# changelog

author: Michel Lind <salimma@fedoraproject.org> - 25.01-1
changelog:
  - Update to 25.01
  - 25.00+ fixes CVE-2025-11001; Resolves: rhbz#2416011
  - Backport Debian patch to disable echo-ing password; Resolves:
    rhbz#2412315


author: Michel Lind <salimma@fedoraproject.org> - 26.01-1
changelog:
  - Update to 26.01; Resolves: rhbz#2440915
  - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
  - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
  - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
  - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF
    image
  - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive handler
  - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive handler
  - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image parser
  - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD
    SYMDEF parser


author: Douglas Kosovic <doug@uq.edu.au> - 1.20.20-5
changelog:
  - Add README.Fedora for Fedora or README.EPEL for EPEL
  - Use (go-l2tp or xl2tpd) dependency for Fedora 43 to handle upgrades
    from earlier Fedora versions that had xl2tpd installed.


author: Douglas Kosovic <doug@uq.edu.au> - 1.52.0-1
changelog:
  - Updated to 1.52.0 release
    Verify file permissions for private connections to prevent unprivileged
    user from using other user's certs (CVE-2025-9615)
  - Ensure NetworkManager dependency has CVE-2025-9615 update.
  - Correct sed example in generated README.Fedora and README.EPEL files.


author: Douglas Kosovic <doug@uq.edu.au> - 1.52.2-1
changelog:
  - Updated to 1.52.2 release which has experimental IPv6 support.
  - Update CVE-2025-9615 related Requires and BuildRequires.
  - Fix typos found by codespell.


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2.2.0-2
changelog:
  - Make spec file compatible with epel9
  - Replace use of %gsub macro with lua
  - Adapted from a contribution to the moby-engine spec file by Maxwell G
    <maxwell@gtmx.me> (see commit 1ecc8a1 in that repo)


author: Bradley G Smith <bradley.g.smith@gmail.com> - 2.2.5-1
changelog:
  - Update to release v2.2.5
  - Resolves: rhbz#2464270
  - Resolves CVE-2026-50195
  - Resolves CVE-2026-53488
  - Resolves CVE-2026-53492
  - Resolves CVE-2026-53489
  - Resolves CVE-2026-47262


author: Petr Menšík <pemensik@redhat.com> - 0.37.0-1
changelog:
  - Update to 0.37.0 (rhbz#2441656)
  - Fixes Denial of Service via crafted HTTP POST request (CVE-2026-29076)


author: Petr Menšík <pemensik@redhat.com> - 0.37.1-1
changelog:
  - Update to 0.37.1 (rhbz#2445943)
  - Fixes Denial of Service via malformed Content-Length header
    (CVE-2026-31870)
  - https://github.com/yhirose/cpp-
    httplib/security/advisories/GHSA-39q5-hh6x-jpxx
  - https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.1


author: Petr Menšík <pemensik@redhat.com> - 0.37.2-1
changelog:
  - Update to 0.37.2
  - Fixes silent TLS certificate verification bypass on HTTPS Redirect via
    proxy (CVE-2026-32627, rhbz#2448105)


author: Sander Hoentjen <shoentjen@antagonist.nl> - 1.9.12-1
changelog:
  - Update to 1.9.12
  - Fixes CVE-2026-0396, CVE-2026-0397, CVE-2026-24028, CVE-2026-24029,
    CVE-2026-24030, CVE-2026-27853, CVE-2026-27854


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.21-1
changelog:
  - Update to 1.9.21
  - Security fix: CVE-2026-41054 — privilege escalation via command socket
  - Fix semaphore error handling (SEM_FAILED vs NULL)
  - Fix /dev/shm permissions (use 01777 with sticky bit)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-1
changelog:
  - Update to 1.9.23
  - Security: use O_EXCL with sem_open to prevent semaphore pre-planting attacks
  - Security: fix OOB memory access in safein()/safeout() on socket errors
  - Security: reject command socket connections from different user namespaces
  - Security: use O_NOFOLLOW for PID file to prevent symlink attacks
  - Harden: open random device with O_CLOEXEC, restrict semaphore to 0600
  - Fix stale semaphore recovery after SIGKILL
  - Fix compilation when NO_COMMAND_MODE is defined


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-2
changelog:
  - Add SELinux policy module to allow semaphore creation in /dev/shm
  - Add rpminspect.yaml to waive pre-existing annocheck false positive


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-3
changelog:
  - Fix rpminspect.yaml: use annocheck failure_severity instead of inspections toggle
    (annocheck is a security inspection and cannot be disabled via inspections section)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.24-1
changelog:
  - Update to 1.9.24
  - Disable command mode in long-running service (--no-command flag)
  - Enable PrivateNetwork=true in systemd service
  - Remove SELinux policy module (no longer needed without command mode)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.25-1
changelog:
  - Update to 1.9.25
  - Fix initramfs switch-root failure caused by --no-command (BZ#2491739)
  - Add haveged-initramfs.service for use inside the initramfs


author: Dominik 'Rathann' Mierzejewski <dominik@greysector.net> - 2.78.3-2
changelog:
  - Rebuilt for Go 1.25.3
  - resolves rhbz#2407547 CVE-2025-58189, rhbz#2408551 CVE-2025-61725,
    rhbz#2409002 CVE-2025-61723, rhbz#2409945 CVE-2025-58185, rhbz#2410882
    CVE-2025-58188, rhbz#2412486 CVE-2025-58183


author: Dominik 'Rathann' Mierzejewski <dominik@greysector.net> - 2.98.0-1
changelog:
  - update to 2.98.0
  - resolves: rhbz#2403136 (CVE-2025-11579), rhbz#2420569 (CVE-2025-47913),
    rhbz#2421867 (CVE-2025-66564), rhbz#2432197 (CVE-2026-23831),
    rhbz#2433101 (CVE-2026-23991), rhbz#2433104 (CVE-2026-23992),
    rhbz#2433535 (CVE-2026-24117), rhbz#2433572 (CVE-2026-24137),
    rhbz#2434246 (CVE-2026-24686), rhbz#2452365 (CVE-2026-32285),
    rhbz#2454524 (CVE-2026-34165), rhbz#2454525 (CVE-2026-33762),
    rhbz#2455638 (CVE-2026-34986)


author: Dominik 'Rathann' Mierzejewski <dominik@greysector.net> - 2.104.1-1
changelog:
  - update to 2.104.1 (resolves rhbz#2463822)
  - exclude uv_test.go, which requires an Artifactory instance


author: Chris Adams <linux@cmadams.net> - 0-0.13
changelog:
  - restructure some things to make it easer/cleaner
  - update for newer libvirt/qemu things
  - add ability to disable graphics console (also disables sound)
  - handle any number of disks rather than just 1 or 2


author: Paul Howarth <paul@city-fan.org> - 1.11.1-1
changelog:
  - Update to 1.11.1 (rhbz#2319104)
    - This is an enhancement and bugfix release - see RELEASE_NOTES for details
    - Note also that various algorithms are now deprecated and not built by
      default, which affects this package


author: Paul Howarth <paul@city-fan.org> - 1.11.1-6
changelog:
  - Fix CVE-2026-7598: integer overflow via large username or password arguments
    (https://github.com/libssh2/libssh2/pull/1858)


author: Pavel Raiskup <praiskup@redhat.com> 42.4-1
changelog:
  - fix sysusers packaging practice once more
  - configuration file owned by `root:root`
  - Rocky Linux 10 configs added (label@rockylinux.org)
  - missing config for AlmaLinux Kitten x86_64_v2 added (jhernandez@cloudlinux.com)
  - config for AlmaLinux Kitten 10 x86_64_v2 added (jonathan@almalinux.org)
  - AlmaLinux 10 configs added (jonathan@almalinux.org)


author: Pavel Raiskup <praiskup@redhat.com> 43.2-1
changelog:
  - disable gpgcheck for EPEL [local] repos
  - make sure [local] repo is available in rhel+epel repos
  - Add Kylin OS 11 (negativo17@gmail.com)
  - Azure Linux (CBL Mariner) 2.0 is now EOL (negativo17@gmail.com)


author: Pavel Raiskup <praiskup@redhat.com> 43.3-1
changelog:
  - Add openSUSE Leap 16.0 configurations (negativo17@gmail.com)
  - Update Kylin OS images and comments (negativo17@gmail.com)


author: Jiri Kyjovsky <j1.kyjovsky@gmail.com> 43.4-1
changelog:
  - Disable bootstrap for riscv (j1.kyjovsky@gmail.com)
  - Add risc-v fedora chroots (j1.kyjovsky@gmail.com)
  - eol/epel-6: copy-paste ca-bundle from host (praiskup@redhat.com)
  - Fix aarch64 configuration for Azure Linux 3 (negativo17@gmail.com)


author: Pavel Raiskup <pavel@raiskup.cz> 43.5-1
changelog:
  - add PQ keys to rhel9 (msuchy@redhat.com)
  - Switch Mageia 10+ and Cauldron to DNF5 (ngompa@mageia.org)
  - EOL Fedora 41


author: Pavel Raiskup <pavel@raiskup.cz> 44.3-1
changelog:
  - the fedora-release-eln renamed to fedora-eln-release
  - Add config for Fedora 44 version of RISC-V port (marcin@juszkiewicz.com.pl)
  - set bootstrap_image_ready=True for AlmaLinux configs (andrew.lukoshko@gmail.com)
  - re-enable bootstrap images for x86_64_v2 AlmaLinux configs (andrew.lukoshko@gmail.com)
  - remove dependency on python3-dnf (msuchy@redhat.com)


author: Pavel Raiskup <pavel@raiskup.cz> 44.4-1
changelog:
  - Fixes #1761: Add Fedora Rawhide RISC-V (jmontleo@redhat.com)
  - configs: add Azure Linux 4.0 beta configuration (tobiasb@microsoft.com)


author: Frank Lichtenheld <frank@lichtenheld.com> - 2.5.11-2
changelog:
  - Import collected upstream changes from git into a patch.
    This fixes several security issues and other bugs.
  - Includes patches up to commit 37160ee8408150990787eef4a76e0299230ed8d8


author: Paul Howarth <paul@city-fan.org> - 1.02-8
changelog:
  - Use relative symlinks rather than absolute symlinks in test (GH#51)
  - Use %{make_build} and %{make_install}


author: Jerry James <loganjerry@gmail.com> - 1.15-1
changelog:
  - Update to 1.15 (rhbz#2241663)
  - Change doc subpackage architecture to noarch
  - Change Source URL to tarball with the tests included
  - Add a %check script
  - Do not glob the library name
  - Minor spec file cleanups


author: Michel Lind <salimma@fedoraproject.org> - 0.62.1-1
changelog:
  - Update to 0.62.1 for ability to enforce SSO login/signups
  - Generate extras subpackages
  - Enforce that the license file is shipped


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.40.02-1
changelog:
  - Update to 6.40.02
  - Rename the jupyroot and distrdf packages to reflect that they are
    now submodules of the main pyyhon package
  - New subpackages: root-package graf3d-glad, root-package net-curl,
    root-package tmva-sofie-parser-python, root-package tree-ml,
    root-package histv7util
  - Dropped patches: 2
  - New patches: 7


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.2.0-1
changelog:
  - Update to verson 1.2.0; Fixes RHBZ#2393793
  - MSRV is now 1.87, edition is 2024
  - The dev-dependency on criterion is now removed via patch rather than
    tomcli


author: David Trudgian <dtrudg@sylabs.io> - 4.4.2-1
changelog:
  - Upgrade to 4.4.2 upstream version.
  - Fix rhbz#2452368
  - Fix rhbz#2453084
  - Fix rhbz#2455643
  - Fix rhbz#2458928
  - Fix CVE-2026-47215


author: Marcel Härry <mh+fedora@scrit.ch>- 0.4.8.21-2
changelog:
  - Fix build issue on newer glibc - https://gitlab.torproject.org/tpo/core/tor/-/issues/41170
  - Include /etc/torrc.d/*.conf by default to avoid modifications from the core package (bz#2338912)


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.9.5-1
changelog:
  - Update to latest upstream release https://forum.torproject.org/t/stable-release-0-4-9-5/21227
  - Enable seccomp on aarch64, which is now supported


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.9.6-1
changelog:
  - Update to latest upstream release https://forum.torproject.org/t/security-release-0-4-8-23-and-0-4-9-6/21386


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.9.8-1
changelog:
  - Update to latest upstream release https://forum.torproject.org/t/security-release-0-4-8-25-and-0-4-9-8/21559
  - Fix CVE-2026-44600 (bz#2476455 / bz#2476454)
  - Fix CVE-2026-44599 (bz#2476453 / bz#2476452)
  - Fix CVE-2026-44597 (bz#2476451 / bz#2476450)
  - Fix CVE-2026-44601 (bz#2467732 / bz#2467731)
  - Fix CVE-2026-44603 (bz#2467720 / bz#2467719)
  - Fix CVE-2026-44602 (bz#2467718 / nz@2467717)


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.9.11-1
changelog:
  - Update to latest upstream release https://forum.torproject.org/t/security-release-0-4-9-11/21786 bz#2483769


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.1.2-1
changelog:
  - Update to 1.1.2 upstream release
  - Resolves: rhbz#2494057
  - Update License and SourceLicense fields


author: Justin Wheeler <jwheel@fedoraproject.org> - 1.0.3-12
changelog:
  - Fix FTBFS. Thanks @limb for the hotfix.
  - Upstream work ongoing for improved support with newer versions of the C programming language and compilers.


author: Justin Wheeler <jwheel@fedoraproject.org> - 1.1.0-1
changelog:
  - Update to v1.1.0
  - Upstream bug fixes: out-of-bounds array access, missing unistd.h header,
    localtime prototype, curses header preprocessor guard
  - Upstream build improvements: LDFLAGS support in Makefile
  - Migrate to %autorelease
  - Remove unnecessary %global _hardened_build 1 (default since F23)


