# changelog

author: Dave Dykstra <dwd@cern.ch> - 1.4.0
changelog:
  - Update to upstream 1.4.0
  - Change Recommends: fakeroot back to Requires: fakeroot on epel10
    now that fakeroot is available there.


author: Rasmus Ory Nielsen <ron@ron.dk> - 1.23-1
changelog:
  - Updated to 1.23
  - Removed obsolete vcf_plugin_tests patch
  - Remove invalid `-errors` from PERL_LIBS to fix linker warnings


author: Mosaab Alzoubi <mosaab[AT]ruya[DOT]systems> - 0-55.20251223git
changelog:
  - Update on 2025-12-23
  - Use stable branch instead of master
  - Add next generation of Gnulib the python release of Gnulib
  - Fix building tests
  - Re-struct for gnulib ng with python base
  - Update dependencies


author: Sérgio Basto <sergio@serjux.com> - 0-78.20260302git4a3650d
changelog:
  - Update to git4a3650d branch stable-202601 with ISO C23 fixes
  - The git-merge-changelog binary has been removed from the source and is now maintained in a separate repository.


author: Michel Lind <salimma@fedoraproject.org> - 2.102-1
changelog:
  - Update to 2.102 upstream release; Resolves: rhbz#2334057
  - Fix build with GCC 15; Resolves: rhbz#2340933


author: Packit <hello@packit.dev> - 1.15.1-1
changelog:
  - We have fixed a bug that prevented running `sync_release()` on a `PackitAPI` instance initialized with `non_git_upstream=True` repeatedly due to an improper clean-up. (#2691)


author: Packit <hello@packit.dev> - 1.15.2-1
changelog:
  - Packit now uses the specfile library's sanitization when parsing spec files.
  - Resolves: rhbz#2450841


author: Paul Howarth <paul@city-fan.org> - 1.37-1
changelog:
  - Update to 1.37
    Features:
    - Add LoadBytes, LoadUTF8, DumpBytes, DumpUTF8 functions (GH#51)
    Fixes:
    - Fix heap buffer overflow in the YAML emitter - CVE-2026-4177 (GH#67)
    - Fix DumpFile with tied filehandles (IO::String, IO::Scalar) (GH#22)
    - Fix _is_glob to recognize IO::Handle subclasses (GH#23)
    - Fix memory leak when dumping filehandles (CPAN RT#41199, GH#42)
    - Fix dumping of tied hashes (GH#31)
    - Fix dumping strings starting with '...' as unquoted plain scalars (GH#34)
    - Fix dumping strings with tabs and carriage returns as plain scalars (GH#59)
    - Fix double-dash YAML parsing (RT#34073, GH#35)
    - Fix extra newline after empty arrays/hashes in YAML output (GH#36)
    - Remove trailing whitespace from YAML output lines (GH#37, GH#38, GH#39)
    - Fix quoting of \r and \t in YAML output instead of emitting raw bytes
      (GH#40)
    - Fix growing !!perl/regexp objects in round-trips (GH#43)
    - Fix quoted '=' being transformed into 'str' (GH#45)
    - Fix backslash-space escape in double-quoted YAML strings (GH#61)
    - Fix flow sequence comma separator not recognized without trailing space
      (GH#60)
    - Fix wide character warning in DumpFile (GH#28)
    - Fix inline arrays without space after comma (GH#25)
    - Fix: quote strings matching YAML implicit types to prevent round-trip
      failures (GH#26)
    - Fix JSON::Syck::Dump to use JSON-valid \uXXXX escapes in output (GH#21)
    - Fix JSON::Syck::Load decoding of \/ and \uXXXX escape sequences (GH#30)
    - Fix: apply JSON postprocessing to JSON::Syck::DumpFile output (GH#104)
    - Fix: add tied-filehandle fallback to JSON::Syck::DumpFile (GH#98)
    - Fix: handle JSON escape sequences in SingleQuote mode Load (GH#99)
    - Fix: restore Perl 5.8 compatibility in test suite (GH#121)
    - Fix: correct copy-paste error in Makefile.PL clean target (GH#101)
    - Fix: correct $SortKeys POD default from false to true (GH#100)
    - Fix: correct POD documentation errors (GH#103)
    Maintenance:
    - Add C23-compatible function prototypes for GCC 15 compatibility (GH#112)
    - Silence macOS compiler warnings (GH#92)
    - Guard stdint.h include for portability (HP-UX 11.11) (GH#33)
    - Guard stdint.h include in syck_st.h for portability (GH#24)
    - Update ppport.h to 3.68
    - Add regression tests for magical variable dumping (GH#32)
    - CI: modernize GitHub Actions workflow (GH#123, GH#124)
    - CI: add disttest job to validate MANIFEST completeness
  - Use %{make_build} and %{make_install}
  - Drop workaround for C23 incompatibility


author: Paul Howarth <paul@city-fan.org> - 1.39-1
changelog:
  - Update to 1.39
    Bug Fixes:
    - Fix: escape solidus (/) as \/ in JSON::Syck::Dump for XSS safety
      (GH#125, GH#130)
    - Fix: anchor tracking for blessed scalar refs in Dump (GH#126, GH#131)
    - Fix: prevent buffer underflow in base60 (sexagesimal) parsing (GH#133)
    - Fix: guard against NULL type from strtok in tag parsing (GH#135)
    - Fix: correct copy-paste bug in syck_seq_assign() ASSERT macros (GH#137)
    - Fix t/yaml-implicit-typing.t failure with -Duselongdouble perls
      (GH#138, GH#139)
    Improvements:
    - Resolve TODO tests for empty/invalid YAML to match actual behaviour
      (GH#127, GH#129)
    Maintenance:
    - Remove dead Perl 5.6 TODOs and convert 5.8 TODO to SKIP (GH#129)
    - Add comprehensive implicit type resolution test suite (GH#137)
    - Update MANIFEST to include all unit tests
    - Clean up test names to remove unnecessary numbering


author: Steve Traylen <steve.traylen@cern.ch> - 4.13.2-1
changelog:
  - Update to 4.13.2
  - New --with bootstrap flag for stestr dep
  - Use pyproject macros file list
  - Remove redundant pyproject-rpms-macro BR
  - Remove redundant seds from setup


author: Derek Weitzel <dweitzel@unl.edu> - 1.9.0-1
changelog:
  - Create simple CLI tool to examine keycache in Python and refresh all entries in keycache
  - Verify Thread-safe + Unwritable Cache + Negative Cache
  - Revamp Sphinx documentation
  - Patch Enforcer to validate against multiple issuers


author: Derek Weitzel <dweitzel@unl.edu> - 1.9.6-1
changelog:
  - Fix SQL injection risk in KeyCache by using parameterized SQLite queries
  - Prevent sibling-path authorization bypass in Enforcer scope checks


author: Derek Weitzel <dweitzel@unl.edu> - 1.9.7-1
changelog:
  - Remove legacy parent SciToken chaining behavior from token initialization and claim handling
  - Harden Enforcer scope path traversal validation (including encoded traversal checks)
  - Clean up documentation references to parent/chained SciTokens


author: Packit <hello@packit.dev> - 0.34.2-1
changelog:
  - context_management: add a type stub override to fix typing. Type checkers like mypy and pyright can now correctly determine the types for `.sources()`, `.sections()`, and the other `Specfile` methods that return context managers. (#457)
  - Resolves: rhbz#2344364


author: Packit <hello@packit.dev> - 0.35.0-1
changelog:
  - Added support for creating Specfile instances from file objects and strings. (#458)
  - The `context_management` type stubs now use `ParamSpec` from `typing_extensions` to support Python < 3.10. (#466)


author: Packit <hello@packit.dev> - 0.36.0-1
changelog:
  - We have fixed a bug that caused specfile to traceback when section names with conditional macro expansions containing spaces were present in the spec file. (#476)


author: Packit <hello@packit.dev> - 0.38.0-1
changelog:
  - A bug leading to incorrect EVR expansion has been fixed. (#492)
  - Prevented side-effects during condition evaluation that could occur when expanding macros that manipulate other macros, leading to misinterpreted validity of condition branches. (#499)


author: Packit <hello@packit.dev> - 0.40.0-1
changelog:
  - `Specfile()` has a new `sanitize` option that enables best effort sanitization of potentially dangerous constructs such as shell expansions and unsafe Lua macros before they are passed to RPM for parsing. (#519)
  - Fixed incorrect parsing of nested macros. (#522)


author: Terje Rosten <terjeros@gmail.com> - 1.43.5-6
changelog:
  - Add forward and backwards weak deps in -gssp subpackage to gnome-shell
  - Remove wrong req. on -kio
  - Let -kio subpackage Supplement kf6-kio-core


author: Pavel Raiskup <praiskup@redhat.com> - 5.10-1
changelog:
  - new upstream release, packages use RPM built-in sysusers support:
    https://github.com/praiskup/resalloc/releases/tag/v5.10


author: Pavel Raiskup <praiskup@redhat.com> - 5.11-1
changelog:
  - new upstream release, don't keep cleanup processes indefinitely:
    https://github.com/praiskup/resalloc/releases/tag/v5.11


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.5.18-4
changelog:
  - Rebuilt with rust-tar 0.4.45 for CVE-2026-33056
  - Updated the License expression based on a current Rawhide build


author: Jason Taylor <jtfas90@proton.me> 8.0.1-1
changelog:
  - Migrate to 8.0.x release
  - Addresses CVE-2025-59147, CVE-2025-59148
  - Addresses CVE-2025-59149, CVE-2025-59150
  - removed libprelude references as it is orphaned
  - removed suricatasc python patch, suricatasc has been migrated to rust
  - removed references to legacy C based libhtp, libhtp has been migrated to rust


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.9.30-2
changelog:
  - Rebuilt with jsonwebtoken patched for CVE-2026-25537
  - Fixes RHBZ#2437472; fixes RHBZ#2437467; fixes RHBZ#2437461


