# changelog

author: Michel Lind <salimma@fedoraproject.org> - 25.01-1
changelog:
  - Update to 25.01
  - 25.00+ fixes CVE-2025-11001; Resolves: rhbz#2416011
  - Backport Debian patch to disable echo-ing password; Resolves:
    rhbz#2412315


author: Michel Lind <salimma@fedoraproject.org> - 26.01-1
changelog:
  - Update to 26.01; Resolves: rhbz#2440915
  - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
  - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
  - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
  - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF
    image
  - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive handler
  - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive handler
  - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image parser
  - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD
    SYMDEF parser


author: Douglas Kosovic <doug@uq.edu.au> - 1.20.20-5
changelog:
  - Add README.Fedora for Fedora or README.EPEL for EPEL
  - Use (go-l2tp or xl2tpd) dependency for Fedora 43 to handle upgrades
    from earlier Fedora versions that had xl2tpd installed.


author: Douglas Kosovic <doug@uq.edu.au> - 1.52.0-1
changelog:
  - Updated to 1.52.0 release
    Verify file permissions for private connections to prevent unprivileged
    user from using other user's certs (CVE-2025-9615)
  - Ensure NetworkManager dependency has CVE-2025-9615 update.
  - Correct sed example in generated README.Fedora and README.EPEL files.


author: Douglas Kosovic <doug@uq.edu.au> - 1.52.2-1
changelog:
  - Updated to 1.52.2 release which has experimental IPv6 support.
  - Update CVE-2025-9615 related Requires and BuildRequires.
  - Fix typos found by codespell.


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.21-1
changelog:
  - Update to 1.9.21
  - Security fix: CVE-2026-41054 — privilege escalation via command socket
  - Fix semaphore error handling (SEM_FAILED vs NULL)
  - Fix /dev/shm permissions (use 01777 with sticky bit)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-1
changelog:
  - Update to 1.9.23
  - Security: use O_EXCL with sem_open to prevent semaphore pre-planting attacks
  - Security: fix OOB memory access in safein()/safeout() on socket errors
  - Security: reject command socket connections from different user namespaces
  - Security: use O_NOFOLLOW for PID file to prevent symlink attacks
  - Harden: open random device with O_CLOEXEC, restrict semaphore to 0600
  - Fix stale semaphore recovery after SIGKILL
  - Fix compilation when NO_COMMAND_MODE is defined


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-2
changelog:
  - Add SELinux policy module to allow semaphore creation in /dev/shm
  - Add rpminspect.yaml to waive pre-existing annocheck false positive


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-3
changelog:
  - Fix rpminspect.yaml: use annocheck failure_severity instead of inspections toggle
    (annocheck is a security inspection and cannot be disabled via inspections section)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.24-1
changelog:
  - Update to 1.9.24
  - Disable command mode in long-running service (--no-command flag)
  - Enable PrivateNetwork=true in systemd service
  - Remove SELinux policy module (no longer needed without command mode)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.25-1
changelog:
  - Update to 1.9.25
  - Fix initramfs switch-root failure caused by --no-command (BZ#2491739)
  - Add haveged-initramfs.service for use inside the initramfs


author: Dominik 'Rathann' Mierzejewski <dominik@greysector.net> - 2.78.3-2
changelog:
  - Rebuilt for Go 1.25.3
  - resolves rhbz#2407547 CVE-2025-58189, rhbz#2408551 CVE-2025-61725,
    rhbz#2409002 CVE-2025-61723, rhbz#2409945 CVE-2025-58185, rhbz#2410882
    CVE-2025-58188, rhbz#2412486 CVE-2025-58183


author: Dominik 'Rathann' Mierzejewski <dominik@greysector.net> - 2.98.0-1
changelog:
  - update to 2.98.0
  - resolves: rhbz#2403136 (CVE-2025-11579), rhbz#2420569 (CVE-2025-47913),
    rhbz#2421867 (CVE-2025-66564), rhbz#2432197 (CVE-2026-23831),
    rhbz#2433101 (CVE-2026-23991), rhbz#2433104 (CVE-2026-23992),
    rhbz#2433535 (CVE-2026-24117), rhbz#2433572 (CVE-2026-24137),
    rhbz#2434246 (CVE-2026-24686), rhbz#2452365 (CVE-2026-32285),
    rhbz#2454524 (CVE-2026-34165), rhbz#2454525 (CVE-2026-33762),
    rhbz#2455638 (CVE-2026-34986)


author: Dominik 'Rathann' Mierzejewski <dominik@greysector.net> - 2.104.1-1
changelog:
  - update to 2.104.1 (resolves rhbz#2463822)
  - exclude uv_test.go, which requires an Artifactory instance


author: Frank Lichtenheld <frank@lichtenheld.com> - 2.5.11-2
changelog:
  - Import collected upstream changes from git into a patch.
    This fixes several security issues and other bugs.
  - Includes patches up to commit 37160ee8408150990787eef4a76e0299230ed8d8


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.40.02-1
changelog:
  - Update to 6.40.02
  - Rename the jupyroot and distrdf packages to reflect that they are
    now submodules of the main pyyhon package
  - New subpackages: root-package graf3d-glad, root-package net-curl,
    root-package tmva-sofie-parser-python, root-package tree-ml,
    root-package histv7util
  - Dropped patches: 2
  - New patches: 7


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.1.2-1
changelog:
  - Update to 1.1.2 upstream release
  - Resolves: rhbz#2494057
  - Update License and SourceLicense fields


author: Bojan Smojver <bojan@rexursive.com> - 1:0.10.6-1
changelog:
  - Update to 0.10.6
  - CVE-2026-32105, CVE-2026-32107, CVE-2026-32623, CVE-2026-32624
  - CVE-2026-33145, CVE-2026-33516, CVE-2026-33689, CVE-2026-35512


author: Bojan Smojver <bojan@rexursive.com> - 1:0.10.6.1-1
changelog:
  - Update to 0.10.6.1
  - CVE-2026-41252, CVE-2026-41521, CVE-2026-44178, CVE-2026-42218
  - CVE-2026-44978, CVE-2026-54538, CVE-2026-55238, CVE-2026-55626
  - CVE-2026-55639, CVE-2026-55645


author: Justin Wheeler <jwheel@fedoraproject.org> - 1.0.3-12
changelog:
  - Fix FTBFS. Thanks @limb for the hotfix.
  - Upstream work ongoing for improved support with newer versions of the C programming language and compilers.


author: Justin Wheeler <jwheel@fedoraproject.org> - 1.1.0-1
changelog:
  - Update to v1.1.0
  - Upstream bug fixes: out-of-bounds array access, missing unistd.h header,
    localtime prototype, curses header preprocessor guard
  - Upstream build improvements: LDFLAGS support in Makefile
  - Migrate to %autorelease
  - Remove unnecessary %global _hardened_build 1 (default since F23)


