# changelog

author: Dave Dykstra <dwd@cern.ch> - 1.4.0
changelog:
  - Update to upstream 1.4.0
  - Change Recommends: fakeroot back to Requires: fakeroot on epel10
    now that fakeroot is available there.


author: Troy Dawson <tdawson@redhat.com> - 0.10.1-1
changelog:
  - Determining if package is synced solely on distrobaker config (sgajdosi)
  - Use the authenticated session for PP API (sgallagh)


author: Troy Dawson <tdawson@redhat.com> - 0.10.2-1
changelog:
  - Add support for cXs-aie-partner branches : CS-3294 (michal)
  - Determine_rhel_state: Add check for locked tags: CS-2997 (sgallagh)
  - Fix use-before-assignment (sgallagh)


author: Than Ngo <than@redhat.com> - 144.0.7559.132-1
changelog:
  - Update to 144.0.7559.132
    * CVE-2026-1861: Heap buffer overflow in libvpx
    * CVE-2026-1862: Type Confusion in V8
  - Add BR on esbuild
  - Disable devtool bundle
  - Update scripts for downloading the source


author: Than Ngo <than@redhat.com> - 145.0.7632.45-1
changelog:
  - Update to 145.0.7632.45
    * CVE-2026-2313: Use after free in CSS
    * CVE-2026-2314: Heap buffer overflow in Codecs
    * CVE-2026-2315: Inappropriate implementation in WebGPU
    * CVE-2026-2316: Insufficient policy enforcement in Frames
    * CVE-2026-2317: Inappropriate implementation in Animation
    * CVE-2026-2318: Inappropriate implementation in PictureInPicture
    * CVE-2026-2319: Race in DevTools
    * CVE-2026-2320: Inappropriate implementation in File input
    * CVE-2026-2321: Use after free in Ozone
    * CVE-2026-2322: Inappropriate implementation in File input
    * CVE-2026-2323: Inappropriate implementation in Downloads


author: Than Ngo <than@redhat.com> - 145.0.7632.109-1
changelog:
  - Update to 145.0.7632.109
    * CVE-2026-2648: Heap buffer overflow in PDFium
    * CVE-2026-2649: Integer overflow in V8
    * CVE-2026-2650: Heap buffer overflow in Media


author: Than Ngo <than@redhat.com> - 145.0.7632.116-1
changelog:
  - Update to 145.0.7632.116
    * CVE-2026-3061: Out of bounds read in Media
    * CVE-2026-3062: Out of bounds read and write in Tint
    * CVE-2026-3063: Inappropriate implementation in DevTools


author: Than Ngo <than@redhat.com> - 145.0.7632.159-1
changelog:
  - Update to 145.0.7632.159
    * CVE-2026-3536: Integer overflow in ANGLE
    * CVE-2026-3537: Object lifecycle issue in PowerVR
    * CVE-2026-3538: Integer overflow in Skia
    * CVE-2026-3539: Object lifecycle issue in DevTools
    * CVE-2026-3540: Inappropriate implementation in WebAudio
    * CVE-2026-3541: Inappropriate implementation in CSS
    * CVE-2026-3542: Inappropriate implementation in WebAssembly
    * CVE-2026-3543: Inappropriate implementation in V8
    * CVE-2026-3544: Heap buffer overflow in WebCodecs
    * CVE-2026-3545: Insufficient data validation in Navigation


author: Than Ngo <than@redhat.com> - 146.0.7680.71-1
changelog:
  - Update to 146.0.7680.71
    * CVE-2026-3913: Heap buffer overflow in WebML
    * CVE-2026-3914: Integer overflow in WebML
    * CVE-2026-3915: Heap buffer overflow in WebML
    * CVE-2026-3916: Out of bounds read in Web Speech
    * CVE-2026-3917: Use after free in Agents
    * CVE-2026-3918: Use after free in WebMCP
    * CVE-2026-3919: Use after free in Extensions
    * CVE-2026-3920: Out of bounds memory access in WebML
    * CVE-2026-3921: Use after free in TextEncoding
    * CVE-2026-3922: Use after free in MediaStream
    * CVE-2026-3923: Use after free in WebMIDI
    * CVE-2026-3924: Use after free in WindowDialog
    * CVE-2026-3925: Incorrect security UI in LookalikeChecks
    * CVE-2026-3926: Out of bounds read in V8
    * CVE-2026-3927: Incorrect security UI in PictureInPicture
    * CVE-2026-3928: Insufficient policy enforcement in Extensions
    * CVE-2026-3929: Side-channel information leakage in ResourceTiming
    * CVE-2026-3930: Unsafe navigation in Navigation
    * CVE-2026-3931: Heap buffer overflow in Skia
    * CVE-2026-3932: Insufficient policy enforcement in PDF
    * CVE-2026-3934: Insufficient policy enforcement in ChromeDriver
    * CVE-2026-3935: Incorrect security UI in WebAppInstalls
    * CVE-2026-3936: Use after free in WebView
    * CVE-2026-3937: Incorrect security UI in Downloads
    * CVE-2026-3938: Insufficient policy enforcement in Clipboard
    * CVE-2026-3939: Insufficient policy enforcement in PDF
    * CVE-2026-3940: Insufficient policy enforcement in DevTools
    * CVE-2026-3941: Insufficient policy enforcement in DevTools
    * CVE-2026-3942: Incorrect security UI in PictureInPicture


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.5.5-1
changelog:
  - Update to version 6.5.5
  - Drop soname patch, use new configure option --enable-librelease instead
  - Unbundle yaml-cpp, using new configure option --with-yaml-cpp
  - EPEL 7 EOL specfile cleanup


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.5.6-1
changelog:
  - Update to version 6.5.6
  - Add PDFs used by new tests to the source RPM
  - Add test file missing from the source tarfile to the source RPM


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.9.4-15
changelog:
  - Use poll instead of select on F41 (bug 2283446)
  - Update spec file a bit, including keeping timestamps


author: Packit <hello@packit.dev> - 1.15.1-1
changelog:
  - We have fixed a bug that prevented running `sync_release()` on a `PackitAPI` instance initialized with `non_git_upstream=True` repeatedly due to an improper clean-up. (#2691)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.38.00-1
changelog:
  - Update to 6.38.00
  - Removed subpackages: root-proof, root-proof-bench, root-proof-player,
      root-proof-sessionviewer, root-sql-mysql, root-sql-odbc, root-sql-pgsql
  - New subpackages: root-geom-checker, root-gui-treemap,
      root-tree-ntuple-browse, root-histv7
  - JsMVA python (sub)module dropped from python3-root package
  - Compile minuit2 with Open MP support
  - Dropped patches: 7
  - New patches: 4


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.38.00-2
changelog:
  - Skip RPATH using -DCMAKE_SKIP_INSTALL_RPATH:BOOL=ON (replaces
    previously used root specific -Drpath:BOOL=OFF no longer available)
  - Backport fixes to python module
  - Rebuild for pythia8 8.3.16


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.38.00-4
changelog:
  - Exclude tests for Fedora 43+ on s390x that fail due to hardware
    acceleration in the zlib-ng library.


author: Maja Massarini <mmassari@redhat.com> - 0.54.0-1
changelog:
  - Support for Forgejo pull requests has been added. (#925)
  - We have added support for Forgejo methods related to permissions. (#918)


author: Packit <hello@packit.dev> - 0.56.0-1
changelog:
  - Tmt documentation has been extended. (#937)
  - Support for forgejo commit statuses has been added. (#936)
  - The package ogr/abstract has been split into multiple files. (#935)
  - Resolves: rhbz#2389723


author: Packit <hello@packit.dev> - 0.56.1-1
changelog:
  - We now use httpx when making requests from our Forgejo implementation. (#941)
  - Resolves: rhbz#2401236


author: Packit <hello@packit.dev> - 0.58.0-1
changelog:
  - `PagureService` now accepts an optional `user_agent` argument to set a custom User-Agent header. (#953)
  - It is now possible to pass a `headers` argument in `PagureProject.get_file_content`. The default header is set to `Accept: text/plain`. (#954)
  - Resolves: rhbz#2420049


author: Packit <hello@packit.dev> - 0.59.0-1
changelog:
  - Improved handling of retries after errors to avoid hitting rate limits if possible. (#958)
  - `GithubPullRequest.labels` property is now cached for better performance and to be consistent with other services. (#960, #961)
  - Resolves: rhbz#2422233


author: Packit <hello@packit.dev> - 0.60.0-1
changelog:
  - A new method `get_rate_limit_remaining()` to check rate limit thresholds has been added to the service API. (#970)
  - Resolves: rhbz#2430818


author: Packit <hello@packit.dev> - 0.60.1-1
changelog:
  - The method `get_rate_limit_remaining()` now also supports repository-specific checks for GitHub. (#972)
  - Resolves: rhbz#2435481


author: Packit <hello@packit.dev> - 0.61.1-1
changelog:
  - Force downstream synchronization of upstream configuration to enable side tagging in EPEL 10.
  - Resolves: rhbz#2437993


author: Pavel Raiskup <praiskup@redhat.com> - 5.10-1
changelog:
  - new upstream release, packages use RPM built-in sysusers support:
    https://github.com/praiskup/resalloc/releases/tag/v5.10


author: Pavel Raiskup <praiskup@redhat.com> - 5.11-1
changelog:
  - new upstream release, don't keep cleanup processes indefinitely:
    https://github.com/praiskup/resalloc/releases/tag/v5.11


author: Packit <hello@packit.dev> - 0.34.2-1
changelog:
  - context_management: add a type stub override to fix typing. Type checkers like mypy and pyright can now correctly determine the types for `.sources()`, `.sections()`, and the other `Specfile` methods that return context managers. (#457)
  - Resolves: rhbz#2344364


author: Packit <hello@packit.dev> - 0.35.0-1
changelog:
  - Added support for creating Specfile instances from file objects and strings. (#458)
  - The `context_management` type stubs now use `ParamSpec` from `typing_extensions` to support Python < 3.10. (#466)


author: Packit <hello@packit.dev> - 0.36.0-1
changelog:
  - We have fixed a bug that caused specfile to traceback when section names with conditional macro expansions containing spaces were present in the spec file. (#476)


author: Packit <hello@packit.dev> - 0.38.0-1
changelog:
  - A bug leading to incorrect EVR expansion has been fixed. (#492)
  - Prevented side-effects during condition evaluation that could occur when expanding macros that manipulate other macros, leading to misinterpreted validity of condition branches. (#499)


author: Packit <hello@packit.dev> - 0.40.0-1
changelog:
  - `Specfile()` has a new `sanitize` option that enables best effort sanitization of potentially dangerous constructs such as shell expansions and unsafe Lua macros before they are passed to RPM for parsing. (#519)
  - Fixed incorrect parsing of nested macros. (#522)


author: Terje Rosten <terjeros@gmail.com> - 1.43.5-6
changelog:
  - Add forward and backwards weak deps in -gssp subpackage to gnome-shell
  - Remove wrong req. on -kio
  - Let -kio subpackage Supplement kf6-kio-core


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2:1.3.3-1
changelog:
  - Update to release v1.3.3
  - Resolves: rhbz#2411664, rhbz#2411410, rhbz#2411148
  - Resolves: rbhz#2410768, rhbz#2410512, rhbz#2410233
  - Resolves: rhbz#2409818, rhbz#2409561, rhbz#2409284
  - Resolves: rhbz#2408345, rhbz#2408091, rhbz#2407818
  - Security. Fixes CVE-2025-31133, CVE-2025-52565, CVE-2025-52881
  - Upstream new feature


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2:1.4.0-2
changelog:
  - Update packit configuration
  - Adds support for go_vendor_archive and go_vendor_license integration with
    packit


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2:1.4.1-1
changelog:
  - Update to release v1.4.1
  - Resolves: rhbz#2447251
  - Adopts go2rpm generates spec file
  - New libpathrs build tag not included as that library is not yet available
    in Fedora


author: Jan André Reuter <j.reuter@fz-juelich.de> - 9.0-1
changelog:
  - New version 9.0
  - Require cube >= 4.9
  - Require otf2 >= 3.1
  - Require opari2 >= 2.0.9
  - Drop GCC 14 patch as fixed upstream
  - Add gotcha-devel dependency
  - Remove el7-isms
  - Drop rpath patch


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0^20251025gitf1c79c0-2
changelog:
  - Patch two newly-reported memory-safety bugs in stb_image
  - https://github.com/nothings/stb/issues/1860
  - https://github.com/nothings/stb/issues/1861


author: Michel Lind <salimma@fedoraproject.org> - 0.8.0-1
changelog:
  - Update to 0.8.0 upstream release
  - Resolves: rhbz#2443508
  - Re-enable debuginfo generation
  - Enable Packit
  - Verified the SPDX license conversion


