# changelog

author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.68.3
   - FDE: LP: #2101834 snapd 2.68+ and snap-bootstrap <2.68 fallback to
     old keyring path
   - Fix Plucky snapd deb build issue related to /var/lib/snapd/void
     permissions
   - Fix snapd deb build complaint about ifneq with extra bracket


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.68.4
   - Snap components: LP: #2104933 workaround for classic 24.04/24.10
     models that incorrectly specify core22 instead of core24
   - Update build dependencies


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.69
   - FDE: re-factor listing of the disks based on run mode model and
     model to correctly resolve paths
   - FDE: run snapd from snap-failure with the correct keyring mode
   - Snap components: allow remodeling back to an old snap revision
     that includes components
   - Snap components: fix remodel to a kernel snap that is already
     installed on the system, but not the current kernel due to a
     previous remodel.
   - Snap components: fix for snapctl inputs that can crash snapd
   - Confdb (experimental): load ephemeral data when reading data via
     snapctl get
   - Confdb (experimental): load ephemeral data when reading data via
     snap get
   - Confdb (experimental): rename {plug}-view-changed hook to observe-
     view-{plug}
   - Confdb (experimental): rename confdb assertion to confdb-schema
   - Confdb (experimental): change operator grouping in confdb-control
     assertion
   - Confdb (experimental): add confdb-control API
   - AppArmor: extend the probed features to include the presence of
     files, as well as directories
   - AppArmor prompting (experimental): simplify the listener
   - AppArmor metadata tagging (disabled): probe parser support for
     tags
   - AppArmor metadata tagging (disabled): implement notification
     protocol v5
   - Confidential VMs: sysroot.mount is now dynamically created by
     snap-bootstrap instead of being a static file in the initramfs
   - Confidential VMs: Add new implementation of snap integrity API
   - Non-suid snap-confine: first phase to replace snap-confine suid
     with capabilities to achieve the required permissions
   - Initial changes for dynamic security profiles updates
   - Provide snap icon fallback for /v2/icons without requiring network
     access at runtime
   - Add eMMC gadget update support
   - Support reexec when using /usr/libexec/snapd on the host (Arch
     Linux, openSUSE)
   - Auto detect snap mount dir location on unknown distributions
   - Modify snap-confine AppArmor template to allow all glibc HWCAPS
     subdirectories to prevent launch errors
   - LP: #2102456 update secboot to bf2f40ea35c4 and modify snap-
     bootstrap to remove usage of go templates to reduce size by 4MB
   - Fix snap-bootstrap to mount kernel snap from
     /sysroot/writable/system-data
   - LP: #2106121 fix snap-bootstrap busy loop
   - Fix encoding of time.Time by using omitzero instead of omitempty
     (on go 1.24+)
   - Fix setting snapd permissions through permctl for openSUSE
   - Fix snap struct json tags typo
   - Fix snap pack configure hook permissions check incorrect file mode
   - Fix gadget snap reinstall to honor existing sizes of partitions
   - Fix to update command line when re-executing a snapd tool
   - Fix 'snap validate' of specific missing newline and add error on
     missed case of 'snap validate --refresh' without another action
   - Workaround for snapd-confine time_t size differences between
     architectures
   - Disallow pack and install of snapd, base and os with specific
     configure hooks
   - Drop udev build dependency that is no longer required and add
     missing systemd-dev dependency
   - Build snap-bootstrap with nomanagers tag to decrease size by 1MB
   - Interfaces: polkit | support custom polkit rules
   - Interfaces: opengl | LP: #2088456 fix GLX on nvidia when xorg is
     confined by AppArmor
   - Interfaces: log-observe | add missing udev rule
   - Interfaces: hostname-control | fix call to hostnamectl in core24
   - Interfaces: network-control | allow removing created network
     namespaces
   - Interfaces: scsi-generic | re-enable base declaration for scsi-
     generic plug
   - Interfaces: u2f | add support for Arculus AuthentiKey


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.70
   - FDE: Fix reseal with v1 hook key format
   - FDE: set role in TPM keys
   - AppArmor prompting (experimental): add handling for expired
     requests or listener in the kernel
   - AppArmor prompting: log the notification protocol version
     negotiated with the kernel
   - AppArmor prompting: implement notification protocol v5 (manually
     disabled for now)
   - AppArmor prompting: register listener ID with the kernel and
     resend notifications after snapd restart (requires protocol v5+)
   - AppArmor prompting: select interface from metadata tags and set
     request interface accordingly (requires protocol v5+)
   - AppArmor prompting: include request PID in prompt
   - AppArmor prompting: move the max prompt ID file to a subdirectory
     of the snap run directory
   - AppArmor prompting: avoid race between closing/reading socket fd
   - Confdb (experimental): make save/load hooks mandatory if affecting
     ephemeral
   - Confdb: clear tx state on failed load
   - Confdb: modify 'snap sign' formats JSON in assertion bodies (e.g.
     confdb-schema)
   - Confdb: add NestedEphemeral to confdb schemas
   - Confdb: add early concurrency checks
   - Simplify building Arch package
   - Enable snapd.apparmor on Fedora
   - Build snapd snap with libselinux
   - Emit snapd.apparmor warning only when using apparmor backend
   - When running snap, on system key mismatch e.g. due to network
     attached HOME, trigger and wait for a security profiles
     regeneration
   - Avoid requiring state lock to get user, warnings, or pending
     restarts when handling API requests
   - Start/stop ssh.socket for core24+ when enabling/disabling the ssh
     service
   - Allow providing a different base when overriding snap
   - Modify snap-bootstrap to mount snapd snap directly to /snap
   - Modify snap-bootstrap to mount /lib/{modules,firmware} from snap
     as fallback
   - Modify core-initrd to use systemctl reboot instead of /sbin/reboot
   - Copy the initramfs 'manifest-initramfs.yaml' to initramfs file
     creation directory so it can be copied to the kernel snap
   - Build the early initrd from installed ucode packages
   - Create drivers tree when remodeling from UC20/22 to UC24
   - Load gpio-aggregator module before the helper-service needs it
   - Run 'systemctl start' for mount units to ensure they are run also
     when unchanged
   - Update godbus version to 'v5 v5.1.0'
   - Add support for POST to /v2/system-info with system-key-mismatch
     indication from the client
   - Add 'snap sign --update-timestamp' flag to update timestamp before
     signing
   - Add vfs support for snap-update-ns to use to simulate and evaluate
     mount sequences
   - Add refresh app awareness debug logging
   - Add snap-bootstrap scan-disk subcommand to be called from udev
   - Add feature to inject proxy store assertions in build image
   - Add OP-TEE bindings, enable by default in ARM and ARM64 builds
   - Fix systemd dependency options target to go under 'unit' section
   - Fix snap-bootstrap reading kernel snap instead of base resulting
     in bad modeenv
   - Fix a regression during seeding when using early-config
   - LP: #2107443 reset SHELL to /bin/bash in non-classic snaps
   - Make Azure kernels reboot upon panic
   - Fix snap-confine to not drop capabilities if the original user is
     already root
   - Fix data race when stopping services
   - Fix task dependency issue by temporarily disable re-refresh on
     prerequisite updates
   - Fix compiling against op-tee on armhf
   - Fix dbx update when not using FDE
   - Fix potential validation set deadlock due to bases waiting on
     snaps
   - LP: #2104066 Only cancel notices requests on stop/shutdown
   - Interfaces: bool-file | fix gpio glob pattern as required for
     '[XXXX]*' format
   - Interfaces: system-packages-doc | allow access to
     /usr/local/share/doc
   - Interfaces: ros-snapd-support interface | added new interface
   - Interfaces: udisks2 | allow chown capability
   - Interfaces: system-observe | allow reading cpu.max
   - Interfaces: serial-port | add ttyMAXX to allowed list
   - Interfaces: modified seccomp template to disallow
     'O_NOTIFICATION_PIPE'
   - Interfaces: fwupd | add support for modem-manager plugin
   - Interfaces: gpio-chardev | make unsupported and remove
     experimental flag to hide this feature until gpio-aggregator is
     available
   - Interfaces: hardware-random | fix udev match rule
   - Interfaces: timeserver-control | extend to allow timedatectl
     timesync commands
   - Interfaces: add symlinks backend
   - Interfaces: system key mismatch handling


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.71
   - FDE: auto-repair when recovery key is used
   - FDE: revoke keys on shim update
   - FDE: revoke old TPM keys when dbx has been updated
   - FDE: do not reseal FDE hook keys every time
   - FDE: store keys in the kernel keyring when installing from initrd
   - FDE: allow disabled DMA on Core
   - FDE: snap-bootstrap: do not check for partition in scan-disk on
     CVM
   - FDE: support secboot preinstall check for 25.10+ hybrid installs
     via the /v2/system/{label} endpoint
   - FDE: support generating recovery key at install time via the
     /v2/systems/{label} endpoint
   - FDE: update passphrase quality check at install time via the
     /v2/systems/{label} endpoint
   - FDE: support replacing recovery key at runtime via the new
     /v2/system-volumes endpoint
   - FDE: support checking recovery keys at runtime via the /v2/system-
     volumes endpoint
   - FDE: support enumerating keyslots at runtime via the /v2/system-
     volumes endpoint
   - FDE: support changing passphrase at runtime via the /v2/system-
     volumes endpoint
   - FDE: support passphrase quality check at runtime via the
     /v2/system-volumes endpoint
   - FDE: update secboot to revision 3e181c8edf0f
   - Confdb: support lists and indexed paths on read and write
   - Confdb: alias references must be wrapped in brackets
   - Confdb: support indexed paths in confdb-schema assertion
   - Confdb: make API errors consistent with options
   - Confdb: fetch confdb-schema assertion on access
   - Confdb: prevent --previous from being used in read-side hooks
   - Components: fix snap command with multiple components
   - Components: set revision of seed components to x1
   - Components: unmount extra kernel-modules components mounts
   - AppArmor Prompting: add lifespan "session" for prompting rules
   - AppArmor Prompting: support restoring prompts after snapd restart
   - AppArmor Prompting: limit the extra information included in probed
     AppArmor features and system key
   - Notices: refactor notice state internals
   - SELinux: look for restorecon/matchpathcon at all known locations
     rather than current PATH
   - SELinux: update policy to allow watching cgroups (for RAA), and
     talking to user session agents (service mgmt/refresh)
   - Refresh App Awareness: Fix unexpected inotify file descriptor
     cleanup
   - snap-confine: workaround for glibc fchmodat() fallback and handle
     ENOSYS
   - snap-confine: add support for host policy for limiting users able
     to run snaps
   - LP: #2114923 Reject system key mismatch advise when not yet seeded
   - Use separate lanes for essential and non-essential snaps during
     seeding and allow non-essential installs to retry
   - Fix bug preventing remodel from core18 to core18 when snapd snap
     is unchanged
   - LP: #2112551 Make removal of last active revision of a snap equal
     to snap remove
   - LP: #2114779 Allow non-gpt in fallback mode to support RPi
   - Switch from using systemd LogNamespace to manually controlled
     journal quotas
   - Change snap command trace logging to only log the command names
   - Grant desktop-launch access to /v2/snaps
   - Update code for creating the snap journal stream
   - Switch from using core to snapd snap for snap debug connectivity
   - LP: #2112544 Fix offline remodel case where we switched to a
     channel without an actual refresh
   - LP: #2112332 Exclude snap/snapd/preseeding when generating preseed
     tarball
   - LP: #1952500 Fix snap command progress reporting
   - LP: #1849346 Interfaces: kerberos-tickets |  add new interface
   - Interfaces: u2f | add support for Thetis Pro
   - Interfaces: u2f | add OneSpan device and fix older device
   - Interfaces: pipewire, audio-playback | support pipewire as system
     daemon
   - Interfaces: gpg-keys | allow access to GPG agent sockets
   - Interfaces: usb-gadget | add new interface
   - Interfaces: snap-fde-control, firmware-updater-support | add new
     interfaces to support FDE
   - Interfaces: timezone-control | extend to support timedatectl
     varlink
   - Interfaces: cpu-control | fix rules for accessing IRQ sysfs and
     procfs directories
   - Interfaces: microstack-support | allow SR-IOV attachments
   - Interfaces: modify AppArmor template to allow snaps to read their
     own systemd credentials
   - Interfaces: posix-mq | allow stat on /dev/mqueue
   - LP: #2098780 Interfaces: log-observe | add capability
     dac_read_search
   - Interfaces: block-devices | allow access to ZFS pools and datasets
   - LP: #2033883 Interfaces: block-devices | opt-in access to
     individual partitions
   - Interfaces: accel | add new interface to support accel kernel
     subsystem
   - Interfaces: shutdown | allow client to bind on its side of dbus
     socket
   - Interfaces: modify seccomp template to allow pwritev2
   - Interfaces: modify AppArmor template to allow reading
     /proc/sys/fs/nr_open
   - Packaging: drop snap.failure service for openSUSE
   - Packaging: add SELinux support for openSUSE
   - Packaging: disable optee when using nooptee build tag
   - Packaging: add support for static PIE builds in snapd.mk, drop
     pie.patch from openSUSE
   - Packaging: add libcap2-bin runtime dependency for ubuntu-16.04
   - Packaging: use snapd.mk for packaging on Fedora
   - Packaging: exclude .git directory
   - Packaging: fix DPKG_PARSECHANGELOG assignment
   - Packaging: fix building on Fedora with dpkg installed


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.72
   - FDE: support replacing TPM protected keys at runtime via the
     /v2/system-volumes endpoint
   - FDE: support secboot preinstall check fix actions for 25.10+
     hybrid installs via the /v2/system/{label} endpoint
   - FDE: tweak polkit message to remove jargon
   - FDE: ensure proper sealing with kernel command line defaults
   - FDE: provide generic reseal function
   - FDE: support using OPTEE for protecting keys, as an alternative to
     existing fde-setup hooks (Ubuntu Core only)
   - Confdb: 'snapctl get --view' supports passing default values
   - Confdb: content sub-rules in confdb-schemas inherit their parent
     rule's "access"
   - Confdb: make confdb error kinds used in API more generic
   - Confdb: fully support lists and indexed paths (including unset)
   - Prompting: add notice backend for prompting types (unused for now)
   - Prompting: include request cgroup in prompt
   - Prompting: handle unsupported xattrs
   - Prompting: add permission mapping for the camera interface
   - Notices: read notices from state without state lock
   - Notices: add methods to get notice fields and create, reoccur, and
     deepcopy notice
   - Notices: add notice manager to coordinate separate notice backends
   - Notices: support draining notices from state when notice backend
     registered as producer of a particular notice type
   - Notices: query notice manager from daemon instead of querying
     state for notices directly
   - Packaging: Ubuntu | ignore .git directory
   - Packaging: FIPS | bump deb Go FIPS to 1.23
   - Packaging: snap | bump FIPS toolchain to 1.23
   - Packaging: debian | sync most upstream changes
   - Packaging: debian-sid | depends on libcap2-bin for postint
   - Packaging: Fedora | drop fakeroot
   - Packaging: snap | modify snapd.mk to pass build tags when running
     unit tests
   - Packaging: snap | modify snapd.mk to pass nooptee build tag
   - Packaging: modify Makefile.am to fix snap-confine install profile
     with 'make hack'
   - Packaging: modify Makefile.am to fix out-of-tree use of 'make
     hack'
   - LP: #2122054 Snap installation: skip snap icon download when
     running in a cloud or using a proxy store
   - Snap installation: add timeout to http client when downloading
     snap icon
   - Snap installation: use http(s) proxy for icon downloads
   - LP: #2117558 snap-confine: fix error message with /root/snap not
     accessible
   - snap-confine: fix non-suid limitation by switching to root:root to
     operate v1 freezer
   - core-initrd: do not use writable-paths when not available
   - core-initrd: remove debian folder
   - LP: #1916244 Interfaces: gpio-chardev | re-enable the gpio-chardev
     interface now with the more robust gpio-aggregator configfs kernel
     interface
   - Interfaces: gpio-chardev | exclusive snap connections, raise a
     conflict when both gpio-chardev and gpio are connected
   - Interfaces: gpio-chardev | fix gpio-aggregator module load order
   - Interfaces: ros-snapd-support | grant access to /v2/changes
   - Interfaces: uda-driver-libs, egl-driver-libs, gbm-driver-libs,
     opengl-driver-libs, opengles-driver-libs | new interfaces to
     support nvidia driver components
   - Interfaces: microstack-support | allow DPDK (hugepage related
     permissions)
   - Interfaces: system-observe | allow reading additional files in
     /proc, needed by node-exporter
   - Interfaces: u2f | add Cano Key, Thesis FIDO2 BioFP+ Security Key
     and Kensington VeriMark DT Fingerprint Key to device list
   - Interfaces: snap-interfaces-requests-control | allow shell API
     control
   - Interfaces: fwupd | allow access to Intel CVS sysfs
   - Interfaces: hardware-observe | allow read access to Kernel
     Samepage Merging (KSM)
   - Interfaces: xilinx-dma | support Multi Queue DMA (QDMA) IP
   - Interfaces: spi | relax sysfs permission rules to allow access to
     SPI device node attributes
   - Interfaces: content | introduce compatibility label
   - LP: #2121238 Interfaces: do not expose Kerberos tickets for
     classic snaps
   - Interfaces: ssh-public-keys | allow ro access to public host keys
     with ssh-key
   - Interfaces: Modify AppArmor template to allow listing systemd
     credentials and invoking systemd-creds
   - Interfaces: modify AppArmor template with workarounds for Go 1.35
     cgroup aware GOMAXPROCS
   - Interfaces: modify seccomp template to allow landlock_*
   - Prevent snap hooks from running while relevant snaps are unlinked
   - Make refreshes wait before unlinking snaps if running hooks can be
     affected
   - Fix systemd unit generation by moving "WantedBy=" from section
     "unit" to "install"
   - Add opt-in logging support for snap-update-ns
   - Unhide 'snap help' sign and export-key under Development category
   - LP: #2117121 Cleanly support socket activation for classic snap
   - Add architecture to 'snap version' output
   - Add 'snap debug api' option to disable authentication through
     auth.json
   - Show grade in notes for 'snap info --verbose'
   - Fix preseeding failure due to scan-disk issue on RPi
   - Support 'snap debug api' queries to user session agents
   - LP: #2112626 Improve progress reporting for snap install/refresh
   - Drop legacy BAMF_DESKTOP_FILE_HINT in desktop files
   - Fix /v2/apps error for root user when user services are present
   - LP: #2114704 Extend output to indicate when snap data snapshot was
     created during remove
   - Improve how we handle emmc volumes
   - Improve handling of system-user extra assertions


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.74.1
   - FDE: measure DeployedMode and AuditMode variables if they appear
     as disabled in the event log to avoid a potential reseal-failure
     boot loop
   - LP: #2139611 FDE: fix db updates by allowing multiple payloads
   - LP: #2139300 snap-confine: add CAP_SYS_RESOURCE to allow raising
     memory lock limit when required
   - LP: #2139099 snap-confine: bump the max element count of the BPF
     map used to store IDs of allowed/matched devices to 1000
   - Interfaces: Added pidfd_open and memfd_secret to seccomp template
   - Interfaces: camera | add locking permission for /dev/video


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.76
   - assertions: add helper for validating integrity data
   - assertions: drop incorrect/non-standard Ed25519 support
   - confdb: allow only API admin read access to confdb secrets
   - confdb: block concurrent confdb accesses
   - confdb: block concurrent snapctl accesses to configuration
     database
   - confdb: check for ephemeral data when missing save-view hook on
     commit
   - confdb: ignore not-found errors in confdb-schema refreshes
   - confdb: support --wait-for timeouts when accessing confdb
   - core-initrd: add group referenced in udev rules
   - core-initrd: add libbpf dependency to initramfs
   - core-initrd: add missing libbpf dependency in 24.04 packaging
   - core-initrd: ensure audio is a system group
   - core-initrd: fix /boot/uboot mount with u-boot env in dedicated
     partition
   - core-initrd: increase mount burst from 5 to 128 for faster boot
   - core-initrd: sync partition udev rules with the ones in core-base
   - core-initrd: sync with latest upload to snappy-dev PPA
   - core-initrd: synchronize changelogs with latest PPA upload
   - core-initrd: update changelog with latest PPA upload
   - LP: #2150773 core-initrd: add nfnetlink module to fix nf netlink
     socket speed regression (Ubuntu Core only)
   - cross-distro: allow snapd to manipulate systemd unit files in
     SELinux policy
   - cross-distro: FIPS bootstrap and dispatch via snap-fips-dispatch
   - desktop: fix common ID selection with multiple desktop plugs
   - FDE: allow user mode on core in secboot TPM handling
   - FDE: bump go-efilib dependency
   - FDE: bump secboot to rev cdcb64992e54 for FDE fixes
   - FDE: deprecate check-pin/passphrase API endpoints
   - LP: #2147606 FDE: give inactive state on classic
   - FDE: improve tracing for OP-TEE probing
   - FDE: move auto-repair logic to overlord/fdestate and provide state
   - FDE: update secboot for TPM/FDE bug fixes including Intel HAP and
     recovery key parsing
   - FDE: use any primary key matching digest when adding a keyslot
   - FDE: use ignore action for preinstall check in VM
   - interfaces: bluez | drop explicit deny send_destination in D-Bus
     configuration
   - interfaces: conditionally deny /proc/self/mountinfo to suppress Go
     1.25+ denials
   - interfaces: custom-device | fix for-device validation panic on
     non-string value
   - interfaces: disallow auto-connect to parallel installs
   - interfaces: docker | make plug implicit on classic systems
   - interfaces: ignore errors in disconnect hooks during explicit snap
     disconnect
   - interfaces: mediatek-accel | add plug interface base declaration
   - interfaces: microceph-support | suppress noisy sudo denial audit
     logs
   - interfaces: podman | add new interface for podman socket access
   - interfaces: pulseaudio | fix security tag syntax inconsistency
   - interfaces: raw-usb | allow USB device enumeration on Fairphone 5
     with NexDock
   - interfaces: restore auto-connections on failed refresh undo
   - LP: #2148544 interfaces: bool-file | support deep SoC sysfs paths
     for LED brightness
   - LP: #2139213 packaging: make Ubuntu 16.04 packaging dep17
     compliant
   - packaging: add cross-distro build script and instructions
   - packaging: add openSUSE 16.0 spread support
   - packaging: Debian build improvements
   - packaging: default openSUSE to /var/lib/snapd/snap and sync from
     downstream
   - packaging: drop transitional packages only for Ubuntu 26.04
     (Resolute)
   - packaging: fix Launchpad FIPS build detection for snapd-fips job
   - packaging: refactor and clean up snapd.mk, standardize test-data
     directories
   - packaging: switch to golang-github-chai2010-gettext-go-dev
   - packaging: update bundled AppArmor 4.1.7 (snapd snap only)
   - prompting: escape paths in prompt constraints
   - prompting: improve API error handling and validation
   - prompting: improve error message when no handler service is
     present
   - prompting: re-enable the prompting notice backend
   - prompting: respond with full user-allowed permission set
   - prompting: validate permissions while unmarshalling
   - remote device management: implement dispatch-mgmt-messages task
     with sequencing support
   - LP: #2125344 snap: avoid empty channel forwarding message
   - LP: #2150683 snap: clarify snap install help text for --classic
     and --devmode
   - LP: #2152908 snap: print complex attributes in snap interface
     --attrs output
   - snap: add run-inhibit hint and inhibit info when a snap is
     disabled
   - snap: allow removing a snap and its base at the same time
   - snap: display detailed component information in snap info
   - snap: extend AlreadyInstalledError to multiple snaps and
     components
   - snap: extend set-quota command options description with accepted
     value formats
   - snap: implement snap delta command for computing snap deltas
   - snap: improve consistency for snap install when some snaps are
     already installed
   - snap: show hint in snap list that a snap has components
   - snap-confine: allow inheriting unix sockets from snaps
   - snap-confine: allow linking to libm in AppArmor profile
   - snap-confine: fix out-of-bounds read in mountinfo parser for
     partial escape sequences
   - snap-confine: harden bpffs mount with nosuid, nodev, noexec flags
   - snap-confine: remove experimental persistent per-user mount
     namespace feature
   - snap-confine: set FD_CLOEXEC on file descriptors returned by BPF
     helpers
   - snap-confine: support transparent_hugepage in AppArmor profile
   - snap-confine: use strchr after NUL-terminating in infofile parser
   - snap-update-ns: switch to a multi-pass process for constructing
     and updating mount namespaces
   - RemoveMountUnitFile now unmounts even if mount unit file is
     missing
   - Add explicit mount phase during single-reboot refresh to fix undo
     of kernel refreshes
   - Add security audit logging subsystem
   - Add base prioritized AppArmmor snippets for strictly confined or
     jailed snaps
   - Allow openshell snap to use experimental daemon-scope: user
   - Allow configuring mount unit options based on filesystem type
   - Allow equals signs in uevent values in netlink parser
   - Also bind-mount directories modified by kmod backend during
     preseed
   - Clean up potentially corrupted files during snap download undo
   - Complete the bootloader environment implementation
   - Copy integrity data files during snap install
   - Create hook for seed refresh mode
   - Create removal tasks for old seed-refresh seeds
   - Dispatch systemctl commands asynchronously when calling Stop()
   - Ensure /tmp/.X11-unix created inside mount namespace has correct
     permissions
   - Ensure exclusive changes conflict with refresh/revert
   - Ensure existing snap confinement flags are not dropped when
     installing or removing components
   - Export ubuntu-boot-state filename constant from bootloader package
   - Fix duplicate removal of apps under $SNAP_MOUNT_DIR/bin
   - Fix integration between prerequisites task and seed-refresh mode
   - Fix split-refresh overwriting provided lane
   - Fix use of umask in GetListener for socket activation
   - Ignore net.ErrClosed during daemon shutdown
   - Implement ResolveValidationSetsEnforcementError in terms of one
     call
   - Improve snapctl install consistency when components are already
     installed
   - Inject seed creation tasks into snap refresh flow
   - Introduce system options for custom certificates on Ubuntu Core
   - Keep idle services with activation units stopped on reload
   - List snap components in snap-debug-info via debug-tools
   - Look at gadget.yaml instead of marker file to determine ubootpart
     usage
   - LP: #1966067 Skip redundant xdg-settings confirmation prompt when
     setting is already correct
   - LP: #2110368 Fix component installation for private snaps via
     snapctl
   - LP: #2110368 Fix download of private snap components by setting
     UserID
   - LP: #2144666 Fix mount namespace updates with synthetic bind
     mounts on same target paths
   - LP: #2146337 Improve handling of failed downloads and retain
     partial files for resume
   - LP: #2147207 Fix snap enable/disable cycle forgetting components
   - Make run-inhibit hint for kill-snap-apps task based on kill reason
   - Merge content-provider prerequisite updates into seed-refresh
   - Move SortServices into Backend.StartServices
   - Move state to client change conversion to ctlcmd package
   - Omit misleading "try to refresh snapd" suggestion for ISA-related
     errors
   - Only create link-component tasks when needed during refresh to
     existing revision
   - Reconfigure piboot bootloader on gadget refreshes to preserve
     os_prefix
   - Reduce the number of AppArmor profile regenerations during snap
     operations
   - Refactor seed-refresh ownership to devicestate
   - Regenerate certificate database on remodels
   - Remove obsolete FIXME comment in VersionCompare
   - Remove unused GenerateDmVerityData helper from snap/integrity
   - Rename and document error type for ISA assumes flags
   - Restart snapd from daemon.Stop to improve restart reliability
   - Restart stopped services on error in stopSnapServices for
     transactionality
   - Simplify certificate-db updates on model-base refresh/installs
   - Support racing Loop and Stop correctly in overlord
   - Support sending file descriptors to systemd via sd_notify
   - Unroll CPU-heavy recursive function in snap state handlers
   - Update seccomp syscalls list for kernel 7.1.0
   - Use change ID to prevent nested seed-refresh spawned by
     prerequisites
   - Validate content interface plug target directories exist for
     core26+ snaps
   - Validate layout paths exist in snap tree for snaps using bare or
     core26+


author: Neal Gompa <ngompa13@gmail.com> - 1.54-1
changelog:
  - Update to 1.54
  - Add API to get snap website
  - Add purge option to remove
  - Switch build system to Meson
  - Fix Qt build with optimisation disabled
  - Fix tests breaking on json-glib < 1.2.4
  - Use C99 style variable definitions


author: Neal Gompa <ngompa13@gmail.com> - 1.55-1
changelog:
  - Update to 1.55
  - Add new APIs for download and logout actions
  - Add support for snap store logout
  - Fix QSnapdAuthData () constructor not copying discharge strings correctly
  - Remove obsolete screenshot parsing code
  - Make all snapd 404 errors return SNAPD_ERROR_NOT_FOUND


author: Neal Gompa <ngompa13@gmail.com> - 1.57-1
changelog:
  - Update to 1.57
  - Add snapd_interface_make_label
  - Add support for new snap types: "core", "base" and "snapd"
  - Change way GTK documentation is generated to avoid a Meson bug
  - Fix leak in markdown parser
  - Fix leak in logout code
  - Make build reproducible by fixing comment in generated file


author: Neal Gompa <ngompa13@gmail.com> - 1.58-1
changelog:
  - Update to 1.58
  - Fix GIR annotations on snapd_client_get_snap_conf
  - Put more information into error messages for unknown errors


author: Neal Gompa <ngompa@fedoraproject.org> - 2.4.14-1
changelog:
  - Rebase to 2.4.14
  - Modernize packaging to current packaging guidelines
  - Drop unsupported devel content
  - Run test suite


author: Michel Alexandre Salim <salimma@fedoraproject.org> - 2.5.1-1
changelog:
  - Update to 2.5.1
  - Convert to SPDX license identifier
  - Add compat subpackage for snoopy-disable and snoopy-enable


author: Michel Lind <salimma@fedoraproject.org> - 2.5.1-6
changelog:
  - Remove compat subpackage on Fedora >= 42 and EPEL >= 10
  - Create Packit configuration to automate future updates


author: Dominik Mierzejewski <rpm@greysector.net> - 1.1.0-1
changelog:
  - update to 1.1.0 (#2026986)
  - fix exceptions when adding devices (#2008448, #2015360)
  - fix exception when applying settings fails (#2020706, #2022320)


author: Dominik Mierzejewski <rpm@greysector.net> - 1.1.2-1
changelog:
  - update to 1.1.2 (#2068769)
  - patch to lower evdev version requirement
  - add explicit build dependency on setuptools
  - sort build dependencies


author: Paul Howarth <paul@city-fan.org> - 0.4.0-11
changelog:
  - Replace /bin/* dependencies with coreutils etc. (#1512898)
  - Drop explicit paths for commands to aid spec readability
  - Drop EL-5 support
    - Drop legacy Group: and BuildRoot: tags
    - Drop explicit buildroot cleaning in %install section
    - Drop explicit %clean section
    - Noarch sub-packages are always available now


author: Paul Howarth <paul@city-fan.org> - 0.4.0-12
changelog:
  - Account for systemd-units being merged into systemd at Fedora 17
  - Drop support for SysV-to-systemd migration from Fedora 18, RHEL 7
  - Use forward-looking conditionals
  - One build requirement per line


author: Robert Scheck <robert@fedoraproject.org> 2.05-27
changelog:
  - Remove retired iXhash blacklists from default configuration
    and provide only example configuration (#2345751, #2346368)


author: Volker Fröhlich <volker27@gmx.at> - 1.9.2-1
changelog:
  - New upstream release
  - Use github as source
  - Use license macro and remove the now-gone README
  - Remove merged patch


author: Kevin Fenzi <kevin@scrye.com> - 1.0.4-1
changelog:
  - Update to 1.0.4. Fixes bug #1856063
  - Apply upstream commit to fix python2 compat on remote side. Fixes bug #1851622


author: Filipe Rosset <filiperosset@fedoraproject.org> - 2.3.1-1
changelog:
  - rebuilt for version 2.3.1 fixes rhbz#1856025 rhbz#2454296 rhbz#2128374
  - modernized packaging, enabled generator, templates, and libev support


author: Sandipan Roy <saroy@redhat.com> - 2.2.0-1
changelog:
  - Update to sslscan 2.2.0
  - Bump bundled OpenSSL to 3.5.0 (minimum supported upstream)
  - Fixes rhbz#2330567


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0^20240208gitb7cf124-1
changelog:
  - Update to 0^20240208gitb7cf124
  - stb_image-devel is updated to 2.29
  - stb_image_resize2-devel is updated to 2.05


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0^20251025gitf1c79c0-2
changelog:
  - Patch two newly-reported memory-safety bugs in stb_image
  - https://github.com/nothings/stb/issues/1860
  - https://github.com/nothings/stb/issues/1861


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0^20260313git904aa67-2
changelog:
  - Fix access/use of uninitialized memory in stb_image
  - This was undefined behavior, and could leak security-relevant information
    from other data structures. See
    https://github.com/nothings/stb/issues/1929.


author: Benjamin A. Beasley <code@musicinmybrain.net> - 17.1-1
changelog:
  - Update to 17.1 (close RHBZ#2356072)
  - The ppc64le version of Stockfish now uses VSX extensions (POWER8)


author: Petr Menšík <pemensik@redhat.com> - 0.4.2-2
changelog:
  - Private users do not work with dynamic users
  - Provide path to unbound-anchor key, but keep it commented out


author: Nils Philippsen <nils@tiptoe.de> - 0.10.18-1
changelog:
  - Update to 0.10.18
  - Fix license and URLs
  - Build with meson instead of waf
  - Fix typos and trailing white space
  - Use package name macro consistently


author: Antonio Trande <sagitter@fedoraproject.org> - 5.8.0-12
changelog:
  - Rebuild (rhbz#2171312)
  - Enable KLU-64 in EPEL9 (rhbz#20673760)
  - Disable PETSc support in 64-bit architectures


author: Tom Callaway <spot@fedoraproject.org> - 3.2.4-1
changelog:
  - update to 3.2.4
  - upstream renamed it to "swatchdog"
  - looks abandoned though, for at least 7 years


author: Tom Callaway <spot@fedoraproject.org> - 3.2.4-2
changelog:
  - add BR: perl-interpreter
  - Fix obsoletes to include release
  - Add license files properly
  - own weird auto directory
  - remove perl(:MODULE_COMPAT... requires, it is obsolete
  - sent patches upstream and include links to issues
  - Use only %{buildroot}
  - fix patch invocations to use "new" syntax


author: Ron Olson <tachoknight@gmail.com> - 6.0.2-1
changelog:
  - Updated to Swift 6.0.2-RELEASE
    Resolves: rhbz#2291122
    Resolves: rhbz#2322729
    Resolves: rhbz#2324076


author: Xavier Bachelot <xavier@bachelot.org> 6.2.68-1
changelog:
  - Update to 6.2.68
  - Dont unbundle jquery-ui on EL9
  - Use Archive::Zip::SimpleZip instead of Archive::Zip where available


author: Xavier Bachelot <xavier@bachelot.org> 6.2.70-2
changelog:
  - Fix sympasoap socket ownership for httpd (RHBZ#2152381)
  - Fix both wwwsympa and sympasoap socket ownership for nginx


author: Xavier Bachelot <xavier@bachelot.org> 6.2.72-4
changelog:
  - Tidy up BuildRequires/Requires
  - BR: tzdata, which is not pulled from dependencies on F39+ (RHBZ#2261742)


author: Xavier Bachelot <xavier@bachelot.org> 6.2.72-5
changelog:
  - Drop EL7 support
  - Fix filter ordering
  - Fix httpd config needed after httpd fix for CVE-2024-38477 (RHBZ#2307179)


author: Xavier Bachelot <xavier@bachelot.org> - 6.2.74-1
changelog:
  - Update to 6.2.74, fix for CVE-2024-55919
    - Full changelog: https://github.com/sympa-community/sympa/releases/tag/6.2.74


author: Michal Schorm <mschorm@redhat.com> - 6.2.76-1.3
changelog:
  - Rebuild without i686 architecture - MySQL 8.4 no longer supports it,
    so perl-DBD-MySQL no longer builds it


author: Xavier Bachelot <xavier@bachelot.org> - 6.2.78-1
changelog:
  - Update to 6.2.78
  - Turn conf sub-packages to noarch
  - Disable some SUID wrappers
  - Drop now useless cookie parameter creation on first install
  - Simplify initial conf creation
  - Install systemd drop-ins in %{_unitdir} (RHBZ#2415142)


author: Xavier Bachelot <xavier@bachelot.org> 1.0.20-11
changelog:
  - Fix build on EL9
  - egrep is deprecated, use grep -E instead in order to fix build on F38+
  - Drop conditionals for EL6


author: Peter Czanik <peter@czanik.hu> - 3.35.1-4
changelog:
  - initial minimal version for EPEL9
  - currently missing dependencies are: hiredis, libdbi, libesmtp,
    mongo-c-driver, paho-c
  - I plan to update it as missing dependencies become available


author: Robert Scheck <robert@fedoraproject.org> - 1.5.15-0.4.el9.1
changelog:
  - Transformed system-config-printer-1.5.15-4.el9 from RHEL 9.3 GA into
    system-config-printer-epel to achieve the missing system-config-printer
    and system-config-printer-applet packages


author: Dmitrij S. Kryzhevich <kryzhev@ispms.ru> - 1.20-1
changelog:
  - Update to new 1.20.
  - Fixed version in log for 1.19-1.
  - Fix filename in doc: README -> README.md.


author: Robert Scheck <robert@fedoraproject.org> - 1.7.21-6
changelog:
  - Disabled strip via objcopy to achieve proper -debuginfo package
  - Added patch to fix compiler warnings about implicit fall-through
  - Added patch to fix "ee key too small" error messages during tests
  - Added patch for OpenSSL 3.0 support (#2088363)


author: Bojan Smojver <bojan@rexursive com> - 4.4.2-1
changelog:
  - bump up to 4.4.2
  - CVE-2022-27939, CVE-2022-27940, CVE-2022-27941, CVE-2022-27942,
  - CVE-2022-28487, CVE-2022-37047, CVE-2022-37048, CVE-2022-37049


author: Bojan Smojver <bojan@rexursive com> - 4.4.3-3
changelog:
  - CVE-2023-27783 CVE-2023-27784 CVE-2023-27785 CVE-2023-27786
    CVE-2023-27787 CVE-2023-27788 CVE-2023-27789


author: Bojan Smojver <bojan@rexursive com> - 4.5.1-5
changelog:
  - Drop unknown configure option --enable-tcpreplay-edit
  - Change tcpdump dependency to package
  - Remove checks for TX_RING support to avoid build problems


author: David King <amigadave@amigadave.com> - 2.1.1-4
changelog:
  - Own more directories
  - Be consistent with use of %{buildroot}
  - Tighten globs in files list
  - Avoid unnecessary gtk-update-icon-cache
  - Use %find_lang for locales
  - Add license and documentation
  - Import the module during %check
  - Verify GPG signature of sources


author: Ding-Yi Chen <dchen@redhat.com> - 1.10.0-1
changelog:
  - Upstream update to 1.10.0
  - Fixes RHBZ #1917603 - terminology-1.10.0 is available
  - Remove BuildRequired elementary-devel because it is merged into efl-devel


author: Than Ngo <than@redhat.com> - 20200406-30
changelog:
  - fixed #2130180, add texlive-fltpoint support
  - fixed #2102699, add babel-french support
  - fixed #2086254, texlive-xecjk dependencies


author: Than Ngo <than@redhat.com> - 20200406-35
changelog:
  - fixed rhbz#2284575, add texlive-mdframed
  - fixed rhbz#2275109, add texlive-picinpar
  - add texlive-selinput, texlive-lipsum, texlive-picture, texlive-kantlipsum, texlive-ntheorem


author: Robert Scheck <robert@fedoraproject.org> - 3.8-1
changelog:
  - Upgrade to 3.8 (#1902857)
  - Spec file modernization including support for RHEL/CentOS 7
  - Remove perl(Socket6) dependency (thanks to Michal Josef Špaček)


author: Carl George <carl@george.computer> - 2.2.0-3.2020704git5a1c8d8
changelog:
  - Update to latest upstream commit
  - Add patch to use correct shell completion locations
  - Run test suite
  - Add provides for ag and bundled uthash


author: Carl George <carl@george.computer> - 2.2.0^2020704.5a1c8d8-1
changelog:
  - Switch to caret versioning
  - Build against system uthash
  - Add patch for zsh completion of new flags


author: Aurelien Bompard <abompard@fedoraproject.org> - 2.10.3-1
changelog:
  - Support in-place upgrades of PostgreSQL major versions
  - Revert to version 2.10.3 to support upgrades from PostgreSQL 12


author: Carl George <carlwgeorge@fedoraproject.org> - 1.11.1-1
changelog:
  - Update to version 1.11.1 rhbz#2220885
  - Switch to SPDX license identifier and mark license file appropriately
  - Use upstream default config file with minimal changes
  - Log to journal instead of files
  - Run daemon in foreground to remove the need for pidfile tracking


author: Carl George <carlwgeorge@fedoraproject.org> - 1.11.2-7
changelog:
  - Backport upstream CVE fixes
  - Fixes CVE-2026-3945
  - Fixes CVE-2026-31842
  - Run upstream test suite


author: Dominik Mierzejewski <dominik@greysector.net> - 2.6.2-28
changelog:
  - apply Debian patch to fix CVE-2021-42260 (rhbz#2253716, rhbz#2253718)
  - apply Debian patch to fix CVE-2023-34194 and its duplicate, CVE-2023-40462
    (rhbz#2254376, rhbz#2254381)
  - fix incorrect text element encoding (upstream isssue #51)
  - compile and run tests


author: Jakub Kadlcik <frostyx@email.cz> 0.6.21-1
changelog:
  - Properly catch TitoException (frostyx@email.cz)
  - Add documentation for the MockBuilder (frostyx@email.cz)
  - Allow to define mock chroot in tito.props (frostyx@email.cz)
  - Fix recursion error in MockBuilder (frostyx@email.cz)
  - DistGitReleasers: don't nuke external sources with fetch_sources (praiskup@redhat.com)
  - Add installation instructions from PyPI (frostyx@email.cz)
  - Add long_description to setup.py (frostyx@email.cz)


author: Jakub Kadlcik <frostyx@email.cz> 0.6.22-1
changelog:
  - Fix python2 urlretrieve import (frostyx@email.cz)
  - Fixed submodule archives concatenation (jerzy.drozdz@jdsieci.pl)
  - Fixed issue #414 (jerzy.drozdz@jdsieci.pl)
  - Fixed issue #413 (jerzy.drozdz@jdsieci.pl)
  - Revert 45d431ad149cb33e2462a990c4c4f29e6bb2bb7e (nmoumoul@redhat.com)


author: Jakub Kadlcik <frostyx@email.cz> 0.6.23-1
changelog:
  - Replace `submodule--helper list` with `git config --get-regexp`
  - do not overwrite packit.yaml and its variants (msuchy@redhat.com)
  - packit: fixing the Fedora build failures (praiskup@redhat.com)
  - Don't upload patches to the lookaside cache (frostyx@email.cz)
  - use spdx license (msuchy@redhat.com)


author: Jakub Kadlcik <frostyx@email.cz> 0.6.24-1
changelog:
  - Will now copy both source files and patch files declared in the spec
  - Fix UpstreamBuilder deprecation warning (#461) (frostyx@email.cz)
  - Fix the setup.py license according to tito.spec (#433) (frostyx@email.cz)


author: Jakub Kadlcik <frostyx@email.cz>
changelog:
  - Use rpm.ds instead of deprecated hdr.dsFromHeader (frostyx@email.cz)
  - Support branch aliases in releasers (frostyx@email.cz)
  - Document how to automate bodhi updates (msuchy@redhat.com)
  - Use raw strings for regex patterns (frostyx@email.cz)
  - Allow tito build without .tito directory (frostyx@email.cz)
  - Unify README and index.md (msuchy@redhat.com)
  - Fix PEP8 issues found by runtests.py (frostyx@email.cz)
  - Replace egrep with grep -E (frostyx@email.cz)
  - Don't use --cacheonly on DNF5 (frostyx@email.cz)


author: Jakub Kadlcik <frostyx@email.cz> 0.6.26-1
changelog:
  - Fix issue with missing version numbers in the changelog (frostyx@email.cz)
  - Tito wrapper for easier development (praiskup@redhat.com)


author: Jakub Kadlčík <frostyx@email.cz>
changelog:
  - Defer submodule detection to git
  - Many improvements to tests and they now run during package build
  - New config option `buildconfig.test_version_suffix`


author: Lukáš Zachar <lzachar@redhat.com> - 1.29.0
changelog:
  - Add page `Releases` to highlight important changes
  - Update and polish hardware requirement docs
  - Refactor generating of stories and lint check docs
  - Add support for pruning test directories
  - Download all sources for `dist-git-source`
  - Source plan environment variables after `prepare` and `execute` steps
  - Framework is not consulted on results provided by tmt-report-result
  - Run scripts with `sudo` when `become` is on
  - Add `retry` for pulling images in the `podman` plugin
  - Add hardware schema for GPU
  - Change the default test pidfile directory to `/var/tmp`
  - Add `device` key into the `hardware` specification
  - Update code and test coverage for the `check` key
  - Document case-insensitive context dimension values
  - Fix use of the `-name` suffix in system HW requirement
  - Correct parsing when called as `rhts`
  - Reconcile HW requirements with virtual's own options
  - Move the `README` content into `docs/overview`
  - Make `BasePlugin` generic over step data class
  - Use `UpdatableMessage` for execute/internal progress bar
  - Drop an empty line from the pull request template
  - Add `runner` property to run with test runner facts
  - Export sources of an `fmf` node
  - Bump pre-commit linters to newer versions
  - Append the checklist template to new pull requests
  - Extend tmt-reboot to allow reboot from outside of the test process
  - Allow optional doc themes
  - Use consistent style for multiword test names
  - Show `check` results in the `html` report
  - Update `where` implementation, docs & test coverage (#2411)
  - Document difference between key, field and option
  - Rename multiword keys to use dashes in export and serialization
  - Allow Path instance to be used when constructing commands
  - Switch `Logger.print()` to output to stdout
  - Replace Generator type annotation with Iterator (#2405)
  - Refactor data container helpers
  - When merging fmf and CLI, use shared base step data
  - Fix installing package from the command line
  - Add support for checks to have their data packages
  - Switch `tmt.identifier` from using `fmf.log`
  - Hide test/plan/story internal fields from export
  - Fix full test suite after recent packaging changes
  - Update the list of code owners
  - Include the `fmf` root in the tarball as well


author: Petr Šplíchal <psplicha@redhat.com> - 1.30.0
changelog:
  - Make `arch` field unsupported in the spec
  - Introduce `tty` test attribute to control terminal environment
  - Ensure the imported plan's `enabled` key is respected
  - Add support for user defined templates (#2519)
  - Update the common schema for the `check` key
  - Create a `checks` directory to store avc/dmesg checks
  - Correctly update environment from importing plan
  - Implement `tmt try` for interactive sessions
  - Use a shorter time for `podman stop` (#2480)
  - Add the `redis` server as a multihost sync example
  - Improve documentation of test checks
  - Adjust the format of Polarion test run title
  - Run all available tests only upon a user request
  - Rename `name` to `how` in test check specification (#2527)
  - Link `inheritance` and `elasticity` from the guide
  - Add the `fips` field for the `polarion` report
  - Cover `tmt.cli` with `pyright` (#2520)
  - Custom soft/hard reboot commands for the connect provision plugin
  - Add `--feeling-safe` for allowing possibly dangerous actions
  - Update docs for the `polarion` report plugin
  - Move test-requested reboot handling into test invocation class
  - Add `-i` to select an image in beaker and artemis
  - Document how to use `yaml` anchors and aliases
  - Simplify log decolorizers to support pickleable trees
  - Add description field to polarion report plugin
  - Make check plugin class generic over check class (#2502)
  - Increase verbosity of Artemis provisioning errors
  - Add more distros to the `mrack` config
  - Move the `contact` key to the `Core` class
  - Bump tmt in lint pre-commit check to 1.29.0
  - Add Python 3.12 to the test matrix
  - Move `mrack` configs into `tmt+provision-beaker`
  - Allow running upgrade from the current repository
  - Fix remote nested library fetch and add test
  - Cover tmt.options with pyright
  - Cover tmt.checks, tmt.frameworks and tmt.log with pyright
  - Cover tmt.result with pyright checks
  - Store fmf `context` in results for each test
  - Add networks to the podman provision plugin (#2419)
  - Add a dedicated exit code when all tests reported `skip` result
  - Move invocation-related fields out of `Test` class
  - Remove expected fail from `/tests/pip/install/full`
  - Convert test execution internals to use "invocation" bundle (#2469)
  - Introduce a separate page `Code` for code docs
  - Add code documentation generated from docstrings
  - Fix possible unbound variable after import-under-try
  - Add `pyright` as a `pre-commit` check
  - Add a helper for nonconflicting, multihost-safe filenames
  - Add the `whiteboard` option for `beaker` provision
  - Support timestamped logging even on the terminal
  - Enable pyupgrade `UP` ruff rule
  - Fix `UP035` deprecated-import violations
  - Fix `UP034` extraneous-parentheses violation
  - Fix `UP033` lru-cache-with-maxsize-none violations
  - Fix `UP032` f-string violations
  - Fix `UP013` convert-typed-dict-functional-to-class
  - Fix `UP009` utf8-encoding-declaration violations
  - Fix `UP006` non-pep585-annotation violations
  - Try several times to build the `become` container (#2467)
  - Add .py file extension to docs scripts (#2476)
  - Add a link to the Testing Farm documentation
  - Use `renku` as the default theme for building docs
  - Properly normalize the test `path` key
  - Add an `adjust` example for enabling custom repo
  - Drop special normalization methods
  - Disable `dist-git-init` in the `distgit` test (#2463)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.31.0
changelog:
  - Simple ReST renderer for CLI help texts (#2574)
  - Generate plugin documentation from their sources (#2549)
  - Fix environment from command line updated twice (#2614)
  - Introduce a new prepare plugin for common features (#2198)
  - Remove `xfail` for the `multidict` issue on `rawhide`
  - Prevent catching avc denials from previous tests
  - Remove an obsolete workaround for `centos-stream-8`
  - Enable the `/tests/discover/libraries` test (#2222)
  - Add documentation on tmt & regular expressions
  - Fix expansion of envvar starting with `@` in fmf nodes
  - Add the `zcrypt` adapter specification
  - Allow urllib3 2.x
  - Enable `/plans/provision/virtual` for pull requests (#2558)
  - Remove the dns failures workaround
  - Fix reporting of schema errors without the `$id` key
  - AVC check now saves a timestamp on guest instead of using runner's time
  - Add check to prevent `tmt try` deleting imported libraries
  - Reduce usage of locks in the `testcloud` plugin
  - Add support for envvars import and export to Polarion
  - Use enumeration to implement action handling
  - Handle the `ctrl-d` shortcut in `tmt try`
  - Run tests with `interactive` mode during `tmt try`
  - Fix `tmt import --dry` and Polarion import file name
  - Document that `name` is supported in `--filter` search (#2637)
  - Refactor running of interactive commands (#2554)
  - Create container images from the latest non-dev copr build
  - Fail `dmesg` check if it contains `Call Trace` or `segfault`
  - Mention the reboot timeout variable in the release notes
  - Bump the default reboot timeout to 10 minutes
  - Allow change of the default reboot timeout via environment variable
  - Introduce essential requirements
  - Allow `--update-missing` to change the default `how` value
  - Document the new `become` feature
  - Raise an error when loading pre-1.24 `tests.yaml`
  - Support terminating process running test via its test invocation (#2589)
  - Fix `egrep` warning in `/plans/install/docs`
  - Test framework may provide additional test requirements
  - Improve logging of AVC check plugin and its test
  - Cleanup logging in `tmt.utils.create_file()`
  - Drop connection closed messages from test output
  - Recommend `qemu-kvm-core` for `provision-virtual`
  - Fix `/tests/plan/import` to not use special ref (#2627)
  - Improve imported plan modification test to verify the order as well (#2618)
  - Retry the `git clone` action multiple times
  - Simplify the debuginfo installation test
  - Support `virtualization.is-virtualized` in `mrack` plugin
  - Support running all or selected steps `--again`
  - Allow hardware requirements limit acceptable operators
  - Fix inheritance of some keys in provision step data
  - Run a callback when command process starts
  - Add support for hard reboot to Beaker provision plugin
  - Make collected requires/recommends guest-aware
  - Copy top level `main.fmf` during testdir pruning
  - Add support for Artemis API v0.0.67
  - Add support for `cpu.flag` hardware requirement
  - Use a different pidfile location for the full test
  - Clear test invocation data path use and derived paths
  - Add support for disallowing plugins via command line
  - Use constraint classes specific for particular value type
  - Making rhts metric value optional.
  - Ignore tarballs and generated man page
  - Cover `tmt.libraries` with `pyright` checks
  - Parallelize the `provision` step
  - Let `click` know about the maximal output width
  - Cover `tmt.identifier` with `pyright` checks
  - Extend `duration` of `/tests/core/escaping` a bit
  - Move docs templates into their own directory
  - Drop no longer needed `tmt.utils.copytree()`
  - Drop no longer used `tmt.utils.listify()`
  - Provision plugins use `self.data` instead of `self.get()`
  - Prepare and finish plugins use self.data instead of self.get()
  - Fix tmt.utils.format to allow int and float values
  - Move code-related pages under new `code` directory
  - Warn on test case not found in Polarion during report
  - Bump pre-commit linters
  - When cloning a logger, give it its own copy of labels
  - Add a `Toolbelt Catalog` entry for `tmt`
  - Enable the `avc` check for all `tmt` tests
  - Fix dmesg check test on Fedora rawhide & newer


author: Martin Hoyer <mhoyer@redhat.com> - 1.32.0
changelog:
  - Support Alpine Linux `apk` package manager
  - Update the `reportportal` plugin
  - Allow `keep-git-metadata` to be used without url
  - Use `TMT_REPORT_ARTIFACTS_URL` in Polarion report plugin
  - Prepare dist-git sources using `rpmbuild -bp`
  - Add support for `zcrypt` to Beaker plugin
  - Introduce ansible-lint to format ansible files
  - Add support for linking artifacts from the report
  - Document test tags and mark beakerlib integration
  - Clarify that plan context is not applied to plan
  - Increase the default test `duration` a bit
  - Update pre-commit checks
  - Fix typos in the `tmt try` help message examples
  - Add new environment variable for test iteration identifier
  - Select no tests if `modified-only` returns nothing (#2761)
  - Debug output for `discover -h fmf --modified-only`
  - Finish unit testing of HW transformations in mrack plugin
  - Run `/plans/install/docs` in core `packit` jobs
  - Extract "package manager" functionality into plugins (#2557)
  - Allow commands whose output is not logged unless they fail
  - Move `/tests/run/shell` to `/plans/provision/local`
  - Include a simple config for the `polarion` plugin
  - Cover `report/junit` with `pyright`
  - Implement the new test check `watchdog`
  - Support `disk.driver` hw requirement for `mrack`
  - Cover `tmt.hardware` with `pyright` check
  - Bootstrap unit tests for Beaker XML transformation of HW requirements
  - Add support for emulated TPM into virtual provision plugin
  - Set default formatting of Pint units to use symbols, not names (#2736)
  - Disable IPv6 for /plans/provision/virtual in CI
  - Add support for `disk.driver` hardware requirement
  - Remove now unnecessary `NON_KVM_ADDITIONAL_WAIT` from testcloud
  - Support `disk.model-name` hw requirement for `mrack`
  - Include `context` in the test `metadata.yaml` file
  - Pass `domain_configuration` to testcloud's `wake()`
  - Document how to enable verbose/debug logging
  - Disable password authentication when using keys
  - Fix /plans/provision/virtual to set correct PROVISION_* variable
  - Log the beaker job whiteboard
  - /usr/sbin/sestatus instead of /usr/bin/sestatus (#2720)
  - Set acl permissions on the `workdir` root
  - Extend the `duration` for time-demanding tests
  - Add support for `disk.model-name` hardware requirement
  - Move deferred user stories into a separate section
  - Mark test check tests with more fitting provision tags
  - Add `Environment` and `FmfContext` among loggable types
  - Bump supported Artemis API versions to 0.0.69
  - "Show default" flag was dropped from CLI option initialization
  - Convert environment handling into a dict-like class (#2612)
  - Enable `additional_coverage` tests for pull requests (#2700)
  - Add essential requirements to checks
  - Remove mention about the full test suite from docs
  - Use the `PROVISION_HOW` variable in `provision` plans (#2688)
  - Properly detect if test is enabled somewhere
  - Check for files in `rpm-ostree install` script
  - Collect test/test check results in test invocation (#2608)
  - Test the `become` key under `virtual` provision
  - Introduce "topology" addresses for guests (#2670)
  - Make checks smarter about environments in which they should not run (#2686)
  - Cover report/display and report/html with pyright (#2682)
  - Cover `tmt.templates` with `pyright`
  - Allow custom boot/connect timeouts for testcloud VMs
  - Underline `try` menu keys
  - Drop two no longer used methods from prepare step
  - Enable the full test execution using a label (#2683)
  - Support URL as post-install-script for Artemis plugin
  - Fix dmesg check test for recent Fedoras


author: Lukáš Zachar <lzachar@redhat.com> - 1.32.2
changelog:
  - Remove /var/tmp workdir from rpm packaging
  - Refactor package manager discovery to allow priorities
  - Add unit test for package manager installing a file system path
  - Update pre-commit checks and add a couple of new ones
  - Removing c9s workaround for pytest-container
  - Clarify the `--last` symlink creation race a bit
  - Remove the `.travis.yml` config file
  - Correctly show the `--provision-timeout` default
  - Refresh Beaker API client in mrack to use up-to-date Kerberos ticket


author: Tomáš Bajer <tbajer@redhat.com> - 1.33.0
changelog:
  - Fix installation of packages from files (#2914)
  - Simplify the documentation building (#2483)
  - Install dependencies of upgrade tasks
  - Improve fail message when library doesn't exist
  - Parse the `system` hardware requirement (#2795)
  - Define `location.lab-controller` hardware requirement (#2794)
  - Test restart on crash (#2870)
  - Add `codespell` pre-commit and fix revealed errors
  - Add test restart counter, similar to `TMT_REBOOT_COUNT`
  - Fix error message if no supported package manager found
  - Fix copy/paste issue for `combine_hw_disk_size()`
  - Slightly improve rendering of ReST for command like
  - Allow `duration` in the `execute` schema
  - Log hash of the beakerlib library repo
  - Fix inability of rpm-ostree to install multiple packages (#2887)
  - Fix Alpine Linux support (#2828)
  - Allow custom failure patterns in `dmesg` test check
  - Make `junit_xml` more visible to linters
  - Add support for `virtualization.hypervisor` hardware requirement (#2733)
  - Add a new section `Review` to contributor docs
  - Accept SSH options from environment variable (#2783)
  - Fix AVC denial detection on Fedora rawhide (#2881)
  - Reuse "become" image to fix sudo-related trouble in /tests/provision/user (#2892)
  - Polish prepare/ansible documentation
  - Support `cpu.cores` hardware requirement for mrack (#2728)
  - Allow pip install from git-archive
  - Add the `cpu.vendor` hardware requirement
  - Fix incorrect translation of `cpu.processors` to Beaker
  - Document custom Jinja template filters (#2769)
  - Update logger-name for clean


author: Martin Hoyer <mhoyer@redhat.com> - 1.34.0
changelog:
  - Fix normalization of `hardware` key/option (#3015)
  - Keep patched sources directly in TMT_SOURCE_DIR (#2999)
  - Copy launch description to suite description (#2992)
  - Add support for multiple disks to testcloud plugin (#2767)
  - Improve rendering of story links in our docs (#3001)
  - Simplify parsing of HW requirements and add missing ones (#2928)
  - Make test shell wrapper filename even more unique (#2998)
  - Add support for basic rerun of tests (#2521)
  - Split provision/virtual plans to subgroups per step (#2938)
  - Document custom container images built for tmt tests (#2930)
  - Require python3.9 in 'develop' target
  - Fix multiple rules `adjust` example in `duration` spec (#2971)
  - Fix "skip missing" behavior when installig debuginfo packages with dnf (#2956)
  - Extend results schema to allow test phases (#2933)
  - Fix path to watchdog log (#2901)
  - Display locals in traceback when requested (#2900)
  - Polish test-check/dmesg documentation (#2897)
  - docs: tweak docs to include how to see details about test failures (#2541)
  - Allow multiplication in duration input value (#2845)
  - Fix validation of fmf id URL, it must be cloneable first (#2957)
  - Cover `tmt.trying` with `pyright` check (#2942)
  - Clarify the `trigger` context dimension values (#2961)
  - Add konflux as possible initiator (#2947)
  - Fix some invalid links in documentation (#2940)
  - Define "block-device" key for guest topology HW exposition
  - Cover tmt.steps.prepare.shell with pyright checks
  - Ignore report files created by pytest-html
  - Fix pre-commit typing python version (#2959)
  - Cover tmt.steps.prepare.distgit with pyright
  - Pass correct spec to _parse_system and _parse_location (#2924)
  - Support `cpu.model-name` hardware requirement for mrack (#2921)
  - Enforce "one blank line after class docstring" rule (#2934)
  - Enable pydocstyle checks in ruff (#2906)
  - Update distros in the `mrack` provisioning config (#2932)
  - Drop duplicate list of supported HW requirements in beaker plugin (#2902)
  - Update interaction with Fedora rawhide (#2931)
  - Run the `no-commit-to-branch` check only locally


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.8.9-1
changelog:
  - update to latest upstream release https://forum.torproject.org/t/security-release-0-4-8-9/10155
  - security fixes for bz#2248562 & bz#2248563
  - add --enable-gpl build options to enable PoW as DDoS protection bz#2247828


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.8.10-1
changelog:
  - update to latest upstream release https://forum.torproject.org/t/security-release-0-4-8-10/10536
  - security fixes for bz#2253846 & bz#2211726 & bz#2253847


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.8.11-1
changelog:
  - update to latest upstream release https://forum.torproject.org/t/stable-release-0-4-8-11/12265
  - bz#2211726


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.8.12-1
changelog:
  - update to latest upstream release https://forum.torproject.org/t/stable-release-0-4-8-12/13060
  - Security fixes: bz#2248564, bz#2281499, bz#2281500, bz#2281502, bz#2281503
  - switch to sysusers based user provisioning approach - fixes bz#2252618
  - Add legacy openssl build dependency from F41 on - fixes FTBS / bz#2301334
  - since we can now drop EL7 support we can also cleanup systemd handling


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.8.12-2
changelog:
  - Re-add systemd-devel as build dependency so the daemon knows how to notify systemd that it was started - fixes bz#2302910


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.8.13-1
changelog:
  - update to latest upstream release https://forum.torproject.org/t/new-tor-stable-release-0-4-8-13/15397 (bz#2211726)
  - reviewed and adjusted SPDX license format


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.8.14-1
changelog:
  - update to latest upstream release https://forum.torproject.org/t/stable-release-0-4-8-14/17242 (bz#2211726)


author: Marcel Härry <mh+fedora@scrit.ch>- 0.4.8.21-2
changelog:
  - Fix build issue on newer glibc - https://gitlab.torproject.org/tpo/core/tor/-/issues/41170
  - Include /etc/torrc.d/*.conf by default to avoid modifications from the core package (bz#2338912)


author: Fedora Release Engineering <releng@fedoraproject.org> - 0.4.9.5-1
changelog:
  - Update to latest upstream release https://forum.torproject.org/t/stable-release-0-4-9-5/21227
  - Enable seccomp on aarch64, which is now supported


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.9.6-1
changelog:
  - Update to latest upstream release https://forum.torproject.org/t/security-release-0-4-8-23-and-0-4-9-6/21386


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.9.8-1
changelog:
  - Update to latest upstream release https://forum.torproject.org/t/security-release-0-4-8-25-and-0-4-9-8/21559
  - Fix CVE-2026-44600 (bz#2476455 / bz#2476454)
  - Fix CVE-2026-44599 (bz#2476453 / bz#2476452)
  - Fix CVE-2026-44597 (bz#2476451 / bz#2476450)
  - Fix CVE-2026-44601 (bz#2467732 / bz#2467731)
  - Fix CVE-2026-44603 (bz#2467720 / bz#2467719)
  - Fix CVE-2026-44602 (bz#2467718 / nz@2467717)


author: Ivan Romanov <drizt72@zoho.eu> - 1.0.2-1
changelog:
  - Bump to v1.0.2
  - Update license
  - Add svg icon
  - Use appstream id for icons, desltop and metainfo files


author: Ivan Romanov <drizt72@zoho.eu> - 1.0.2-2
changelog:
  - Add patch to fix epel building
  - Drop Qt4 support
  - Update description
  - Use specific macros for metainfo dir


author: Miro Hrončok <mhroncok@redhat.com> - 3.24.4-2
changelog:
  - Always BuildRequire runtime dependencies to avoid non-installable builds
  - Remove no longer needed obsoletes of python3-detox


author: John Zaitseff <J.Zaitseff@zap.org.au> - 7.18-1
changelog:
  - Updated the RPM package for a new release of Star Traders: version 7.18.
  - Added verification of upstream signature.


author: John Zaitseff <J.Zaitseff@zap.org.au> - 7.19-1
changelog:
  - Updated the RPM package for a new release of Star Traders: version 7.19.
  - Update rules for AppStream metainfo and desktop files.


author: Jered Floyd <jered@redhat.com> 9.2.4-2
changelog:
  - Enable build with deprecated OpenSSL Engine
    https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine


author: Jered Floyd <jered@redhat.com> 9.2.9-1
changelog:
  - Update to upstream 9.2.9
  - Resolves CVE-2024-38311, CVE-2024-56195, CVE-2024-56196, CVE-2024-56202


author: Jerry Snitselaar <jsnitsel@redhat.com> - 0.3.14-4
changelog:
  - Fix for CVE-2020-24330 (RHBZ#1874824)
  - Fix for CVE-2020-24331 (RHBZ#1870057)
  - Fix for CVE-2020-24332 (RHBZ#1870053)


author: Michel Lind <salimma@fedoraproject.org> - 4.0.2-4
changelog:
  - Add bcond for documentation building
  - Fix warnings when regenerating the RPM by moving post-endif comments to new lines


author: Andreas Schneider <asn@redhat.com> - 2.1.1-1
changelog:
  - Update to version 2.1.1
    * https://github.com/neovim/unibilium/releases/tag/v2.1.1
    * https://github.com/neovim/unibilium/releases/tag/v2.1.0


author: Björn Esser <besser82@fedoraproject.org> - 2.3.0-5
changelog:
  - Add tools package
  - Add explicit perl BRs
  - Add example program to doc package
  - Drop google site-verification file from doc package
  - Require main package in doc package to avoid file conflicts


author: Michel Lind <salimma@fedoraproject.org> - 0.0.27-2
changelog:
  - Use script to generate list of coreutils commands
  - On EPEL 9, reduce the list of obsoletes to packages actually built


author: Jonathan Wright <jonathan@almalinux.org> - 7.2.5-8
changelog:
  - Enable tests by default
    selectively disable tests that fail in mock for redis
    disable redis-sentinel tests, they always fail in mock


author: Remi Collet <remi@fedoraproject.org> - 8.0.6-1
changelog:
  - update to 8.0.6
    fixes CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 and CVE-2025-46819
  - update documentation to 8.0.5


author: Jonathan Wright <jonathan@almalinux.org> - 1.32.0-1
changelog:
  - update to 1.32.0 rhbz#2304045
    Resolves CVE-2024-39924
    Resolves CVE-2024-39925
    Resolves CVE-2024-39926


author: Jonathan Wright <jonathan@almalinux.org> - 1.33.0-1
changelog:
  - update to 1.33.0 rhbz#2342073
    Fix GHSA-f7r5-w49x-gxm3 Getting access to the Admin Panel via CSRF
    Fix CVE-2025-24364 RCE in the admin panel
    Fix CVE-2025-24365 escalation of privilege via variable confusion in OrgHeaders trait


author: Jonathan Wright <jonathan@almalinux.org> - 1.33.2-1
changelog:
  - update to 1.33.2 rhbz#2343535
    Fix CVE-2025-0977 ssl::select_next_proto use after free rhbz#2344558


author: Jonathan Wright <jonathan@almalinux.org> - 1.36.0-1
changelog:
  - update to 1.36.0 rhbz#2368636
  - Fix bitwarden mobile app not working rhbz#2437599
  - Fix CVE-2025-58160 vaultwarden: Tracing log pollution
  - Fix CVE-2026-25537 vaultwarden: jsonwebtoken has Type Confusion that leads to potential authorization bypass
  - Fix CVE-2026-25727 vaultwarden: time affected by a stack exhaustion denial of service attack
  - Fix CVE-2026-26012 vaultwarden: Information disclosure due to bypassed collection permissions
  - Fix CVE-2026-27898 vaultwarden: Information disclosure via API partial update
  - Fix CVE-2026-27803 vaultwarden: Unauthorized collection management operations due to improper access control
  - Fix CVE-2026-27801 vaultwarden: Two-factor authentication bypass allows unauthorized access and data deletion


author: Jonathan Wright <jonathan@almalinux.org> - 2026.4.1-1
changelog:
  - update to 2026.4.1 rhbz#2387335
  - Fixes CVE-2026-27803 Unauthorized collection management operations due to improper access control
  - Fixes CVE-2026-27801 Two-factor authentication bypass allows unauthorized access and data deletion
  - Fixes CVE-2026-27802 Privilege Escalation via Unauthorized Bulk Permission Update
  - Fixes CVE-2026-27898 Information disclosure via API partial update


author: Pavel Raiskup <praiskup@redhat.com> - 5-1
changelog:
  - support for fast "ruff" analyser
  - --linter-tag option added
  - subproject detection by .vcs-diff-lint.yml


author: Pavel Raiskup <praiskup@redhat.com> 6-1
changelog:
  - bugfix: correctly honor file renames
  - bugfix: fix subproject detection for git worktree
  - ruff: do full project scans (since Ruff is fast enough)
  - check the new (changed) code in a side-directory


author: Pavel Raiskup <praiskup@redhat.com> 6.2-1
changelog:
  - drop unnecessary newline in the output
  - ruff: don't prefix the error locations with absolute path
  - ruff: don't optimize out the full Ruff run
  - print the git sha1 being analyzed
  - bugfix: correct matching filenames with endswith()


author: Pavel Raiskup <praiskup@redhat.com> 6.3-1
changelog:
  - don't require all the linters, just recommend them
  - use requested linters only if they are available
  - nicer info/debug output


author: Pavel Raiskup <pavel@raiskup.cz> 6.7-1
changelog:
  - Handle (no traceback) "invalid-syntax" code from Ruff
  - log.debug() all git commands
  - do not let "git apply" pollute stderr with whitespace errors


author: Filipe Rosset <rosset.filipe@gmail.com> - 4.226-1
changelog:
  - Update to 4.226, enabled tests, spec cleanup and modernization
  - Fixes rhbz#1933296 rhbz#2047099 and rhbz#2026957


author: Nolan Poe <npgo22@gmail.com> - 5.022-1
changelog:
  - Update to 5.022 - Fix SPDX License identifier - Add CMake for tests - Fix
    runtime dependency check - Fix runtime version checck - Fix
    multithreading bug that causes spurious failures - Default to using
    tcmalloc


author: Nolan Poe <npgo22@gmail.com> - 5.022-2
changelog:
  - Improve conformance to modern Fedora packaging guidelines - Break out
    packages - Remove CC0 content


author: Akira TAGOH <tagoh@redhat.com> - 20220612-1
changelog:
  - New upstream release.
    Resolves: rhbz#1858617
  - Revise the spec file for new packaging guidelines.


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.27.rc3
changelog:
  - Update to version 2.1.0-rc3
  - Drop patches accepted upstream
  - Add new patches (the PRs have been accepted upstream)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 3.3.5-1
changelog:
  - Update to version 3.3.5
  - Do not run tests
    - some scripts needed for generating the test certificates are missing


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 3.3.2-1
changelog:
  - Update to version 3.3.2
  - Drop patches voms-clients-java-use-a-more-sensible-timeout.patch and
    voms-clients-java-change-default-proxy-cert-key-length-to-2048-bits.patch


author: Stephen Smoogen <smooge@fedoraproject.org> - 3.1.20.3-9
changelog:
  - Add patch to bring up to 2022-03-15 git 17cc55f24d1c56f6a5dcca6065a227ca91d01c90
  - Remove patch for bigendian and boost-1.76 due to inclusion to git
  - Add in boost-1.78 for rawhide fix BZ#2084320 BZ#2113757
  - Add in minor fixes to clean up C20 warnings


author: Stephen Smoogen <smooge@fedoraproject.org> - 3.3.0-1
changelog:
  - Updated to 3.3.0
  - Removed un-needed patches to code to fix C20 problems
  - Removed endian patches
  - Changed CMakefileLists.txt patch to remove -Werror for gcc-13
  - Opened upstream on that.


author: Stephen Smoogen <smooge@fedoraproject.org> - 3.5.4-1
changelog:
  - Moved from 3.3.x to 3.5.x
  - License has changed from MPLv2 AND Boost to MPLv2
  - No longer need to carry the big-endian patch
  - Needed to fix some entries which did not include cstdint


author: Stephen Smoogen <smooge@fedoraproject.org> - 3.5.11-2
changelog:
  - Try to fix the selinux problem seen with CS10
  - Try to fix problem with socket creation and systemd


author: Stephen Smoogen <smooge@fedoraproject.org> - 3.5.11-3
changelog:
  - Rewrite the selinux policy from scratch with sepolgen
  - Remove the socket creation as systemd as vsomeip will not work with it.


author: Robert Scheck <robert@fedoraproject.org> - 0.5.3-63.git20230121
changelog:
  - Added upstream patch to fix out-of-bounds access due to multiple backspaces
    to address incomplete fix for CVE-2022-38223 (#2222775, #2222780, #2255207)


author: hydai <hydai@hyd.ai> - 0.17.0-1
changelog:
  - Update to 0.17.0
  - Drop downstream LLVM 19/20/21 and overflow patches (merged upstream)
  - Add downstream patch to build against RHEL 9 fmt 8 / spdlog 1.10


author: Benjamin A. Beasley <code@musicinmybrain.net> - 6.0.4-12
changelog:
  - Explicitly set most Makefile variables
  - Moves the documentation into the standard location
  - Enables rebuilding localized man pages etc.


author: Benjamin A. Beasley <code@musicinmybrain.net> - 6.0.5-2
changelog:
  - Remove explicit %set_build_flags, not needed since F36 > >
    https://www.fedoraproject.org/wiki/Changes/SetBuildFlagsBuildCheck


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.2.2-17
changelog:
  - Change URLs from HTTP to HTTPS
  - Add source file signature verification
  - Use %make_build and %make_install macros
  - Reformatting and minor changes for personal style preference
  - Fix man page glob
  - Use less broad globs
  - Add ABOUT-NLS, BACKLOG, and THANKS as %doc files
  - Rebuild configure script at build time
  - Add a %check section and run the tests
  - Add ncurses-devel BR for termcap/curses support
  - Add missing BR on gcc
  - Rebuild man pages in RPM build
  - Properly install license file (COPYING)


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.2.2-18
changelog:
  - Improve summary and description text
  - Build HTML and PDF versions of the documentation
  - Add Latex2e to License field


author: Romain Geissler <romain.geissler@amadeus.com> - 2.1.0-10
changelog:
  - Disable explicit OCSP requests by default for privacy reasons.
  - Accept --progress=dot:... for backwards compatibility.


author: Michal Ruprich <mruprich@redhat.com> - 2.2.0-1
changelog:
  - New version 2.2.0
  - Resolves: rhbz#2298879 - Using options -nc and -O simultaneously causes existing files to be clobbered/truncated
  - Resolves: rhbz#2327788 - wget starts using non-working IPv6 addresses on dual stack
  - Resolves: rhbz#2327728 - Crash: "free(): double free detected in tcache 2" when using --load-cookies
  - Resolves: rhbz#2280151 - wget2 always re-downdloads when using custom output filename


author: Michal Ambroz <rebus at, seznam.cz> - 0.5.5-2
changelog:
  - removed alias bundle - needs to be solved by
  - added conditional for the (network) tests
  - license is GPLv2+
  - empty the plugin/IpToCountry.csv with problematic 
  - move addons and plugin-development to doc folder


author: Sudip Shil <sshil@redhat.com> - 1.0.7-1
changelog:
  - feature added: fontname option, sans-serif would be default
  - feature added: add option to print utf8 hex sequence


author: Sudip Shil <sshil@redhat.com> - 1.0.8-1
changelog:
  - Handling non-printable charcaters
  - Print nicer names for all non-printable characters
  - code rendering


author: Sudip Shil <sshil@redhat.com> - 2.1.0-0
changelog:
  - Added --language (-l) CLI option to detect the default font for a given language code, which detects and prints the default font family that supports the specified language.
  - Introduced valid_langs[] array containing known language codes supported by fontconfig, Rejects invalid language codes early with a clear error message.
  - Checks not only if a font is returned, but whether it actually supports the given language.
  - Updated --help output to include usage for --language option.
  - updated readme with installation, build section.


author: Sudip Shil <sshil@redhat.com> - 2.2.0-1
changelog:
  - Modified input_char to handle multiple words as a single input string, allowing space-separated characters.
  - :: as the delimiter for Fontconfig parameters.
  - help section in better format
  - Modified tests.sh to include new test cases for space-separated inputs and :: parameter handling.


author: Sudip Shil <sshil@redhat.com> - 2.3.0-1
changelog:
  - Improve input handling for -f option and Update test cases in to cover new scenarios and edge cases.
  - now tests.sh can capture segmentation fault and save in test_error txt file
  - Created github workflow action tests.yml in github - if test fails then it is usefull for CI and automation.


author: Sudip Shil <sshil@redhat.com> - 3.0.0-1
changelog:
  - resolve snowflake emoji incorrectly defaulting to Symbola
  - emoji detection for BMP ranges and remove redundant logic
  - Integrate Pango API to segment and find fonts and refine hex detection logics
  - Fix Pango sans-serif fallback and --language feature not giving output fixed
  - Fix CI build by adding missing GLib and Pango dependencies


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.7.0-4
changelog:
  - Update architectures for asan/tsan/ubsan tests based on GCC 15
  - Adds riscv64 to supported architectures for all three kinds of tsts


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.20091126-27
changelog:
  - Clarify URL/Source situation, and do not claim to have a working source
    archive URL
  - General tidying of spec file; use modern macros and install HTML format
    description as documentation
  - Add hand-written man pages


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.20091126-40
changelog:
  - Security fix for CVE-2010-1028
  - Various other fixes collected by Debian and contributed back upstream to
    the sfnt2woff-zopfli fork: https://github.com/bramstein/sfnt2woff-
    zopfli/pull/20


author: Andrew Bauer <zonexpertconsulting@outlook.com> - 5.7.2-2
changelog:
  - RHBZ#2308628 RHBZ#2308629 RHBZ#2308630 RHBZ#2308631 fixed in 5.7.2 release
  - fips macro patch no longer needed


author: Yaakov Selkowitz <yselkowi@redhat.com> - 1.10.50-1
changelog:
  - Update to 1.10.50
  - Enable GNOME Flashback applet
  - Support GNOME Shell 42 (#2132504) and 43 (#2132507)


author: Sérgio Basto <sergio@serjux.com> - 0.9.16^20230801gita61f364-1
changelog:
  - Update to a61f364e385d98677c04070a994397b287385219 git snapshot from
    2023-08-01 (a support for acquiring a DRM framebuffer with a drm schema
    in -rawfb option)


author: Tom Rix <trix@redhat.com> - 6.63-2
changelog:
  - Add tests, samples
  - Change license to BSD-3-Clause
  - Check directory ownership
  - Package as static library


author: Mattia Verga <mattia.verga@proton.me> - 4.1.0^320240205.gita2da14b-1
changelog:
  - Update to latest svn version
  - Fix icons and desktop file
  - Add appstream metainfo
  - Fix versioning


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.0.6-3
changelog:
  - Adjust whitespace and ordering to personal preference
  - Add missing autoconf BR and drop bogus libtool BR
  - Add --force to autoreconf
  - Drop --disable-silent-rules configure argument, redundant with V=1 in
    make_build macro
  - Slightly nicer description
  - Install ChangeLog and README
  - Add cryptographic source archive verification


author: Xavier Bachelot <xavier@bachelot.org> - 1.2.13-3
changelog:
  - Enable external libdvdnav for EL9
  - Restore specfile compatibility with RPM Fusion for EL7/8
  - Restore building from snapshot


author: Xavier Bachelot <xavier@bachelot.org> - 0.99.14-2
changelog:
  - Use SPDX License: tag
  - Drop useless conditionals
  - Drop useless comments
  - Add EL7 cond for %post/%postun
  - Escape unescaped % in %changelog
  - Drop very old Obsoletes:/Provides: for xine/xine-skins


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.0.5-7
changelog:
  - Add missing autoconf BR and drop bogus libtool BR
  - Add --force to autoreconf
  - Drop --disable-silent-rules configure argument, redundant with V=1 in
    make_build macro
  - Install ChangeLog and README
  - Add cryptographic source archive verification


author: Dennis van Raaij <dvraaij@fedoraproject.org> - 2:22.0.0-1
changelog:
  - Updated to v22.0.0, using the archive available on GitHub.
  - Changed the epoch to mark the new upstream version scheme.
  - Changed the epoch to 2 instead of 1 for consistency with the GNATcoll
    packages.
  - Updated the license, a runtime exception has now been added.
  - Added new build dependencies to build the documentation with Sphinx and LaTeX.
  - Examples are now located in _pkgdocdir/examples.
  - License field now contains an SPDX license expression.
  - Added the Unicode license to cover all code that has been generated using
    Unicode data.
  - Removed some post-install steps that are no longer required.
  - Static libraries are now build position independent (PIC).
  - Fix permission errors in the prep step; these are source packaging errors.
  - Updated some summaries and descriptions.
  - Improved spec file readability.
  - Marked the source package as architecture independent.
  - Removed empty directory '_libdir/static'; it seems to have no purpose.
  - Moved all libraries from '_libdir/xmlada' to '_libdir'.
  - Fix up the symbolic links for the shared libraries.
  - Moved documentation and examples into a separate package.
  - Made the generated project files architecture-independent.
  - Added a build dependency on sed, removed the explicit version dependency on
    GPRbuild.
  - Bootstrap mode can now be enabled via a configuration option.


author: Dennis van Raaij <dvraaij@fedoraproject.org> - 2:23.0.0-1
changelog:
  - Updated to v23.0.0, using the archive available on GitHub.
  - Removed backport patch for improved Unicode support.
  - Removed fix for file permissions; has been fixed upstream (commit: 9e1bd23).
  - Removed patch gprbuild-gprinstall-relocate-artifacts.patch; move files after
    GPRinstall has run.
  - Moved the documentation back to where is was until version 2:22.0.0.


author: Bojan Smojver <bojan@rexursive.com> - 0.9.19-5
changelog:
  - Insert glamoregl module into xorg.conf for glamor package
  - Add missed Xorg server dependencies into glamor package


author: Tom Callaway <spot@fedoraproject.org> - 1:4.04-5
changelog:
  - pull in all the headers
  - apply null fix for default var in GlobalParams()
  - make a libxpdfcore for texlive-base to use


author: Bojan Smojver <bojan@rexursive.com> - 1:0.10.2~5
changelog:
  - Move README.Fedora to README.md
  - Adjust ownership/permissions of certs/keys for unprivileged user


author: Bojan Smojver <bojan@rexursive.com> - 1:0.10.2~6
changelog:
  - Set permissions of cert, key and rsakeys.ini to 0640
  - Revert optional dependency on noopenh264, library dependency exists


author: Bojan Smojver <bojan@rexursive.com> - 1:0.10.6-1
changelog:
  - Update to 0.10.6
  - CVE-2026-32105, CVE-2026-32107, CVE-2026-32623, CVE-2026-32624
  - CVE-2026-33145, CVE-2026-33516, CVE-2026-33689, CVE-2026-35512


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.1.8-3
changelog:
  - Do not hardcode the build type
  - Use CMAKE_BUILD_TYPE RelWithDebInfo to avoid -Werror in compiler flags


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.6.0-2
changelog:
  - Correct naming of helper library libXrdPelicanHttpCore (not a plugin)
  - Fix parallel running of Posc tests


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 1:6.03-1
changelog:
  - Update to 6.03
  - All patches sent to the upstream was merged, yeah!
  - print_xinput_event: check if XIRawEvent.raw_values is available


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 1:6.03-3
changelog:
  - print_xinput_event: don't print raw_values (instead of
    checking if XIRawEvent.raw_values is available)


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 1:6.05-3
changelog:
  - Kill no longer needed workaround stuff
  - hacks/fonts: fix installation on out-of-source build
  - driver/Makefile.in: fix GLIB_COMPILE_RESOURCES source
  - hacks/Makefile.in: fix driver/prefs.o output location


author: Davide Cavalca <dcavalca@fedoraproject.org> - 1.0.2-1
changelog:
  - Unretire package
  - Switch source to GitHub and update to 1.0.2
  - Use cmake instead of scons
  - Install systemd user service
  - Misc specfile updates


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-3
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2110440, rhbz#2110433


author: Peter Hutterer <peter.hutterer@redhat.com> - 21.1.3-5
changelog:
  - CVE fix for: CVE-2022-4283 (#2151803), CVE-2022-46340 (#2151778),
    CVE-2022-46341 (#2151783), CVE-2022-46342 (#2151786),
    CVE-2022-46343 (#2151793), CVE-2022-46344 (#2151796)


author: Olivier Fourdan <ofourdan@redhat.com> - 0.0.4-2
changelog:
  - Require and use mutter as default compositor in RHEL
  - Make other compositors very weak dependencies in RHEL


author: Adrien Vergé <adrienverge@gmail.com> - 1.31.0-1
changelog:
  - Update to latest upstream version
  - Temporarily restore setup.py/setup.cfg since setuptools ≥ 61 is not available


author: Neal Gompa <ngompa@fedoraproject.org> - 1.22.10-4
changelog:
  - Work around broken brp-mangle-shebangs behavior (see RHBZ#1998924)
  - Fix broken macro variable for legacy "nodejs-yarn" binary name (RHBZ#1904279)


author: zsvetlik@redhat.com - 1.22.17-1
changelog:
  - Update to latest upstream release
  - use --force in yarnpkg-tarball.sh to workaround dependency conflincts


author: Sandro Mani <manisandro@gmail.com> - 1.22.22-9
changelog:
  - Add CVE-2025-6545_6547.prebundle.patch and regenerate bundle. Fixes CVE-2025-6545 and CVE-2025-6547.


author: Sandro Mani <manisandro@gmail.com> - 1.22.22-11
changelog:
  - Refresh bundle
  - Drop patches obsoleted by new bundle
  - Add yarn-update-jest.prebundle.patch to update jest and avoid some vulerable dependencies
  - Apply fixes for CVE-2025-8262 and CVE-2025-8263


author: Sandro Mani <manisandro@gmail.com> - 1.22.22-12
changelog:
  - Regenerate bundle, fixes CVE-2025-59343
  - Patch out eslint and commitizen devDependencies to reduce dependencies


author: Dominik Mierzejewski <dominik@greysector.net> - 1.3.0^20230922git9defefa-1
changelog:
  - update to latest git snapshot
  - drop obsolete patch
  - use modern macros
  - run the test suite in %check
  - fixes: CVE-2023-37732 CVE-2023-31975 CVE-2021-33454


author: Veronika Hanulikova <vhanulik@redhat.com> - 2.3.0-1
changelog:
  - New upstream release (#2059540)
  - Initialize maybe-uninitialized variables
  - Fix usage of pointer after free
  - Build against OpenSSL 3.0


author: Severin Gehwolf <sgehwolf@redhat.com> - 2.4.8-4
changelog:
  - Add explicit requirement on javapackages-tools since yuicompressor
    script uses java-functions. See RHBZ#1600426.


author: Orion Poplawski <orion@nwra.com> - 1:6.0.29-1
changelog:
  - Update to 6.0.29
  - Hopefully really get the zabbix_run_sudo SELinux boolean working for
    zabbix-agent and allow it to run lvm when enabled


author: Orion Poplawski <orion@nwra.com> - 1:6.0.36-1
changelog:
  - Update to 6.0.36 (CVE-2024-42330 rhbz#2329218, CVE-2024-42332 rhbz#2329221,
    CVE-2024-42333 rhbz#2329224)


author: Orion Poplawski <orion@nwra.com> - 1:6.0.36-1
changelog:
  - Update to 6.0.36 (CVE-2024-42330 rhbz#2329219, CVE-2024-42332 rhbz#2329222,
    CVE-2024-42333 rhbz#2329225)


author: Orion Poplawski <orion@nwra.com> - 7.0.9-2
changelog:
  - Re-install SELinux module in %posttrans to address "upgrade" from zabbixA.B
    to zabbixX.Y in one transaction


author: Jonathan Dieter <jdieter@gmail.com> - 1.3.0-1
changelog:
  - Add option to generate a zchunk header from an uncompressed file without
    actually creating a zchunk file


author: Jonathan Dieter <jdieter@gmail.com> - 1.3.1-1
changelog:
  - Fix a few low severity security bugs including
    - An off-by-one overflow when reading compressed integers from a
      malicious zchunk file
    - Error handling being skipped when the number of bytes read doesn't
      match what's expected
    - Not freeing memory when attempting to reallocate to size 0


author: Jonathan Dieter <jdieter@gmail.com> - 1.4.0-1
changelog:
  - Add native OpenSSL 3 compatibility
  - Add new function for getting zchunk context from chunk
  - Fix bug when assembling from multiple sources


author: Ben Woodard <woodard@redhat.com> - 4.3.4-2
changelog:
  - disable building with libunwind to fix C++ exceptions when a C applicaion loads
    a module written in C++ #2175966


author: Jan200101 <sentrycraft123@gmail.com> - 0.13.0-7
changelog:
  - build stage 3 using zig build system
  - add user provided options to the end of the build and install options


author: Jan200101 <sentrycraft123@gmail.com> - 0.13.0-8
changelog:
  - specify to build against local zig stdlib directory to ensure we are building against the newest stdlib
  - use release fast instead of release safe to fix aarch64 builds from running out of memory
  - enable position independent executable for the zig build


author: Justin Wheeler <jwheel@fedoraproject.org> - 1.0.3-12
changelog:
  - Fix FTBFS. Thanks @limb for the hotfix.
  - Upstream work ongoing for improved support with newer versions of the C programming language and compilers.


author: Justin W. Flory <jflory7@fedoraproject.org> - 1.0.3-1
changelog:
  - Fix reused integers from being optimized out.
  - Props to Jan Drögehoff (FAS: sentry) for sending this fix upstream to avoid carrying a Fedora-specific patch.
  - Remove grues.


