# changelog

author: Jens Petersen <petersen@redhat.com> - 1.7.1-34
changelog:
  - rebuild for haxr xmlrpc to Accept: application/xml
  - use rpmbuild-order 0.4.13
  - [epel] recommends epel-rpm-macros


author: Jens Petersen <petersen@redhat.com> - 1.8-35
changelog:
  - https://hackage.haskell.org/package/fbrnch-1.8/changelog
  - new 'branch-log' command
  - 'build','parallel': can now merge --from a particular branch
  - 'commit': requires -b option to confirm non-rawhide commit
  - 'compare-tarballs': new command to diff source tarballs
  - 'copr --failures': fetches tails of failed build logs
  - new 'repoquery' command which wraps fedora-repoquery
  - 'update-sources': prep in tmpdir; compares tarballs; improved ver-rel logic
  - `FBRNCH_KOJI_PROFILE` provides experimental Koji profile support (eg riscv)
  - merge handling improvements
  - tries to setup git upstream branch tracking


author: Jens Petersen <petersen@redhat.com> - 1.8.1-38
changelog:
  - new native watchtask implementation and command
  - local build.log's now generated with 'script' tool instead of tee pipe
  - some web API calls now retry to help with connection issues
  - update-sources try to take "sources" changes into account now
  - merge tries to rebase if origin ahead
  - more details: https://hackage.haskell.org/package/fbrnch-1.8.1/changelog


author: Sayan Paul <saypaul@redhat.com> - 1.9.2-15
changelog:
  - Add Python unit test suite to %check
  - Bring in pytest/numpy build dependencies for the tests
  - Patch: raise cmake_minimum_required to 3.5 for CMake 4+ compatibility
  - Patch UseLATEX.cmake: make html target depend on pdf target (CMake 4)


author: Jens Petersen <petersen@redhat.com> - 2.31.5-1
changelog:
  - rebase to nix-2.31.5 using libgit_1.9
  - fixes GHSA-vh5x-56v6-4368
  - https://nix.dev/manual/nix/2.31/release-notes/rl-2.31.html


author: Paul Howarth <paul@city-fan.org> - 5.006-1
changelog:
  - Update to 5.006 (rhbz#2480335)
    - Update bundled miniz to 3.1.1
    - Avoid deprecated ZSTD api
    - Tidy and regen


author: Paul Howarth <paul@city-fan.org> - 5.005-1
changelog:
  - Update to 5.005 (rhbz#2480052)
    - Update bundled Zstd to 1.5.7, and other changes
    - Update spec to document changes from version 5
    - Security fixes - make sure that COPY tags cannot be used to read past end
      of buffer


author: Paul Howarth <paul@city-fan.org> - 5.006-1
changelog:
  - Update to 5.006 (rhbz#2480334)
    - Update bundled miniz to 3.1.1
    - Avoid deprecated ZSTD api
    - Tidy and regen


author: Paul Howarth <paul@city-fan.org> - 5.006-1
changelog:
  - Update to 5.006 (rhbz#2480336)
    - Update bundled miniz to 3.1.1
    - Avoid deprecated ZSTD api
    - Tidy and regen


author: Remi Collet <rcollet@redhat.com> - 8.3.12-1
changelog:
  - rebase to 8.3.12
  - disable pspell and imap extensions
  - disable pdo_dblib (missing freetds)
  - disable pdo_firebird (missing firebird)


author: Remi Collet <rcollet@redhat.com> - 8.3.12-3
changelog:
  - Fix Integer overflow in the dblib/firebird quoter causing OOB writes
    CVE-2024-11236
  - enable pdo_dblib extension


author: Remi Collet <rcollet@redhat.com> - 8.4.14-1
changelog:
  - build as php8.4-extras
  - update to 8.4.14
  - drop pspell an imap subpackages
  - add sodium-devel subpackage


author: Robert Scheck <robert@fedoraproject.org> 13.0.2-4
changelog:
  - Use 'systemctl try-reload-or-restart' in logrotate postrotate
    script (#2371331, thanks to Marcos Mello)
  - Do not use removed /etc/pki/tls/certs/ca-bundle.crt bundle file
    for Fedora 43 >= and RHEL >= 11


author: Tom Callaway <spot@fedoraproject.org> - 13.0.4-2
changelog:
  - rebuild for lua 5.5
  - apply upstream fix for configure
  - make a new patch to actually support lua 5.5


author: Robert Scheck <robert@fedoraproject.org> 1.11.2-4
changelog:
  - Use 'systemctl try-reload-or-restart' in logrotate postrotate
    script (#2371326, thanks to Marcos Mello)


author: Jonathan Wright <jonathan@almalinux.org> - 1.33.0-1
changelog:
  - update to 1.33.0 rhbz#2342073
    Fix GHSA-f7r5-w49x-gxm3 Getting access to the Admin Panel via CSRF
    Fix CVE-2025-24364 RCE in the admin panel
    Fix CVE-2025-24365 escalation of privilege via variable confusion in OrgHeaders trait


author: Jonathan Wright <jonathan@almalinux.org> - 1.33.2-1
changelog:
  - update to 1.33.2 rhbz#2343535
    Fix CVE-2025-0977 ssl::select_next_proto use after free rhbz#2344558


author: Jonathan Wright <jonathan@almalinux.org> - 1.36.0-1
changelog:
  - update to 1.36.0 rhbz#2368636
  - Fix bitwarden mobile app not working rhbz#2437599
  - Fix CVE-2025-58160 vaultwarden: Tracing log pollution
  - Fix CVE-2026-25537 vaultwarden: jsonwebtoken has Type Confusion that leads to potential authorization bypass
  - Fix CVE-2026-25727 vaultwarden: time affected by a stack exhaustion denial of service attack
  - Fix CVE-2026-26012 vaultwarden: Information disclosure due to bypassed collection permissions
  - Fix CVE-2026-27898 vaultwarden: Information disclosure via API partial update
  - Fix CVE-2026-27803 vaultwarden: Unauthorized collection management operations due to improper access control
  - Fix CVE-2026-27801 vaultwarden: Two-factor authentication bypass allows unauthorized access and data deletion


author: Jonathan Wright <jonathan@almalinux.org> - 2026.4.1-1
changelog:
  - update to 2026.4.1 rhbz#2387335
  - Fixes CVE-2026-27803 Unauthorized collection management operations due to improper access control
  - Fixes CVE-2026-27801 Two-factor authentication bypass allows unauthorized access and data deletion
  - Fixes CVE-2026-27802 Privilege Escalation via Unauthorized Bulk Permission Update
  - Fixes CVE-2026-27898 Information disclosure via API partial update


author: Hans de Goede <hans@hansg.org> - 3.2.9a-1.20250317gitce9782a
changelog:
  - Update to 3.2.9a + latest git changes to fix build with -std=c11
  - Switch to upstream appdata/metainfo and desktop file
  - Drop all patches (all upstreamed)
  - Resolves: rhbz#2341567
  - Resolves: rhbz#2385740


