# changelog

author: Carl George <carlwgeorge@gmail.com> - 2.10.2-9
changelog:
  - Port to new golang packaging guidelines
  - Backport upstream fix for CVE-2026-27585
  - Backport upstream fix for CVE-2026-27586
  - Backport upstream fix for CVE-2026-27587
  - Backport upstream fix for CVE-2026-27588
  - Backport upstream fix for CVE-2026-27589
  - Backport upstream fix for CVE-2026-27590
  - Backport upstream fix for CVE-2026-30851
  - Backport upstream fix for CVE-2026-30852
  - Update vendored github.com/quic-go/quic-go to v0.57.0 for CVE-2025-64702
  - Update vendored golang.org/x/crypto to v0.52.0 for CVE-2025-47913,
    CVE-2026-39828, CVE-2026-39829, and CVE-2026-39830
  - Update vendored github.com/smallstep/certificates to v0.30.0 for
    CVE-2025-44005 and CVE-2026-40097
  - Update vendored github.com/go-chi/chi/v5 to v5.2.5 for CVE-2025-69725
  - Update vendored github.com/yuin/goldmark/renderer/html to v1.7.17 for
    CVE-2026-5160


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2.2.5-1
changelog:
  - Update to release v2.2.5
  - Resolves: rhbz#2464270
  - Resolves CVE-2026-50195
  - Resolves CVE-2026-53488
  - Resolves CVE-2026-53492
  - Resolves CVE-2026-53489
  - Resolves CVE-2026-47262


author: Sander Hoentjen <shoentjen@antagonist.nl> - 2.0.3-1
changelog:
  - Update to new upstream
  - Fixes #2453419 (CVE-2026-27854)
  - Fixes #2453421 (CVE-2026-27853)
  - Fixes #2453426 (CVE-2026-24030)
  - Fixes #2453427 (CVE-2026-0397)
  - Fixes #2453429 (CVE-2026-24029)
  - Fixes #2453430 (CVE-2026-0396)
  - Fixes #2453431 (CVE-2026-24028)


author: Jens Petersen <petersen@redhat.com> - 0.8-1
changelog:
  - https://hackage.haskell.org/package/fedora-repoquery-0.8/changelog
  - parsing and completion of all dnf options
  - add generated fish and zsh completion files for fedora-repoquery (frpq
    pending)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.21-1
changelog:
  - Update to 1.9.21
  - Security fix: CVE-2026-41054 — privilege escalation via command socket
  - Fix semaphore error handling (SEM_FAILED vs NULL)
  - Fix /dev/shm permissions (use 01777 with sticky bit)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-1
changelog:
  - Update to 1.9.23
  - Security: use O_EXCL with sem_open to prevent semaphore pre-planting attacks
  - Security: fix OOB memory access in safein()/safeout() on socket errors
  - Security: reject command socket connections from different user namespaces
  - Security: use O_NOFOLLOW for PID file to prevent symlink attacks
  - Harden: open random device with O_CLOEXEC, restrict semaphore to 0600
  - Fix stale semaphore recovery after SIGKILL
  - Fix compilation when NO_COMMAND_MODE is defined


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-2
changelog:
  - Add SELinux policy module to allow semaphore creation in /dev/shm
  - Add rpminspect.yaml to waive pre-existing annocheck false positive


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-3
changelog:
  - Fix rpminspect.yaml: use annocheck failure_severity instead of inspections toggle
    (annocheck is a security inspection and cannot be disabled via inspections section)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.24-1
changelog:
  - Update to 1.9.24
  - Disable command mode in long-running service (--no-command flag)
  - Enable PrivateNetwork=true in systemd service
  - Remove SELinux policy module (no longer needed without command mode)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.25-1
changelog:
  - Update to 1.9.25
  - Fix initramfs switch-root failure caused by --no-command (BZ#2491739)
  - Add haveged-initramfs.service for use inside the initramfs


author: Dominik 'Rathann' Mierzejewski <dominik@greysector.net> - 2.104.1-1
changelog:
  - update to 2.104.1 (resolves rhbz#2463822)
  - exclude uv_test.go, which requires an Artifactory instance


author: Paul Howarth <paul@city-fan.org> - 1.11.1-1
changelog:
  - Update to 1.11.1 (rhbz#2319104)
    - This is an enhancement and bugfix release - see RELEASE_NOTES for details
    - Note also that various algorithms are now deprecated and not built by
      default, which affects this package


author: Paul Howarth <paul@city-fan.org> - 1.11.1-6
changelog:
  - Fix CVE-2026-7598: integer overflow via large username or password arguments
    (https://github.com/libssh2/libssh2/pull/1858)


author: Pavel Raiskup <praiskup@redhat.com> 42.4-1
changelog:
  - fix sysusers packaging practice once more
  - configuration file owned by `root:root`
  - Rocky Linux 10 configs added (label@rockylinux.org)
  - missing config for AlmaLinux Kitten x86_64_v2 added (jhernandez@cloudlinux.com)
  - config for AlmaLinux Kitten 10 x86_64_v2 added (jonathan@almalinux.org)
  - AlmaLinux 10 configs added (jonathan@almalinux.org)


author: Pavel Raiskup <praiskup@redhat.com> 43.2-1
changelog:
  - disable gpgcheck for EPEL [local] repos
  - make sure [local] repo is available in rhel+epel repos
  - Add Kylin OS 11 (negativo17@gmail.com)
  - Azure Linux (CBL Mariner) 2.0 is now EOL (negativo17@gmail.com)


author: Pavel Raiskup <praiskup@redhat.com> 43.3-1
changelog:
  - Add openSUSE Leap 16.0 configurations (negativo17@gmail.com)
  - Update Kylin OS images and comments (negativo17@gmail.com)


author: Jiri Kyjovsky <j1.kyjovsky@gmail.com> 43.4-1
changelog:
  - Disable bootstrap for riscv (j1.kyjovsky@gmail.com)
  - Add risc-v fedora chroots (j1.kyjovsky@gmail.com)
  - eol/epel-6: copy-paste ca-bundle from host (praiskup@redhat.com)
  - Fix aarch64 configuration for Azure Linux 3 (negativo17@gmail.com)


author: Pavel Raiskup <pavel@raiskup.cz> 43.5-1
changelog:
  - add PQ keys to rhel9 (msuchy@redhat.com)
  - Switch Mageia 10+ and Cauldron to DNF5 (ngompa@mageia.org)
  - EOL Fedora 41


author: Pavel Raiskup <pavel@raiskup.cz> 44.3-1
changelog:
  - the fedora-release-eln renamed to fedora-eln-release
  - Add config for Fedora 44 version of RISC-V port (marcin@juszkiewicz.com.pl)
  - set bootstrap_image_ready=True for AlmaLinux configs (andrew.lukoshko@gmail.com)
  - re-enable bootstrap images for x86_64_v2 AlmaLinux configs (andrew.lukoshko@gmail.com)
  - remove dependency on python3-dnf (msuchy@redhat.com)


author: Pavel Raiskup <pavel@raiskup.cz> 44.4-1
changelog:
  - Fixes #1761: Add Fedora Rawhide RISC-V (jmontleo@redhat.com)
  - configs: add Azure Linux 4.0 beta configuration (tobiasb@microsoft.com)


author: Filipe Rosset <filiperosset@fedoraproject.org> - 5.4.3-1
changelog:
  - update to 5.4.3 fixes rhbz#2492868
  - a bunch of other bugs were fixed and will be backported to all supported
    Fedora / EPEL versions


author: Paul Howarth <paul@city-fan.org> - 1.6400-1
changelog:
  - Update to 1.64
    - Update AlphaVantage.pm (GH#447)
    - Fix to Stooq.pm (GH#445)
    - Updated ASX.pm (GH#404)
    - Added more fields to CSE.pm and exposed all labels
    - Changed parsing in Comdirect.pm (GH#413)
    - Complete rewrite of OnVista.pm (GH#414)
    - Minor fix to FinanceAPI decoding JSON (GH#434)
    - Modified YahooJSON to deal with "nan" as dividend yield in JSON
    - New CurrencyRates module, CurrencyRates/FinanceAPI (GH#427)
    - Fixed Bourso.pm (GH#417)
    - Allowed Currency Rates modules Fixer.pm and OpenExchange.pm to read their
      API keys from environment variables (GH#426)
    - Removed references to IEXCloud (IEX ended support for all products at the
      end of August 2024)
  - Switch source URL from cpan.metacpan.org to www.cpan.org
  - Add build conditional for author tests, disabled by default


author: Paul Howarth <paul@city-fan.org> - 1.6500-1
changelog:
  - Update to 1.65
    - Added EXCHANGE feature to Sinvestor.pm and some fixes (GH#481)
    - Added EXCHANGE feature to OnVista.pm (GH#480)
    - Added EXCHANGE feature to Consorsbank.pm and some fixes (GH#479)
    - Enabled usage count in Quote.pm
    - Removed DWS.pm
    - Improved check that dividend yield is a number in YahooJSON.pm by adding
      regex anchors
    - Added ssl_opts to user agent in Union.pm to account for bad certificate
      chain (GH#482)
    - Added ETFs search, more labels and EXCHANGE feature to Comdirect.pm (GH#478)
    - GoogleWeb: Add support for Hong Kong Exchange (GH#476)
    - YahooJSON: Adjust other currency fields when data is returned in GBp, ZAc,
      or ILA
    - Added labels wkn, ìsin, close, ask, bid, p_change, time to OnVista.pm
    - Modified OnVista.pm to enable search by ISIN and WKN and search for ETFs
    - Added methodinfo hash to Tradegate.pm (GH#465)
    - Added labels isin, open, ask, bid, time to Tradegate.pm (GH#465)
    - Fixed Tradegate.pm - Search for ETFs (GH#465)
    - Removed MorningstarAU (GH#405)
    - Fixed malformed character in YahooWeb.pm (GH#468)
    - Changed useragent in YahooJSON.pm (GH#467)
    - Added methodinfo hash to AEX.pm (GH#466)
    - Added labels exchange, close, time to AEX.pm (GH#466)
    - Fixed XETRA.pm (GH#460)
    - Added methodinfo hash to Fool.pm
    - Fixed MorningstarJP.pm (GH#443, GH#451)
  - Use %{make_build} and %{make_install}


author: Paul Howarth <paul@city-fan.org> - 1.6600-1
changelog:
  - Update to 1.66
    - Modified CurrencyRates/CurrencyFreaks.pm to return from and to values
      instead of calculated rate
    - Removed Bloomberg.pm, Tiaacref.pm, Troweprice.pm
    - AlphaVantage: Return 'symbol not found' when no price data is returned
    - ASX: Changed error message when symbol isn't found (GH#497)
    - Added a new module to fetch the fund NAV from CMBChina (GH#494)
    - Added Cookie Jar to Comdirect user agent (GH#491)
    - Removed HU.pm, Oslobors.pm, and SEB.pm (GH#490)


author: Paul Howarth <paul@city-fan.org> - 1.6700-1
changelog:
  - Update to 1.67
    - Fixed ASEGR.pm; web site redesigned, URL used for data was no longer
      working (GH#509)
    - Fixed TesouroDireto.pm using Tesouro Transparente as data source (GH#527)
    - Added a new module to fetch data from SwissFundData (GH#515)
    - Handle no trade date in BorsaItaliana.pm (GH#528)
    - Added methodinfo() to MarketWatch.pm and BorsaItaliana.pm
    - Fixed MorningstarCH.pm
    - Fixed MorningstarUK.pm
  - Package new CONTRIBUTING.md file


author: Paul Howarth <paul@city-fan.org> - 1.6800-1
changelog:
  - Update to 1.68
    - Changes to AlphaVantage.pm and CurrencyRates/AlphaVantage.pm to throttle
      queries (GH#546)
    - YahooJSON.pm: Add additional fields/labels (GH#544)
    - New module USBonds.pm
    - MarketWatch.pm: Added headers to fix 401 code (GH#542)
    - Modified AEX.pm to return no data available if currency indicator is '%'
      (bonds return percentage of par/facevalue) (GH#539)
    - Fixed YahooWeb.pm (GH#533, GH#538)
    - Removed CMBChina.pm - no longer working (GH#534)
    - Rewrote Union.pm for URL that returns JSON (GH#516)
    - Modified parsing in BVB.pm (GH#513)


author: Paul Howarth <paul@city-fan.org> - 1.6900-1
changelog:
  - Update to 1.69
    - Sinvestor.pm: Trim whitespace before parsing date and price
    - XETRA.pm: Trim whitespace from date-time before extracting the actual date
      value (GH#557)
    - Modified Stooq.pm to send cookies
      - Stooq requires European visitors to their website to accept cookies
      - Cookies are set using JavaScript
      - Current version of module hard codes these cookies gleaned from a browser
        session
      - Added CurrencyRates/TwelveData.pm


author: Paul Howarth <paul@city-fan.org> - 1.7000-1
changelog:
  - Update to 1.70
    - New module Finnhub.pm: Fetches quotes from https://finnhub.io using a free
      personal-use API key
    - GoogleWeb.pm: Adapt to the redesigned Google Finance site
    - Tradegate.pm: Remove explicit "our $VERSION" assignment that collided with
      the dzil-injected version, producing a duplicate declaration and an
      "our variable $VERSION redeclared" warning; use a bare # VERSION
      marker like the other modules
    - Tradegate.pm: Trim whitespace before parsing date and time
    - Added CurrencyRates/Frankfurter
    - Removed AEX.pm: Euronext.com added JavaScript based anti-webscraping
    - Added CurrencyRates/UniRate.pm


author: Paul Howarth <paul@city-fan.org> - 1.02-8
changelog:
  - Use relative symlinks rather than absolute symlinks in test (GH#51)
  - Use %{make_build} and %{make_install}


author: Paul Howarth <paul@city-fan.org> - 1.03-1
changelog:
  - Update to 1.03 (rhbz#2492167)
    - Fix tests to work with newer Archive::Tar (GH#51)
    - Check link errors and warnings while extracting an archive


author: Benjamin A. Beasley <code@musicinmybrain.net> - 3.8.0-1
changelog:
  - Update to 3.8.0 (close RHBZ#2492139)
  - Run tests with pytest, as upstream is gradually adopting it


author: David Trudgian <dtrudg@sylabs.io> - 4.4.2-1
changelog:
  - Upgrade to 4.4.2 upstream version.
  - Fix rhbz#2452368
  - Fix rhbz#2453084
  - Fix rhbz#2455643
  - Fix rhbz#2458928
  - Fix CVE-2026-47215


author: Filipe Rosset <filiperosset@fedoraproject.org> - 2.3.1-1
changelog:
  - rebuilt for version 2.3.1 fixes rhbz#1856025 rhbz#2454296 rhbz#2128374
  - modernized packaging, enabled generator, templates, and libev support


