# changelog

author: Ondřej Nosek <onosek@redhat.com> - 1.47-1
changelog:
  - Use ruff code checker instead of bandit (onosek)
  - Clone the API key info into all help messages (mpospisi)
  - README: Documentation link change, and new Jenkins link – `#606`_ (gleiro)
  - `update`: Add unspecified update type (priv.luk@gmail.com)
  - `request-unretirement`: Added a new command (amedvede)
  - `request-repo`: creating project and package in Anitya (amedvede)
  - Switch to %pyproject_* macros (onosek)
  - `retire`: extend the command's console help - `rhbz#2189969`_ (onosek)
  - Jenkinsfile: use local declaration instead of global (onosek)
  - `srpm`: --offline arg to prevent connecting to Koji – `#600`_ (onosek)


author: Ondřej Nosek <onosek@redhat.com> - 1.48-1
changelog:
  - Handle repo-status API errors (artur)
  - Add --package option to fedpkg repo-status (artur)
  - Omit unused repos in repo-status (artur)
  - Separate Fedora and EPEL in repo-status (artur)
  - Add initial version of repo-status command (artur)
  - Migrate SCM requests from Pagure to Forgejo (patrik)
  - Clean up unnecessary Python 2 compatibility code (onosek)
  - Fixing ruff and flake8 complaints (onosek)
  - feat(new-package): add tests (sanjay.ankur)
  - feat(new-package): add util functions (sanjay.ankur)
  - feat(new-package): add new command (sanjay.ankur)
  - Unittests for PR#631 (onosek)
  - Allow detecting release from EPEL minor version feature branches
    (carlwgeorge)
  - Fix Jenkinsfile for a Jenkins CI triggered from the Forge (onosek)
  - Web documentation at Readthedocs.io (onosek)
  - Post-migration steps (onosek)
  - `request_unretirement`: split branches into koji_tags and distgit_branches
    (amedvede)
  - Add lookaside_http_version config option (onosek)
  - docs: modernize Sphinx conf.py (onosek)
  - `update`: Add --notes-file option to read notes from file (onosek)
  - License file without physical address (onosek)
  - Modularity retired - remove corresponding commands (onosek)
  - Various code linter issues fixed (onosek)
  - Check the correct sorting of imports from now on (onosek)
  - `request-unretirement`: fix unittests (onosek)


author: Scott K Logan <logans@cottsay.net> - 0.18.1-1
changelog:
  - Update to 0.18.1 (rhbz#2300129)
  - Drop RHEL 7 spec support
  - Use boolean operators for backwards compatibility package dependencies


author: Michel Lind <salimma@fedoraproject.org> - 0.62.1-1
changelog:
  - Update to 0.62.1 for ability to enforce SSO login/signups
  - Generate extras subpackages
  - Enforce that the license file is shipped


author: Peter Bieringer <pb@bieringer.de>
changelog:
  - Add missing requirement InfCloud-fontware to InfCloud
  - Extend SELinux policy for access to /run/systemd/userdb/io.systemd.DynamicUser on start


author: Ondřej Nosek <onosek@redhat.com> - 1.69-1
changelog:
  - Only update the progress bar when meaningfully changed (code)
  - Don’t set up upload progress when stdout isn’t a tty (code)
  - Fix unittests for Python 3.14 (onosek)
  - `sources`: set "Accept-Encoding: identity" header on HTTP requests
    (decathorpe)
  - Accept auto-generated sources in pre-push checks (fweimer)
  - Add mock configuration option to build and srpm commands for use along with
    the srpm mock option, same as in mockbuild command. (abobrov)
  - `srpm`: man page generation fixed (onosek)
  - `install`: add rpmbuild arguments `--with` and `--without` - 541 (gleiro)
  - type: fix typo in requirements README. (gleiro)
  - `patch`: Execute subprocess in text mode (ferdnyc)
  - Fix mockbuild --srpm-mock specfile_path (wngtk)
  - `pre-push-check`: bogus error - file wasn't listed - #747 (onosek)
  - Switch to %pyproject_* macros (onosek)
  - Use the spec name to assemble src.rpm name (sergio)
  - Jenkinsfile: use local declaration instead the global (onosek)
  - `srpm`: --offline arg to prevent connecting to Koji - 600 (onosek)
  - `mockbuild`: -r argument as shortcut of --root (sergio)
  - `rhpkg mockbuild` won't show a hint with '--target' (onosek)


author: Ondřej Nosek <onosek@redhat.com> - 1.69-3
changelog:
  - Patch: Check the correct sorting of imports from now on
  - Patch: `update`: interactive editor is broken


author: Ondřej Nosek <onosek@redhat.com> - 1.70-1
changelog:
  - Fix SRPM import for files with a backslash in the name - unittests (onosek)
  - Fixing ruff and flake8 complaints (onosek)
  - Add verrel --json support (onosek)
  - Fix Jenkinsfile for a Jenkins CI triggered from the Forge (onosek)
  - Links to a new documentation at Readthedocs.io (onosek)
  - Web documentation at Readthedocs.io (onosek)
  - Post-migration steps (onosek)
  - Fix SRPM import for files with a backslash in the name (pavel)
  - Remove deprecated 'clean --dry-run' argument - rhbz#2458827 (onosek)
  - Add configurable HTTP version for lookaside transfers (onosek)
  - docs: modernize Sphinx conf.py (onosek)
  - pre_push_check: unset GIT_DIR to fix worktree support - #769 (vashirov)
  - Various code linter issues fixed (onosek)
  - Submitting the module build - duplicate timeout - #766 (onosek)
  - _run_command: timeout is not supported in Python 2 (onosek)
  - Check the correct sorting of imports from now on (onosek)
  - `update`: interactive editor is broken - #762 (onosek)
  - Use ruff code checker instead of bandit (onosek)
  - Execute shell command: Non-interactive stdin (onosek)


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.8.4-1
changelog:
  - Update to version 1.8.4; Fixes RHBZ#2453126
  - Do not expose metapackages for unstable or undocumented features


author: Michel Lind <salimma@fedoraproject.org> - 0.7.0-3
changelog:
  - Enable Unix, ACL, SELinux and systemd-logind features
  - Declare licenses for the uutils-coreutils binary package


author: Jonathan Wright <jonathan@almalinux.org> - 1.33.0-1
changelog:
  - update to 1.33.0 rhbz#2342073
    Fix GHSA-f7r5-w49x-gxm3 Getting access to the Admin Panel via CSRF
    Fix CVE-2025-24364 RCE in the admin panel
    Fix CVE-2025-24365 escalation of privilege via variable confusion in OrgHeaders trait


author: Jonathan Wright <jonathan@almalinux.org> - 1.33.2-1
changelog:
  - update to 1.33.2 rhbz#2343535
    Fix CVE-2025-0977 ssl::select_next_proto use after free rhbz#2344558


author: Jonathan Wright <jonathan@almalinux.org> - 1.36.0-1
changelog:
  - update to 1.36.0 rhbz#2368636
  - Fix bitwarden mobile app not working rhbz#2437599
  - Fix CVE-2025-58160 vaultwarden: Tracing log pollution
  - Fix CVE-2026-25537 vaultwarden: jsonwebtoken has Type Confusion that leads to potential authorization bypass
  - Fix CVE-2026-25727 vaultwarden: time affected by a stack exhaustion denial of service attack
  - Fix CVE-2026-26012 vaultwarden: Information disclosure due to bypassed collection permissions
  - Fix CVE-2026-27898 vaultwarden: Information disclosure via API partial update
  - Fix CVE-2026-27803 vaultwarden: Unauthorized collection management operations due to improper access control
  - Fix CVE-2026-27801 vaultwarden: Two-factor authentication bypass allows unauthorized access and data deletion


author: Jonathan Wright <jonathan@almalinux.org> - 1.37.1-1
changelog:
  - update to 1.37.1 rhbz#2510094
  - Fix CVE-2026-31812 vaultwarden: quinn-proto: Denial of Service via crafted QUIC Initial packet rhbz#2446376
  - Fix 8 cited but yet-to-be-listed medium-severity vulnerabilities


author: Jonathan Wright <jonathan@almalinux.org> - 2026.4.1-1
changelog:
  - update to 2026.4.1 rhbz#2387335
  - Fixes CVE-2026-27803 Unauthorized collection management operations due to improper access control
  - Fixes CVE-2026-27801 Two-factor authentication bypass allows unauthorized access and data deletion
  - Fixes CVE-2026-27802 Privilege Escalation via Unauthorized Bulk Permission Update
  - Fixes CVE-2026-27898 Information disclosure via API partial update


