# changelog

author: Dave Dykstra <dwd@cern.ch> - 1.4.0
changelog:
  - Update to upstream 1.4.0
  - Change Recommends: fakeroot back to Requires: fakeroot on epel10
    now that fakeroot is available there.


author: Than Ngo <than@redhat.com> - 144.0.7559.132-1
changelog:
  - Update to 144.0.7559.132
    * CVE-2026-1861: Heap buffer overflow in libvpx
    * CVE-2026-1862: Type Confusion in V8
  - Add BR on esbuild
  - Disable devtool bundle
  - Update scripts for downloading the source


author: Than Ngo <than@redhat.com> - 145.0.7632.45-1
changelog:
  - Update to 145.0.7632.45
    * CVE-2026-2313: Use after free in CSS
    * CVE-2026-2314: Heap buffer overflow in Codecs
    * CVE-2026-2315: Inappropriate implementation in WebGPU
    * CVE-2026-2316: Insufficient policy enforcement in Frames
    * CVE-2026-2317: Inappropriate implementation in Animation
    * CVE-2026-2318: Inappropriate implementation in PictureInPicture
    * CVE-2026-2319: Race in DevTools
    * CVE-2026-2320: Inappropriate implementation in File input
    * CVE-2026-2321: Use after free in Ozone
    * CVE-2026-2322: Inappropriate implementation in File input
    * CVE-2026-2323: Inappropriate implementation in Downloads


author: Than Ngo <than@redhat.com> - 145.0.7632.109-1
changelog:
  - Update to 145.0.7632.109
    * CVE-2026-2648: Heap buffer overflow in PDFium
    * CVE-2026-2649: Integer overflow in V8
    * CVE-2026-2650: Heap buffer overflow in Media


author: Than Ngo <than@redhat.com> - 145.0.7632.116-1
changelog:
  - Update to 145.0.7632.116
    * CVE-2026-3061: Out of bounds read in Media
    * CVE-2026-3062: Out of bounds read and write in Tint
    * CVE-2026-3063: Inappropriate implementation in DevTools


author: Than Ngo <than@redhat.com> - 145.0.7632.159-1
changelog:
  - Update to 145.0.7632.159
    * CVE-2026-3536: Integer overflow in ANGLE
    * CVE-2026-3537: Object lifecycle issue in PowerVR
    * CVE-2026-3538: Integer overflow in Skia
    * CVE-2026-3539: Object lifecycle issue in DevTools
    * CVE-2026-3540: Inappropriate implementation in WebAudio
    * CVE-2026-3541: Inappropriate implementation in CSS
    * CVE-2026-3542: Inappropriate implementation in WebAssembly
    * CVE-2026-3543: Inappropriate implementation in V8
    * CVE-2026-3544: Heap buffer overflow in WebCodecs
    * CVE-2026-3545: Insufficient data validation in Navigation


author: Than Ngo <than@redhat.com> - 146.0.7680.71-1
changelog:
  - Update to 146.0.7680.71
    * CVE-2026-3913: Heap buffer overflow in WebML
    * CVE-2026-3914: Integer overflow in WebML
    * CVE-2026-3915: Heap buffer overflow in WebML
    * CVE-2026-3916: Out of bounds read in Web Speech
    * CVE-2026-3917: Use after free in Agents
    * CVE-2026-3918: Use after free in WebMCP
    * CVE-2026-3919: Use after free in Extensions
    * CVE-2026-3920: Out of bounds memory access in WebML
    * CVE-2026-3921: Use after free in TextEncoding
    * CVE-2026-3922: Use after free in MediaStream
    * CVE-2026-3923: Use after free in WebMIDI
    * CVE-2026-3924: Use after free in WindowDialog
    * CVE-2026-3925: Incorrect security UI in LookalikeChecks
    * CVE-2026-3926: Out of bounds read in V8
    * CVE-2026-3927: Incorrect security UI in PictureInPicture
    * CVE-2026-3928: Insufficient policy enforcement in Extensions
    * CVE-2026-3929: Side-channel information leakage in ResourceTiming
    * CVE-2026-3930: Unsafe navigation in Navigation
    * CVE-2026-3931: Heap buffer overflow in Skia
    * CVE-2026-3932: Insufficient policy enforcement in PDF
    * CVE-2026-3934: Insufficient policy enforcement in ChromeDriver
    * CVE-2026-3935: Incorrect security UI in WebAppInstalls
    * CVE-2026-3936: Use after free in WebView
    * CVE-2026-3937: Incorrect security UI in Downloads
    * CVE-2026-3938: Insufficient policy enforcement in Clipboard
    * CVE-2026-3939: Insufficient policy enforcement in PDF
    * CVE-2026-3940: Insufficient policy enforcement in DevTools
    * CVE-2026-3941: Insufficient policy enforcement in DevTools
    * CVE-2026-3942: Incorrect security UI in PictureInPicture


author: Mosaab Alzoubi <moceap[AT]fedoraproject[DOT]com> - 0-46.20230706git
changelog:
  - Update on 2023-07-06
  - General clean-ups
  - Move built javaversion to new sub-package
  - Drop built javaversion from i686


author: Mosaab Alzoubi <moceap[AT]fedoraproject[DOT]com> - 0-47.20230709git
changelog:
  - Update on 2023-07-09
  - Fix can't build on aarch64  (https://bugzilla.redhat.com/show_bug.cgi?id=2220874)
  - Fix can't build on epel8 (https://koji.fedoraproject.org/koji/buildinfo?buildID=2227816)


author: Derek Weitzel <dweitzel@unl.edu> - 1.2.0-1
changelog:
  - Fix segfault if the JSON parser cannot parse the JWKS
  - Fix float time claims issue and improve error handling
  - Fix security issue with malicious issuer handling in error messages
  - Improve JWTVerificationException message to include the invalid issuer
  - Update usage on verify command to make the TOKENFILE explicit
  - Read token for scitokens-verify from stdin
  - Set CURLOPT_NOSIGNAL option in SimpleCurlGet to prevent signal interruptions
  - Adding asan value to the job name
  - Turn off building unit tests by default.
  - Add cmake option SCITOKENS_WITH_ASAN which enables memory checking with the address sanitizer.  Also enable this in CI, so that tests fail if they hit a memory leak or other memory problem.
  - Fix memory leak in store_public_ec_key
  - Fix memory leaks in the unit tests
  - Fix memory leak in rs256_from_coords
  - Fix memory leak in scitokens_verify


author: Brian Bockelman <bbockelman@morgridge.org> - 1.3.0-1
changelog:
  - Add scitokens-generate-jwks CLI for key generation.
  - Add environment variable-based configuration on library initialization.
  - Add per-issuer lock to prevent multiple concurrent queries against issuers without a known key
  - Add negative cache for failed issuer lookups (preventing frequent re-queries)
  - Add monitoring API for per-issuer validation statistics
  - Add optional background thread for JWKS refresh
  - Add keycache load, metadata, and delete APIs
  - Revert "Fix memory leak in rs256_from_coords" by @djw8605
  - Add CTest-based integration test with JWKS server and TLS infrastructure


author: Derek Weitzel <dweitzel@unl.edu> - 1.4.0-2
changelog:
  - Add keycache.allow_in_memory config option with in-memory SQLite fallback
  - Add persistent anchor connection for shared in-memory SQLite database
  - Improve error messages when keycache file cannot be read or written
  - Add integration test for keycache not-writable error message
  - Improve cache directory permission tests to handle common deployment misconfigurations
  - Implement keycache location retrieval and update library to 0.0.3
  - Fix typo in SQLite file extension in integration and main tests


author: Derek Weitzel <dweitzel@unl.edu> - 1.4.1-1
changelog:
  - Fix scope path boundary validation to deny sibling-prefix authorization bypasses
  - Reject parent-directory traversal in scope paths, including encoded traversal forms
  - Add regression tests covering sibling-prefix and traversal authorization checks


author: Than Ngo <than@redhat.com> - 20200406-35
changelog:
  - fixed rhbz#2284575, add texlive-mdframed
  - fixed rhbz#2275109, add texlive-picinpar
  - add texlive-selinput, texlive-lipsum, texlive-picture, texlive-kantlipsum, texlive-ntheorem


author: Than Ngo <than@redhat.com> - 13:20240311-6
changelog:
  - Fix missing texlive-ms that is splitted into multitoc and count1to
  - Fix Requirement on texlive-base, texlive-kpathsea
  - Remove texlive-sfmath as it's part of texlive-2024


