# changelog

author: Douglas Kosovic <doug@uq.edu.au> - 1.20.20-5
changelog:
  - Add README.Fedora for Fedora or README.EPEL for EPEL
  - Use (go-l2tp or xl2tpd) dependency for Fedora 43 to handle upgrades
    from earlier Fedora versions that had xl2tpd installed.


author: Douglas Kosovic <doug@uq.edu.au> - 1.52.0-1
changelog:
  - Updated to 1.52.0 release
    Verify file permissions for private connections to prevent unprivileged
    user from using other user's certs (CVE-2025-9615)
  - Ensure NetworkManager dependency has CVE-2025-9615 update.
  - Correct sed example in generated README.Fedora and README.EPEL files.


author: Douglas Kosovic <doug@uq.edu.au> - 1.52.2-1
changelog:
  - Updated to 1.52.2 release which has experimental IPv6 support.
  - Update CVE-2025-9615 related Requires and BuildRequires.
  - Fix typos found by codespell.


author: Simone Caronni <negativo17@gmail.com> - 2.43-2
changelog:
  - Allow mirroring Debian repositories that do not follow the Debian/Ubuntu
    structure (JFrog, Hashicorp, NVIDIA, Spotify, etc.).


author: Paul Howarth <paul@city-fan.org> - 1.11.1-1
changelog:
  - Update to 1.11.1 (rhbz#2319104)
    - This is an enhancement and bugfix release - see RELEASE_NOTES for details
    - Note also that various algorithms are now deprecated and not built by
      default, which affects this package


author: Paul Howarth <paul@city-fan.org> - 1.11.1-6
changelog:
  - Fix CVE-2026-7598: integer overflow via large username or password arguments
    (https://github.com/libssh2/libssh2/pull/1858)


author: josef radinger <cheese@nosuchhost.net> - 2.6.0-1
changelog:
  - bump version
  - add basic_passwords.txt and vulnerabilities.csv
  - cleanup spec-file
  - remove patch1


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 7.0.0-1
changelog:
  - ARC version 7 packaged for EPEL with a different package name
  - Based on the Fedora rawhide package
  - These packages declare conflicts with the ARC version 6 packages


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 7.0.0-3
changelog:
  - Update the VOMS attribute certificate signing hash algorithm
  - Re-enable the VOMSUtilTest on Fedora 43 (after above fix)
  - Fix unowned directory /etc/arc.conf.d


author: Paul Howarth <paul@city-fan.org> - 4.39-1
changelog:
  - Update to 4.39
    - Fix Windows -Dusequadmath (GH#229, GH#235)
    - Fix inconsistent behavior between decoding escaped and unescaped
      surrogates, and escaped non-characters vs. non-escaped non-characters; now
      aligned to JSON::PP (GH#227, GH#233)
    - Add type_all_string tests (GH#236)
    - Silence UV to char cast warnings (GH#232)
    - Fix MSVC preprocessor errors (GH#232)
    - Fix -Wformat warnings on Windows (GH#228)
    - Clarify BigInt decoding (GH#226)
  - Drop EL-7 support
  - Use %{make_build} and %{make_install}


author: Paul Howarth <paul@city-fan.org> - 4.40-1
changelog:
  - Update to 4.40
    - Fix overflow with overlong numbers, fuzzing only (CVE-2025-40929)
    - Detect more malformed numbers, with two decimal points
    - Pin Github actions to latest @v via pinact run -u


author: Paul Howarth <paul@city-fan.org> - 4.41-1
changelog:
  - Update to 4.41
    - Fix BOM-shift PV-corruption SIGABRT (CVE-2026-9516)
    - Fix dupkeys_as_arrayref type confusion (CVE-2026-9334)
    - Fix incr_parse single-quote string delimiter (GH#245)
    - Fix a one-byte out-of-bounds heap read reachable via allow_barekey on
      truncated input (GH#244)


author: Paul Howarth <paul@city-fan.org> - 1.4.3-1
changelog:
  - Update to 1.43
    - Replace use of the cryptographically weak rand() function with the much
      stronger Crypt::URandom::urandom() (GH#3, CVE-2026-6659, rhbz#2479575)
    - Add Encode, Exporter, ExtUtils::MakeMaker to Makefile.PL
    - Add files AI_POLICY.md and SECURITY.md


author: Paul Howarth <paul@city-fan.org> - 4.018-2
changelog:
  - Make sure that COPY tags cannot be used to read past end of buffer
    (ported from upstream commit 303a2c69)


author: Paul Wouters <paul.wouters@aiven.io> - 6.0.6-1
changelog:
  - Update to 6.0.6 to fix a bunch of security issues:
  - Resolves: rhbz#CVE-2026-25075
  - Resolves: rhbz#CVE-2026-35328
  - Resolves: rhbz#CVE-2026-35329
  - Resolves: rhbz#CVE-2026-35330
  - Resolves: rhbz#CVE-2026-35331
  - Resolves: rhbz#CVE-2026-35332
  - Resolves: rhbz#CVE-2026-35333
  - Resolves: rhbz#CVE-2026-35334
  - Resolves: rhbz#CVE-2026-25075
  - Resolves: rhbz#CVE-2025-9615
  - Resolves: rhbz#CVE-2025-62291


author: Michel Lind <salimma@fedoraproject.org> - 0.62.1-1
changelog:
  - Update to 0.62.1 for ability to enforce SSO login/signups
  - Generate extras subpackages
  - Enforce that the license file is shipped


author: Peter Bieringer <pb@bieringer.de> - 3.6.0-1
changelog:
  - Update to 3.6.0
  - add BuildRequires: python3-packaging
  - force to use "passlib" instead of "libpass"


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.7.0-4
changelog:
  - Update architectures for asan/tsan/ubsan tests based on GCC 15
  - Adds riscv64 to supported architectures for all three kinds of tsts


author: Bojan Smojver <bojan@rexursive.com> - 1:0.10.6-1
changelog:
  - Update to 0.10.6
  - CVE-2026-32105, CVE-2026-32107, CVE-2026-32623, CVE-2026-32624
  - CVE-2026-33145, CVE-2026-33516, CVE-2026-33689, CVE-2026-35512


