# changelog

author: Carl George <carlwgeorge@gmail.com> - 2.10.2-9
changelog:
  - Port to new golang packaging guidelines
  - Backport upstream fix for CVE-2026-27585
  - Backport upstream fix for CVE-2026-27586
  - Backport upstream fix for CVE-2026-27587
  - Backport upstream fix for CVE-2026-27588
  - Backport upstream fix for CVE-2026-27589
  - Backport upstream fix for CVE-2026-27590
  - Backport upstream fix for CVE-2026-30851
  - Backport upstream fix for CVE-2026-30852
  - Update vendored github.com/quic-go/quic-go to v0.57.0 for CVE-2025-64702
  - Update vendored golang.org/x/crypto to v0.52.0 for CVE-2025-47913,
    CVE-2026-39828, CVE-2026-39829, and CVE-2026-39830
  - Update vendored github.com/smallstep/certificates to v0.30.0 for
    CVE-2025-44005 and CVE-2026-40097
  - Update vendored github.com/go-chi/chi/v5 to v5.2.5 for CVE-2025-69725
  - Update vendored github.com/yuin/goldmark/renderer/html to v1.7.17 for
    CVE-2026-5160


author: Sander Hoentjen <shoentjen@antagonist.nl> - 2.0.3-1
changelog:
  - Update to new upstream
  - Fixes #2453419 (CVE-2026-27854)
  - Fixes #2453421 (CVE-2026-27853)
  - Fixes #2453426 (CVE-2026-24030)
  - Fixes #2453427 (CVE-2026-0397)
  - Fixes #2453429 (CVE-2026-24029)
  - Fixes #2453430 (CVE-2026-0396)
  - Fixes #2453431 (CVE-2026-24028)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.21-1
changelog:
  - Update to 1.9.21
  - Security fix: CVE-2026-41054 — privilege escalation via command socket
  - Fix semaphore error handling (SEM_FAILED vs NULL)
  - Fix /dev/shm permissions (use 01777 with sticky bit)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-1
changelog:
  - Update to 1.9.23
  - Security: use O_EXCL with sem_open to prevent semaphore pre-planting attacks
  - Security: fix OOB memory access in safein()/safeout() on socket errors
  - Security: reject command socket connections from different user namespaces
  - Security: use O_NOFOLLOW for PID file to prevent symlink attacks
  - Harden: open random device with O_CLOEXEC, restrict semaphore to 0600
  - Fix stale semaphore recovery after SIGKILL
  - Fix compilation when NO_COMMAND_MODE is defined


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-2
changelog:
  - Add SELinux policy module to allow semaphore creation in /dev/shm
  - Add rpminspect.yaml to waive pre-existing annocheck false positive


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-3
changelog:
  - Fix rpminspect.yaml: use annocheck failure_severity instead of inspections toggle
    (annocheck is a security inspection and cannot be disabled via inspections section)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.24-1
changelog:
  - Update to 1.9.24
  - Disable command mode in long-running service (--no-command flag)
  - Enable PrivateNetwork=true in systemd service
  - Remove SELinux policy module (no longer needed without command mode)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.25-1
changelog:
  - Update to 1.9.25
  - Fix initramfs switch-root failure caused by --no-command (BZ#2491739)
  - Add haveged-initramfs.service for use inside the initramfs


author: Dominik 'Rathann' Mierzejewski <dominik@greysector.net> - 2.104.1-1
changelog:
  - update to 2.104.1 (resolves rhbz#2463822)
  - exclude uv_test.go, which requires an Artifactory instance


author: Than Ngo <than@redhat.com> - 6.0.2.1-1
changelog:
  - Fix rhbz#2481429, Update to 6.0.2.1
  - Fix rhbz#2476573, CVE-2026-42144 krita: integer overflow in PNM size check bypasses memory guard


author: Paul Howarth <paul@city-fan.org> - 1.11.1-1
changelog:
  - Update to 1.11.1 (rhbz#2319104)
    - This is an enhancement and bugfix release - see RELEASE_NOTES for details
    - Note also that various algorithms are now deprecated and not built by
      default, which affects this package


author: Paul Howarth <paul@city-fan.org> - 1.11.1-6
changelog:
  - Fix CVE-2026-7598: integer overflow via large username or password arguments
    (https://github.com/libssh2/libssh2/pull/1858)


author: Filipe Rosset <filiperosset@fedoraproject.org> - 5.4.3-1
changelog:
  - update to 5.4.3 fixes rhbz#2492868
  - a bunch of other bugs were fixed and will be backported to all supported
    Fedora / EPEL versions


author: Filipe Rosset <filiperosset@fedoraproject.org> - 2.3.1-1
changelog:
  - rebuilt for version 2.3.1 fixes rhbz#1856025 rhbz#2454296 rhbz#2128374
  - modernized packaging, enabled generator, templates, and libev support


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.9.30-2
changelog:
  - Rebuilt with jsonwebtoken patched for CVE-2026-25537
  - Fixes RHBZ#2437472; fixes RHBZ#2437467; fixes RHBZ#2437461


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.6.0-2
changelog:
  - Correct naming of helper library libXrdPelicanHttpCore (not a plugin)
  - Fix parallel running of Posc tests


