16952)
  - efi-string: Add startswith8() (RHEL-16952)
  - efi-string: Add efi_memchr() (RHEL-16952)
  - vmm: Add more const (RHEL-16952)
  - vmm: Add smbios_find_oem_string() (RHEL-16952)
  - stub: Read extra kernel command line items from SMBIOS (RHEL-16952)
  - vmm: Modernize get_smbios_table() (RHEL-16952)
  - stub: measure SMBIOS kernel-cmdline-extra in PCR12 (RHEL-16952)
  - efi: support passing empty cmdline to mangle_stub_cmdline() (RHEL-16952)
  - efi: set EFIVAR to stop Shim from uninstalling its protocol (RHEL-16952)
  - ukify: use empty stub for addons (RHEL-16952)
  - stub: allow loading and verifying cmdline addons (RHEL-16952)
  - TODO: remove fixed item (RHEL-16952)
  - fix: do not check/verify slice units if recursive errors are to be ignored (RHEL-1086)


author: Than Ngo <than@redhat.com> - 9:20200327-19
changelog:
  - Related: #1960650, add create-clean-texlive.sh to generate clean tarball from released build tarballs, update URLs


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-65
changelog:
  - Update OpenSSL certificates set up
    Resolves: RHEL-81721
  - Remove deprecated path from systemd service file
    Resolves: RHEL-81716


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-66
changelog:
  - Use systemd-sysusers for the 'pegasus' user and group creation
  - Fix Requires of subpackages
    Related: RHEL-90737
  - Add support for Image Mode
    Resolves: RHEL-90737


author: Štěpán Horáček <shoracek@redhat.com> - 3.2.2-1
changelog:
  - Rebase to 3.2.2
  - Use systemd-sysusers to create user
    Resolves: CVE-2023-22745
    Resolves: rhbz#2095479
    Resolves: rhbz#2160307
    Resolves: rhbz#2162613


author: Kalev Lember <klember@redhat.com> - 3.1.0~rc-3
changelog:
  - Obsolete libtracker-control and libtracker-miner
  - Add conflicts with tracker3 packages to help with the upgrade path


author: Hans de Goede <hdegoede@redhat.com> - 1:3.2.7b-1
changelog:
  - New upstream release 3.2.7b
  - Add patch fixing CVE-2019-19746 (rhbz#1787040)
  - Add patch fixing CVE-2019-19797 (rhbz#1786726)


author: Ondrej Dubaj <odubaj@redhat.com> - 1:3.2.7b-7
changelog:
  - Fixed CVE-2020-21681 (#1998350)
  - Fixed CVE-2020-21683 (#1998594)
  - Fixed CVE-2020-21680 (#1998306)
  - Fixed CVE-2020-21684 (#2000747)
  - Fixed CVE-2020-21678 (#2000741)
  - Fixed CVE-2020-21676 (#2000751)
  - Fixed CVE-2020-21682 (#2000738)


author: Ondrej Dubaj <odubaj@redhat.com> - 1:3.2.7b-8
changelog:
  - Fixed CVE-2020-21529 (#2005518)
  - Fixed CVE-2020-21532 (#2006007)
  - Fixed CVE-2020-21531 (#2006002)


author: Tomas Korbar <tkorbar@redhat.com> - 1.16.2-3.1
changelog:
  - Fix KeyTrap - Extreme CPU consumption in DNSSEC validator CVE-2023-50387
  - Fix Preparing an NSEC3 closest encloser proof can exhaust CPU resources CVE-2023-50868
  - Resolves: RHEL-25642
  - Resolves: RHEL-25670


author: Tomas Korbar <tkorbar@redhat.com> - 1.16.2-6
changelog:
  - Fix KeyTrap - Extreme CPU consumption in DNSSEC validator CVE-2023-50387
  - Fix Preparing an NSEC3 closest encloser proof can exhaust CPU resources CVE-2023-50868
  - Resolves: RHEL-25671
  - Resolves: RHEL-25643


author: Petr Menšík <pemensik@redhat.com> - 1.24.2-2
changelog:
  - Switch TLS configuration to follow TLS sockets by crypto-policy again
    (RHEL-147860)
  - Change the default of tls-use-system-policy-versions at build-time


author: Fedor Vorobev <fvorobev@redhat.com> - 1.24.2-3.1
changelog:
  - Fix CVE-2026-33278 (RHEL‑177822)
    Fix CVE-2026-42944 (RHEL-177936)
    Fix CVE-2026-42959 (RHEL-177797)


author: Fedor Vorobev <fvorobev@redhat.com> - 1.24.2-3.1
changelog:
  - Fix CVE-2026-33278 (RHEL-177822)
    Fix CVE-2026-42944 (RHEL-177936)
    Fix CVE-2026-42959 (RHEL-177797)


author: Fedor Vorobev <fvorobev@redhat.com> - 1.24.2-3.2
changelog:
  - Fix CVE-2026-40622 (RHEL-184840)
    Fix CVE-2026-44390 (RHEL-186688)
    Fix CVE-2026-41292 (RHEL-187352)
    Fix CVE-2026-42534 (RHEL-187095)


author: RHEL Packaging Agent <jotnar@redhat.com> - 2.3.12-1
changelog:
  - Rebase to version 2.3.12
  - Add unixODBC-c89.patch for GCC 14 compatibility
  - Update so-version-bump.patch for new version
  - Fix multilib_fix_c_header path to match actual header location
  - Resolves: RHEL-94798


author: Victor Toso <victortoso@redhat.com> - 0.13.0-1
changelog:
  - Rebase to latest upstream: 0.13.0
  - Keeps usbredirserver binary (removed upstream)
    Related: rhbz#2135760


author: Victor Toso <victortoso@redhat.com> - 0.13.0-2
changelog:
  - Fixes 100% CPU usage when usbredirect used as TCP server
    Related: rhbz#2157520
  - Fixes USB redirection of identical devices
    Resolves: rhbz#2157520


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.12.1-5
changelog:
  - Replace arch-dependent /usr/include/urcu/config.h with arch-independent
    stub when needed. (bz# 1951223)
  - Added CI gating tests
  - Resolves: bz #1951223


author: Tomas Korbar <tkorbar@redhat.com> - 6.6.2-4
changelog:
  - Add parameters h2_rst_allowance and h2_rst_allowance_period to mitigate CVE-2023-44487
  - Resolves: RHEL-12817


author: Luboš Uhliarik <luhliari@redhat.com> - 6.6.2-4.1
changelog:
  - Resolves: RHEL-30387 - varnish: HTTP/2 Broken Window Attack may result
    in denial of service (CVE-2024-30156)


author: Tomas Korbar <tkorbar@redhat.com> - 6.6.2-5
changelog:
  - Add parameters h2_rst_allowance and h2_rst_allowance_period to mitigate CVE-2023-44487
  - Resolves: RHEL-12818


author: Luboš Uhliarik <luhliari@redhat.com> - 6.6.2-6
changelog:
  - Resolves: RHEL-30337 - varnish: HTTP/2 Broken Window Attack may result
    in denial of service (CVE-2024-30156)


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.0.7-5
changelog:
  - Remove LVM2 "devices file" during conversion
    resolves: rhbz#2112801
  - Add support for Zstandard compressed kernel modules
    resolves: rhbz#2116811


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.2.0-5
changelog:
  - Rebase to virt-v2v 2.2.0
    resolves: rhbz#2135762
  - Copy drivers for Windows 11, Windows 2019 & Windows 2022
    resolves: rhbz#2149811
  - Fix Description field for Windows >= 10 in -o rhv/vdsm modes
    resolves: rhbz#2149863
  - Fix UEFI fallback boot loader if broken
    resolves: rhbz#2149629
  - Document Windows system on Dynamic Disk is not supported (2140548 comment 5)
  - Include the BOCHS DRM driver in the initial ram disk
    resolves: rhbz#2131123
  - windows_virtio: favor "fwcfg" over "qemufwcfg"
    resolves: rhbz#2151752
  - -o rhv-upload: set ovirt:id correctly
    resolves: rhbz#2152465
  - Enable the %check tests
  - -o kubevirt: Fix position of cpu field
    resolves: rhbz#2162331
  - -o kubevirt: Fix incorrect error message
    resolves: rhbz#2162441
  - -o kubevirt: Error if invalid guest name on target
    resolves: rhbz#2162332
  - -o kubevirt: Enable -oo compressed option
    resolves: rhbz#2162444
  - Remove -oo qemu-boot option completely
    resolves: rhbz#2166565
  - Remove warning when converting Rocky Linux
    resolves: rhbz#2166618
  - Fix kernel panic after converting Rocky Linux 9
    resolves: rhbz#2166619


author: Laszlo Ersek <lersek@redhat.com> - 1:2.2.0-6
changelog:
  - cope with kernel-core / kernel-modules-core subpackage split in RHEL-9.2 guests
    resolves: rhbz#2184970


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.3.4-2
changelog:
  - Rebase to virt-v2v 2.3.4
    resolves: rhbz#2187961, rhbz#2175703, rhbz#2172075, rhbz#2168082,
    rhbz#1986386
  - Remove --block-driver option downstream
    resolves: rhbz#2190387


author: Laszlo Ersek <lersek@redhat.com> - 1:2.3.4-3
changelog:
  - recognize "--key /dev/mapper/VG-LV:key:password"
  - enable the %check tests for real
    resolves: rhbz#2168506


author: Laszlo Ersek <lersek@redhat.com> - 1:2.3.4-5
changelog:
  - improve UX when running as root and we can't chown v2v tmpdir or socks
  - make the appliance kernel UP in %check, for working around RHBZ#2216496
    resolves: rhbz#2182024


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.4.0-2
changelog:
  - Rebase to virt-v2v 2.4.0
  - -it ssh: Double quote ssh command which tests remote file exists
    resolves: RHEL-12105
  - Implement --key all:...
    resolves: RHEL-18142
  - Fix off-by-one error causing rare crash
    resolves: RHEL-19061
  - Improve the error message for -i vmx with a .vmdk file
    resolves: RHEL-19564
  - Fix -i vmx when remote filename contains literal '*'
    resolves: RHEL-21365
  - Fix virt-v2v --version output
    resolves: RHEL-22262


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.4.0-3
changelog:
  - Fixes to improve installation of QEMU Guest Agent and removal
    of VMware Tools
    resolves: RHEL-54150, RHEL-54151
  - Allow --mac gw and len fields to be optional
    resolves: RHEL-54152


author: Eduard Abdullin <eabdullin@almalinux.org> - 1:2.4.0-4.alma.1
changelog:
  - convert: windows: Online all virtio disks at first boot
  - Add warning about virt-v2v-in-place not being supported


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.5.6-1
changelog:
  - Further fixes for QEMU Guest Agent
    resolves: RHEL-49761
  - Place Windows firstboot files under C:\Program Files\Guestfs\Firstboot
  - Improve debugging output


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.5.6-3
changelog:
  - Further fixes for QEMU Guest Agent install & VMware Tools removal
    resolves: RHEL-49761, RHEL-51169


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.5.6-8
changelog:
  - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper
    resolves: RHEL-78844
  - convert: Use yum/apt/... for package removals
    resolves: RHEL-78842


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.5.4-2
changelog:
  - Package virt-v2v-in-place in libexec as unsupported tool
  - Add warning about virt-v2v-in-place not being supported
    resolves: RHEL-40903
  - Add more fields to virt-inspector output
    related: MTV-1079
  - Revert "docs: Remove paragraph about -ip passwords and ssh/scp"
    resolves: RHEL-45527


author: Darren Archibald <darren.archibald@oracle.com> - 1:2.5.6-8
changelog:
  - Migration Plan / vddk pod cannot remove open-vm-tools in case of dependencies
    Resolves: RHEL-78842
  - CentOS 9 Migration from VMWare to Openshift Virt fails
    Resolves: RHEL-78844


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.5.9-1
changelog:
  - Rebase to upstream development version 2.5.9
  - Fix display of incorrect Windows 11 version
    resolves: RHEL-56784
  - Add customization options for post-conversion modification
    resolves: RHEL-55761
  - convert: windows: Ignore sriov drivers on virtio-win disk
    resolves: RHEL-56383


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.7.1-5
changelog:
  - Rebase to upstream development version 2.7.1
    resolves: RHEL-56813
  - Replace Jansson with json-c
    resolves: RHEL-65296
  - Find drivers for win2025 guests
    resolves: RHEL-65010
  - in-place: Add new -O option to write inspector XML
    resolves: RHEL-58032
  - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper
    resolves: RHEL-77989
  - convert: Use yum/apt/... for package removals
    resolves: RHEL-71522
  - Fix failure if the kernel-source package is installed in the source VM
    resolves: RHEL-80080


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.7.1-16
changelog:
  - mlcustomize: Remove dnf --verbose option
    resolves: RHEL-83289
  - Print blkhash of converted image in virt-v2v debugging output
    resolves: RHEL-85512
  - Print nbdcopy command in debug output
    resolves: RHEL-86022
  - Turn live domain error into a warning
    resolves: RHEL-88543
  - Remove usage of nbdkit-cacheextents-filter
    resolves: RHEL-88857
  - Print better mountpoint stats in debug output
    resolves: RHEL-88861
  - Remove several ancient, deprecated options
    resolves: RHEL-88866
  - New tool: virt-v2v-open
    resolves: RHEL-88985
  - Remove virt-v2v -io vddk-noextents=true option
    resolves: RHEL-102618
  - Fix installation of drivers on firstboot with pending reboots
    resolves: RHEL-100682


author: Debarshi Ray <rishi@fedoraproject.org> - 0.64.2-1
changelog:
  - Update to 0.64.2
  - Add missing _VTE_CXX_NOEXCEPT to downstream patches (#1973174)
  - Fix the License fields and ship the correct license texts (#1973299)


author: Michal Ruprich <mruprich@redhat.com> - 1:3.4.10-4
changelog:
  - Resolves: #2152064 - CVE-2022-3190 wireshark: f5ethtrailer Infinite loop in legacy style dissector


author: Michal Ruprich <mruprich@redhat.com> - 1:3.4.10-5
changelog:
  - Resolves: #2210864 - Candump log file parser crash
    Resolves: #2210865 - VMS TCPIPtrace file parser crash
    Resolves: #2210868 - NetScaler file parser crash
    Resolves: #2210870 - RTPS dissector crash
    Resolves: #2210871 - IEEE C37.118 Synchrophasor dissector crash


author: Mat Booth <mat.booth@redhat.com> - 4.15-5
changelog:
  - Remove springframework conditionals, the deps are a long time removed from
    Fedora and this simplifies the spec a bit
  - Disable unused modules that can't build on JDK 11


author: Michal Srb <michal@redhat.com> - 1.51.0-16
changelog:
  - Drop bundled expat and build against libxml2
  - Resolves: CVE-2022-25235
  - Resolves: CVE-2022-25236


author: Jakub Hrozek <jhrozek@redhat.com> - 1.2.29-7
changelog:
  - compile without sha1 and md5
  - Resolves: rhbz#1936682 - xmlsec1 implements and/or uses the deprecated
                             SHA-1 algorithm by default


author: Merlin Mathesius <mmathesi@redhat.com> - 0:2.7.0-6
changelog:
  - Fix FTBFS by patching ValueAssertTest to adjust for changed format of
    mismatched string exception


author: Peter Hutterer <peter.hutterer@redhat.com> 1.0.1-2
changelog:
  - xf86-input-libinput 1.0.1 (#1951879)
  - Fix the upstream source URL
  - Use autosetup instead of manual patch handling


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.0.0-5
changelog:
  - Emulate a zero axis events after REL_WHEEL (RHEL-153540)
  - Fix ToolSerials assignment for serials greater than INT_MAX (RHEL-153532)


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.9-5
changelog:
  Fix for CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
    CVE-2024-0408, CVE-2024-0409


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-3
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-80204), CVE-2025-26595 (RHEL-80187),
                 CVE-2025-26596 (RHEL-80190), CVE-2025-26597 (RHEL-80193),
                 CVE-2025-26598 (RHEL-80195), CVE-2025-26599 (RHEL-80202),
                 CVE-2025-26600 (RHEL-80203), CVE-2025-26601 (RHEL-80207)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-4
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97288), CVE-2025-49176 (RHEL-97334),
                 CVE-2025-49177 (RHEL-97357), CVE-2025-49178 (RHEL-97393),
                 CVE-2025-49179 (RHEL-97404), CVE-2025-49180 (RHEL-97244)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-5
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119977), CVE-2025-62230 (RHEL-120023),
                 CVE-2025-62231 (RHEL-125018)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-5
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119974), CVE-2025-62230 (RHEL-120021),
                 CVE-2025-62231 (RHEL-125017)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-6
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163198
    Resolves: https://redhat.atlassian.net/browse/RHEL-163294
    Resolves: https://redhat.atlassian.net/browse/RHEL-163252


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-3
changelog:
  - Fix a regression in Xwayland 24.1.9 with XTS test Xlib10
    Resolves: https://redhat.atlassian.net/browse/RHEL-170368


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-4
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163199
    Resolves: https://redhat.atlassian.net/browse/RHEL-163295
    Resolves: https://redhat.atlassian.net/browse/RHEL-163253


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-4.1
changelog:
  - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258,
                 CVE-2026-50259, CVE-2026-50260, CVE-2026-50261,
                 CVE-2026-50262, CVE-2026-50263
    Resolves: https://redhat.atlassian.net/browse/RHEL-182426


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-3
changelog:
  - Fix a regression in Xwayland 24.1.9 with XTS test Xlib10
    Resolves: https://redhat.atlassian.net/browse/RHEL-169765


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-4
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163200
    Resolves: https://redhat.atlassian.net/browse/RHEL-163296
    Resolves: https://redhat.atlassian.net/browse/RHEL-163254


author: José Expósito <jexposit@redhat.com> - 1.20.11-22
changelog:
  - CVE fix for: CVE-2023-6377, CVE-2023-6478
    Resolves: https://issues.redhat.com/browse/RHEL-18322
    Resolves: https://issues.redhat.com/browse/RHEL-18329


author: José Expósito <jexposit@redhat.com> - 1.20.11-23
changelog:
  - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
    CVE-2024-0408 and CVE-2024-0409
    Resolves: https://issues.redhat.com/browse/RHEL-21203
    Resolves: https://issues.redhat.com/browse/RHEL-20531
    Resolves: https://issues.redhat.com/browse/RHEL-20380
    Resolves: https://issues.redhat.com/browse/RHEL-20386
    Resolves: https://issues.redhat.com/browse/RHEL-21193
    Resolves: https://issues.redhat.com/browse/RHEL-21200


author: José Expósito <jexposit@redhat.com> - 1.20.11-25
changelog:
  - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and
    CVE-2024-31083
  - Add util-linux as a dependency of Xvfb
  - Fix compilation error on i686


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-28
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-80201), CVE-2025-26595 (RHEL-80186),
                 CVE-2025-26596 (RHEL-80188), CVE-2025-26597 (RHEL-80191),
                 CVE-2025-26598 (RHEL-80192), CVE-2025-26599 (RHEL-80199),
                 CVE-2025-26600 (RHEL-80198), CVE-2025-26601 (RHEL-80200)


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.11-30
changelog:
  - xfree86: Fix potentially NULL reference to platform device's PCI device
    Resolves: https://issues.redhat.com/browse/RHEL-84253


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-31
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97285), CVE-2025-49176 (RHEL-97308),
                 CVE-2025-49178 (RHEL-97387), CVE-2025-49179 (RHEL-97409),
                 CVE-2025-49180 (RHEL-97253)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-32
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119963), CVE-2025-62230 (RHEL-120035),
                 CVE-2025-62231 (RHEL-125003)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-32
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119960), CVE-2025-62230 (RHEL-120033),
                 CVE-2025-62231 (RHEL-125002)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-33
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163225
    Resolves: https://redhat.atlassian.net/browse/RHEL-163307
    Resolves: https://redhat.atlassian.net/browse/RHEL-163238


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-34
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163226
    Resolves: https://redhat.atlassian.net/browse/RHEL-163308
    Resolves: https://redhat.atlassian.net/browse/RHEL-163239


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-34.1
changelog:
  - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258,
                 CVE-2026-50259, CVE-2026-50260, CVE-2026-50261,
                 CVE-2026-50262, CVE-2026-50263, CVE-2026-50264
    Resolves: https://redhat.atlassian.net/browse/RHEL-182435


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-34
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163227
    Resolves: https://redhat.atlassian.net/browse/RHEL-163309
    Resolves: https://redhat.atlassian.net/browse/RHEL-163240


author: Vladis Dronov <vdronov@redhat.com> - 0.8.2-1
changelog:
  - Update to version 0.8.2
  - Drop patch 1-fix-man-page-installation.patch
  - Use SPDX license identifiers


author: Kalev Lember <klember@redhat.com> - 2:40~beta-2
changelog:
  - Drop libtool as-needed hack as as-needed is in default LDFLAGS now
  - Remove unneeded ldconfig_scriptlets macro call
  - Tighten soname globs


author: Matej Mužila <mmuzila@redhat.com> - 1.2.11-34
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.11-37
changelog:
  - Rebased Power 8 optimization patches
  - Fix for Unnecessary IFUNC resolver for crc32_z
  - Fix for python3.11 broken libxml2 and lxml on s390x


