# changelog

author: Didier Fabert <didier.fabert@gmail.com> - 0.1-35.20171025gitab9bbbd
changelog:
  - Stop using deprecated py3_build/py3_install macros https://bugzilla.redhat.com/show_bug.cgi?id=2378474
  - migrated to last commit


author: Marcel Härry <mh+fedora@scrit.ch>- 0.4.8.21-2
changelog:
  - Fix build issue on newer glibc - https://gitlab.torproject.org/tpo/core/tor/-/issues/41170
  - Include /etc/torrc.d/*.conf by default to avoid modifications from the core package (bz#2338912)


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.9.5-1
changelog:
  - Update to latest upstream release https://forum.torproject.org/t/stable-release-0-4-9-5/21227
  - Enable seccomp on aarch64, which is now supported


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.9.6-1
changelog:
  - Update to latest upstream release https://forum.torproject.org/t/security-release-0-4-8-23-and-0-4-9-6/21386


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.9.8-1
changelog:
  - Update to latest upstream release https://forum.torproject.org/t/security-release-0-4-8-25-and-0-4-9-8/21559
  - Fix CVE-2026-44600 (bz#2476455 / bz#2476454)
  - Fix CVE-2026-44599 (bz#2476453 / bz#2476452)
  - Fix CVE-2026-44597 (bz#2476451 / bz#2476450)
  - Fix CVE-2026-44601 (bz#2467732 / bz#2467731)
  - Fix CVE-2026-44603 (bz#2467720 / bz#2467719)
  - Fix CVE-2026-44602 (bz#2467718 / nz@2467717)


author: Ivan Romanov <drizt72@zoho.eu> - 1.0.2-1
changelog:
  - Bump to v1.0.2
  - Update license
  - Add svg icon
  - Use appstream id for icons, desltop and metainfo files


author: Ivan Romanov <drizt72@zoho.eu> - 1.0.2-2
changelog:
  - Add patch to fix epel building
  - Drop Qt4 support
  - Update description
  - Use specific macros for metainfo dir


author: Miro Hrončok <miro@hroncok.cz> - 4.26.0-1
changelog:
  - Update to 4.26.0
  - Requires virtualenv 20.29+
  - Supports freethreading Python
  - Fixes: rhbz#2365939


author: Enric Balletbo i Serra <eballetbo@redhat.com> - 0.1~git.20250530.3ccaa1a-1
changelog:
  - Check for g_malloc failure in unpack_efi_zboot_image
  - EFI zboot payload offset and size validation
  - Correct and simplify output file writing logic in main
  - Direct gunzip error messages to stderr
  - Improve ZSTD decompression error handling and reporting
  - Suppress unused parameter warnings in zalloc/zfree
  - Initialize z_stream in gunzip to prevent uninitialized use
  - Prevent memory leak in gunzip on inflateInit2 failure
  - Allow output to stdout to provide greater flexibility
  - Refactor output file writing in unzboot
  - Add SPDX license identifier and simplify license header
  - Add EFI application with zstd compression example
  - Append to the name the type of compression


author: Dominik Mierzejewski <dominik@greysector.net> - 3.2.4-1
changelog:
  - update to 3.2.4 (resolves rhbz#2231660)
  - switch to SPDX expression in License tag
  - use modern autosetup and plain cmake dependency and macros


author: Björn Esser <besser82@fedoraproject.org> - 2.3.0-5
changelog:
  - Add tools package
  - Add explicit perl BRs
  - Add example program to doc package
  - Drop google site-verification file from doc package
  - Require main package in doc package to avoid file conflicts


author: Packit <hello@packit.dev> - 2.10-1
changelog:
  - Update to 2.10 upstream release
  - Update libdir patch
  - No longer glob SONAME when listing shared library files
  - Use SPDX license identifiers
  - Fix license from BSD to MIT AND BSD-3-Clause
  - Fixes: RHBZ#2269036


author: Jonathan Wright <jonathan@almalinux.org> - 1.33.0-1
changelog:
  - update to 1.33.0 rhbz#2342073
    Fix GHSA-f7r5-w49x-gxm3 Getting access to the Admin Panel via CSRF
    Fix CVE-2025-24364 RCE in the admin panel
    Fix CVE-2025-24365 escalation of privilege via variable confusion in OrgHeaders trait


author: Jonathan Wright <jonathan@almalinux.org> - 1.33.2-1
changelog:
  - update to 1.33.2 rhbz#2343535
    Fix CVE-2025-0977 ssl::select_next_proto use after free rhbz#2344558


author: Jonathan Wright <jonathan@almalinux.org> - 1.36.0-1
changelog:
  - update to 1.36.0 rhbz#2368636
  - Fix bitwarden mobile app not working rhbz#2437599
  - Fix CVE-2025-58160 vaultwarden: Tracing log pollution
  - Fix CVE-2026-25537 vaultwarden: jsonwebtoken has Type Confusion that leads to potential authorization bypass
  - Fix CVE-2026-25727 vaultwarden: time affected by a stack exhaustion denial of service attack
  - Fix CVE-2026-26012 vaultwarden: Information disclosure due to bypassed collection permissions
  - Fix CVE-2026-27898 vaultwarden: Information disclosure via API partial update
  - Fix CVE-2026-27803 vaultwarden: Unauthorized collection management operations due to improper access control
  - Fix CVE-2026-27801 vaultwarden: Two-factor authentication bypass allows unauthorized access and data deletion


author: Jonathan Wright <jonathan@almalinux.org> - 2026.4.1-1
changelog:
  - update to 2026.4.1 rhbz#2387335
  - Fixes CVE-2026-27803 Unauthorized collection management operations due to improper access control
  - Fixes CVE-2026-27801 Two-factor authentication bypass allows unauthorized access and data deletion
  - Fixes CVE-2026-27802 Privilege Escalation via Unauthorized Bulk Permission Update
  - Fixes CVE-2026-27898 Information disclosure via API partial update


author: Pavel Raiskup <praiskup@redhat.com> - 5-1
changelog:
  - support for fast "ruff" analyser
  - --linter-tag option added
  - subproject detection by .vcs-diff-lint.yml


author: Pavel Raiskup <praiskup@redhat.com> 6-1
changelog:
  - bugfix: correctly honor file renames
  - bugfix: fix subproject detection for git worktree
  - ruff: do full project scans (since Ruff is fast enough)
  - check the new (changed) code in a side-directory


author: Pavel Raiskup <praiskup@redhat.com> 6.2-1
changelog:
  - drop unnecessary newline in the output
  - ruff: don't prefix the error locations with absolute path
  - ruff: don't optimize out the full Ruff run
  - print the git sha1 being analyzed
  - bugfix: correct matching filenames with endswith()


author: Pavel Raiskup <praiskup@redhat.com> 6.3-1
changelog:
  - don't require all the linters, just recommend them
  - use requested linters only if they are available
  - nicer info/debug output


author: Pavel Raiskup <pavel@raiskup.cz> 6.7-1
changelog:
  - Handle (no traceback) "invalid-syntax" code from Ruff
  - log.debug() all git commands
  - do not let "git apply" pollute stderr with whitespace errors


author: Fedora Release Engineering <marcus_fedora@baseband.digital> - 3.2.0-5
changelog:
  - Enable tests
  - Disable rotator2 SSE 4.1 kernels (other implementations available)
  - Use default compiler flags (strict aliasing works)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 3.3.5-1
changelog:
  - Update to version 3.3.5
  - Do not run tests
    - some scripts needed for generating the test certificates are missing


author: Stephen Smoogen <smooge@fedoraproject.org> - 3.5.4-1
changelog:
  - Moved from 3.3.x to 3.5.x
  - License has changed from MPLv2 AND Boost to MPLv2
  - No longer need to carry the big-endian patch
  - Needed to fix some entries which did not include cstdint


author: Stephen Smoogen <smooge@fedoraproject.org> - 3.5.11-2
changelog:
  - Try to fix the selinux problem seen with CS10
  - Try to fix problem with socket creation and systemd


author: Stephen Smoogen <smooge@fedoraproject.org> - 3.5.11-3
changelog:
  - Rewrite the selinux policy from scratch with sepolgen
  - Remove the socket creation as systemd as vsomeip will not work with it.


author: Robert Scheck <robert@fedoraproject.org> - 0.5.3-63.git20230121
changelog:
  - Added upstream patch to fix out-of-bounds access due to multiple backspaces
    to address incomplete fix for CVE-2022-38223 (#2222775, #2222780, #2255207)


author: Benjamin A. Beasley <code@musicinmybrain.net> - 6.0.4-12
changelog:
  - Explicitly set most Makefile variables
  - Moves the documentation into the standard location
  - Enables rebuilding localized man pages etc.


author: Petr Pisar <ppisar@redhat.com> - 5-22
changelog:
  - Disable filesystem subpackage as it is already provided by CentOS 10 Stream
    (bug #2309358)
  - Convert license tags to SPDX
  - Fix restarting systemd services


author: Romain Geissler <romain.geissler@amadeus.com> - 2.1.0-10
changelog:
  - Disable explicit OCSP requests by default for privacy reasons.
  - Accept --progress=dot:... for backwards compatibility.


author: Michal Ruprich <mruprich@redhat.com> - 2.2.0-1
changelog:
  - New version 2.2.0
  - Resolves: rhbz#2298879 - Using options -nc and -O simultaneously causes existing files to be clobbered/truncated
  - Resolves: rhbz#2327788 - wget starts using non-working IPv6 addresses on dual stack
  - Resolves: rhbz#2327728 - Crash: "free(): double free detected in tcache 2" when using --load-cookies
  - Resolves: rhbz#2280151 - wget2 always re-downdloads when using custom output filename


author: Sudip Shil <sshil@redhat.com> - 2.1.0-0
changelog:
  - Added --language (-l) CLI option to detect the default font for a given language code, which detects and prints the default font family that supports the specified language.
  - Introduced valid_langs[] array containing known language codes supported by fontconfig, Rejects invalid language codes early with a clear error message.
  - Checks not only if a font is returned, but whether it actually supports the given language.
  - Updated --help output to include usage for --language option.
  - updated readme with installation, build section.


author: Sudip Shil <sshil@redhat.com> - 2.2.0-1
changelog:
  - Modified input_char to handle multiple words as a single input string, allowing space-separated characters.
  - :: as the delimiter for Fontconfig parameters.
  - help section in better format
  - Modified tests.sh to include new test cases for space-separated inputs and :: parameter handling.


author: Sudip Shil <sshil@redhat.com> - 2.3.0-1
changelog:
  - Improve input handling for -f option and Update test cases in to cover new scenarios and edge cases.
  - now tests.sh can capture segmentation fault and save in test_error txt file
  - Created github workflow action tests.yml in github - if test fails then it is usefull for CI and automation.


author: Sudip Shil <sshil@redhat.com> - 3.0.0-1
changelog:
  - resolve snowflake emoji incorrectly defaulting to Symbola
  - emoji detection for BMP ranges and remove redundant logic
  - Integrate Pango API to segment and find fonts and refine hex detection logics
  - Fix Pango sans-serif fallback and --language feature not giving output fixed
  - Fix CI build by adding missing GLib and Pango dependencies


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.7.0-9
changelog:
  - Update architectures for asan/tsan/ubsan tests based on GCC 15
  - Adds riscv64 to supported architectures for all three kinds of tsts


author: Aleksei Bavshin <alebastr@fedoraproject.org> - 0.17.0-1
changelog:
  - Update to 0.17.0 (#2250885)
  - Use xcb-errors util library
  - Apply patches from 0.17.x bugfix branch


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.20091126-47
changelog:
  - Security fix for CVE-2010-1028
  - Various other fixes collected by Debian and contributed back upstream to
    the sfnt2woff-zopfli fork: https://github.com/bramstein/sfnt2woff-
    zopfli/pull/20


author: Hans de Goede <hans@hansg.org> - 3.2.9a-1.20250317gitce9782a
changelog:
  - Update to 3.2.9a + latest git changes to fix build with -std=c11
  - Switch to upstream appdata/metainfo and desktop file
  - Drop all patches (all upstreamed)
  - Resolves: rhbz#2341567
  - Resolves: rhbz#2385740


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.0.5-7
changelog:
  - Add missing autoconf BR and drop bogus libtool BR
  - Add --force to autoreconf
  - Drop --disable-silent-rules configure argument, redundant with V=1 in
    make_build macro
  - Install ChangeLog and README
  - Add cryptographic source archive verification


author: Jonathan Wright <jonathan@almalinux.org> - 1.60.4-1
changelog:
  - update to 1.60.4 rhbz#2334236
  - re-enable builds against libxml2, no more bundled libexpat
  - fixes rhbz#2310136
  - fixes rhbz#2310146
  - fixes rhbz#2310152


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.1.2-1
changelog:
  - xbitmaps 1.1.2
  - Use make macros, see
    https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.6.0-2
changelog:
  - Correct naming of helper library libXrdPelicanHttpCore (not a plugin)
  - Fix parallel running of Posc tests


author: Sandro Mani <manisandro@gmail.com> - 1.22.22-9
changelog:
  - Add CVE-2025-6545_6547.prebundle.patch and regenerate bundle. Fixes CVE-2025-6545 and CVE-2025-6547.


author: Sandro Mani <manisandro@gmail.com> - 1.22.22-11
changelog:
  - Refresh bundle
  - Drop patches obsoleted by new bundle
  - Add yarn-update-jest.prebundle.patch to update jest and avoid some vulerable dependencies
  - Apply fixes for CVE-2025-8262 and CVE-2025-8263


author: Sandro Mani <manisandro@gmail.com> - 1.22.22-12
changelog:
  - Regenerate bundle, fixes CVE-2025-59343
  - Patch out eslint and commitizen devDependencies to reduce dependencies


author: Dominik Mierzejewski <dominik@greysector.net> - 1.3.0^20230922git9defefa-1
changelog:
  - update to latest git snapshot
  - drop obsolete patch
  - use modern macros
  - run the test suite in %check
  - fixes: CVE-2023-37732 CVE-2023-31975 CVE-2021-33454


author: Orion Poplawski <orion@nwra.com> - 7.0.9-2
changelog:
  - Re-install SELinux module in %posttrans to address "upgrade" from zabbixA.B
    to zabbixX.Y in one transaction


author: Michel Lind <salimma@fedoraproject.org> - 0.8.0-1
changelog:
  - Update to 0.8.0 upstream release
  - Resolves: rhbz#2443508
  - Re-enable debuginfo generation
  - Enable Packit
  - Verified the SPDX license conversion


author: Justin Wheeler <jwheel@fedoraproject.org> - 1.0.3-12
changelog:
  - Fix FTBFS. Thanks @limb for the hotfix.
  - Upstream work ongoing for improved support with newer versions of the C programming language and compilers.


