# changelog

author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-10
changelog:
  - Use PBMAC1 by default when creating PKCS#12 files in FIPS mode
    Related: RHEL-36659
  - Support key encapsulation/decapsulation in openssl pkeyutl command
    Resolves: RHEL-54156
  - Fix typo in the patch numeration
    Related: RHEL-41261
  - Enable KTLS, temporary disable KTLS tests
    Related: RHEL-47335
  - Speedup SSL_add_{file,dir}_cert_subjects_to_stack
    Resolves: RHEL-54232
  - Resolve SAST package scan results
    Resolves: RHEL-37561


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-15
changelog:
  - Fix providers no_cache behavior
    Resolves: RHEL-71903
  - Fix pkcs12 command line segfault
    Resolves: RHEL-70878
  - Print key exchange group for hybrid PQC
    Resolves: RHEL-66163
  - Ensure correct fips.so checksum calculation
    Resolves: RHEL-73170
  - Locally configured providers should not interfere with openssl build-time tests
    Resolves: RHEL-76182
  - Load system default cipher string from crypto-policies configuration file
    include /etc/crypto-policies/back-ends/opensslcnf.config and remove
    /etc/crypto-policies/back-ends/openssl.config.
    Resolves: RHEL-71132


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-16
changelog:
  - Fix timing side-channel in ECDSA signature computation (CVE-2024-13176)
    Resolves: RHEL-70879
  - Load system default cipher string from crypto-policies configuration file
    should ignore errors.
    Related: RHEL-71132
  - RFC7250 handshakes with unauthenticated servers don't abort as expected (CVE-2024-12797)
    Resolves: RHEL-76754
  - Fix segfault on printing the temp key from s_client when connection is not established
    Resolves: RHEL-79045


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-3
changelog:
  - Fix `openssl speed` running in FIPS mode
    Resolves: RHEL-88908
  - pkeyutl ecdsa signature with sha1 shouldn't work by default
    Resolves: RHEL-88911
  - Expose settable params for EVP_SKEY
    Resolves: RHEL-88913
  - Restore RHEL9-style indicators defines
    Resolves: RHEL-88906
  - Enable sslkeylog support
    Resolves: RHEL-90853
  - Fix UEFI builds
    Resolves: RHEL-89137


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-4
changelog:
  - Fix regressions caused by rebase to OpenSSL 3.5
    Related: RHEL-80811
  - Fix UEFI builds on double function definitions
    Resolves: RHEL-93168


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-5
changelog:
  - Compact patches for better maintainability
    Related: RHEL-80811
  - Make hybrid MLKEM work with our FIPS provider (3.0.7)
    Resolves: RHEL-94614


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.1-1
changelog:
  - Rebasing to OpenSSL 3.5.1
    Resolves: RHEL-90350
    Resolves: RHEL-95613
    Resolves: RHEL-97796
    Resolves: RHEL-99353
    Resolves: RHEL-100168


author: Simo Sorce <simo@redhat.com> - 1:3.5.1-2
changelog:
  - Move fips.so to a seprate subpackage
    Reverts FIPS self test for SLH-DSA
    Add Suggests to try to prefer the openssl-fips-provider package
    over the fips-provider-next package by default
    Revolves: RHEL-102408
    Related: RHEL-80811


author: Simo Sorce <simo@redhat.com> - 1:3.5.1-3
changelog:
  - Add custom define to disable symbol versioning in downstream patched code
    Also add stricter Suggests for openssl-fips-provider
    Resolves: RHEL-101548
  - Fix Requires/Provider to fix default install of fips providers
    Resolves: RHEL-105010


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.1-7
changelog:
  - Fix CVE-2025-11187 CVE-2025-15467 CVE-2025-15468 CVE-2025-15469
    CVE-2025-66199 CVE-2025-68160 CVE-2025-69418 CVE-2025-69419 CVE-2025-69420
    CVE-2025-69421 CVE-2026-22795 CVE-2026-22796
    Resolves: RHEL-142062
    Resolves: RHEL-141985
    Resolves: RHEL-142053
    Resolves: RHEL-142049
    Resolves: RHEL-142045
    Resolves: RHEL-142041
    Resolves: RHEL-142037
    Resolves: RHEL-142033
    Resolves: RHEL-142029
    Resolves: RHEL-142008
    Resolves: RHEL-142025
    Resolves: RHEL-142021


author: Pavol Žáčik <pzacik@redhat.com> - 1:3.5.1-4
changelog:
  - Make openssl speed test signatures without errors
    Resolves: RHEL-95182
  - Build tests in check and without LTO
    Resolves: RHEL-111634


author: Pavol Žáčik <pzacik@redhat.com> - 1:3.5.1-5
changelog:
  - Fix globally disabled LTO
    Related: RHEL-111634
  - Initialize reserved and unused memory in aes-s390x.pl
    Resolves: RHEL-107479


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.5-1
changelog:
  - Rebase to OpenSSL 3.5.5
    Resolves: RHEL-122599
    Resolves: RHEL-141987
    Resolves: RHEL-142009
    Resolves: RHEL-142022
    Resolves: RHEL-142026
    Resolves: RHEL-142030
    Resolves: RHEL-142034
    Resolves: RHEL-142038
    Resolves: RHEL-142042
    Resolves: RHEL-142046
    Resolves: RHEL-142050
    Resolves: RHEL-142054


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.5-4
changelog:
  Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181,
  CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768,
  CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447,
  CVE-2026-34182.
  Resolves: RHEL-179267
  Resolves: RHEL-179281
  Resolves: RHEL-179537
  Resolves: RHEL-179542
  Resolves: RHEL-179545
  Resolves: RHEL-179550
  Resolves: RHEL-179553
  Resolves: RHEL-179626
  Resolves: RHEL-179658
  Resolves: RHEL-179675
  Resolves: RHEL-179682
  Resolves: RHEL-179685
  Resolves: RHEL-179689
  Resolves: RHEL-179693
  Resolves: RHEL-179697


author: Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-12
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
  - Fix build in all arches, copied from Debian
  - Run autoreconf to make sure that autotools are updated
  - Clean up some trailing white spaces


author: Lukas Tyrychtr <ltyrycht@redhat.com> - 46.1-2
changelog:
  - Explicitly depend on speech-dispatcher, restoring the previous behavior before it split its libs into a separate package


author: Laurence Rochfort <laurence.rochfort@oracle.com> 185-1.0.1
changelog:
  - Bump to v185 [Orabug: 39666639]
  - Oracle Linux support was merged upstream in osbuild PR 2476, adding the OL runner symlink


author: Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com> - 132-1.0.1
changelog:
  - Simplify repository names [JIRA: OLDIS-35893]
  - Ensure build on latest golang: CVE-2024-34156
  - Refactor patches to fix some naming and set a correct kernel for Oracle Linux [Orabug: 37253643]
  - Support using OCI variables inside built images [JIRA: OLDIS-35302]
  - Support using repository definitons with OCI variables [JIRA: OLDIS-38657]
  - Update repositories to contain OCI variables
  - Remove image types Minimal-raw and wsl [JIRA: OLDIS-38123]
  - Increase default /boot size to 1GB [Orabug: 36827079]
  - Add support for OCI hybrid images [JIRA: OLDIS-33593]
  - enable aarch64 OCI image builds [JIRA: OLDIS-33593]
  - support for building OL8/9 images on Oracle Linux 9 [Orabug: 36400619]


author: Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com> - 134.1-2.0.1
changelog:
  - Add OL10 support
  - Update repository URLs for baseos, appstream and UERK
  - Fix the label for UEKR repository
  - Simplify repository names [JIRA: OLDIS-35893]
  - Ensure build on latest golang: CVE-2024-34156
  - Refactor patches to fix some naming and set a correct kernel for Oracle Linux [Orabug: 37253643]
  - Support using OCI variables inside built images [JIRA: OLDIS-35302]
  - Support using repository definitons with OCI variables [JIRA: OLDIS-38657]
  - Update repositories to contain OCI variables
  - Remove image types Minimal-raw and wsl [JIRA: OLDIS-38123]
  - Increase default /boot size to 1GB [Orabug: 36827079]
  - Add support for OCI hybrid images [JIRA: OLDIS-33593]
  - enable aarch64 OCI image builds [JIRA: OLDIS-33593]
  - support for building OL8/9 images on Oracle Linux 9 [Orabug: 36400619]


author: Gianluca Zuccarelli <gzuccare@redhat.com> - 134.1-3
changelog:
  - Fix json tailoring blueprint conversion
    Resolves: RHEL-115392
  - Fix unclosed logrus logging pipes
    Resolves: RHEL-121533
  - Update go-jose dependency
    Resolves: RHEL-82957 (CVE-2025-27144)


author: EL Errata <el-errata_ww@oracle.com> - 134.1-3.0.1
changelog:
  - Add OL10 support
  - Update repository URLs for baseos, appstream and UERK
  - Fix the label for UEKR repository
  - Simplify repository names [JIRA: OLDIS-35893]
  - Ensure build on latest golang: CVE-2024-34156
  - Refactor patches to fix some naming and set a correct kernel for Oracle Linux [Orabug: 37253643]
  - Support using OCI variables inside built images [JIRA: OLDIS-35302]
  - Support using repository definitons with OCI variables [JIRA: OLDIS-38657]
  - Update repositories to contain OCI variables
  - Remove image types Minimal-raw and wsl [JIRA: OLDIS-38123]
  - Increase default /boot size to 1GB [Orabug: 36827079]
  - Add support for OCI hybrid images [JIRA: OLDIS-33593]
  - enable aarch64 OCI image builds [JIRA: OLDIS-33593]
  - support for building OL8/9 images on Oracle Linux 9 [Orabug: 36400619]
  - Rebuild for CVE-2025-22871


author: EL Errata <el-errata_ww@oracle.com> - 149-4.0.1
changelog:
  - Add missing dependency over dracut-config-rescue for image-installer [Orabug: 38587453]
  - Add OL10 support
  - Update repository URLs for baseos, appstream and UERK
  - Fix the label for UEKR repository
  - Simplify repository names [JIRA: OLDIS-35893]
  - Ensure build on latest golang: CVE-2024-34156
  - Refactor patches to fix some naming and set a correct kernel for Oracle Linux [Orabug: 37253643]
  - Support using OCI variables inside built images [JIRA: OLDIS-35302]
  - Support using repository definitons with OCI variables [JIRA: OLDIS-38657]
  - Update repositories to contain OCI variables
  - Remove image types Minimal-raw and wsl [JIRA: OLDIS-38123]
  - Increase default /boot size to 1GB [Orabug: 36827079]
  - Add support for OCI hybrid images [JIRA: OLDIS-33593]
  - enable aarch64 OCI image builds [JIRA: OLDIS-33593]
  - support for building OL8/9 images on Oracle Linux 9 [Orabug: 36400619]


author: imagebuilder-bot <imagebuilder-bots+imagebuilder-bot@redhat.com> - 149-5
changelog:
  - Rebuilt to fix: 
    - CVE-2025-61726
    - CVE-2025-61728
    - CVE-2025-61729
    - CVE-2025-68121
    - RHEL-146726
    - RHEL-146931
    - RHEL-147353
    - RHEL-149232


author: Craig Guiller <craig.guiller@oracle.com> - 20250124-2.0.1
changelog:
  - Add OL9.6 data [Orabug: 37816177]
  - Make sure all OL XML files are included [Orabug: 37816177]
  - Add OL10.0 data
  - Add 9.5 data


author: Craig Guiller <craig.guiller@oracle.com> - 20250606-1.0.1
changelog:
  - Fix path to initrd and vmlinux on x86_64 for OL10 [Orabbug: 38239100]
  - Add OL10.1 data
  - Add OL9.7 data
  - Add OL9.6 data [Orabug: 37816177]
  - Make sure all OL XML files are included [Orabug: 37816177]
  - Add OL10.0 data
  - Add 9.5 data


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 20250606-2.0.1
changelog:
  - Add OL10.2 and OL9.8 data
  - Fix path to initrd and vmlinux on x86_64 for OL10 [Orabbug: 38239100]
  - Add OL10.1 data
  - Add OL9.7 data
  - Add OL9.6 data [Orabug: 37816177]
  - Make sure all OL XML files are included [Orabug: 37816177]
  - Add OL10.0 data
  - Add 9.5 data


author: Joseph Marrero Corchado <jmarrero@redhat.com> - 2025.2-1
changelog:
  - Rebase to ostree 2025.2 Backport
    https://github.com/ostreedev/ostree/pull/3473 Backport
    https://github.com/ostreedev/ostree/pull/3472


author: Chris Lumens <clumens@redhat.com> - 3.0.0-2
changelog:
  - Rebase on upstream 3.0.0-rc1
  - Default globally-unique to true when clone-node-max > 1
  - Fix regression in crm_resource master resource handling
  - Related: RHEL-61383
  - Resolves: RHEL-56675
  - Resolves: RHEL-60534


author: Chris Lumens <clumens@redhat.com> - 3.0.0-3
changelog:
  - Rebase on upstream 3.0.0-rc2
  - Support X.509 certificates for Pacemaker Remote connections and remote
    CIB administration
  - Fix ability to do rolling upgrades (regression introduced in 3.0.0-rc1)
  - Fix memory leaks in daemons (regressions introduced in 3.0.0-rc1)
  - Ensure ACLs remain valid after CIB upgrades (regression introduced in
    3.0.0-rc1)
  - Related: RHEL-61383
  - Resolves: RHEL-7600


author: Chris Lumens <clumens@redhat.com> - 3.0.0-4
changelog:
  - Rebase on upstream 3.0.0-rc3
  - Log warnings if XSL transforms cannot preserve previous behavior
  - Ensure XSL transforms do not invalidate ACLs
  - Remove build dependency on inkscape
  - Resolves: RHEL-62096
  - Resolves: RHEL-62722


author: Chris Lumens <clumens@redhat.com> - 3.0.0-5
changelog:
  - Rebase on upstream 3.0.0 final release
  - Raise minimum GnuTLS dependency to 3.4.6
  - Move logrotate script back to pacemaker-cli package
  - Clear warnings and errors when resetting scheduler object
  - Resolves: RHEL-61383


author: Alan Steinberg <alan.steinberg@oracle.com> - 3.0.0-5.0.1
changelog:
  - Replace bug url [Orabug: 34202300]
  - Upstream reference in pacemaker crm_report binary [Orabug: 32825154]


author: Chris Lumens <clumens@redhat.com> - 3.0.1-1
changelog:
  - Rebase on upstream 3.0.1-rc1
  - Use dbus to detect completion of systemd resource start/stop actions
  - Add an option for controlling remote node fencing behavior
  - Split large IPC messages into multiple smaller ones
  - Related: RHEL-86085
  - Resolves: RHEL-71181
  - Resolves: RHEL-86146
  - Resolves: RHEL-86144


author: Chris Lumens <clumens@redhat.com> - 3.0.1-4
changelog:
  - Fix promoting instances of a cloned resource
  - Handle large timeouts correctly in crm_resource --wait
  - Don't evict IPC clients as long as they're still processing messages
  - Don't overwhelm the FSA queue with repeated CIB queries
  - Resolves: RHEL-120932
  - Resolves: RHEL-86148
  - Resolves: RHEL-114895


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.5-8
changelog:
  - Make sure redhat-package-notes spec is skipped if _package_note_flags is
    undefined (rbhz#2184553)


author: Sudip Shil <sshil@redhat.com> - 6.0-7
changelog:
  - Convert to new fonts packaging guidelines and SPDX license
  - Update the fonts package
  - https://fedoraproject.org/wiki/Changes/New_Fonts_Packaging


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.6.1-2
changelog:
  - Fix static analyzer detected issues. Resolves: RHEL-36475
  - pam_env: fixes for NULL environment variables


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.6.1-6
changelog:
  - pam_access: always match local address and clarify LOCAL keyword behaviour.
    Resolves: RHEL-65223


author: Mark Will <mark.will@oracle.com> - 0^20250217.ga1e48a0-5
changelog:
  - Resolves: RHEL-83979 RHEL-84157 RHEL-86761
  - Resolves: RHEL-84249 RHEL-83979 RHEL-84157 RHEL-84248
  - Resolves: RHEL-80297


author: Michal Hlavinka <mhlavink@redhat.com> - 3.13.0-1
changelog:
  - updated to 3.13, adds support for cxl1.1 device link status information (#RHEL-29153)
  - add riscv64 build support (#RHEL-40383)


author: Nathan Scott <nathans@redhat.com> - 6.3.2-1
changelog:
  - Align start of PCP services with systemd presets (RHEL-22723)
  - Improved pcp-xsos command line error diagnostics (RHEL-56836)
  - Fix buffer sizing checks in pmstore PDU handling (RHEL-57795)
  - Guard against symlink attacks in pmpost program (RHEL-57797)
  - Update to latest stable version of PCP (RHEL-62801)


author: Mohith Kumar Thummaluru <mohith.k.kumar.thummaluru@oracle.com> - 6.3.7-1.0.2
changelog:
  - Add support for rocestat pmda [Orabug: 38109270]
  - Add support for rocestat client [Orabug: 38109292]


author: Sourav Sharma <sourav.ss.sharma@oracle.com> 6.3.7-1.0.4
changelog:
  - Backports various pcp bugs and enhancements  [Orabug: 35778072]
  - [Orabug: 36932629] [Orabug: 37655753] [Orabug: 38435551]
  - [Orabug: 38380185] [Orabug: 38526634]


author: Nathan Scott <nathans@redhat.com> - 6.3.7-5
changelog:
  - Make pcp-zeroconf start enabled services once again (RHEL-93182)
  - Fix python PMDA wrapper handling of list objects
  - Improve tmpfiles.d handling of empty directories
  - Backport some more fixes to the OpenMetrics PMDA
  - Fix a multilib regression in PCP header files


author: EL Errata <el-errata_ww@oracle.com> - 6.3.7-5.0.1
changelog:
  - Fixes build issues due to patch 1002 applying error [Orabug: 38288886]
  - Add support for rocestat pmda [Orabug: 38109270]
  - Add support for rocestat client [Orabug: 38109292]


author: Darren Archibald <darren.archibald@oracle.com> - 7.0.3-3.0.1
changelog:
  - Adds interval option support in PCP nfsiostat tool [Orabug: 39068870]
  - Introduces proc.numa_maps metrics in linux_proc PMDA [Orabug: 39096683]
  - adds numastat process option in the tool
  - Added support for size based cleanup for pcp archives [Orabug: 38757778]
  - Implement sorting option in pcp ps based on %cpu, %mem [Orabug: 38719615]
  - Fixed pmlogger incorrectly attempts to terminate
  - unauthorized process [Orabug: 38598244]
  - Merges new PCP nfsiostat parser in OL [Orabug: 38817053]
  - pmdanfsclient: fix regex to correctly parse NFS op stats [Orabug: 38724847]
  - pmda/rocestat: pmda/rocestat: skip installation when IB is absent [Orabug: 38595797]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 7.0.3-3.0.2
changelog:
  - Fix unterminated backtick in pmlogger_janitor fix not to terminate unauthorized process patch
    [Orabug: 39270658]


author: Jan Kuřík <jkurik@redhat.com> - 7.0.3-4
changelog:
  - Fix CVE-2026-16524: linux_sockets PMDA command injection (RHEL-213659)
  - Fix CVE-2026-16526: FD_CLOEXEC privilege escalation via pmdaroot (RHEL-213695)
  - Fix CVE-2026-16527: pmproxy unauthenticated /store access (RHEL-213721)
  - Fix CVE-2026-16529: __pmGetPDU signed integer overflow DoS (RHEL-213732)


author: Jan Kuřík <jkurik@redhat.com> - 7.0.3-5
changelog:
  - Fix CVE-2026-16530: __pmLogLoadInDom OOB pointer dereference (RHEL-213746)
  - Fix CVE-2026-16531: pmproxy logger servlet path traversal (RHEL-213756)
  - Backport remaining PCP security hardening fixes from private-pcp
  - pmieconf and pmlogmv command injection hardening (CWE-78)
  - libpcp PDU decode OOB read and overflow guards (CWE-125/190/195)
  - timezone and zoneinfo string validation
  - pmdaroot peer credential verification (CWE-403)
  - pmproxy REST CERT_REQD enforcement and logger servlet authentication


author: EL Errata <el-errata_ww@oracle.com> - 7.0.3-5.0.1
changelog:
  - Fix unterminated backtick in pmlogger_janitor fix not to terminate unauthorized process patch
    [Orabug: 39270658]
  - Adds interval option support in PCP nfsiostat tool [Orabug: 39068870]
  - Introduces proc.numa_maps metrics in linux_proc PMDA [Orabug: 39096683]
  - adds numastat process option in the tool
  - Added support for size based cleanup for pcp archives [Orabug: 38757778]
  - Implement sorting option in pcp ps based on %cpu, %mem [Orabug: 38719615]
  - Fixed pmlogger incorrectly attempts to terminate
  - unauthorized process [Orabug: 38598244]
  - Merges new PCP nfsiostat parser in OL [Orabug: 38817053]
  - pmdanfsclient: fix regex to correctly parse NFS op stats [Orabug: 38724847]
  - pmda/rocestat: pmda/rocestat: skip installation when IB is absent [Orabug: 38595797]


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.38.2-503
changelog:
  - 5.38.2 bump (see <https://metacpan.org/release/PEVANS/perl-5.38.2/view/pod/perldelta.pod>
    or release notes


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.40.0-509
changelog:
  - 5.40.0 bump (see <https://metacpan.org/release/HAARG/perl-5.40.0/view/pod/perldelta.pod)
  - Subpackage Term-Table
  - Subpackage Test-Suite2


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.40.0-512
changelog:
  - Resolves: RHEL-75798
  - 5.40.1 bump (see <https://metacpan.org/release/SHAY/perl-5.40.1/view/pod/perldelta.pod>)
  - Add config.over to make build od perl reproducible
  - Removed unnecessary conversion
  - Add new systemtap-sdt-dtrace to build deps


author: Alex Burmashev <alexander.burmashev@oracle.com> - 4:5.40.2-512.1
changelog:
  - 5.40.2 bump (see <https://metacpan.org/release/SHAY/perl-5.40.2/view/pod/perldelta.pod>)
  - Resolves: RHEL-87186


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 3.02-512.1
changelog:
  - Fix CVE-2026-42496: validate symlink and hardlink targets in secure
    extract mode
  - Resolves: RHEL-181651


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 3.02-512.2
changelog:
  - Fix CVE-2026-9538: cap per-entry declared size during archive
    reading to prevent memory DoS
  - Resolves: RHEL-191918


author: Paul Howarth <paul@city-fan.org> - 0.018-1
changelog:
  - Update to 0.018
    - Fix version requirement for CPAN::Meta::Prereqs
    - Move issue tracker to GitHub


author: Paul Howarth <paul@city-fan.org> - 2.07-32
changelog:
  - Package tidy-up
    - Use author-independent source URL
    - Fix "warning: missing braces around initializer [-Wmissing-braces]"
    - Avoid deprecated patch syntax
    - Simplify find command using -empty
    - Fix permissions verbosely


author: Paul Howarth <paul@city-fan.org> - 0.114-1
changelog:
  - Update to 0.114
    - Data::OptList now requires perl v5.12.0
    - Tests no longer add "-T" to shebang, so do not invoke taint mode


author: Packit <hello@packit.dev> - 6.93-1
changelog:
  - Release: v6.93 (Sullivan Beck)
  - Checkpoint: v6.93 (Sullivan Beck)
  - Remove Travis (Sullivan Beck)
  - Initial checkin of next release cycle: 6.93 (Sullivan Beck)


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 6.94-5.1
changelog:
  - Fix CVE-2026-60075: prevent quadratic-cost regex DoS in date/time
    parsing by rejecting overly long input strings
    Resolves: RHEL-239790


author: Paul Howarth <paul@city-fan.org> - 1.006000-1
changelog:
  - Update to 1.006000
    - Introduced lexical exporter support on Perl 5.11.2+ using the Lexical::Var
      module
    - Refactored the Perl 5.37.2+ lexical exporter support


author: Paul Howarth <paul@city-fan.org> - 1.006001-1
changelog:
  - Update to 1.006001
    Documentation
    - Don't mention Alt::Lexical::Var::ButSupportModernPerl in manual
    Packaging
    - No longer dynamically recommend Alt::Lexical::Var::ButSupportModernPerl


author: Paul Howarth <paul@city-fan.org> - 1.006002-1
changelog:
  - Update to 1.006002
    Documentation
    - Link to Exporter::Almighty in pod
    - Update copyright dates
    Packaging
    - Set homepage in metadata to https://exportertiny.github.io


author: Michal Josef Špaček <mspacek@redhat.com> - 6.01-34
changelog:
  - Package tests
  - Patch for remove warning in test
  - Simplify build and install phases
  - Update license to SPDX format


author: Paul Howarth <paul@city-fan.org> - 2.205-1
changelog:
  - Update to 2.205
    - Add perl 5.38 to CI matrix
    - Add on workflow_dispatch
    - Add some OO examples


author: Paul Howarth <paul@city-fan.org> - 2.081-1
changelog:
  - Update to 2.081
    - New function set_msg_callback for user defined callback on each SSL message
    - Showcase function in example/ssl_client.pl and example/ssl_server.pl for
      computing JA3S/JA3 fingerprints
    - Fix tracing added in 2.076 to no longer include SSL3_RT_HEADER (noise)


author: Paul Howarth <paul@city-fan.org> - 2.082-1
changelog:
  - Update to 2.082
    - SSL_version default now TLS 1.2+ since TLS 1.1 and lower are deprecated
      (GH#122)
    - Fix output of alert string when debugging (GH#132)
    - Improve regex for hostname validation (GH#130, GH#126)
    - Add can_ciphersuites subroutine for feature checking (GH#127)
    - Utils::CERT_create - die if unexpected arguments are given instead of
      ignoring these
  - Avoid use of deprecated patch syntax


author: Paul Howarth <paul@city-fan.org> - 2.083-1
changelog:
  - Update to 2.083
    - Fix t/protocol_version.t for OpenSSL versions that don't support SECLEVEL
      (regression from GH#122)


author: Paul Howarth <paul@city-fan.org> - 2.084-1
changelog:
  - Update to 2.084
    - Various fixes for edge cases and build: GH#136, GH#141, GH#142, GH#143,
      GH#145
    - Update documentation to reflect default SSL_version


author: Paul Howarth <paul@city-fan.org> - 2.085-1
changelog:
  - Update to 2.085
    - Fix test that failed due to behavior changes in OpenSSL 3.2 (GH#147)
    - Update PublicSuffix
    - Add examples for TLS JA3/JA4 fingerprinting to tls_fingerprint/


author: Paul Howarth <paul@city-fan.org> - 0.430-9
changelog:
  - Disable extra test in RHEL builds (based on
    https://src.fedoraproject.org/rpms/perl-List-MoreUtils-XS/pull-request/1)
  - Silence build-time warnings about missing bundled modules


author: Paul Howarth <paul@city-fan.org> - 2:0.42.34-1
changelog:
  - 0.4234 bump
  - Use author-independent source URL
  - Fix permissions verbosely
  - Make %files list more explicit


author: Michal Josef Špaček <mspacek@redhat.com> - 6.0.1-42
changelog:
  - Add patch to add tests for other USM scenarios
  - Add patch to rewrite from Digest::SHA1 to Digest::SHA
  - Add patch to rewrite usage of HMAC with same dependencies
  - Add patch to split test files for better readability
  - Improve patch for switch from Socket6 to Socket
  - Package tests
  - Rename patch to better name with source dist version


author: Paul Howarth <paul@city-fan.org> - 1.94-1
changelog:
  - Update to 1.94
    - Net::SSLeay now officially supports all stable releases of OpenSSL 3.1 and
      3.2, and LibreSSL 3.5-3.8
    - Many noisy compiler warnings have been silenced - if SSLeay.xs fails to
      compile, it should now be much easier to identify the cause
    - libcrypto's OPENSSL_init_crypto() function and libssl's OPENSSL_init_ssl()
      function are now exposed, enabling fine-grained control over the
      initialisation and configuration of both libraries
    - libssl functions implementing TLS 1.3 PSK authentication are now exposed,
      in particular SSL_CTX_set_psk_find_session_callback() (on the server side)
      and SSL_CTX_set_psk_use_session_callback() (on the client side)
    - libssl functions implementing server-side TLS 1.2 PSK authentication are
      now exposed, in particular SSL_CTX_set_psk_server_callback()
    - libssl's SSL_CTX_set_client_hello_cb() function is now exposed, allowing a
      TLS server to set a callback function that is executed when the server
      processes a ClientHello message
    - Many more libcrypto/libssl constants and functions are now exposed; see the
      release notes for the 1.93 developer releases for a full list


author: Michal Josef Špaček <mspacek@redhat.com> - 2.014-9
changelog:
  - Fix running of tests in perl-Net-Server-tests subpackage
    Resolves: RHEL-65278
  - Sync OpenSSL Engine patch with upstream


author: Paul Howarth <paul@city-fan.org> - 0.104003-1
changelog:
  - Update to 0.104003 (rhbz#2208530)
    - Add Artistic 1.0 Perl license and make Perl license use it
    - Remove extra "59" from LGPL-2.1
  - Use SPDX-format license tag


author: Paul Howarth <paul@city-fan.org> - 0.104004-1
changelog:
  - Update to 0.104004 (rhbz#2209461)
    - Rename Perl Artistic License to avoid confusion in detecting license


author: Paul Howarth <paul@city-fan.org> - 0.991-1
changelog:
  - Update to 0.991
    - Make the requirement for perl v5.12.0 explicit; previously, it was only
      implicit because of prerequisites


author: Paul Howarth <paul@city-fan.org> - 0.929-1
changelog:
  - Update to 0.929 (rhbz#2157199)
    - Update packaging and metadata
  - Use SPDX-format license tag
  - Use %license
  - Fix permissions verbosely
  - Simplify find command using -delete
  - Drop redundant buildroot cleaning in %install section


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1:2.0210-4.1
changelog:
  - Fix out-of-bounds heap read on truncated UTF-8 sequences
    (CVE-2026-8177)
  - Resolves: RHEL-186521


author: Paul Howarth <paul@city-fan.org> - 1.31-1
changelog:
  - Update to 1.31 (rhbz#2255994)
    - Update docs to recommend YAML::PP
  - Package description updated as per upstream documentation


author: EL Errata <el-errata_ww@oracle.com> - 116-6.0.1
changelog:
  - Update Oracle Linux test certificates [Orabug: 35823872]
  - Update Oracle Linux test certificates [Orabug: 31928433]


author: Filip Janus <fjanus@redhat.com> - 1.4.8-5
changelog:
  - Add postgresql_default macro to be able to decide which version of extension
    is the default one in the repository


author: Remi Collet <remi@remirepo.net> - 1:1.10.13-5
changelog:
  - fix PHP 8.2 deprecations using patch from
    https://github.com/pear/pear-core/pull/124
  - use SPDX license IDs


author: Remi Collet <remi@remirepo.net> - 6.1.0~RC2-1
changelog:
  - update to 6.1.0RC2
  - fix test suite with redis 6.2 using patch from
    https://github.com/phpredis/phpredis/pull/2555


author: Remi Collet <remi@remirepo.net> - 2.0.3-12
changelog:
  - fix incompatible pointer types using patch from
    https://github.com/php/pecl-processing-rrd/pull/4
  - build out of sources tree


author: Remi Collet <remi@remirepo.net> - 5.1.25-2
changelog:
  - cleanup spec file, remove ZTS stuff and very old Obsoletes
  - add pie Provides
  - refresh configuration for new option and new default values


author: Fedora Release Engineering <releng@fedoraproject.org> - 4.2.7-2
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
  - Fix GCC-14 new errors (https://github.com/openpmix/openpmix/pull/3245)


author: Sérgio Basto <sergio@serjux.com> - 4.2.8-1
changelog:
  - Update pmix to 4.2.8
  - Exclude ix86, configure: abort in 32-bit environments
    https://github.com/openpmix/openpmix/pull/2892
    and Open MPI v5.0.x does not support 32 bit
    https://github.com/open-mpi/ompi/issues/11248


author: Jindrich Novy <jnovy@redhat.com> - 6:5.2.2-1
changelog:
  - stick to v5.2-rhel upstream branch for RHEL
  - update to the latest content of https://github.com/containers/podman/tree/v5.2-rhel
    (https://github.com/containers/podman/commit/458f9b4)
  - Related: RHEL-58990


author: Jindrich Novy <jnovy@redhat.com> - 6:5.2.2-3
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.2-rhel
    (https://github.com/containers/podman/commit/e40738b)
  - Resolves: RHEL-61858


author: EL Errata <el-errata_ww@oracle.com> - 5.4.0-1.0.1
changelog:
  - Add devices on container startup, not on creation
  - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694]
  - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 5.4.0-1.0.2
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.4-rhel
    (https://github.com/containers/podman/commit/0ee1d49) [Orabug: 37995432]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 6:5.4.0-10
changelog:
  - rebuild to resolve CVE-2025-22871
  - Pick latest f rom https://github.com/containers/podman/tree/v5.4-rhel
    https://github.com/containers/podman/commit/0ee1d49


author: Craig Guiller <craig.guiller@oracle.com> - 6:5.4.0-12
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.4-rhel
    (https://github.com/containers/podman/commit/9811294)
  - fixes "CVE-2025-6032 podman: podman missing TLS verification [rhel-9.6.z]"
  - Resolves: RHEL-96708


author: Jindrich Novy <jnovy@redhat.com> - 6:5.4.0-13
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.4-rhel
    (https://github.com/containers/podman/commit/b0d88c7)
  - fixes "CVE-2025-9566 podman: Podman kube play command may overwrite host files [rhel-9.6.z]"
  - Resolves: RHEL-113152


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-3
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/7078b79)
  - fixes "CVE-2025-9566 podman: Podman kube play command may overwrite host files [rhel-10.1]"
  - Resolves: RHEL-113140


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-4
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/c5a3735)
  - fixes "Can not find network create and rm message from podman event when set --events-backend to journald - [RHEL 10.1] 0day"
  - Resolves: RHEL-110318


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-5
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/61231e1)
  - fixes "Timeouts while pushing Sigstore logs to Rekor - [RHEL 10.1] 0day"
  - Resolves: RHEL-111077


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-6
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/2791007)
  - fixes "[Minor Incident] CVE-2025-52881 podman: container escape and denial of service due to arbitrary write gadgets and procfs write redirects [rhel-10.1.z]"
  - Resolves: RHEL-126635


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-8
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/3bf5313)
  - fixes "run 1.2.x upgrade throws error while using nocopy volume mount filesystem option - [RHEL 10.1]"
  - Resolves: RHEL-132532


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-9
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/a58af02)
  - fixes "Bump to runc v1.2.9 or v1.3.4 to get CVE and regression fixes - Podman [rhel-10.1.z]"
  - Resolves: RHEL-132825


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-10
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/0a20b84)
  - fixes "CVE-2025-47913 podman: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS [rhel-10.1.z]"
  - Resolves: RHEL-134778


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-11
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/b194cd9)
  - fixes "podman build system test easily failed with TIMEOUT"
  - Resolves: RHEL-138650


author: Jindrich Novy <jnovy@redhat.com> - 6:5.6.1-0.1
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6
    (https://github.com/containers/podman/commit/d46b857)
  - fixes "Can not find network create and rm message from podman event when set --events-backend to journald"
  - Related: RHEL-109790


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-2
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/56f1962)
  - fixes "Work on RHEL10.1 packaging"
  - Related: RHEL-80817


author: Jindrich Novy <jnovy@redhat.com> - 7:5.8.1-1
changelog:
  - update to https://github.com/containers/podman/releases/tag/v5.8.1
  - fixes Update Podman to support TLS 1.3 configuration
  - Resolves: RHEL-153732


author: Jindrich Novy <jnovy@redhat.com> - 7:5.8.2-1
changelog:
  - update to https://github.com/containers/podman/releases/tag/v5.8.2
  - fixes CVE-2026-34986 go-jose: Go JOSE Denial of Service via crafted JWE
  - Resolves: RHEL-165012


author: Jindrich Novy <jnovy@redhat.com> - 7:5.8.2-4
changelog:
  - update to the latest state of the sustaining branch
  - fixes CVE-2026-42508 CVE-2026-39829 CVE-2026-39830 CVE-2026-39832 CVE-2026-39835
  - fixes CVE-2026-57231 CVE-2026-25681 CVE-2026-27136
  - Resolves: RHEL-173842 RHEL-185604 RHEL-185920 RHEL-186263 RHEL-188713 RHEL-190073 RHEL-190857 RHEL-191095 RHEL-191546 RHEL-192440


author: Vit Mojzis <vmojzis@redhat.com> - 3.9-2
changelog:
  - semanage: Reset active value when deleting boolean customizations (RHEL-111421)
  - setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC (RHEL-111505)


author: Jan Rybar <jrybar@redhat.com> - 125-4
changelog:
  - changing log level via dbus is now restricted to root
  - backport of https://github.com/polkit-org/polkit/commit/5a4ba7dfdcc3f
  - Resolves: RHEL-90807


author: Jan Rybar <jrybar@redhat.com> - 125-4
changelog:
  - changing log level via dbus is now restricted to root
  - backport of https://github.com/polkit-org/polkit/commit/5a4ba7dfdcc3f


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 125-4.1
changelog:
  - NOTICE (jrybar): the record 125-4 below was added in manually after Ymir's initial
  - commit 125-3.1. For some reason, 125-3.1 for rhel-10.2 was based on contents
  - of rhel-10.0 release instead of version 125-4 present in rhel-10.1.
  - Fix CVE-2026-4897: string overflow in polkit agent helper
    Resolves: RHEL-218025


author: Marek Kasik <mkasik@redhat.com> - 24.02.0-7.el10_2.2
changelog:
  - Fix integer overflow in tilingPatternFill (CVE-2026-10118)
  - Bump NVR for MR
  - Resolves: RHEL-180565


author: Fedor Vorobev <fvorobev@redhat.com> - 2:3.8.5-9
changelog:
  - Added a RHEL-specific patch to remove an OpenSSL version mismatch warning.
    Resolves: RHEL-138726


author: Fedor Vorobev <fvorobev@redhat.com> - 2:3.8.5-10
changelog:
  - Fix for CVE-2026-43964: buffer over-read via malformed enhanced status code.
    Resolves: RHEL-176554


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.8.4-1
changelog:
  - New version
    Resolves: rhbz#2255641
  - Fixed SMTP smuggling vulnerability
    Resolves: CVE-2023-51764


author: Filip Janus <fjanus@redhat.com> - 1.9.7-4.Final
changelog:
  - Add macro postgresql_default to be able set up default version in distro
  - Add symbol postgres-decoderbufs-any


author: Filip Janus <fjanus@redhat.com> - 16.10-2
changelog:
  - Add OpenSSL support to upgrade_configure function
  - This ensures upgrade server is compiled with OpenSSL support
  - Required for SSL/TLS connections during database upgrades


author: Filip Janus <fjanus@redhat.com> - 16.10-3
changelog:
  - Add tmpfiles.d configuration for PostgreSQL 16
  - Ensures proper directory permissions for /var/lib/pgsql


author: Filip Janus <fjanus@redhat.com> - 16.13-1
changelog:
  - Update to 16.13
  - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input
  - Fix CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow
  - Fix CVE-2026-2006: PostgreSQL missing validation of multibyte character length
  - Resolves: RHEL-149364 RHEL-149398 RHEL-149332


author: Filip Janus <fjanus@redhat.com> - 16.11-1
changelog:
  - Update to 16.11
  - Resolves: RHEL-128802 (CVE-2025-12818) [rhel-10.2]
  - Resolves: RHEL-128801 (CVE-2025-12818) [rhel-10.1.z]


author: Filip Janus <fjanus@redhat.com> - 16.13-1
changelog:
  - Update to 16.13
  - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input
  - Fix CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow
  - Fix CVE-2026-2006: PostgreSQL missing validation of multibyte character length
  - Resolves: RHEL-149365 RHEL-149399 RHEL-149333


author: Filip Janus <fjanus@redhat.com> - 18.3-1
changelog:
  - Update to 18.3
  - Enable pltcl
  - Update gating configuration
  - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code
  - Fix CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code
  - Fix CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code
  - Fix CVE-2026-2007: PostgreSQL libpq read out-of-bound buffer error


author: Benjamin A. Beasley <code@musicinmybrain.net> - 3.19.6-3
changelog:
  - Remove unnecessary explicit pkgconfig dependencies
  - Remove an obsolete workaround for failing Java tests
  - Remove conditionals for retired 32-bit ARM architecture
  - Remove a slow-test workaround on s390x
  - Reduce macro indirection in the spec file


author: Brian C. Lane <bcl@redhat.com> - 3.52.6-1
changelog:
  - doc/versionremoved: Update VersionChange import for Sphinx 8.0.0 (bcl)
    Related: RHEL-61426
  - workflow: Use python 3.12.7 for testing (bcl)
    Related: RHEL-61426
  - options: adjust to behavior change in upstream _parse_optional (awilliam)
    Resolves: RHEL-61426


author: Brian C. Lane <bcl@redhat.com> - 3.52.7-1
changelog:
  - Add support for inline certificates with `%certificate` section (k.koukiou)
    Resolves: RHEL-61435


author: Brian C. Lane <bcl@redhat.com> - 3.52.8-1
changelog:
  - Update %certificate section documentation (rvykydal)
    Related: RHEL-61435
  - Make %certificate section option --dir mandatory. (rvykydal)
    Resolves: RHEL-76502


author: Brian C. Lane <bcl@redhat.com> - 3.52.9-1
changelog:
  - workflows: Switch to using ubuntu-latest (bcl)
    Related: RHEL-80086
  - Do not remove "md" prefix from RAID names (vtrefny)
    Resolves: RHEL-80086


author: Brian C. Lane <bcl@redhat.com> - 3.52.10-1
changelog:
  - pylint: Ignore files in .git (bcl)
    Related: RHEL-96217
  - Add support for RDP (jkonecny)
    Resolves: RHEL-96217


author: Brian C. Lane <bcl@redhat.com> - 3.52.11-1
changelog:
  - Add support for new bootc kickstart command (ppolawsk)
    Resolves: RHEL-132612
    Related: RHEL-58215


author: Brian C. Lane <bcl@redhat.com> - 3.52.12-1
changelog:
  - rhsm: Add Flatpak registry option for RHEL10 (bciconel)
    Resolves: RHEL-132652
    Related: RHEL-132663


author: EL Errata <el-errata_ww@oracle.com> - 3.52.12-1.0.1
changelog:
  - Support btrfs with --autopart on uek
    [Orabug: 37413006]
  - Revert back to Fedora 38 Autopart handler to support BTRFS
    [Orabug: 37413006]
  - Retain the btrfs command in RHEL10_BTRFS class
    [Orabug: 37119393]
  - Support btrfs partition command in RHEL9_Partition class
    [Orabug: 33796791]
  - Sync OL 8 command handlers with upstream [Orabug: 31683439]
  - Don't exit installer if btrfs is specified for autopart [Orabug: 31192722]
  - Don't exit installer with message that btrfs is unsupported [Orabug: 31192722]
  - Fix crash when using btrfs [Orabug: 30792917]
  - Remove the RHSM command [Orabug: 30902364]
  - drop syspurpose command [Orabug: 29443881]
  - Include the OL8 Handler class in the commandMap [Orabug: 29373077]
  - Make sure version is output properly for OL [Orabug: 20440019]
  - Alter tools to recognize OL version strings [Orabug: 20440019]
  - Enable Oracle Linux handlers


author: Brian C. Lane <bcl@redhat.com> - 3.52.3-1
changelog:
  - btrfs: Remove support for the btrfs command on RHEL10 (bcl)
    Resolves: RHEL-34009
  - Deprecate modularity on RHEL 10 (marusak.matej)
    Resolves: RHEL-34829


author: Brian C. Lane <bcl@redhat.com> - 3.52.4-1
changelog:
  - timezone: Remove the --isUtc, --nontp, and --ntpserver arguments (bcl)
    Related: RHEL-34009
  - packages: Remove the old camel case arguments on RHEL10 (bcl)
    Resolves: RHEL-34009
  - nvdimm: Remove support for the nvdimm command on RHEL10 (bcl)
    Related: RHEL-34009


author: Ondřej Sloup <osloup@redhat.com> - 5.0.0~b1-1
changelog:
  - Rebase to the newest version, test the beta (rhbz#2235122)
  - This release drops Python 2 and adds Python 3.12 support


author: Ondrej Sloup <osloup@redhat.com> - 5.0.0~b4-1
changelog:
  - Rebase to the newest version, test the beta (Related: rhbz#2235401)
  - Remove the hotfix (move of pyodbc.py) as it is fixed in upstream


author: Ondrej Sloup <osloup@redhat.com> - 5.1.0-1
changelog:
  - Rebase to the newest version (Related: rhbz#2262845)
  - Update license tag to the SPDX format (MIT-0)


author: Miro Hrončok <mhroncok@redhat.com> - 1.12.1-1
changelog:
  - Add a temporary workaround for RPM 4.20 alpha 2 leaking \x1f (unit separators)
  - Related: rhbz#2284187


author: Miro Hrončok <mhroncok@redhat.com> - 1.13.0-1
changelog:
  - Properly escape weird characters from paths in %{pyproject_files} (RPM 4.19+ only)
  - Revert the temporary workaround for RPM 4.20 alpha 2 leaking \x1f (unit separators)
  - Fixes: rhbz#1990879


author: Python Maint <python-maint@redhat.com> - 1.15.0-1
changelog:
  - Add a possibility to read runtime requirements from pyproject.toml [project] table
  - Fixes: rhbz#2261939
  - Don't generate a dependency on pip when %pyproject_buildrequires -N is used
  - Fixes: rhbz#2294510
  - Even when %_auto_set_build_flags is disabled, set all compiler flags when building wheels
  - Fixes: rhbz#2293616


author: Miro Hrončok <mhroncok@redhat.com> - 1.16.0-1
changelog:
  - %pyproject_buildrequires: Add support for dependency groups (PEP 735), via the -g flag
  - This is implied when used tox testenvs depend on dependency groups (requires tox 4.22+)
  - Fixes: rhbz#2318849


author: Miro Hrončok <miro@hroncok.cz> - 1.16.1-1
changelog:
  - Support for setuptools 70+
  - wheel is no longer generated as a dependency of the default build system


author: Miro Hrončok <miro@hroncok.cz> - 1.17.0-1
changelog:
  - Add the -M flag to %pyproject_save_files
  - The flag can be used to indicate no Python modules should be saved


author: Miro Hrončok <mhroncok@redhat.com> - 1.18.0-1
changelog:
  - Make %pyproject_buildrequires -t/-e and %tox fail when no suitable tox configuration exists
  - The %pyproject_buildrequires -t/-e case is temporarily allowed on Fedora 40-42
  - Requires tox-current-env >= 0.0.16


author: Miro Hrončok <mhroncok@redhat.com> - 1.18.3-1
changelog:
  - %pyproject_buildrequires: Do not generate BuildRequires from Requires core metadata fields
  - That field is deprecated and should include importable module names, not distribution packages
  - Related: rhbz#2378463


author: Miro Hrončok <mhroncok@redhat.com> - 1.18.4-1
changelog:
  - Don't exit from pyproject-srpm-macros implementation of %pyproject_buildrequires
  - Fixes: rhbz#2391290
  - On RPM 4.20+ don't put pyproject-macros-specific files in %buildsubdir
  - Works around https://github.com/rpm-software-management/rpm/issues/3890
  - Speed %pyproject_save_files up significantly


author: Miro Hrončok <mhroncok@redhat.com> - 1.18.5-1
changelog:
  - %pyproject_extras_subpkg: Only %ghost the dist-info directory, not the content
  - That way, accidentally unpackaged files within are reported as errors
  - %pyproject_save_files: Also save top level typing stub files (.pyi)


author: Packit <hello@packit.dev> - 0.19.6-1
changelog:
  - [packit] 0.19.6 upstream release
  - Resolves rhbz#2211521 Upstream tag: v0.19.6 Upstream commit: b83949d0


author: Vendula Poncova <vponcova@redhat.com> - 1.7-1
changelog:
  - CI: Use dnf instead of yum to install CentOS packages (vponcova)
  - Documentation: Improve the installation instruction (vponcova)
  - Remove untracked files from the git repository interactively (vponcova)
  - UnixFD: Document the support for Unix file descriptors (vponcova)
  - Documentation: Clean up examples in the documentation (vponcova)
  - Documentation: Simplify the README.md file (vponcova)
  - Documentation: Fix bullet point lists (vponcova)
  - Documentation: Simplify the hostname example (vponcova)
  - CI: Run tests for all supported Python version (vponcova)
  - UnixFD: Handle DBus signals with Unix file descriptors (vponcova)
  - UnixFD: Add tests for DBus properties with Unix file descriptors (vponcova)
  - UnixFD: Clean up tests of DBus calls with Unix file descriptors (vponcova)
  - UnixFD: Clean up tests for swapping Unix file descriptors (vponcova)
  - UnixFD: Clean up `GLibClientUnix` and `GLibServerUnix` (vponcova)
  - UnixFD: Process results of client calls in the low-level library (vponcova)
  - UnixFD: Move the support for Unix file descriptors to dasbus.unix (vponcova)
  - CI: Always pull the latest container image (vponcova)
  - CI: Disable the unhashable-member warning (vponcova)
  - Revert "Don't use pylint from pip on Fedora Rawhide" (vponcova)
  - UnixFD: Move the unit tests to a new file (vponcova)
  - UnixFD: Manage the testing bus on set up and tear down (vponcova)
  - UnixFD: Don't add arguments to the DBusTestCase.setUp method (vponcova)
  - UnixFD: Create a new testing DBus interface (vponcova)
  - UnixFD: Fix the indentation in unit tests (vponcova)
  - Add unit tests for variants with variant types (vponcova)
  - Simplify the code for replacing values of the UnixFD type (vponcova)
  - Add classes for unpacking and unwrapping a variant (vponcova)
  - Don't use pylint from pip on Fedora Rawhide (vponcova)
  - UnixFD: Rename a parameter to server_arguments (vponcova)
  - UnixFD: Revert a change in GLibClient._async_call_finish (vponcova)
  - Raise TimeoutError if a DBus call times out (vponcova)
  - Fix pylint tests in CentOS Stream 8 (vponcova)
  - Fix the ENV instruction in Dockerfiles (vponcova)
  - Fix pylint issues (vponcova)
  - run forked tests using subprocess, instead of multiprocessing (wdouglass)
  - use mutable list for return value in fd_test_async make fd getters more explicit (wdouglass)
  - Add test case for method call only returning fd (jlyda)
  - Always use call_with_unix_fd_list* to properly handle returned fds (jlyda)
  - fix some lint discovered errors (wdouglass)
  - seperate unixfd functionality, to better support systems that don't have them (wdouglass)
  - Remove note in documentation about unsupported Unix file descriptors (wdouglass)
  - Add a test for UnixFD transfer (wdouglass)
  - Allow UnixFDs to be replaced and passed into Gio (wdouglass)
  - Fix rpm lint warnings for OpenSUSE 15.3 (christopher.m.cantalupo)
  - Extend the .coveragerc file (vponcova)
  - Disable builds for Fedora ELN on commits (vponcova)
  - Test Debian with Travis (vponcova)
  - Test Ubuntu with Travis (vponcova)
  - Test CentOS Stream 9 with Travis (vponcova)
  - Use CentOS Stream 8 for testing (vponcova)
  - add remove dbus object function on bus and update tests (matthewcaswell)
  - properly measure coverage across multiprocess test cases (wdouglass)
  - Move handle typing tests into a new class (and a new file) (wdouglass)
  - Add another test for a crazy data type, fix a bug discovered via the test (wdouglass)
  - Add functions for generating/consuming fdlists with variants (wdouglass)
  - Provide a language argument for the code blocks (seahawk1986)
  - Change the type of 'h' glib objects from 'File' to 'UnixFD' (wdouglass)
  - Allow to run tests in a container (vponcova)
  - Add C0209 to the ignore list for pylint (tjoslin)
  - Use the latest distro in Travis CI (vponcova)
  - Always update the container (vponcova)
  - Document limitations of the DBus specification generator (vponcova)


author: Packit <hello@packit.dev> - 1.9.0-1
changelog:
  - Optimize some repo metastuff and prepare v1.9.0 (#364) (nir0s)
  - Actions(deps): Bump actions/setup-python from 4 to 5 (#363) (dependabot[bot])
  - Test on modern versions of CPython and PyPy and macOS (#362) (Christian Clauss)
  - Actions(deps): Bump actions/checkout from 3 to 4 (#361) (dependabot[bot])
  - Refactor `distro.info()` method to return an `InfoDict` (#360) (SCC/楊志璿)
  - Ignore the file '/etc/ec2_version' (Pritam Kulkarni)
  - Add Debian Testing to the tests (#356) (Harshula Jayasuriya)
  - Ignore the file '/etc/board-release' (#353) (Pedro Lamas)
  - Add support for ALT Linux Server 10.1 distribution (#354) (Alexander Stepchenko)
  - Run Python 3.6 on Ubuntu 20.04 for CI and bump isort (#355) (Samuel FORESTIER)
  - Update archlinux resource for tests (Saltaformajo)
  - Resolves rhbz#2255740


author: Miro Hrončok <mhroncok@redhat.com> - 3.1.5-1
changelog:
  - Update to 3.1.5
  - Security fix for CVE-2024-56201
  - Security fix for CVE-2024-56326
  Resolves: RHEL-73095


author: Julien Rische <jrische@redhat.com> - 1.0.0-19
changelog:
  - Use DNS discovery for declared realms only (CVE-2025-59088)
    Resolves: RHEL-122777
  - Fix DoS vulnerability based on unbounded TCP buffering (CVE-2025-59089)
    Resolves: RHEL-122776


author: Julien Rische <jrische@redhat.com> - 1.1.0-1
changelog:
  - New upstream version (1.1.0)
  - Use DNS discovery for declared realms only (CVE-2025-59088)
    Resolves: RHEL-113652
  - Fix DoS vulnerability based on unbounded TCP buffering (CVE-2025-59089)
    Resolves: RHEL-113656


author: Miro Hrončok <miro@hroncok.cz> - 5.1.0-5
changelog:
  - Reduce the type safety as a workaround for build failures in Fedora 40+
  - Fixes: rhbz#2261034
  - Fixes: rhbz#2256232


author: Miro Hrončok <miro@hroncok.cz> - 5.1.0-7
changelog:
  - Revert "Reduce the type safety as a workaround for build failures in
    Fedora 40+"
  - The workaround has been moved to Cython


author: Martin Kolman <mkolman@redhat.com> - 0.51-1
changelog:
  - SPDX compatible License: line (mkolman)
  - setup.py: switch from distutils to setuptools (tim.orling@konsulko.com)
  - Improve formatting and data in setup.py (vslavik)


author: John Eckersberg <jeckersb@redhat.com> - 0.10.1-1
changelog:
  - New upstream release 0.10.1 (rhbz#2256342)
  - Remove patch for Python 3.13 compatibility (merged upstream in 0.10.0)
  - Add new depencency on furo
  - Include missing THANKS file (https://github.com/netaddr/netaddr/pull/345)


author: Charalampos Stratakis <cstratak@redhat.com> - 23.3.2-2
changelog:
  - Use tarfile.data_filter for extracting (CVE-2007-4559, PEP-721, PEP-706)
  - Require Python with tarfile filters
  - Resolves: RHEL-25820


author: Miro Hrončok <mhroncok@redhat.com> - 23.3.1-5
changelog:
  - Switched to autogenerated BuildRequires for test dependencies,
    which removed some that were no longer necessary


author: Jindrich Novy <jnovy@redhat.com> - 3:5.0.0-1
changelog:
  - python-podman-5.0.0-1.el10
  - update to https://github.com/containers/podman-py/releases/tag/v5.0.0
  - Related: RHEL-34195


author: Jindrich Novy <jnovy@redhat.com> - 3:5.2.0-1
changelog:
  - python-podman-5.2.0-1.el10
  - update to https://github.com/containers/podman-py/releases/tag/v5.2.0
  - Related: RHEL-34195


author: Jindrich Novy <jnovy@redhat.com> - 3:5.3.0-1
changelog:
  - python-podman-5.3.0-1.el10
  - update to https://github.com/containers/podman-py/releases/tag/v5.3.0
  - Resolves: RHEL-69004


author: Ondrej Sloup <osloup@redhat.com> - 2.9.6-4
changelog:
  - Update license and use SPDX formula according to fedora-license-data
  - https://gitlab.com/fedora/legal/fedora-license-data/-/issues/153


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 0.6.2-1.1
changelog:
  - Fix CVE-2026-59886: prevent overflow in Real.__float__() when
    converting ASN.1 Real values with large exponents
    Resolves: RHEL-217904


author: Miro Hrončok <mhroncok@redhat.com> - 14-3
changelog:
  - Avoid needless pkg_resources import in pythonbundles.py
  - Ignore environment markers in pythonbundles.py


author: Miro Hrončok <mhroncok@redhat.com> - 3.12-11
changelog:
  - %python_extras_subpkg: Add -v option to specify the required version(-release)
  - This is useful when the extras are built from a different specfile (e.g. in EPEL for a RHEL base package)
  - Resolves: RHEL-117448


author: Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com> - 2.1.76-12.0.1
changelog:
  - Add patch 101-allow-mixed-case-in-oracle-iqns to fix [Orabug: 27613482]
  - Add patch 100-allow-underscore-in-oracle-iqns to fix [Orabug: 27582660]


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.2.6-5
changelog:
  - Confirm License is SPDX MIT
  - Reduce macro indirection, etc.
  - Drop unused manual runtime dependency on setuptools
  - Add a note about the circular dependency with ruamel.yaml
  - Stop numbering sources and patches
  - Update URL (close RHBZ#1840610)
  - Add an import-only “smoke test”
  - Properly handle libyaml bundling
  - Port to pyproject-rpm-macros (“new Python guidelines”)
  - Add a link to the upstream issue for the Cython workaround


author: Jiri Konecny <jkonecny@redhat.com> - 1.9.0-5
changelog:
  - Migrate to SPDX license: https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1#Detailed_Description


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.8-1
changelog:
  - Update to 3.12.8
  - Security fix for CVE-2024-9287 and CVE-2024-12254
  Resolves: RHEL-64877, RHEL-70450


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.10-3
changelog:
  - Fix PySSL_SetError handling SSL_ERROR_SYSCALL
  - This fixes random flakiness of test_ssl on stressed machines
  Resolves: RHEL-90555


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.11-1
changelog:
  - Update to 3.12.11
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98060, RHEL-98047, RHEL-97813, RHEL-98062, RHEL-98180


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-3.1
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143054 RHEL-143105 RHEL-144852


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-4
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143057
  Resolves: RHEL-143109
  Resolves: RHEL-144854


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-5
changelog:
  - Rebuilding previous fixes for different build target
  Related: RHEL-143057, RHEL-143109, RHEL-144854


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.13-1
changelog:
  - Update to 3.12.13
  - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672
  - Require expat >= 2.7.2 to prevent symbol lookup errors at runtime with older expat
  Related: RHEL-167886, RHEL-168120


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.13-2
changelog:
  - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224
  Resolves: RHEL-167886, RHEL-168120


author: Akshata Konala <akshata.konala@oracle.com> - 3.12.9-2.2
changelog:
  - Enable PAC and BTI protections for aarch64
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  - Resolves: RHEL-98058, RHEL-98020, RHEL-97809, RHEL-98184, RHEL-98211


author: Lukas Tyrychtr <ltyrycht@redhat.com>
changelog:
  - Conditionalize the festival subpackage, we're not shipping Festival in RHEL 10
   Festival in RHEL 10)


author: Jerry James <loganjerry@gmail.com> - 2021.11.0-1
changelog:
  - Rebase to version 2021.11.0
  - New -bind subpackage for the NUMA support library
  - Build with cmake
  - Minor spec file cleanups


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.14.0-2
changelog:
  - Initial package
  - Fedora contributions by:
        Björn Esser <besser82@fedoraproject.org>
        Bohuslav Kabrda <bkabrda@redhat.com>
        Charalampos Stratakis <cstratak@redhat.com>
        Dan Horák <dan@danny.cz>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Florian Weimer <fweimer@redhat.com>
        Gwyn Ciesla <limb@fedoraproject.org>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Iryna Shcherbina <shcherbina.iryna@gmail.com>
        Jaroslav Škarvada <jskarvad@redhat.com>
        Jason ティビツ <tibbs@fedoraproject.org>
        Kalev Lember <klember@redhat.com>
        Karolina Surma <ksurma@redhat.com>
        Karsten Hopp <karsten@redhat.com>
        Lukáš Zachar <lzachar@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Marcel Plch <mplch@redhat.com>
        Matej Stuchlik <mstuchli@redhat.com>
        Michal Cyprian <mcyprian@redhat.com>
        Michal Toman <mtoman@fedoraproject.org>
        Miro Hrončok <mhroncok@redhat.com>
        Nicolas Chauvet <kwizart@gmail.com>
        Orion Poplawski <orion@cora.nwra.com>
        Patrik Kopkan <pkopkan@redhat.com>
        Peter Robinson <pbrobinson@gmail.com>
        Petr Šplíchal <psplicha@redhat.com>
        Petr Viktorin <pviktori@redhat.com>
        Rex Dieter <rdieter@fedoraproject.org>
        Richard W.M. Jones <rjones@redhat.com>
        Robert Kuska <rkuska@redhat.com>
        Sahana Prasad <sahana@redhat.com>
        Stephen Gallagher <sgallagh@redhat.com>
        Than Ngo <than@redhat.com>
        Thomas Spura <thomas.spura@gmail.com>
        Till Maas <opensource@till.name>
        Tom Stellard <tstellar@redhat.com>
        Tomas Mraz <tmraz@fedoraproject.org>
        Tomas Orsava <torsava@redhat.com>
        Tomas Radej <tradej@redhat.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Toshio Kuratomi <toshio@fedoraproject.org>
        U2FsdGVkX1 <U2FsdGVkX1@gmail.com>
        Victor Stinner <vstinner@redhat.com>
        Ville Skyttä <ville.skytta@iki.fi>
        Yaakov Selkowitz <yselkowi@redhat.com>
        Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Karolina Surma <ksurma@redhat.com> - 3.14.3-1
changelog:
  - Update to Python 3.14.3
  - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865,
  CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367
  Resolves: RHEL-144855, RHEL-143058, RHEL-143111


author: Karolina Surma <ksurma@redhat.com> - 3.14.4-1
changelog:
  - Update to Python 3.14.4
  - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865
  Related: RHEL-168121, RHEL-167887


author: Charalampos Stratakis <cstratak@redhat.com> - 3.14.4-2
changelog:
  - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100
  Resolves: RHEL-168121, RHEL-167887


author: Miro Hrončok <mhroncok@redhat.com> - 3.14.5~rc1-1
changelog:
  - Update to 3.14.5rc1
  - Move back to the generational from the incremental garbage collector
  - Security fix for CVE-2026-6019
  Resolves: RHEL-176147


author: Python Maint <python-maint@redhat.com> - 1.1.2-1
changelog:
  - Initial package
  - Fedora contributions by:
        Benjamin A. Beasley <code@musicinmybrain.net>
        Carl George <carl@george.computer>
        Damien Ciabrini <dciabrin@redhat.com>
        Haïkel Guémar <hguemar@fedoraproject.org>
        Iryna Shcherbina <ishcherb@redhat.com>
        Itamar Reis Peixoto <itamar@ispbrasil.com.br>
        Julien Enselme <jujens@jujens.eu>
        Lumír Balhar <lbalhar@redhat.com>
        Michal Schorm <mschorm@redhat.com>
        Miro Hrončok <mhroncok@redhat.com>
        Yaakov Selkowitz <yselkowi@redhat.com>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 5.0.2-5
changelog:
  - Initial package
  Fedora contributions by:
      Adam Williamson <awilliam@redhat.com>
      Alexander Bokovoy <abokovoy@redhat.com>
      Bill Nottingham <notting@fedoraproject.org>
      Dan Callaghan <dcallagh@redhat.com>
      David Malcolm <dmalcolm@redhat.com>
      Dennis Gilmore <dennis@ausil.us>
      Ignacio Vazquez-Abrams <ivazqueznet+rpm@gmail.com>
      Igor Gnatenko <ignatenko@redhat.com>
      Iryna Shcherbina <ishcherb@redhat.com>
      Jakub Dorňák <jdornak@redhat.com>
      James Bowes <jbowes@redhat.com> 1.0-1
      Jan Kaluza <jkaluza@redhat.com>
      Jesse Keating <jkeating@fedoraproject.org>
      Joe Orton <jorton@redhat.com>
      Josh Kayse <joshkayse@fedoraproject.org>
      Karolina Surma <ksurma@redhat.com>
      Kevin Fenzi <kevin@fedoraproject.org>
      Luboš Uhliarik <luhliari@redhat.com>
      Luke Macken <lmacken@redhat.com>
      Matthias Runge <mrunge@redhat.com>
      Miro Hrončok <mhroncok@redhat.com>
      Orion Poplawski <orion@cora.nwra.com>
      Peter Robinson <pbrobinson@fedoraproject.org>
      Richard W.M. Jones <rjones@redhat.com>
      Ricky Zhou <ricky@fedoraproject.org>
      Tomas Orsava <torsava@redhat.com>
      Tomas Hrnciar <thrnciar@redhat.com>
      Tom Stellard <tstellar@redhat.com>
      Troy Dawson <tdawson@redhat.com>
      Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 2.3.4-1
changelog:
  - Initial import
  - Fedora contributions by:
        Benjamin A. Beasley <code@musicinmybrain.net>
        Bill Nottingham <notting@fedoraproject.org>
        Charalampos Stratakis <cstratak@redhat.com>
        Christian Dersch <lupinix@mailbox.org>
        Dan Horák <dan@danny.cz>
        David Malcolm <dmalcolm@redhat.com>
        David Tardon <dtardon@redhat.com>
        Deji Akingunola <deji@fedoraproject.org>
        Dennis Gilmore <dennis@ausil.us>
        dmalcolm <dmalcolm@fedoraproject.org>
        Elliott Sales de Andrade <quantum.analyst@gmail.com>
        Gwyn Ciesla <gwync@protonmail.com>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Iñaki Úcar <iucar@fedoraproject.org>
        Iryna Shcherbina <shcherbina.iryna@gmail.com>
        Jarod Wilson <jwilson@fedoraproject.org>
        Jaromir Capik <jcapik@redhat.com>
        Jef Spaleta <jspaleta@fedoraproject.org>
        Jerry James <loganjerry@gmail.com>
        Jesse Keating <jkeating@fedoraproject.org>
        Kalev Lember <klember@redhat.com>
        Karolina Surma <ksurma@redhat.com>
        Lukáš Zaoral <lzaoral@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Merlin Mathesius <mmathesi@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Nikola Forró <nforro@redhat.com>
        Orion Poplawski <orion@nwra.com>
        Pavel Šimovec <psimovec@redhat.com>
        Peter Robinson <pbrobinson@gmail.com>
        Robert Kuska <rkuska@redhat.com>
        Scott Talbert <swt@techie.net>
        Simone Caronni <negativo17@gmail.com>
        Songsong Zhang <u2fsdgvkx1@gmail.com>
        Thomas Spura <thomas.spura@gmail.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Tomas Orsava <torsava@redhat.com>
        Tomas Tomecek <ttomecek@redhat.com>
        Tulio Magno Quites Machado Filho <tuliom@redhat.com>
        Ville Skyttä <scop@fedoraproject.org>
        Yaakov Selkowitz <yselkowi@redhat.com>


author: Lukáš Zachar <lzachar@redhat.com> - 25.2-5
changelog:
  - Fix gating plan
  - removed unnecessary older VERSION= tests
  - removed bootstrap test
  - fix pip_install_upgrade to run pip-3.14
  - fix bash completion + remove unused metadata file


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11-29
changelog:
  - Initial package
  Fedora contributions by:
      Dennis Gilmore <dennis@ausil.us>
      Bill Nottingham <notting@fedoraproject.org>
      Charalampos Stratakis <cstratak@redhat.com>
      Christian Heimes <cheimes@redhat.com>
      David Malcolm <dmalcolm@redhat.com>
      Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
      Igor Gnatenko <ignatenkobrain@fedoraproject.org>
      Jesse Keating <jkeating@fedoraproject.org>
      Miro Hrončok <miro@hroncok.cz>
      Orion Poplawski <orion@cora.nwra.com>
      Patrik Kopkan <pkopkan@redhat.com>
      Rob Crittenden <rcritten@redhat.com>
      Robert Kuska <rkuska@redhat.com>
      Slavek Kabrda <bkabrda@redhat.com>
      Stephen Gallagher <sgallagh@redhat.com>
      Thomas Spura <tomspur@fedoraproject.org>
      Tom Callaway <spot@fedoraproject.org>
      Troy Dawson <tdawson@redhat.com>


author: Charalampos Stratakis <cstratak@redhat.com> - 3.11^20251221git9d7c400-1
changelog:
  - Update to the latest and last upstream commit
  - The project won't have any new releases
  - Use modern pyproject macros
  Related: RHEL-120807


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 2.9.10-3
changelog:
  - Initial package
  Fedora contributions by:
      Ales Nezbeda <anezbeda@redhat.com>
      Bill Nottingham <notting@fedoraproject.org>
      Bohuslav Kabrda <bkabrda@redhat.com>
      Charalampos Stratakis <cstratak@redhat.com>
      David Malcolm <dmalcolm@redhat.com>
      Dennis Gilmore <dennis@ausil.us>
      Devrim Gündüz <devrim@gunduz.org>
      Filip Januš <fjanus@redhat.com>
      Honza Horak <hhorak@redhat.com>
      Ignacio Vazquez-Abrams <ivazqueznet+rpm@gmail.com>
      Igor Gnatenko <ignatenkobrain@fedoraproject.org>
      Jason L Tibbitts III <tibbs@math.uh.edu>
      Jesse Keating <jkeating@fedoraproject.org>
      Jozef Mlich <jmlich@redhat.com>
      Lumír Balhar <lbalhar@redhat.com>
      Miro Hrončok <mhroncok@redhat.com>
      Ondřej Sloup <ondrej.sloup@protonmail.com>
      Patrik Novotný <panovotn@redhat.com>
      Pavel Raiskup <praiskup@redhat.com>
      Petr Kubat <pkubat@redhat.com>
      Peter Robinson <pbrobinson@fedoraproject.org>
      Todd Zullinger <tmz@pobox.com>
      Tomas Hrnciar <thrnciar@redhat.com>
      Tom Lane <tgl@redhat.com>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 1.16.2-1
changelog:
  - Initial package
  - Fedora contributions by:
        Antonio Trande <anto.trande@gmail.com>
        Benjamin A. Beasley <code@musicinmybrain.net>
        Bill Nottingham <notting@fedoraproject.org>
        Björn Esser <me@besser82.io>
        Charalampos Stratakis <cstratak@redhat.com>
        Christian Dersch <lupinix@mailbox.org>
        David Abdurachmanov <davidlt@rivosinc.com>
        David Malcolm <dmalcolm@redhat.com>
        Deji Akingunola <deji@fedoraproject.org>
        Dennis Gilmore <dennis@ausil.us>
        dmalcolm <dmalcolm@fedoraproject.org>
        Elliott Sales de Andrade <quantum.analyst@gmail.com>
        Florian Weimer <fweimer@redhat.com>
        Gwyn Ciesla <gwync@protonmail.com>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Igor Gnatenko <ignatenko@redhat.com>
        Iñaki Úcar <iucar@fedoraproject.org>
        Jef Spaleta <jspaleta@fedoraproject.org>
        Jerry James <loganjerry@gmail.com>
        Jesse Keating <jkeating@fedoraproject.org>
        Jitka Plesnikova <jplesnik@redhat.com>
        Jonathan Wakely <jwakely@redhat.com>
        Kalev Lember <klember@redhat.com>
        Karolina Surma <ksurma@redhat.com>
        Kevin Fenzi <kevin@scrye.com>
        Lumir Balhar <lbalhar@redhat.com>
        Mamoru TASAKA <mtasaka@fedoraproject.org>
        Marcel Plch <mplch@redhat.com>
        Maxwell G <maxwell@gtmx.me>
        Miro Hrončok <miro@hroncok.cz>
        Nikola Forró <nforro@redhat.com>
        Nils Philippsen <nils@redhat.com>
        Orion Poplawski <orion@nwra.com>
        Pavel Šimovec <psimovec@redhat.com>
        Peter Robinson <pbrobinson@fedoraproject.org>
        Petr Viktorin <pviktori@redhat.com>
        Robert Kuska <rkuska@redhat.com>
        Than Ngo <than@redhat.com>
        Thomas Spura <thomas.spura@gmail.com>
        Tomas Tomecek <ttomecek@redhat.com>
        Toshio Kuratomi <toshio@fedoraproject.org>
        Troy Dawson <tdawson@fedoraproject.org>
        Yaakov Selkowitz <yselkowi@redhat.com>
        Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Benjamin A. Beasley <code@musicinmybrain.net> - 2.6.1-1
changelog:
  - Update to 2.6.1
  - Fixes CVE-2025-66471 / GHSA-2xpw-w6gg-jr37
  - Fixes CVE-2025-66418 / GHSA-gm62-xv2j-4w53


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 2.6.3-2
changelog:
  - Security fix for CVE-2026-44431 and CVE-2026-44432
  - Resolves: RHEL-184903
  - Resolves: RHEL-185128


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.0.0-10
changelog:
  - kvm-Enable-uefi-variable-service-for-edk2.patch [RHEL-102325]
  - Resolves: RHEL-102325
    ([qemu] enable variable service for edk2)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.0.0-11
changelog:
  - kvm-rbd-Fix-.bdrv_get_specific_info-implementation.patch [RHEL-105440]
  - Resolves: RHEL-105440
    (Openstack guest becomes inaccessible via network when storage network on the hypervisor is disabled/lost [rhel-10.1])


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.0.0-12
changelog:
  - kvm-RHEL-Pack-uefi-vars-module.patch [RHEL-102325]
  - Resolves: RHEL-102325
    ([qemu] enable variable service for edk2)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.0.0-13
changelog:
  - Added TDX support
  - Resolves: RHEL-20797
    ([Intel 10.0 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD)
  - Resolves: RHEL-49727
    ([Intel 10.0 FEAT] [SPR][EMR] Virt-QEMU: TDX: Allow to configure apic bus clock)
  - Resolves: RHEL-50307
    ([Intel 10.0 FEAT] [SPR] TDX: Virt-QEMU: QEMU Support)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.0.0-14
changelog:
  - kvm-hw-uefi-clear-uefi-vars-buffer-in-uefi_vars_write-ca.patch [RHEL-108614]
  - kvm-hw-uefi-return-success-for-notifications.patch [RHEL-108614]
  - kvm-hw-uefi-check-access-for-first-variable.patch [RHEL-108614]
  - Resolves: RHEL-108614
    (CVE-2025-8860 qemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callback [rhel-10.1])


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.0.0-14.el10_1.1
changelog:
  - kvm-arm-kvm-report-registers-we-failed-to-set.patch [RHEL-120074]
  - Resolves: RHEL-120074
    ([rhel10] Backport "arm/kvm: report registers we failed to set" [rhel-10.1.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.0.0-14.el10_1.2
changelog:
  - kvm-io-move-websock-resource-release-to-close-method.patch [RHEL-120118]
  - kvm-io-fix-use-after-free-in-websocket-handshake-code.patch [RHEL-120118]
  - Resolves: RHEL-120118
    (CVE-2025-11234 qemu-kvm: VNC WebSocket handshake use-after-free [rhel-10.1.z])


author: Jon Maloy <jmaloy@redhat.com> - 10.0.0-14.el10_1.3
changelog:
  - kvm-ram-block-attributes-fix-interaction-with-hugetlb-me.patch [RHEL-129549]
  - kvm-ram-block-attributes-Unify-the-retrieval-of-the-bloc.patch [RHEL-129549]
  - Resolves: RHEL-129549
    ([RHEL 10]snp guest fail to boot with hugepage [rhel-10.1.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.0.0-14.el10_1.4
changelog:
  - kvm-file-posix-Handle-suspended-dm-multipath-better-for-.patch [RHEL-133521]
  - kvm-block-backend-Fix-race-when-resuming-queued-requests.patch [RHEL-133527]
  - Resolves: RHEL-133521
    (The VM hit io error when do S3-PR integration on the pass-through  failover multipath device [rhel-10.1.z])
  - Resolves: RHEL-133527
    (Assertion failure on drain with iothread and I/O load [rhel-10.1.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.0.0-14.el10_1.5
changelog:
  - kvm-Revert-i386-cpu-Move-adjustment-of-CPUID_EXT_PDCM-be.patch [RHEL-135453]
  - Resolves: RHEL-135453
    (Live migration after workload update fails with operation failed: guest CPU doesn't match specification: missing features: pdcm [rhel-10.1.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.0.0-5
changelog:
  - kvm-file-posix-Define-DM_MPATH_PROBE_PATHS.patch [RHEL-65852]
  - kvm-file-posix-Probe-paths-and-retry-SG_IO-on-potential-.patch [RHEL-65852]
  - kvm-io-Fix-partial-struct-copy-in-qio_dns_resolver_looku.patch [RHEL-67706]
  - kvm-util-qemu-sockets-Refactor-setting-client-sockopts-i.patch [RHEL-67706]
  - kvm-util-qemu-sockets-Refactor-success-and-failure-paths.patch [RHEL-67706]
  - kvm-util-qemu-sockets-Add-support-for-keep-alive-flag-to.patch [RHEL-67706]
  - kvm-util-qemu-sockets-Refactor-inet_parse-to-use-QemuOpt.patch [RHEL-67706]
  - kvm-util-qemu-sockets-Introduce-inet-socket-options-cont.patch [RHEL-67706]
  - kvm-tests-unit-test-util-sockets-fix-mem-leak-on-error-o.patch [RHEL-67706]
  - Resolves: RHEL-65852
    (Support multipath failover with scsi-block)
  - Resolves: RHEL-67706
    (postcopy on the destination host can't switch into pause status under the network issue if boot VM with '-S')


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.0.0-6
changelog:
  - kvm-scsi-disk-Add-native-FUA-write-support.patch [RHEL-71962]
  - kvm-Fix-handling-of-have_block_rbd.patch [RHEL-96057]
  - kvm-Delete-obsolete-references-to-architectures.patch [RHEL-96057]
  - kvm-Fix-arch-list-for-vgabios-and-ipxe-roms.patch [RHEL-96057]
  - kvm-Disable-virtio-net-pci-romfile-loading-on-riscv64.patch [RHEL-96057]
  - Resolves: RHEL-71962
    ([RFE] Implement FUA support in scsi-disk)
  - Resolves: RHEL-96057
    (qemu-kvm: Various small issues in the spec file)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.0.0-7
changelog:
  - kvm-s390x-Fix-leak-in-machine_set_loadparm.patch [RHEL-98555]
  - kvm-hw-s390x-ccw-device-Fix-memory-leak-in-loadparm-sett.patch [RHEL-98555]
  - kvm-target-i386-Update-EPYC-CPU-model-for-Cache-property.patch [RHEL-52650]
  - kvm-target-i386-Update-EPYC-Rome-CPU-model-for-Cache-pro.patch [RHEL-52650]
  - kvm-target-i386-Update-EPYC-Milan-CPU-model-for-Cache-pr.patch [RHEL-52650]
  - kvm-target-i386-Add-couple-of-feature-bits-in-CPUID_Fn80.patch [RHEL-52650]
  - kvm-target-i386-Update-EPYC-Genoa-for-Cache-property-per.patch [RHEL-52650]
  - kvm-target-i386-Add-support-for-EPYC-Turin-model.patch [RHEL-52650]
  - kvm-include-qemu-compiler-add-QEMU_UNINITIALIZED-attribu.patch [RHEL-95479]
  - kvm-hw-virtio-virtio-avoid-cost-of-ftrivial-auto-var-ini.patch [RHEL-95479]
  - kvm-block-skip-automatic-zero-init-of-large-array-in-ioq.patch [RHEL-95479]
  - kvm-chardev-char-fd-skip-automatic-zero-init-of-large-ar.patch [RHEL-95479]
  - kvm-chardev-char-pty-skip-automatic-zero-init-of-large-a.patch [RHEL-95479]
  - kvm-chardev-char-socket-skip-automatic-zero-init-of-larg.patch [RHEL-95479]
  - kvm-hw-audio-ac97-skip-automatic-zero-init-of-large-arra.patch [RHEL-95479]
  - kvm-hw-audio-cs4231a-skip-automatic-zero-init-of-large-a.patch [RHEL-95479]
  - kvm-hw-audio-es1370-skip-automatic-zero-init-of-large-ar.patch [RHEL-95479]
  - kvm-hw-audio-gus-skip-automatic-zero-init-of-large-array.patch [RHEL-95479]
  - kvm-hw-audio-marvell_88w8618-skip-automatic-zero-init-of.patch [RHEL-95479]
  - kvm-hw-audio-sb16-skip-automatic-zero-init-of-large-arra.patch [RHEL-95479]
  - kvm-hw-audio-via-ac97-skip-automatic-zero-init-of-large-.patch [RHEL-95479]
  - kvm-hw-char-sclpconsole-lm-skip-automatic-zero-init-of-l.patch [RHEL-95479]
  - kvm-hw-dma-xlnx_csu_dma-skip-automatic-zero-init-of-larg.patch [RHEL-95479]
  - kvm-hw-display-vmware_vga-skip-automatic-zero-init-of-la.patch [RHEL-95479]
  - kvm-hw-hyperv-syndbg-skip-automatic-zero-init-of-large-a.patch [RHEL-95479]
  - kvm-hw-misc-aspeed_hace-skip-automatic-zero-init-of-larg.patch [RHEL-95479]
  - kvm-hw-net-rtl8139-skip-automatic-zero-init-of-large-arr.patch [RHEL-95479]
  - kvm-hw-net-tulip-skip-automatic-zero-init-of-large-array.patch [RHEL-95479]
  - kvm-hw-net-virtio-net-skip-automatic-zero-init-of-large-.patch [RHEL-95479]
  - kvm-hw-net-xgamc-skip-automatic-zero-init-of-large-array.patch [RHEL-95479]
  - kvm-hw-nvme-ctrl-skip-automatic-zero-init-of-large-array.patch [RHEL-95479]
  - kvm-hw-ppc-pnv_occ-skip-automatic-zero-init-of-large-str.patch [RHEL-95479]
  - kvm-hw-ppc-spapr_tpm_proxy-skip-automatic-zero-init-of-l.patch [RHEL-95479]
  - kvm-hw-usb-hcd-ohci-skip-automatic-zero-init-of-large-ar.patch [RHEL-95479]
  - kvm-hw-scsi-lsi53c895a-skip-automatic-zero-init-of-large.patch [RHEL-95479]
  - kvm-hw-scsi-megasas-skip-automatic-zero-init-of-large-ar.patch [RHEL-95479]
  - kvm-hw-ufs-lu-skip-automatic-zero-init-of-large-array.patch [RHEL-95479]
  - kvm-net-socket-skip-automatic-zero-init-of-large-array.patch [RHEL-95479]
  - kvm-net-stream-skip-automatic-zero-init-of-large-array.patch [RHEL-95479]
  - kvm-hw-i386-amd_iommu-Isolate-AMDVI-PCI-from-amd-iommu-d.patch [RHEL-85649]
  - kvm-hw-i386-amd_iommu-Allow-migration-when-explicitly-cr.patch [RHEL-85649]
  - kvm-Enable-amd-iommu-device.patch [RHEL-85649]
  - kvm-ui-vnc-Update-display-update-interval-when-VM-state-.patch [RHEL-83883]
  - Resolves: RHEL-98555
    ([s390x][RHEL10.1][ccw-device] there would be memory leak with virtio_blk disks)
  - Resolves: RHEL-52650
    ([AMDSERVER 10.1 Feature] Turin: Qemu EPYC-Turin Model)
  - Resolves: RHEL-95479
    (-ftrivial-auto-var-init=zero reduced performance)
  - Resolves: RHEL-85649
    ([RHEL 10]Qemu/amd-iommu: Add ability to manually specify the AMDVI-PCI device)
  - Resolves: RHEL-83883
    (Video stuck after switchover phase when play one video during migration)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.0.0-8
changelog:
  - kvm-migration-multifd-move-macros-to-multifd-header.patch [RHEL-59697]
  - kvm-migration-refactor-channel-discovery-mechanism.patch [RHEL-59697]
  - kvm-migration-Add-save_postcopy_prepare-savevm-handler.patch [RHEL-59697]
  - kvm-migration-ram-Implement-save_postcopy_prepare.patch [RHEL-59697]
  - kvm-tests-qtest-migration-consolidate-set-capabilities.patch [RHEL-59697]
  - kvm-migration-write-zero-pages-when-postcopy-enabled.patch [RHEL-59697]
  - kvm-migration-enable-multifd-and-postcopy-together.patch [RHEL-59697]
  - kvm-migration-Add-qtest-for-migration-over-RDMA.patch [RHEL-59697]
  - kvm-qtest-migration-rdma-Enforce-RLIMIT_MEMLOCK-128MB-re.patch [RHEL-59697]
  - kvm-qtest-migration-rdma-Add-test-for-rdma-migration-wit.patch [RHEL-59697]
  - kvm-tests-qtest-migration-add-postcopy-tests-with-multif.patch [RHEL-59697]
  - kvm-file-posix-Fix-aio-threads-performance-regression-af.patch [RHEL-96854]
  - kvm-block-remove-outdated-comments-about-AioContext-lock.patch [RHEL-88561]
  - kvm-block-move-drain-outside-of-read-locked-bdrv_reopen_.patch [RHEL-88561]
  - kvm-block-snapshot-move-drain-outside-of-read-locked-bdr.patch [RHEL-88561]
  - kvm-block-move-drain-outside-of-read-locked-bdrv_inactiv.patch [RHEL-88561]
  - kvm-block-mark-bdrv_parent_change_aio_context-GRAPH_RDLO.patch [RHEL-88561]
  - kvm-block-mark-change_aio_ctx-callback-and-instances-as-.patch [RHEL-88561]
  - kvm-block-mark-bdrv_child_change_aio_context-GRAPH_RDLOC.patch [RHEL-88561]
  - kvm-block-move-drain-outside-of-bdrv_change_aio_context-.patch [RHEL-88561]
  - kvm-block-move-drain-outside-of-bdrv_try_change_aio_cont.patch [RHEL-88561]
  - kvm-block-move-drain-outside-of-bdrv_attach_child_common.patch [RHEL-88561]
  - kvm-block-move-drain-outside-of-bdrv_set_backing_hd_drai.patch [RHEL-88561]
  - kvm-block-move-drain-outside-of-bdrv_root_attach_child.patch [RHEL-88561]
  - kvm-block-move-drain-outside-of-bdrv_attach_child.patch [RHEL-88561]
  - kvm-block-move-drain-outside-of-quorum_add_child.patch [RHEL-88561]
  - kvm-block-move-drain-outside-of-bdrv_root_unref_child.patch [RHEL-88561]
  - kvm-block-move-drain-outside-of-quorum_del_child.patch [RHEL-88561]
  - kvm-blockdev-drain-while-unlocked-in-internal_snapshot_a.patch [RHEL-88561]
  - kvm-blockdev-drain-while-unlocked-in-external_snapshot_a.patch [RHEL-88561]
  - kvm-block-mark-bdrv_drained_begin-and-friends-as-GRAPH_U.patch [RHEL-88561]
  - kvm-iotests-graph-changes-while-io-remove-image-file-aft.patch [RHEL-88561]
  - kvm-iotests-graph-changes-while-io-add-test-case-with-re.patch [RHEL-88561]
  - Resolves: RHEL-59697
    (Allow multifd+postcopy features being enabled together, but only use multifd during precopy )
  - Resolves: RHEL-96854
    (Performance Degradation(aio=threads) between Upstream Commit b75c5f9 and 984a32f)
  - Resolves: RHEL-88561
    (qemu graph deadlock during job-dismiss)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.0.0-9
changelog:
  - kvm-Declare-rtl8139-as-deprecated.patch [RHEL-45624]
  - Resolves: RHEL-45624
    (Deprecate rtl8139 NIC in QEMU)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-9
changelog:
  - kvm-monitor-generalize-query-mshv-info-mshv-to-query-acc.patch [RHEL-134212]
  - kvm-block-Improve-comments-in-BlockLimits.patch [RHEL-110003]
  - kvm-block-Expose-block-limits-for-images-in-QMP.patch [RHEL-110003]
  - kvm-qemu-img-info-Optionally-show-block-limits.patch [RHEL-110003]
  - kvm-qemu-img-info-Add-cache-mode-option.patch [RHEL-110003]
  - kvm-rh-configs-enable-CONFIG_TDX-for-x86_64.patch [RHEL-111853]
  - Resolves: RHEL-134212
    ([RHEL10.2] L1VH qemu downstream initial merge RHEL10.2)
  - Resolves: RHEL-110003
    (Expose block limits of block nodes in QMP and qemu-img)
  - Resolves: RHEL-111853
    ([Intel 10.0 FEAT] [SPR] TDX: Virt-QEMU: QEMU Support [rhel-10])


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-10
changelog:
  - kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-108142]
  - Resolves: RHEL-108142
    (QEMU crashes when stopping source VM during live migration)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-11
changelog:
  - kvm-fix-pc_rhel_10_2_compat_len.patch [RHEL-126707]
  - kvm-q35-increase-default-tseg-size.patch [RHEL-126707]
  - kvm-hw-intc-ioapic-Fix-ACCEL_KERNEL_GSI_IRQFD_POSSIBLE-t.patch [RHEL-139028]
  - kvm-redhat-allow-5-level-paging-for-TDX-VMs.patch [RHEL-111853]
  - Resolves: RHEL-126707
    ([qemu, rhel-10] increase default TSEG size)
  - Resolves: RHEL-139028
    (Intel IOMMU VM freezes: "call_irq_handler: 3.37 No irq handler for vector"[rhel-10.2])
  - Resolves: RHEL-111853
    ([Intel 10.0 FEAT] [SPR] TDX: Virt-QEMU: QEMU Support [rhel-10])


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-12
changelog:
  - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-79118]
  - kvm-curl-Fix-coroutine-waking.patch [RHEL-79118]
  - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-79118]
  - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-79118]
  - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-79118]
  - kvm-net-bundle-all-offloads-in-a-single-struct.patch [RHEL-143785]
  - kvm-linux-headers-deal-with-counted_by-annotation.patch [RHEL-143785]
  - kvm-linux-headers-Update-to-Linux-v6.17-rc1.patch [RHEL-143785]
  - kvm-virtio-introduce-extended-features-type.patch [RHEL-143785]
  - kvm-virtio-serialize-extended-features-state.patch [RHEL-143785]
  - kvm-virtio-add-support-for-negotiating-extended-features.patch [RHEL-143785]
  - kvm-virtio-pci-implement-support-for-extended-features.patch [RHEL-143785]
  - kvm-vhost-add-support-for-negotiating-extended-features.patch [RHEL-143785]
  - kvm-qmp-update-virtio-features-map-to-support-extended-f.patch [RHEL-143785]
  - kvm-vhost-backend-implement-extended-features-support.patch [RHEL-143785]
  - kvm-vhost-net-implement-extended-features-support.patch [RHEL-143785]
  - kvm-virtio-net-implement-extended-features-support.patch [RHEL-143785]
  - kvm-net-implement-tunnel-probing.patch [RHEL-143785]
  - kvm-net-implement-UDP-tunnel-features-offloading.patch [RHEL-143785]
  - Resolves: RHEL-79118
    ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled [rhel10])
  - Resolves: RHEL-143785
    (backport support for GSO over UDP tunnel offload)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-13
changelog:
  - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147425]
  - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-132749]
  - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-132749]
  - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-132749]
  - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-132749]
  - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-132749]
  - kvm-Revert-hw-arm-virt-Use-ACPI-PCI-hotplug-by-default-f.patch [RHEL-134989 RHEL-146584]
  - Resolves: RHEL-147425
    (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts)
  - Resolves: RHEL-132749
    (Migrate SCSI PR state and preempt reservation upon live migration)
  - Resolves: RHEL-134989
    (Hotplugged interface device can not be shown in the guest)
  - Resolves: RHEL-146584
    ([RHEL-10.2][ARM]: Unable to Check the mem prefetched size on Guest)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-14
changelog:
  - kvm-hw-uefi-add-variable-digest-to-vmstate.patch [RHEL-153058]
  - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-144004]
  - Resolves: RHEL-153058
    (Qemu crashes with "double free" during restore --reset-nvram with uefi-vars secure boot)
  - Resolves: RHEL-144004
    ([rhel-10] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-15
changelog:
  - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155601]
  - Resolves: RHEL-155601
    (Mirror job can miss writes during startup, corrupting the copy [rhel-10.2])


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-16
changelog:
  - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-158224]
  - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-158224]
  - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-158224]
  - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-158224]
  - Resolves: RHEL-158224
    (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-10.2])


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-16.el10_2.1
changelog:
  - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164536]
  - Resolves: RHEL-164536
    (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-10.2.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-16.el10_2.2
changelog:
  - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166007]
  - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166007]
  - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166007]
  - kvm-scsi-change-buf_size-to-unsigned-int-in-scsi_SG_IO.patch [RHEL-166033]
  - kvm-scsi-handle-reservation-changes-across-migration.patch [RHEL-166033]
  - Resolves: RHEL-166007
    (live migration failed the VM just register key only [rhel-10.2.z])
  - Resolves: RHEL-166033
    (live migration failed or get failed WSFC test result during WSFC testing [rhel-10.2.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-16.el10_2.3
changelog:
  - kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch [RHEL-184529]
  - Resolves: RHEL-184529
    (CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-10.2.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-16.el10_2.4
changelog:
  - kvm-blkdebug-Add-delay-ns-option.patch [RHEL-190702]
  - kvm-block-Add-blk_co_start-end_request-and-BDRV_REQ_NO_Q.patch [RHEL-190702]
  - kvm-block-Add-flags-parameter-to-blk_-_pdiscard.patch [RHEL-190702]
  - kvm-ide-Minimal-fix-for-deadlock-between-TRIM-and-drain.patch [RHEL-190702]
  - kvm-ide-Clean-up-ide_trim_co_entry-to-be-idiomatic-corou.patch [RHEL-190702]
  - kvm-ide-test-Factor-out-wait_dma_completion.patch [RHEL-190702]
  - kvm-ide-test-Test-reset-during-TRIM.patch [RHEL-190702]
  - kvm-spec-Install-qtests-into-qemu-kvm-tests-package.patch [RHEL-190702]
  - Resolves: RHEL-190702
    (qemu-kvm hung during drain after double pause [rhel-10.2.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-16.el10_2.5
changelog:
  - kvm-file-posix-populate-pwrite_zeroes_alignment.patch [RHEL-207389]
  - kvm-block-use-pwrite_zeroes_alignment-when-writing-first.patch [RHEL-207389]
  - kvm-iotests-add-Linux-loop-device-image-creation-test.patch [RHEL-207389]
  - Resolves: RHEL-207389
    (qemu-img create/convert fails on target block device with 4k sector size [rhel-10.2.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-7
changelog:
  - kvm-pcie_sriov-Fix-broken-MMIO-accesses-from-SR-IOV-VFs.patch [RHEL-120115]
  - kvm-arm-fix-oob-access-in-compat-handling.patch [RHEL-130478]
  - Resolves: RHEL-120115
    (The vf nic created using the IGB emulated nic can not obtain ip address )
  - Resolves: RHEL-130478
    (Migration from RHEL 10.2 to RHEL 10.1 with virt-rhel10.0.0 machine type fails on Grace)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-8
changelog:
  - kvm-block-backend-Fix-race-when-resuming-queued-requests.patch [RHEL-129540]
  - kvm-file-posix-Handle-suspended-dm-multipath-better-for-.patch [RHEL-121543]
  - kvm-accel-Add-Meson-and-config-support-for-MSHV-accelera.patch [RHEL-134212]
  - kvm-target-i386-emulate-Allow-instruction-decoding-from-.patch [RHEL-134212]
  - kvm-target-i386-mshv-Add-x86-decoder-emu-implementation.patch [RHEL-134212]
  - kvm-hw-intc-Generalize-APIC-helper-names-from-kvm_-to-ac.patch [RHEL-134212]
  - kvm-include-hw-hyperv-Add-MSHV-ABI-header-definitions.patch [RHEL-134212]
  - kvm-linux-headers-linux-Add-mshv.h-headers.patch [RHEL-134212]
  - kvm-accel-mshv-Add-accelerator-skeleton.patch [RHEL-134212]
  - kvm-accel-mshv-Register-memory-region-listeners.patch [RHEL-134212]
  - kvm-accel-mshv-Initialize-VM-partition.patch [RHEL-134212]
  - kvm-treewide-rename-qemu_wait_io_event-qemu_wait_io_even.patch [RHEL-134212]
  - kvm-accel-mshv-Add-vCPU-creation-and-execution-loop.patch [RHEL-134212]
  - kvm-accel-mshv-Add-vCPU-signal-handling.patch [RHEL-134212]
  - kvm-target-i386-mshv-Add-CPU-create-and-remove-logic.patch [RHEL-134212]
  - kvm-target-i386-mshv-Implement-mshv_store_regs.patch [RHEL-134212]
  - kvm-target-i386-mshv-Implement-mshv_get_standard_regs.patch [RHEL-134212]
  - kvm-target-i386-mshv-Implement-mshv_get_special_regs.patch [RHEL-134212]
  - kvm-target-i386-mshv-Implement-mshv_arch_put_registers.patch [RHEL-134212]
  - kvm-target-i386-mshv-Set-local-interrupt-controller-stat.patch [RHEL-134212]
  - kvm-target-i386-mshv-Register-CPUID-entries-with-MSHV.patch [RHEL-134212]
  - kvm-target-i386-mshv-Register-MSRs-with-MSHV.patch [RHEL-134212]
  - kvm-target-i386-mshv-Integrate-x86-instruction-decoder-e.patch [RHEL-134212]
  - kvm-target-i386-mshv-Write-MSRs-to-the-hypervisor.patch [RHEL-134212]
  - kvm-target-i386-mshv-Implement-mshv_vcpu_run.patch [RHEL-134212]
  - kvm-accel-mshv-Handle-overlapping-mem-mappings.patch [RHEL-134212]
  - kvm-qapi-accel-Allow-to-query-mshv-capabilities.patch [RHEL-134212]
  - kvm-target-i386-mshv-Use-preallocated-page-for-hvcall.patch [RHEL-134212]
  - kvm-docs-Add-mshv-to-documentation.patch [RHEL-134212]
  - kvm-MAINTAINERS-Add-maintainers-for-mshv-accelerator.patch [RHEL-134212]
  - kvm-accel-mshv-initialize-thread-name.patch [RHEL-134212]
  - kvm-accel-mshv-use-return-value-of-handle_pio_str_read.patch [RHEL-134212]
  - Resolves: RHEL-129540
    (Assertion failure on drain with iothread and I/O load)
  - Resolves: RHEL-121543
    (The VM hit io error when do S3-PR integration on the pass-through  failover multipath device)
  - Resolves: RHEL-134212
    ([RHEL10.2] L1VH qemu downstream initial merge RHEL10.2)


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-6
changelog:
  - kvm-vfio-container-Fix-container-object-destruction.patch [RHEL-67936]
  - kvm-virtio-net-disable-USO-for-RHEL9.patch [RHEL-40950]
  - kvm-qemu-guest-agent-add-new-api-to-allow-rpc.patch [RHEL-60223]
  - Resolves: RHEL-67936
    (QEMU should fail gracefully with passthrough devices in SEV-SNP guests)
  - Resolves: RHEL-40950
    ([Stable_Guest_ABI][USO]From 10-beta to RHEL.9.5.0  the guest with 9.4 machine type only, the guest crashed  with - qemu-kvm: Features 0x1c0010130afffa7 unsupported. Allowed features: 0x10179bfffe7 )
  - Resolves: RHEL-60223
    ([qemu-guest-agent] Add new api 'guest-network-get-route' to allow-rpc)


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-7
changelog:
  - kvm-virtio-net-Add-queues-before-loading-them.patch [RHEL-58316]
  - kvm-docs-system-s390x-bootdevices-Update-loadparm-docume.patch [RHEL-68444]
  - kvm-docs-system-bootindex-Make-it-clear-that-s390x-can-a.patch [RHEL-68444]
  - kvm-hw-s390x-Restrict-loadparm-property-to-devices-that-.patch [RHEL-68444]
  - kvm-hw-Add-loadparm-property-to-scsi-disk-devices-for-bo.patch [RHEL-68444]
  - kvm-scsi-fix-allocation-for-s390x-loadparm.patch [RHEL-68444]
  - kvm-pc-bios-s390x-Initialize-cdrom-type-to-false-for-eac.patch [RHEL-68444]
  - kvm-pc-bios-s390x-Initialize-machine-loadparm-before-pro.patch [RHEL-68444]
  - kvm-pc-bios-s390-ccw-Re-initialize-receive-queue-index-b.patch [RHEL-68444]
  - Resolves: RHEL-58316
    (qemu crashed when migrate vm with multiqueue from rhel9.4 to rhel10.0)
  - Resolves: RHEL-68444
    (The new "boot order" feature is sometimes not working as expected [RHEL 10])


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-8
changelog:
  - kvm-migration-Allow-pipes-to-keep-working-for-fd-migrati.patch [RHEL-69047]
  - Resolves: RHEL-69047
    (warning: fd: migration to a file is deprecated when create or revert a snapshot)


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-9
changelog:
  - kvm-linux-headers-Update-to-Linux-v6.12-rc5.patch [RHEL-32665]
  - kvm-s390x-cpumodel-add-msa10-subfunctions.patch [RHEL-32665]
  - kvm-s390x-cpumodel-add-msa11-subfunctions.patch [RHEL-32665]
  - kvm-s390x-cpumodel-add-msa12-changes.patch [RHEL-32665]
  - kvm-s390x-cpumodel-add-msa13-subfunctions.patch [RHEL-32665]
  - kvm-s390x-cpumodel-Add-ptff-Query-Time-Stamp-Event-QTSE-.patch [RHEL-32665]
  - kvm-linux-headers-Update-to-Linux-6.13-rc1.patch [RHEL-32665]
  - kvm-s390x-cpumodel-add-Concurrent-functions-facility-sup.patch [RHEL-32665]
  - kvm-s390x-cpumodel-add-Vector-Enhancements-facility-3.patch [RHEL-32665]
  - kvm-s390x-cpumodel-add-Miscellaneous-Instruction-Extensi.patch [RHEL-32665]
  - kvm-s390x-cpumodel-add-Vector-Packed-Decimal-Enhancement.patch [RHEL-32665]
  - kvm-s390x-cpumodel-add-Ineffective-nonconstrained-transa.patch [RHEL-32665]
  - kvm-s390x-cpumodel-Add-Sequential-Instruction-Fetching-f.patch [RHEL-32665]
  - kvm-s390x-cpumodel-correct-PLO-feature-wording.patch [RHEL-32665]
  - kvm-s390x-cpumodel-Add-PLO-extension-facility.patch [RHEL-32665]
  - kvm-s390x-cpumodel-gen17-model.patch [RHEL-32665]
  - kvm-qga-skip-bind-mounts-in-fs-list.patch [RHEL-71939]
  - kvm-hw-char-pl011-Use-correct-masks-for-IBRD-and-FBRD.patch [RHEL-67108]
  - Resolves: RHEL-32665
    ([IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part)
  - Resolves: RHEL-71939
    (qemu-ga cannot freeze filesystems with sentinelone)
  - Resolves: RHEL-67108
    ([aarch64] [rhel-10.0] Backport some important post 9.1 qemu fixes)


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-10
changelog:
  - kvm-qdev-Fix-set_pci_devfn-to-visit-option-only-once.patch [RHEL-43412]
  - kvm-tests-avocado-hotplug_blk-Fix-addr-in-device_add-com.patch [RHEL-43412]
  - kvm-qdev-monitor-avoid-QemuOpts-in-QMP-device_add.patch [RHEL-43412]
  - kvm-vl-use-qmp_device_add-in-qemu_create_cli_devices.patch [RHEL-43412]
  - kvm-pc-q35-Bump-max_cpus-to-4096-vcpus.patch [RHEL-57668]
  - kvm-vhost-fail-device-start-if-iotlb-update-fails.patch [RHEL-73005]
  - kvm-virtio-net-disable-USO-for-all-RHEL9.patch [RHEL-69500]
  - Resolves: RHEL-43412
    (qom-get iothread-vq-mapping is empty on new hotplug disk [rhel-10.0-beta])
  - Resolves: RHEL-57668
    ([RFE] [HPEMC] [RHEL-10.0] qemu-kvm: support up to 4096 VCPUs)
  - Resolves: RHEL-73005
    (qemu-kvm: vhost: reports error while updating IOTLB entries)
  - Resolves: RHEL-69500
    ([Stable_Guest_ABI][USO][9.6.0-machine-type]From 10.0 to RHEL.9.6.0 the guest with 9.6 machine type only, the guest crashed with - qemu-kvm: Features 0x1c0010130afffa7 unsupported. Allowed features: 0x10179bfffe7)


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-11
changelog:
  - kvm-target-i386-Make-sure-SynIC-state-is-really-updated-.patch [RHEL-73002]
  - kvm-hw-virtio-fix-crash-in-processing-balloon-stats.patch [RHEL-73835]
  - kvm-qga-Add-log-to-guest-fsfreeze-thaw-command.patch [RHEL-74361]
  - kvm-qemu-ga-Optimize-freeze-hook-script-logic-of-logging.patch [RHEL-74461]
  - Resolves: RHEL-73002
    (kvm-unti kvm-hyperv_synic test is stuck on AMD with COS9 [rhel-10])
  - Resolves: RHEL-73835
    (VM crashes when requesting domstats [rhel-10])
  - Resolves: RHEL-74361
    (qemu-ga logs only "guest-fsfreeze called" (but not "guest-fsthaw called"))
  - Resolves: RHEL-74461
    (fsfreeze hooks doesn't log error on system logs when running hook fails [rhel-10])


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-12
changelog:
  - kvm-pci-ensure-valid-link-status-bits-for-downstream-por.patch [RHEL-65618]
  - kvm-pc-bios-s390-ccw-Abort-IPL-on-invalid-loadparm.patch [RHEL-72717]
  - kvm-pc-bios-s390-ccw-virtio-Add-a-function-to-reset-a-vi.patch [RHEL-72717]
  - kvm-pc-bios-s390-ccw-Fix-boot-problem-with-virtio-net-de.patch [RHEL-72717]
  - kvm-pc-bios-s390-ccw-netmain-Fix-error-messages-with-reg.patch [RHEL-72717]
  - kvm-arm-disable-pauth-for-virt-rhel9-in-RHEL10.patch [RHEL-71761]
  - Resolves: RHEL-65618
    ([RHEL10] Failed to hot add PCIe device behind xio3130 downstream)
  - Resolves: RHEL-72717
    (Boot fall back to cdrom from network not always working)
  - Resolves: RHEL-71761
    ([Nvidia "Grace"] Lack of "PAuth" CPU feature results in live migration failure from RHEL 9.6 to 10)


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-13
changelog:
  - kvm-nbd-server-Silence-server-warnings-on-port-probes.patch [RHEL-76908]
  - Resolves: RHEL-76908
    (Ensure qemu as NBD server does not flood logs [rhel-10])


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-14
changelog:
  - kvm-net-Fix-announce_self.patch [RHEL-73894]
  - kvm-vhost-Add-stubs-for-the-migration-state-transfer-int.patch [RHEL-78370]
  - kvm-virtio-net-vhost-user-Implement-internal-migration.patch [RHEL-78370]
  - Resolves: RHEL-73894
    (No RARP packets on the destination after migration [rhel-10])
  - Resolves: RHEL-78370
    (Add vhost-user internal migration for passt)


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-15
changelog:
  - kvm-migration-Add-helper-to-get-target-runstate.patch [RHEL-54670]
  - kvm-qmp-cont-Only-activate-disks-if-migration-completed.patch [RHEL-54670]
  - kvm-migration-block-Make-late-block-active-the-default.patch [RHEL-54670]
  - kvm-migration-block-Apply-late-block-active-behavior-to-.patch [RHEL-54670]
  - kvm-migration-block-Fix-possible-race-with-block_inactiv.patch [RHEL-54670]
  - kvm-migration-block-Rewrite-disk-activation.patch [RHEL-54670]
  - kvm-block-Add-active-field-to-BlockDeviceInfo.patch [RHEL-54670]
  - kvm-block-Allow-inactivating-already-inactive-nodes.patch [RHEL-54670]
  - kvm-block-Inactivate-external-snapshot-overlays-when-nec.patch [RHEL-54670]
  - kvm-migration-block-active-Remove-global-active-flag.patch [RHEL-54670]
  - kvm-block-Don-t-attach-inactive-child-to-active-node.patch [RHEL-54670]
  - kvm-block-Fix-crash-on-block_resize-on-inactive-node.patch [RHEL-54670]
  - kvm-block-Add-option-to-create-inactive-nodes.patch [RHEL-54670]
  - kvm-block-Add-blockdev-set-active-QMP-command.patch [RHEL-54670]
  - kvm-block-Support-inactive-nodes-in-blk_insert_bs.patch [RHEL-54670]
  - kvm-block-export-Don-t-ignore-image-activation-error-in-.patch [RHEL-54670]
  - kvm-block-Drain-nodes-before-inactivating-them.patch [RHEL-54670]
  - kvm-block-export-Add-option-to-allow-export-of-inactive-.patch [RHEL-54670]
  - kvm-nbd-server-Support-inactive-nodes.patch [RHEL-54670]
  - kvm-iotests-Add-filter_qtest.patch [RHEL-54670]
  - kvm-iotests-Add-qsd-migrate-case.patch [RHEL-54670]
  - kvm-iotests-Add-NBD-based-tests-for-inactive-nodes.patch [RHEL-54670]
  - Resolves: RHEL-54670
    (Provide QMP command for block device reactivation after migration [rhel-10.0])


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-15.1
changelog:
  - kvm-net-vhost-user-add-QAPI-events-to-report-connection-.patch [RHEL-80622]
  - Resolves: RHEL-80622
    (Allow libvirt to restart passt/vhost-user when the process is killed


author: Alan Steinberg <alan.steinberg> - 9.1.0-15.2
changelog:
  - kvm-hw-i386-Fix-machine-type-compatibility.patch [RHEL-92430]
  - Resolves: RHEL-92430
    (Fix x86 M-type compats [rhel-10.0.z])


author: Kevin Lyons <kevin.x.lyons> - 9.1.0-15.3
changelog:
  - kvm-ui-vnc-Update-display-update-interval-when-VM-state-.patch [RHEL-100765]
  - kvm-include-qemu-compiler-add-QEMU_UNINITIALIZED-attribu.patch [RHEL-99889]
  - kvm-hw-virtio-virtio-avoid-cost-of-ftrivial-auto-var-ini.patch [RHEL-99889]
  - kvm-block-skip-automatic-zero-init-of-large-array-in-ioq.patch [RHEL-99889]
  - kvm-chardev-char-fd-skip-automatic-zero-init-of-large-ar.patch [RHEL-99889]
  - kvm-chardev-char-pty-skip-automatic-zero-init-of-large-a.patch [RHEL-99889]
  - kvm-chardev-char-socket-skip-automatic-zero-init-of-larg.patch [RHEL-99889]
  - kvm-hw-audio-ac97-skip-automatic-zero-init-of-large-arra.patch [RHEL-99889]
  - kvm-hw-audio-cs4231a-skip-automatic-zero-init-of-large-a.patch [RHEL-99889]
  - kvm-hw-audio-es1370-skip-automatic-zero-init-of-large-ar.patch [RHEL-99889]
  - kvm-hw-audio-gus-skip-automatic-zero-init-of-large-array.patch [RHEL-99889]
  - kvm-hw-audio-marvell_88w8618-skip-automatic-zero-init-of.patch [RHEL-99889]
  - kvm-hw-audio-sb16-skip-automatic-zero-init-of-large-arra.patch [RHEL-99889]
  - kvm-hw-audio-via-ac97-skip-automatic-zero-init-of-large-.patch [RHEL-99889]
  - kvm-hw-char-sclpconsole-lm-skip-automatic-zero-init-of-l.patch [RHEL-99889]
  - kvm-hw-dma-xlnx_csu_dma-skip-automatic-zero-init-of-larg.patch [RHEL-99889]
  - kvm-hw-display-vmware_vga-skip-automatic-zero-init-of-la.patch [RHEL-99889]
  - kvm-hw-hyperv-syndbg-skip-automatic-zero-init-of-large-a.patch [RHEL-99889]
  - kvm-hw-misc-aspeed_hace-skip-automatic-zero-init-of-larg.patch [RHEL-99889]
  - kvm-hw-net-rtl8139-skip-automatic-zero-init-of-large-arr.patch [RHEL-99889]
  - kvm-hw-net-tulip-skip-automatic-zero-init-of-large-array.patch [RHEL-99889]
  - kvm-hw-net-virtio-net-skip-automatic-zero-init-of-large-.patch [RHEL-99889]
  - kvm-hw-net-xgamc-skip-automatic-zero-init-of-large-array.patch [RHEL-99889]
  - kvm-hw-nvme-ctrl-skip-automatic-zero-init-of-large-array.patch [RHEL-99889]
  - kvm-hw-ppc-spapr_tpm_proxy-skip-automatic-zero-init-of-l.patch [RHEL-99889]
  - kvm-hw-usb-hcd-ohci-skip-automatic-zero-init-of-large-ar.patch [RHEL-99889]
  - kvm-hw-scsi-lsi53c895a-skip-automatic-zero-init-of-large.patch [RHEL-99889]
  - kvm-hw-scsi-megasas-skip-automatic-zero-init-of-large-ar.patch [RHEL-99889]
  - kvm-hw-ufs-lu-skip-automatic-zero-init-of-large-array.patch [RHEL-99889]
  - kvm-net-socket-skip-automatic-zero-init-of-large-array.patch [RHEL-99889]
  - kvm-net-stream-skip-automatic-zero-init-of-large-array.patch [RHEL-99889]
  - Resolves: RHEL-100765
    (Video stuck after switchover phase when play one video during migration [rhel-10.0.z])
  - Resolves: RHEL-99889
    (-ftrivial-auto-var-init=zero reduced performance [rhel-10.0.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-15.el10_0.1
changelog:
  - kvm-net-vhost-user-add-QAPI-events-to-report-connection-.patch [RHEL-80522]
  - Resolves: RHEL-80522
    (Allow libvirt to restart passt/vhost-user when the process is killed)


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-15.el10_0.4
changelog:
  - kvm-rbd-Fix-.bdrv_get_specific_info-implementation.patch [RHEL-108727]
  - Resolves: RHEL-108727
    (Openstack guest becomes inaccessible via network when storage network on the hypervisor is disabled/lost [rhel-10.0.z])


author: Jan Grulich <jgrulich@redhat.com> - 6.8.1-7
changelog:
  - Sync with Fedora:
    - fix directory ownership
    - install cmake modules for plugins
    - depend on pkgconfig(egl) rather than mesa-libEGL-devel
    Resolves: RHEL-73681


author: Jan Grulich <jgrulich@redhat.com> - 6.10.1-1
changelog:
  - 6.10.1
    Resolves: RHEL-109197
  - QSsl: add support for ML-DSA signature algorithm
    Resolves: RHEL-97008


author: Jan Grulich <jgrulich@redhat.com> - 6.8.1-2
changelog:
  - Make -devel subpkg to require qtbase-private-devel for cmake >= 3.31.0
    Workaround for rhbz#2330219
    Resolves: RHEL-53982


author: Jan Grulich <jgrulich@redhat.com> - 6.10.1-1
changelog:
  - 6.10.1
    Resolves: RHEL-109197
  - Fix CVE-2025-11277 in bundled assimp library
    Resolves: RHEL-120979


author: RHEL Packaging Agent <jotnar@redhat.com> - 6.9.1-2.2
changelog:
  - Fix CVE-2025-10728: Replace quadratic cycle check with linear recursion
    guard to prevent stack overflow
    Resolves: RHEL-119719


author: Lukáš Zaoral <lzaoral@redhat.com> - 2.7-10
changelog:
  - skip btrfs subvolumes when detecting ESP partitions
  - fix booting on UEFI systems with multiple CDROM devices
  - fix copying of console kernel cmdline parameters
  - Use git to apply patches in %prep
  - Sync with patches in CentOS Stream 9 (kudos to @pcahyna!):
    - Backport PR 3250 to fix useless warning that libsystemd-core requires
      additional libraries and ReaR recovery system needs additional libraries
    - Backport PR 3242 to fix IPv6 address in nfs:// and sshfs://
      BACKUP/OUTPUT_URL
  - fix backup of btrfs subvolumes


author: Pavel Cahyna <pcahyna@redhat.com> - 2.7-11
changelog:
  - Generate /etc/rear/os.conf during build again, it is better than generating it
    in %post, but do not mark it as config file to allow it to be updated during
    package upgrade and avoid containing an old OS version information


author: Pavel Cahyna <pcahyna@redhat.com> - 2.7-12
changelog:
  - Remove doc/rear-release-notes.txt, it is CC-BY-ND-3.0, which is not an allowed
    license for documentation, and use a cleaned tarball (with the file removed)
    for build


author: Lukáš Zaoral <lzaoral@redhat.com> - 2.9-1
changelog:
  - rebase to version 2.9 (rhbz#2343296)
  - drop upstreamed patches
  - remove obsolete patch for rhbz2119501
    - ReaR 2.7 and newer do not copy dangling symlinks in /lib/modules/*/
  - remove broken patch for rhbz1492177 (VERBOSE is a read-only var, so the script silently failed)
    - install correct packages using proper RPM dependencies instead
  - rebase remaining patches


author: Lukáš Zaoral <lzaoral@redhat.com> - 2.9-3
changelog:
  - add dependency on grub2-tools-extra on EFI machines (RHEL-85421)
  - add initial support for aarch64 machines with UEFI (RHEL-84286)
  - enhance the 300_map_disks.sh script to also print the disk sizes (RHEL-106771)
  - support generation of ed25519 SSH host keys in the rescue image (RHEL-106770)
  - fix recovery of LUKS encrypted systems with multiple keyslots (RHEL-106762)
  - fix PPC PReP Boot detection on GPT layouts (RHEL-82098)
  - skip longhorn iscsi devices in disklayout.conf (RHEL-106561)
  - restore the pre-2.8 OUTPUT=IPL behaviour (RHEL-102563)


author: Lukáš Zaoral <lzaoral@redhat.com> - 2.9-5
changelog:
  - fix support for PowerNV machines without PPC PReP partitions (RHEL-134218)
  - fix duplicate execution of automated recovery (RHEL-110659)
  - fix sorting of stage scripts (RHEL-132181)
  - add support for dbus-broker (RHEL-134213)


author: Akira TAGOH <tagoh@redhat.com> - 4.0.3-5
changelog:
  - Split packages for variable fonts.
  - Drop unnecessary/duplicate fonts from packages.
  - Worked around broken family name in variable fonts.


author: Akira TAGOH <tagoh@redhat.com> - 4.0.3-8
changelog:
  - Use no VF in family name version of ttf for -vf packages.
  - Adjust properties in VF to avoid confusion.


author: Akira TAGOH <tagoh@redhat.com> - 4.0.3-11
changelog:
  - Add a provide line of font(redhatdisplayvf), font(redhattextvf),
    and font(redhatmonovf) to each sub-packages for backward compatibility.
  - Fix invalid License field.


author: Akira TAGOH <tagoh@redhat.com> - 4.0.3-14
changelog:
  - Remove Italic variable fonts to workaround a crash issue
    and unexpected italic rendering.
    Resolves: RHEL-69430


author: Tomas Popela <tpopela@redhat,com> - 0.1-4
changelog:
  - Migrate to the new flatpak preinstall config format
  - Add collection id to rhel registry config file and reference it from
    preinstall config files
  - Use org.mozilla.Firefox (and not firefox) which is in RHEL


author: Tulio Magno Quites Machado Filho <tuliom@redhat.com> - 284-1
changelog:
  - Use --config=xxx for clang configs instead of two separate arguments to work
    around a bug in meson
  - Add clang link config file


author: Michal Domonkos <mdomonko@redhat.com> - 290-1
changelog:
  - Use upstream versions of find-provides/requires (RHEL-39760)
  - brp-mangle-shebangs: Strip env flags when mangling shebangs (RHEL-84703)


author: Milan Crha <mcrha@redhat.com> - 0.9.1-11.1
changelog:
  - Add patch for CVE-2026-16615 (Weak random number generation in PKCE implementation)
    Resolves: RHEL-213749


author: Rich Megginson <rmeggins@redhat.com> - 1.106.1-0.1
changelog:
  - Resolves: RHEL-103887 : postfix - fix: configure postfix to listen only to IPv4 if IPv6 is disabled
  - Resolves: RHEL-103573 : selinux - fix: tempdir path not defined in check mode; __selinux_item.path may be undefined
  - ha_cluster - ansible 2.19 support
  - bootloader - fix wording in README


author: Rich Megginson <rmeggins@redhat.com> - 1.107.0-0.1
changelog:
  - Resolves: RHEL-105093 : podman - specifying multiple users causes resources to be associated with wrong user
  - Resolves: RHEL-95757 : storage - Improve error reporting when invalid or unsupported RAID configuration is given
  - Resolves: RHEL-95729 : storage - [RHEL10] Incorrect key file in crypttab entry for volume encrypted_vol
  - refactor ha_cluster to have empty __init__.py in module_utils for ansible-test
  - fix tests in postfix, selinux


author: Rich Megginson <rmeggins@redhat.com> - 1.108.1-0.1
changelog:
  - Resolves: RHEL-107013 : bootloader - fix: boolean values and null values are not allowed
  - Resolves: RHEL-95719 : storage - Tests verification fails on encrypted LVM on top of MD RAID
  - Resolves: RHEL-106261 : sudo - redhat.rhel_system_roles.sudo takes 6-7 hours to scan /etc/sudoers.d
  - fix storage role tests related to encrypted LVM on top of MD RAID and el7 raid errors
  - fix postfix role tests related to rebooting
  - fix ha_cluster role tests related to missing fence agent
  - add firewall test debugging for interface tests


author: Rich Megginson <rmeggins@redhat.com> - 1.108.3-0.1
changelog:
  - Resolves: RHEL-107013 : bootloader - fix: boolean values and null values are not allowed
  - add bootloader test for this fix


author: Rich Megginson <rmeggins@redhat.com> - 1.108.4-0.1
changelog:
  - Resolves: RHEL-107013 : bootloader - fix: boolean values and null values are not allowed
  - no actual code changes, test fixes for bootloader, ha_cluster, kdump, tlog


author: Rich Megginson <rmeggins@redhat.com> - 1.108.5-0.1
changelog:
  - Resolves: RHEL-107013 : bootloader - fix: boolean values and null values are not allowed
  - This fixes tests in certificate, ha_cluster, kdump, selinux


author: Rich Megginson <rmeggins@redhat.com> - 1.108.6-0.1
changelog:
  - Resolves: RHEL-107013 : bootloader - fix: boolean values and null values are not allowed
  - This fixes ha_cluster tests


author: Akshata Konala <akshata.konala@oracle.com> - 1.108.6-0.1.0.1
changelog:
  - Replace bug reporting url [Orabug: 34202300]
  - Replace upstream references from description tag [OLDIS-1810]
  - Replace upstream URLs from galaxy_transform.py command in spec file
  - Remove comments which confuse ruamel
  - Replace upstream reference of Ansible Collection in spec file [Orabug: 32904501]


author: Rich Megginson <rmeggins@redhat.com> - 1.118.0-0.1
changelog:
  - Resolves: RHEL-122052 : Templates in some role license files
  - Resolves: RHEL-120413 : ha_cluster - ha_cluster role does not work in container builds
  - Resolves: RHEL-136607 : metrics - [RFE] configure TLS certificates in grafana using the metrics system role
  - Resolves: RHEL-138277 : ssh - feat: Add new configuration option VersionAddendum
  - Resolves: RHEL-144495 : sshd - feat: New OpenSSH configuration option GSSAPIDelegateCredentials
  - Resolves: RHEL-137261 : storage - in _get_device_id IndexError: list index out of range
  - All roles support INJECT_FACTS_AS_VARS=false
  - metrics - test: do not restore service if final state not-found
  - sshd - feat: Add systemd ephemeral authorized_keys to the instantiated service file on Fedora
  - storage - fix: add vdo package for Fedora OSTree


author: Rich Megginson <rmeggins@redhat.com> - 1.118.0-0.2
changelog:
  - Resolves: RHEL-122052 : Templates in some role license files
  - Fix ansible-test issue with community.general.ini_file module 11.4.4 in documentation string


author: Rich Megginson <rmeggins@redhat.com> - 1.119.0-0.1
changelog:
  - Resolves: RHEL-144914 : postgresql - add PostgreSQL 18
  - fix upstream shellcheck issue in nbde_client role


author: Rich Megginson <rmeggins@redhat.com> - 1.119.1-0.0.1
changelog:
  - Resolves: RHEL-144914 : postgresql - add PostgreSQL 18 - fixes test issue
  - Resolves: RHEL-135522 : snapshot - Snapshot role ignores snapshot_lvm_bootable: true setting when creating a snapset
  - Resolves: RHEL-123523 : storage -  ZeroDivisionError when creating LVM volume without size specification


author: Rich Megginson <rmeggins@redhat.com> - 1.120.1-0.1
changelog:
  - Resolves: RHEL-145214 : selinux - Missing proto 'sctp' and 'dccp'
  - Resolves: RHEL-145219 : vpn - [ERROR]: Task failed: object of type 'dict' has no attribute '1.1.1.1'


author: Rich Megginson <rmeggins@redhat.com> - 1.120.2-0.1
changelog:
  - Resolves: RHEL-145214 : selinux - Missing proto 'sctp' and 'dccp'
  - timesync - fix: use ansible_facts timesync_ntp_provider_current


author: Rich Megginson <rmeggins@redhat.com> - 1.120.3-0.1
changelog:
  - Resolves: RHEL-150780 : firewall - fix: el7 interface functionality requires NetworkManager
  - Resolves: RHEL-145247 : selinux - [v 1.10.4] Prepare module installation -> "Template error: object of type 'dict' has no attribute 'path'"
  - ha_cluster - fix: ostree - add dnf/dnf5 package, add firewall packages
  - metrics - test: ostree - add package pcp-pmda-apache, role certificate
  - systemd - test: ostree requires cronie package for testing


author: Rich Megginson <rmeggins@redhat.com> - 1.120.4-0.1
changelog:
  - Resolves: RHEL-150780 : firewall - fix: el7 interface functionality requires NetworkManager
  - firewall - test: ensure interface chosen is managed by NetworkManager


author: Rich Megginson <rmeggins@redhat.com> - 1.92.1-0.1
changelog:
  - Resolves: RHEL-45303 : ha_cluster - rhel_system_roles.ha_cluster - adapt the role for pcs-0.12
  - Resolves: RHEL-70571 : systemd - fix: Always become user we are managing [rhel-10]


author: Rich Megginson <rmeggins@redhat.com> - 1.93.0-0.1
changelog:
  - Resolves: RHEL-70700 : storage - Could not find luks2 key size in verify-pool-member-encryption.yml
  - also resolves some test failures in cockpit


author: Rich Megginson <rmeggins@redhat.com> - 1.94.1-0.1
changelog:
  - Resolves: RHEL-67411 : aide - New role aide to manage system integrity checking [rhel-10]
  - this adds cron support for aide
  - Resolves: RHEL-73442 : network - fix: Prioritize find link info by permanent MAC address, with fallback to current address [rhel-10]
  - Resolves: RHEL-73443 : podman - fix: get user information for secrets [rhel-10]
  - Resolves: RHEL-73441 : sshd - fix: use quote with command, shell and validate with variable [rhel-10]
  - Resolves: RHEL-73440 : sshd - fix: rename var sshd -> sshd_config and deprecate the former [rhel-10]
  - Resolves: RHEL-73439 : sshd - fix: Reload the service when needed [rhel-10]


author: Rich Megginson <rmeggins@redhat.com> - 1.94.1-0.2
changelog:
  - Resolves: RHEL-67411 New role aide to manage system integrity checking
  - not really related to aide - new community.general collection rhsm_repository.py
  - module now has line lengths > 164 which causes ansible-lint errors due to vendoring
  - fixed - skip pep8 checking


author: Rich Megginson <rmeggins@redhat.com> - 1.94.2-0.1
changelog:
  - Resolves: RHEL-76504 : storage - Ansible storage role 'grow_to_fill' option on LVM pools always failing with LVM resize failure due to miscalculation of free extents. [rhel-10]
  - also includes updates for el10 for ha_cluster and rhc
  - new community.general 10.3.0


author: Rich Megginson <rmeggins@redhat.com> - 1.95.3-0.1
changelog:
  - Resolves: RHEL-67411 : aide - New role aide to manage system integrity checking
  - fixes aide ostree support
  - fixes storage role ostree support
  - fixes cockpit tests_packages_full
  - fixes kdump tests_ssh_wrapper
  - fix crash in selinux.py module on el7


author: Rich Megginson <rmeggins@redhat.com> - 1.95.4-0.1
changelog:
  - Resolves: RHEL-67411 : aide - New role aide to manage system integrity checking
  - fixes an issue with parameter name
  - fixes an issue with changed reporting true when nothing has changed


author: Rich Megginson <rmeggins@redhat.com> - 1.95.5-0.1
changelog:
  - Resolves: RHEL-67411 : aide - New role aide to manage system integrity checking
  - fixes issue with certificate tests_basic_ipa.yml


author: Rich Megginson <rmeggins@redhat.com> - 1.95.7-0.1
changelog:
  - Resolves: RHEL-82525 : rhc - rhc: does not enable content in EL10 systems [rhel-10]
  - plus an upgrade to rhc role to fix a testing issue
  - Resolves: RHEL-82526 : storage - "Make sure required packages are installed' task fails because Blivet requires the kmod-kvdo package, which is no longer available on RHEL-10 [rhel-10]


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-3
changelog:
  - Fix potential use of uninitialized pipe array (RHEL-54012)
  - Fix potential use of uninitialized pgp struct (RHEL-54013)
  - Fix memory leak in rpmsign(8) (RHEL-37564)


author: Panu Matilainen <pmatilai@redhat.com> - 4.19.1.1-4
changelog:
  - Remove hardcoded GPG references from signing error messages
  - Support switching between GnuPG and Sequoia for package signing (RHEL-56363)


author: Panu Matilainen <pmatilai@redhat.com> - 4.19.1.1-9
changelog:
  - Revert the gnupg/sequoia sub-packages, too much headache
  - Ship sequoia-signing enablement macros as documentation instead
  - Generate binary signatures with Sequoia too


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-10
changelog:
  - Report unsafe symlinks during installation as a specific case (RHEL-73186)
  - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-54386)
  - Rebuild for ima-evm-utils 1.6 soname bump (RHEL-65378)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-11
changelog:
  - Fix possible package corruption on --delsign/resign/addsign (RHEL-69518)
  - Fix regression on build-id generation from compressed ELF (RHEL-54000)
  - Fix root relocation regression (RHEL-56613)
  - Update sequoia macros for sq 1.0 (RHEL-56363)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-13
changelog:
  - Make %_passwd_path and %_group_path into lists (RHEL-78693)
  - Fix memory leak in rpmspec --shell (RHEL-55284)
  - Fix memory leak in rpmsign (RHEL-82284)
  - Fix command references in rpmsign(8) man page (RHEL-73173)
  - Fix exit code regression on update failure (RHEL-87384)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-14
changelog:
  - Store configurable digest(s) on packages in rpmdb (RHEL-84062)
  - Fix command references in rpmsign(8) man page, take II (RHEL-73173)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-15
changelog:
  - Add support for spec local file attributes and generators (RHEL-84057)
  - Ensure binary and source headers are identified as such (RHEL-87383)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-18
changelog:
  - Add support for multiple OpenPGP signatures per package (RHEL-100571)
  - Add support for OpenPGP v6 signature pre-salting (RHEL-100571)
  - Add support for PQC algorithms from RFC-9580 (RHEL-100571)
  - Add --list and --erase commands to rpmkeys(8) (RHEL-105421)
  - Fix regression on dynamic subpackage RPMTAG_SOURCERPM missing (RHEL-102023)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-21
changelog:
  - Fix pre/post/meta/etc. qualifiers for weak dependencies (RHEL-101936)
  - Fix redundant rpmdb-migrate.service runs (RHEL-96510)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-22
changelog:
  - Ignore signatures made by unknown or disabled algorithms (RHEL-112394)
  - Enable NSS-based user and group lookups again (RHEL-118365)
  - Fix ignored password field if empty in passwd/group file (RHEL-118365)


author: Joseph Marrero Corchado <jmarrero@redhat.com> - 2025.6-4
changelog:
  - backport: https://github.com/coreos/rpm-ostree/pull/5322
    https://github.com/coreos/rpm-ostree/pull/5339 which pairs with the
    previous backport: https://github.com/coreos/rpm-ostree/pull/5341


author: EL Errata <el-errata_ww@oracle.com> - 9.6-9.0.1
changelog:
  - Replaced bugzilla.oracle.com references [Orabug: 34202300]
  - Replace bugzilla.oracle.com references [Orabug: 34202300]
  - Added oracle-bugzilla.patch to replace bugzilla url


author: Michal Ruprich <mruprich@redhat.com> - 3.4.1-1
changelog:
  - New version 3.4.1
  - Resolves: RHEL-70151 - Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling
  - Resolves: RHEL-70159 - Info Leak via Uninitialized Stack Contents
  - Resolves: RHEL-70203 - rsync server leaks arbitrary client files
  - Resolves: RHEL-72500 - Path traversal vulnerability in rsync
  - Resolves: RHEL-72501 - --safe-links option bypass leads to path traversal
  - Resolves: RHEL-71658 - Race Condition in rsync Handling Symbolic Links
  - Resolves: RHEL-71293 - Build rsync with --with-rrsync


author: Michal Ruprich <mruprich@redhat.com> - 3.4.4-1
changelog:
  - Resolves: RHEL-181630 - Rebase rsync to version 3.4.4
  - Resolves: RHEL-174929 - TOCTOU symlink race condition (CVE-2026-29518)
  - Resolves: RHEL-174949 - Memory disclosure via int overflow (CVE-2026-43618)


author: Attila Lakatos <alakatos@redhat.com> - 8.2408.0-1
changelog:
  - Rebase to 8.2408.0
  - Remove dependency on libgcrypt
  - Introduce new ossl crypto provider, replacement for gcry
    Resolves: RHEL-22023


author: Attila Lakatos <alakatos@redhat.com> - 8.2412.0-1
changelog:
  - Rebase to 8.2412.0
    Resolves: RHEL-70110
  - Fix $ActionQueueDiscardMark default value to 80% queue size
    Resolves: RHEL-41153
  - Fix segfault when $ControlCharacterEscapePrefix is set
    Resolves: RHEL-35823
  - Fix segfault due to processing malform queue message
    Resolves: RHEL-33451
  - Fix crash on startup when an invalid function is specified
    Resolves: RHEL-59893
  - Startup rsyslog service after network-online.target
    Resolves: RHEL-39284
  - Harden service file
    Resolves: RHEL-39237
  - imjournal: PID nummber is retrieved from the journal by default 
    Resolves: RHEL-39413


author: Attila Lakatos <alakatos@redhat.com> - 8.2506.0-1
changelog:
  - Rebase to 8.2506.0
  - imuxsock: track dropped messages by ratelimiting
    Resolves: RHEL-96589
  - man page version update
    Resolves: RHEL-96592


author: Attila Lakatos <alakatos@redhat.com> - 8.2510.0-5
changelog:
  - Rebase to 8.2510.0
  - gnutls netstream driver: improve doc
    Resolves: RHEL-106763
  - rsyslog.conf: use RainerSscript syntax in actions
    Resolves: RHEL-119492
  - gnutls netstream driver: report missing certificate just once
    Resolves: RHEL-106477


author: Jun Aruga <jaruga@redhat.com> - 3.3.1-5
changelog:
  - Upgrade to Ruby 3.3.1.
    Resolves: RHEL-33975
  - Fix buffer overread vulnerability in StringIO.
    Resolves: RHEL-34124
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    Resolves: RHEL-34116
  - Fix arbitrary memory address read vulnerability with Regex search.
    Resolves: RHEL-33866


author: Jarek Prokop <jprokop@redhat.com> - 3.3.5-7
changelog:
  - Upgrade to Ruby 3.3.5
    Resolves: RHEL-59035
  - Fix DoS vulnerability in rexml.
    (CVE-2024-39908)
    (CVE-2024-41946)
    (CVE-2024-43398)
    Resolves: RHEL-57047
    Resolves: RHEL-57059
    Resolves: RHEL-57070
  - Fix REXML DoS when parsing an XML having many specific characters such as
    whitespace character, >] and ]>.
    (CVE-2024-41123)
    Resolves: RHEL-52802


author: Jun Aruga <jaruga@redhat.com> - 3.3.7-9
changelog:
  - Upgrade to Ruby 3.3.7
    Resolves: RHEL-77994
  - Fix Ruby OpenSSL to respect crypto-policies TLS minimal version.
    Resolves: RHEL-21019


author: Jarek Prokop <jprokop@redhat.com> - 3.3.8-10
changelog:
  - Upgrade to Ruby 3.3.8.
    Resolves: RHEL-87342
  - Fix Net::IMAP vulnerable to possible DoS by memory exhaustion. (CVE-2025-25186)
  - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219)
    Resolves: RHEL-86116
  - Fix userinfo leakage in URI#join, URI#merge and URI#+. (CVE-2025-27221)


author: Jun Aruga <jaruga@redhat.com> - 3.3.10-11
changelog:
  - Upgrade to Ruby 3.3.10.
    Resolves: RHEL-130160
  - Fix possible denial of service in resolv gem (CVE-2025-24294)
  - Fix URI Credential Leakage Bypass previous fixes. (CVE-2025-61594)
  - Fix REXML denial of service. (CVE-2025-58767)
    Resolves: RHEL-122028


author: Jarek Prokop <jprokop@redhat.com> - 3.3.10-12
changelog:
  - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316)
    Resolves: RHEL-171244


author: Jarek Prokop <jprokop@redhat.com> - 3.3.10-12
changelog:
  - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316)
    Resolves: RHEL-171245


author: Jarek Prokop <jprokop@redhat.com> - 3.3.10-13
changelog:
  - Fix DoS via crafted IMAP responses in net-imap. (CVE-2026-42245)
    Resolves: RHEL-181687
  - Fix information disclosure via MITM attack bypassing TLS in net-imap.
    (CVE-2026-42246)
    Resolves: RHEL-181775
  - Fix command injection via Symbol arguments in net-imap. (CVE-2026-42258)
    Resolves: RHEL-181797


author: Jun Aruga <jaruga@redhat.com> - 3.4.2-24
changelog:
  - Fix the tests using SHA-1 Probabilistic Signature Scheme (PSS) parameters.
    Resolves: rhbz#2358256


author: Jun Aruga <jaruga@redhat.com> - 3.4.7-28
changelog:
  - Upgrade to Ruby 3.4.7.
    Resolves: rhbz#2402422
  - Fix URI Credential Leakage Bypass previous fixes.
    Resolves: CVE-2025-61594
  - Fix REXML denial of service.
    Resolves: CVE-2025-58767


author: Tomas Juhasz <tjuhasz@redhat.com> - 4.0.3-34
changelog:
  - Upgrade to Ruby 4.0.3.
    Resolves: RHEL-171239
  - Fix ERB: Arbitrary code execution via bypass
   (CVE-2026-41316)
    Resolves: RHEL-170910
  - Fix JSON: Denial of Service or Information Disclosure via format string injection
   (CVE-2026-33210)
   Resolves: RHEL-173457


author: Tomas Juhasz <tjuhasz@redhat.com> - 4.0.3-35
changelog:
  - Fix Net::IMAP ResponseReader quadratic complexity vulnerability (CVE-2026-42245)
    Includes core fix plus additional performance optimizations 
    Resolves: RHEL-181675
  - Fix Net::IMAP STARTTLS stripping vulnerability (CVE-2026-42246)
    Resolves: RHEL-181767
  - Fix Net::IMAP command injection vulnerability via unvalidated Symbol arguments (CVE-2026-42258)
    Resolves: RHEL-181793


author: Yaakov Selkowitz <yselkowi@redhat.com> - 0.5.5-4
changelog:
  - Adapt tests to mariadb 10.11
  - Avoid rubygem-eventmachine build dependency in RHEL
  - Adapt tests to openssl 3.2


author: Mark Will <mark.will@oracle.com> - 0:4.21.3-104
changelog:
  - resolves: RHEL-75587 - Fix deadlock between two smbd processes
  - resolves: RHEL-85348 - Fix winbindd memory leak


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 0:4.21.3-113
changelog:
  - Rebuild for zstream
  - Fix 'net ads join' in setups with multiple DCs
  - Fix DC discovery after Windows netlogon hardening
    (follow-up, main fix is in samba-4.21.3-106)
  - Fix winbind fork bomb in 'IPA with AD trust'
    environment
  - Fix samba-gpupdate to process empty GPO Link
  - Fix 'net ads kerberos kinit'
  - smb.conf: Remove the '@' for NIX groups, we
    removed NIS support


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.4-104
changelog:
  - resolves: RHEL-101759 - Fix DC discovery after Windows netlogon hardening
    (follow-up, main fix is in samba-4.22.2-103.el10)


author: Pavel Filipenský <pfilipensky@samba.org> - 2:4.23.4-100
changelog:
  - Update to version 4.23.4
  - resolves: RHEL-114545 - Update to version 4.23.4
  - resolves: RHEL-132338 - Fix Time Machine backup
  - resolves: RHEL-132975 - Remove unexpected dependency of libldb to samba


author: Pavel Filipenský <pfilipensky@samba.org> - 2:4.23.5-100
changelog:
  - Update to version 4.23.5
  - resolves: RHEL-138263 - Fix winbind group resolution
  - resolves: RHEL-141012 - Fix winbind crash


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.5-108
changelog:
  - Security release for CVE-2026-1933 CVE-2026-2340  CVE-2026-3012
    CVE-2026-4480 CVE-2026-40170 CVE-2026-4408
  - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba:
    various flaws
  - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing
  - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2
  - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.2-1
changelog:
  - rebase to upstream v1.5.2
  - convert license naming to SPDX
  - make static analysis happy with a few checks & rearanges with
    dynamic-memory-management


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.2-1.5
changelog:
  - Bump release for rebuild against pacemaker-3.0.0-rc1 package
    Resolves: RHEL-68410
    Resolves: RHEL-67387


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-36
changelog:
  - Update OpenSSL certificates set up
    Resolves: RHEL-113741
  - Add sysusers.d config file to allow rpm to create users/groups automatically
    and drop attempt to delete group
    Related: RHEL-114454
  - Add support for Image Mode
    Resolves: RHEL-114454


author: Timm Bäder <tbaeder@redhat.com> - 2.2.8-21
changelog:
  - Add downstream patch to fix c99 incompatibilities
  - https://fedoraproject.org/wiki/Changes/PortingToModernC


author: Vojtech Polasek <vpolasek@redhat.com> - 0.1.72-1
changelog:
  - Update to latest upstream SCAP-Security-Guide-0.1.72 release:
    https://github.com/ComplianceAsCode/content/releases/tag/v0.1.72


author: Matthew Burket <mburket@redhat.com>
changelog:
  - Update to latest upstream SCAP-Security-Guide-0.1.74 release:
    https://github.com/ComplianceAsCode/content/releases/tag/v0.1.74


author: Vojtech Polasek <vpolasek@redhat.com> - 0.1.77-2
changelog:
  - fix incorrect applicability of Grub2 UEFI specific rules
  - replace grub-mkconfig with grub2-mkconfig in rule descriptions


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.77-2.0.1
changelog:
  - Update OL9 STIG to align with DISA STIG V1R1 [Orabug: 38201131]
  - Update OL10 profiles [Orabug: 37806688]


author: Vojtech Polasek <vpolasek@redhat.com> - 0.1.78-1
changelog:
  - rebase scap-security-guide to the latest version 0.1.78 (RHEL-111008)
  - rules allow white spaces around equal sign in Systemd configuration (RHEL-93659)
  - add support for dropin files to Systemd coredump rules (RHEL-99973)


author: Armando Acosta <armando.acosta@oracle.com> - 0.1.78-1.0.1
changelog:
  - Update OL9 STIG to V1R2 [Orabug: 38523686]
  - Fix accounts password pwquality and faillock behavior [Orabug: 38523686]


author: Artem Denisov <adenisov@redhat.com> - 0.1.79-1
changelog:
  - rebase scap-security-guide to the latest version 0.1.79 (RHEL-130242)
  - add a test scenario to cover case where user has nologin defined in usr (RHEL-118647)


author: Armando Acosta <armando.acosta@oracle.com> - 0.1.79-2.0.1
changelog:
  - Update OL9 STIG to V1R3 [Orabug: 38790495]
  - Add new rule to ensure EPEL is not configured [Orabug: 38790495]
  - Update OL8 and OL9 STIG references [Orabug: 38790495]


author: Vojtech Polasek <vpolasek@redhat.com> - 0.1.80-1
changelog:
  - Import Red Hat quantum-resistant keys using sequoia commands (RHEL-127300)
  - Rule audit_rules_privileged_commands adds architecture filters in audit rules (RHEL-142647)
  - Use correct permissions and consider the log_group option in rules file_permissions_var_log_audit and directory_permissions_var_log_audit (RHEL-138549)
  - Add a new BSI profile to RHEL 10 that aligns to the BSI (Federal Office for Security Information in Germany) IT-Grundschutz Basic-Protection. (RHEL-134722)
  - Corrected version in the description of CIS profiles (RHEL-143955)
  - Rebase scap-security-guide to the latest upstream version 0.1.80 (RHEL-152059)


author: EL Errata <el-errata_ww@oracle.com> - 0.1.80-1.0.1
changelog:
  - Update OL9 STIG to V1R4 [Orabug: 38993199]
  - Removed configure_ssh_crypto_policy from OL9 profiles [Orabug : 39208555]


author: Jan Černý <jcerny@redhat.com> - 0.1.81-1
changelog:
  - Rebase scap-security-guide to 0.1.81 (RHEL-180768)
  - Rules *xccdf_org.ssgproject.content_rule_file_permission_user_init_files* and *xccdf_org.ssgproject.content_rule_file_permission_user_init_files_root* were updated to include text instructions on how to perform the remediation without losing previously set permissions on files that are not compliant. (RHEL-150283)
  - Enabled specifying a custom text (including newlines) in multiple rules checking login banners (RHEL-118499)


author: Armando Acosta <armando.acosta@oracle.com> - 0.1.81-1.0.1
changelog:
  - Update OL8 STIG to V2R8 [Orabug: 39590112]
  - Update OL9 STIG to V1R5 [Orabug: 39590112]
  - Fix RH rerefences for OL10 [Orabug : 39590112]


author: Remi Collet <remi@remirepo/net> - 1:2.0.3-1
changelog:
  - Rebase to 2.0.3
  - add upstream patch to fix brp-python-hardlink path
  - use SPDX license ID
  - run upstream tests


author: Neal Gompa <ngompa@fedoraproject.org> - 2.32.50-1
changelog:
  - Update to 2.32.50
  - Backport fixes from upstream
    + Correctly handle SDL environment variables
    + Fix to avoid over optimizing away internal strlen
    Resolves: RHEL-77078


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.20-1
changelog:
  - Allow virtqemud domain transition on numad execution
  Resolves: RHEL-65789
  - Support virt live migration using ssh
  Resolves: RHEL-53972
  - Allow ssh_t read systemd config files
  Resolves: RHEL-53972
  - Allow virtqemud permissions needed for live migration
  Resolves: RHEL-43217
  - Allow virtqemud the getpgid process permission
  Resolves: RHEL-46357
  - Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
  Resolves: RHEL-71068
  - Allow virtqemud relabelfrom virt_log_t files
  Resolves: RHEL-48236
  - Allow virtqemud relabel tun_socket
  Resolves: RHEL-71394
  - Allow gnome-remote-desktop dbus chat with policykit
  Resolves: RHEL-35877
  - Update ktlsh policy
  Resolves: RHEL-42672
  - Confine the ktls service
  Resolves: RHEL-42672
  - Allow request-key to read /etc/passwd
  Resolves: RHEL-71490
  - Allow request-key to manage all domains' keys
  Resolves: RHEL-71490


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.21-1
changelog:
  - Allow init create vsock socket for sshd
  Resolves: RHEL-72549
  - Support ssh connections via systemd-ssh-generator
  Resolves: RHEL-72549
  - Allow ssh generator work with systemd unit files
  Resolves: RHEL-72549
  - Confine systemd system-ssh-generator
  Resolves: RHEL-72549
  - Allow login_userdomain getattr nsfs files
  Resolves: RHEL-72549
  - Allow virtqemud send a generic signal to the ssh client domain
  Resolves: RHEL-53972
  - Add the auth_dontaudit_read_passwd_file() interface
  Resolves: RHEL-71490
  - Dontaudit request-key read /etc/passwd
  Resolves: RHEL-71490


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.22-1
changelog:
  - Allow staff user dbus chat with virt-dbus
  Resolves: RHEL-73914
  - Allow virtqemud domain transition to nbdkit
  Resolves: RHEL-69118
  - Add nbdkit interfaces defined conditionally
  Resolves: RHEL-69118
  - Allow svirt_t read sysfs files
  Resolves: RHEL-71270
  - Label /dev/pmem[0-9]+ with fixed_disk_device_t
  Resolves: RHEL-71656
  - Add support for the KVM guest memfd anon inodes
  Resolves: RHEL-69128
  - Allow sysadm user dbus chat with virt-dbus
  Resolves: RHEL-73914
  - Allow initrc_t transition to passwd_t
  Resolves: RHEL-71665
  - Allow unconfined_service_t transition to passwd_t
  Resolves: RHEL-71665


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.23-1
changelog:
  - Remove the lockdown class from the policy
  Resolves: RHEL-36741
  - Remove socket from unconfined_domain_type allow rule
  Resolves: RHEL-36741
  - Include key_socket in socket_class_set
  Resolves: RHEL-36741


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.24-1
changelog:
  - Allow systemd-generator connect to syslog over a unix datagram socket
  Resolves: RHEL-75879
  - Allow ssh_t to change role to system_r
  Resolves: RHEL-53972
  - Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
  Resolves: RHEL-39893
  - Allow virtqemud manage fixed disk device nodes
  Resolves: RHEL-71656
  - Allow samba-bgqd connect to cupsd over an unix domain stream socket
  Resolves: RHEL-72861
  - Allow systemd-machined read the vsock device
  Resolves: RHEL-74280
  - Allow pcmsensor write nmi_watchdog state information
  Resolves: RHEL-52838
  - Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
  Resolves: RHEL-52838


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.25-1
changelog:
  - Update ktlshd policy to read /proc/keys and domain keyrings
  Resolves: RHEL-42672
  - Allow pcmsensor read nmi_watchdog state information
  Resolves: RHEL-52838
  - Support peer-to-peer migration of vms using ssh
  Resolves: RHEL-77351
  - Allow virt_domain read hardware state information unconditionally
  Resolves: RHEL-71270
  - Allow timemaster write to sysfs files
  Resolves: RHEL-44637
  - Allow virtqemud map svirt_image_t plain files
  Resolves: RHEL-40080
  - Allow virtqemud unmount a filesystem with extended attributes
  Resolves: RHEL-40080
  - Allow virtqemud work with nvdimm devices
  Resolves: RHEL-71656
  - Update virtqemud policy regarding the svirt_tcg_t domain
  Resolves: RHEL-71270
  - Allow virtqemud use hostdev usb devices conditionally
  Resolves: RHEL-74230
  - Support saving and restoring a VM to/from a block device
  Resolves: RHEL-76138
  - Allow virtnwfilterd dbus chat with firewalld
  Resolves: RHEL-76138
  - Allow virt_domain to use pulseaudio - conditional
  Resolves: RHEL-62763
  - Allow virtstoraged write to sysfs files
  Resolves: RHEL-44637
  - Allow irqbalance to run unconfined scripts conditionally
  Resolves: RHEL-54019
  - Allow rhsmcertd notify virt-who
  Resolves: RHEL-77114
  - Allow init mounton crypto sysctl files
  Resolves: RHEL-56250


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.26-1
changelog:
  - Rename winbind_rpcd_* types to samba_dcerpcd_*
  Resolves: RHEL-14759
  - Allow samba-dcerpcd work with ctdb cluster
  Resolves: RHEL-14759
  - Revert "Remove socket from unconfined_domain_type allow rule"
  Resolves: RHEL-77327
  - Dontaudit access of virt-related permissive domains
  Resolves: RHEL-77808
  - Add selinux_requires_min macro
  Resolves: RHEL-54715
  - Filter out EPEL related modules
  Resolves: RHEL-73505


author: Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com>- 40.13.26-1.0.1
changelog:
  - Allow systemd_fstab_generator_t to read udev pid files [Orabug: 37139639]
  - Allow systemd_fstab_generator_t to read sysfs filesystem [Orabug: 37139639]
  - Allow systemd_fstab_generator_t to get attributs of fixed_disk_device_t and
    removable_device_t [Orabug: 37139639]
  - Change reference in /etc/selinux/config to point to Oracle doc [Orabug: 36899915]
  - Allow user_mail_domain to manage exim_log_t and exim_spool_t link files [Orabug: 36617121]
  - Allow exim_t to read exim_log_t and manage exim_spool_t link files [Orabug: 36430005]
  - Allow cgred_t to get attributes of cgroup filesystems [Orabug: 36176655]
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make lsmd and rngd work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.16-1
changelog:
  - Allow sshd-session inherit limits from its parent sshd process
  Resolves: RHEL-136673
  - Revert "Allow sshd-session inherit limits from its parent process"
  Resolves: RHEL-136673
  - Allow tlshd write generic certificates
  Resolves: RHEL-123737
  - Allow systemd-hostnamed to create its Varlink socket
  Resolves: RHEL-139385
  - Update gpg_role() interface with unix_stream_socket permissions
  Resolves: RHEL-128555
  - Label /etc/aliases.cdb with etc_aliases_t
  Resolves: RHEL-109976
  - Add aliases.lmdb to mta_filetrans_named_content()
  Resolves: RHEL-140884
  - Update policy for bootupd
  Resolves: RHEL-141391


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.17-1
changelog:
  - Allow rhsmcertd read anaconda run files
  Resolves: RHEL-141391
  - Allow mdadm to use CAP_BPF during RAID monitoring
  Resolves: RHEL-135765
  - Allow mdadm the CAP_SYS_PTRACE capability
  Resolves: RHEL-135765
  - Allow staff and sysadm execute iotop using sudo
  Resolves: RHEL-134940
  - Allow kernel_t to read/write all domains' pipes
  Resolves: RHEL-124442
  - Allow nfsd_t domain setuid and setgid capability for rpc.mountd
  Resolves: RHEL-148107


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.18-1
changelog:
  - Allow NetworkManager list bpf directories
  Resolves: RHEL-142171
  - Dontaudit systemd-generator connect to sssd over a unix stream socket
  Resolves: RHEL-114886
  - Allow pkcsslotd read files in /proc and /sys
  Resolves: RHEL-130812
  - Allow pkcsslotd map its private tmpfs files
  Resolves: RHEL-130812
  - Allow tlshd communication to unconfined_t over a tcp socket
  Resolves: RHEL-125106
  - Label /run/insights-client.ppid with insights_client_run_t
  Resolves: RHEL-146687
  - Allow NM nvme dispatcher script start systemd services
  Resolves: RHEL-140760
  - Allow tlshd write generic certificate dirs
  Resolves: RHEL-127023
  - Allow aide get attributes of tmpfs and devtmpfs filesystems
  Resolves: RHEL-121479
  - Allow plasma login manager stop login services
  Resolves: RHEL-140911
  - Rebuild selinux policy after installation of the extra package
  Resolves: RHEL-135875
  Resolves: RHEL-143926
  - Move triggerin scriptlets to the parent packages
  Resolves: RHEL-141813
  - Rebuild policy before running {binsbin|varrun}-convert.sh
  Resolves: RHEL-141813


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 42.1.18-4.0.1.el10_2.2
changelog:
  - Allow systemd_fstab_generator_t to read udev pid files [Orabug: 37139639]
  - Allow systemd_fstab_generator_t to read sysfs filesystem [Orabug: 37139639]
  - Allow systemd_fstab_generator_t to get attributs of fixed_disk_device_t and
    removable_device_t [Orabug: 37139639]
  - Change reference in /etc/selinux/config to point to Oracle doc [Orabug: 36899915]
  - Allow user_mail_domain to manage exim_log_t and exim_spool_t link files [Orabug: 36617121]
  - Allow exim_t to read exim_log_t and manage exim_spool_t link files [Orabug: 36430005]
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make lsmd and rngd work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.14-1
changelog:
  - Update ktls policy
  Resolves: RHEL-123737
  - Update policy for redfish-finder
  Resolves: RHEL-50299
  - Allow sshd-session read, write, and map ica tmpfs files
  Resolves: RHEL-138247
  - Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t
  Resolves: RHEL-127721
  - Allow stalld map sysfs files
  Resolves: RHEL-135512
  - Allow aide get attributes of a filesystem with extended attributes
  Resolves: RHEL-121479
  - Label miscellaneous /dev/papr-* devices
  Resolves: RHEL-129839
  - Allow KDE Plasma Login Manager to function as a display manager
  Resolves: RHEL-135676
  - Update specfile trigger for openwsmand
  Resolves: RHEL-133024


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.15-1
changelog:
  - Allow hostapd write to socket files in /tmp
  Resolves: RHEL-77047
  - Allow stap server read virtual memory sysctls
  Resolves: RHEL-114104
  - Allow sshd-session inherit limits from its parent process
  Resolves: RHEL-136673
  - Allow sshd noatsecure on sshd-session execution
  Resolves: RHEL-138247
  - Allow sshd-net read and write to sshd vsock socket
  Related: RHEL-138247


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.3-1
changelog:
  - Allow svirt read virtqemud fifo files
  Resolves: RHEL-104069
  - Allow virtqemud handle virt_content_t chr files
  Resolves: RHEL-76104
  - Allow "hostapd_cli ping" run as a systemd service
  Resolves: RHEL-77047
  - All sblim-sfcbd the dac_read_search capability
  Resolves: RHEL-98287
  - Allow sblim domain read systemd session files
  Resolves: RHEL-98287
  - Allow sblim-sfcbd execute dnsdomainname
  Resolves: RHEL-98287
  - Allow systemd-importd create and unlink init pid socket
  Resolves: RHEL-98490


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.4-1
changelog:
  - Allow systemd-coredump the sys_chroot capability
  Resolves: RHEL-97586
  - Add the rhcd_rw_fifo_files() interface
  Related: RHEL-99318
  - Add insights_client_delete_lib_dirs() interface
  Related: RHEL-99318


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.5-1
changelog:
  - Confine nfs-server generator
  Resolves: RHEL-106119
  - Support virtqemud handle hotplug hostdev devices
  Resolves: RHEL-65266
  - Allow virtstoraged create qemu /var/run files
  Resolves: RHEL-104344
  - Allow virtqemud write to sysfs files
  Resolves: RHEL-104378
  - Allow unconfined_domain_type cap2_userns capabilities
  Resolves: RHEL-93656


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.6-1
changelog:
  - Apply generator template to selinux-autorelabel generator
  Resolves: RHEL-107516
  - Allow systemd-coredumpd capabilities in the user namespace
  Resolves: RHEL-97586
  - Allow virtqemud start a vm which uses nbdkit
  Resolves: RHEL-69118
  - Add nbdkit_signal() and nbdkit_signull() interfaces
  Resolves: RHEL-69118
  - Allow openvswitch read virtqemud process state
  Resolves: RHEL-65322
  - Add binsbin-convert.sh script
  Resolves: RHEL-69118


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.7-1
changelog:
  - Revert "Add policy for insights-core"
  Resolves: RHEL-110651
  - Revert "Add insights_core interfaces"
  Resolves: RHEL-110651


author: Ilya Okomin <ilya.okomin@oracle.com> - 42.1.7-1.0.2
changelog:
  - Fix specfile triggers for fapolicyd and usbguard DSP modules [Orabug: 38681740] [Orabug: 38579739]


author: EL Errata <el-errata_ww@oracle.com> - 42.1.7-1.0.2.el10_1.1
changelog:
  - Fix specfile triggers for fapolicyd and usbguard DSP modules [Orabug: 38681740] [Orabug: 38579739]
  - Allow systemd_fstab_generator_t to read udev pid files [Orabug: 37139639]
  - Allow systemd_fstab_generator_t to read sysfs filesystem [Orabug: 37139639]
  - Allow systemd_fstab_generator_t to get attributs of fixed_disk_device_t and
    removable_device_t [Orabug: 37139639]
  - Change reference in /etc/selinux/config to point to Oracle doc [Orabug: 36899915]
  - Allow user_mail_domain to manage exim_log_t and exim_spool_t link files [Orabug: 36617121]
  - Allow exim_t to read exim_log_t and manage exim_spool_t link files [Orabug: 36430005]
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make lsmd and rngd work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]


author: Vit Mojzis <vmojzis@redhat.com> - 42.1.7-1.2
changelog:
  - Update specfile triggers for DSP modules (RHEL-132492)
  - Update specfile trigger for smartmontools
  - Update specfile trigger for openwsman
  - Move triggerin scriptlets to the parent packages (RHEL-150914)
  - Rebuild policy before running {binsbin|varrun}-convert.sh (RHEL-128498)


author: Petr Lautrbach <lautrbach@redhat.com> - 4.4.2-4
changelog:
  - Disable/remove neverallow options in sediff.
  - Improve man pages
  - seinfoflow: Add -r option to get flows into the source type.
  - seinfoflow.1: Remove references to sepolgen permission map.
  - AVRule/AVRuleXperm: Treat rules with no permissions as invalid policy.
  - SELinuxPolicy: Add explicit cast for libspol message


author: Petr Lautrbach <lautrbach@redhat.com> - 3.3.34-1
changelog:
  - data: update app icon
  - Disable bug reporting, if libreport is not available
  - Enable Georgian and Arabic (ar) languages in configure.ac
  - Update translations


author: Akshata Konala <akshata.konala@oracle.com> - 3.3.35-1.0.1
changelog:
  - Replaced bugzilla.oracle.com references [Orabug: 34202300]
  - Add setroubleshoot-oracle-enterprise.patch to change bug reporting
    URL to bugzilla.oracle.com [Orabug: 29870389]


author: Petr Lautrbach <lautrbach@redhat.com> - 3.3.35-3
changelog:
  - Reload auditd using auditctl instead of service
  - Drop dependency on initscripts-service
  Resolves: rhbz#2365614


author: Javier Martinez Canillas <javierm@redhat.com> - 15-3
changelog:
  - Make EFI variable copying fatal only on secureboot enabled systems
    Resolves: rhbz#1704854
  - Fix booting shim from an EFI shell using a relative path
    Resolves: rhbz#1717063


author: Ilya Okomin <ilya.okomin@oracle.com> - 16.1-2.0.1.el10
changelog:
  - Update shim to upstream v16.1 [Orabug: 38397604]
  - Update Oracle sbat metadata and vendor certificates [Orabug: 38397604]


author: Jindrich Novy <jnovy@redhat.com> - 1:1.18.1-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.18
    (https://github.com/containers/skopeo/commit/bfd0850)
  - fixes "CVE-2025-27144 skopeo: Go JOSE's Parsing Vulnerable to Denial of Service [rhel-10.1]"
  - Resolves: RHEL-80611


author: Alex Burmashev <alexander.burmashev@oracle.com> - 1:1.18.1-2
changelog:
  - Fix bats dep on tests subpackage
  - Resolves: RHEL-58990
  - Rebuild on new golang to fix CVE-2025-22871


author: Jindrich Novy <jnovy@redhat.com> - 2:1.22.2-1
changelog:
  - update to https://github.com/containers/skopeo/releases/tag/v1.22.2
  - fixes signature verification of images which only sign the per-platform
    manifest in skopeo proxy
  - Resolves: RHEL-168168


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-4
changelog:
  - Ignore updates from non-tracked subtrees during modify/modrdn/update
    to avoid deadlocks with retro changelog


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.70.0-1
changelog:
  - Upstream release 0.70.0: make NIS server optional
  - Disable NIS server support
  - Resolves: RHEL-34186


author: Jindrich Novy <jnovy@redhat.com> - 1.3.2-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.3.2
  - Related: RHEL-58990


author: Jindrich Novy <jnovy@redhat.com> - 1.3.3-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.3.3
  - Resolves: RHEL-94771


author: Zuzana Miklankova <zmiklank@redhat.com> - 3.45.0-1
changelog:
  - Updated to version 3.45.0 (https://sqlite.org/releaselog/3_45_0.html)
  - List versioned soname in files, preventing unnoticed soname bumps
  - Disable func4 tests for i686 arch due to failing float<->int conversions


author: Luboš Uhliarik <luhliari@redhat.com> - 7:6.10-5
changelog:
  - Disable ESI support
  - Resolves: RHEL-65069 - CVE-2024-45802 squid: Denial of Service processing ESI
    response content


author: Luboš Uhliarik <luhliari@redhat.com> - 7:6.10-6
changelog:
  - Resolves: RHEL-86817 - ”TCP connection to XX.XX.XX.XX/XXXX failed” message is
    output frequently on RHEL10


author: Luboš Uhliarik <luhliari@redhat.com> - 7:6.10-9
changelog:
  - Resolves: RHEL-122481 - squid: Squid vulnerable to information disclosure via
    authentication credential leakage in error handling (CVE-2025-62168)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:6.10-10
changelog:
  - Resolves: RHEL-129457 - "ICAP_ERR_OTHER/408" occurs in icap.log when
    downloading a file on RHEL9


author: Tomas Korbar <tkorbar@redhat.com> - 7:6.10-11
changelog:
  - Resolves: RHEL-160668 - squid: Squid: Denial of Service via
    heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:6.10-2
changelog:
  - Resolves: RHEL-62323 - (Regression) Transfer-encoding:chunked data is not sent
    to the client in its complementary


author: Luboš Uhliarik <luhliari@redhat.com> - 7:6.10-1
changelog:
  - new version 6.10
  - Resolves: RHEL-45048 - squid: Out-of-bounds write error may lead to Denial of
    Service (CVE-2024-37894)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:6.10-6.1
changelog:
  - Resolves: RHEL-122480 - CVE-2025-62168 squid: Squid vulnerable to information
    disclosure via authentication credential leakage in error handling


author: Tomas Korbar <tkorbar@redhat.com> - 7:6.10-6.2
changelog:
  - Resolves: RHEL-160665 - squid: Squid: Denial of Service via
    heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)


author: Tomas Korbar <tkorbar@redhat.com> - 7:6.10-6.3
changelog:
  - Resolves: RHEL-160667 - squid: Squid: Denial of Service via
    crafted ICP traffic (CVE-2026-32748)


author: Stephen Gallagher <sgallagh@redhat.com> - 3.0.5-12
changelog:
  - Fix IP address handling in CA certificate SAN constraints
  - Add automatic single-IP subnet mask to IP addresses in CA name
    constraints
  - Update help text to show simplified IP format without subnet mask
  - Add comprehensive test for basicConstraints


author: Stephen Gallagher <sgallagh@redhat.com> - 4.0.0-1
changelog:
  - Release SSCG 4.0.0
  - Support for ML-DSA keys for post-quantum cryptography (PQC) when built
    against OpenSSL 3.5 or later
  - Support for EC-DSA keys for elliptic curves
  - RSA certificate authority is now created with a minimum key strength of
    4096 bits
  - Improved --help output
  - Deprecated support for generating custom DH parameters
  - Stopped producing the DH parameter file by default (it may be requested
    explicitly with the --dhparams-file argument)
  - Minimum OpenSSL version is now 3.0
  - Drop upstreamed patches


author: Alexey Tikhonov <atikhono@redhat.com> - 2.10.0-1
changelog:
  - Resolves: RHEL-62725 - Rebase SSSD for RHEL 10.0
  - Resolves: RHEL-56701 - sss_ssh_knownhosts is breaking ansible-pull
  - Resolves: RHEL-55993 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not


author: Alexey Tikhonov <atikhono@redhat.com> - 2.10.1-1
changelog:
  - Resolves: RHEL-62725 - Rebase SSSD for RHEL 10.0
  - Resolves: RHEL-4984 - Mismatch between input and parsed domain name when default_domain_suffix is set.
  - Resolves: RHEL-65848 - sssd password authentication broken in sssd-2.10.0~beta2-2 and later
  - Resolves: RHEL-67669 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option
  - Resolves: RHEL-68421 - sssd ldap_child process segfaults when krb5.conf is invalid [rhel-10]
  - Resolves: RHEL-66935 - Avoid log flooding in case an app keeps making invalid `getservbyport(0, ...)` request
  - Resolves: RHEL-65736 - ipa: sudo commands doesn't check threshold correctly
  - Resolves: RHEL-68319 - Please deprecate/remove ad_allow_remote_domain_local_groups


author: Masahiro Matsuya <mmatsuya@redhat.com> - 2.10.2-3.3
changelog:
  - Resolves: RHEL-120286 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.11.0-1
changelog:
  - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1
  - Resolves: RHEL-4976 - [RFE] Continue searching other PKCS#11 tokens if certificates are not found
  - Resolves: RHEL-87200 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack
  - Resolves: RHEL-25593 - Improve sssd-simple man page description
  - Resolves: RHEL-14752 - [RFE] Add IPA subdomain support to allow IPA-IPA trust
  - Resolves: RHEL-92569 - SSSD LDAPU1 Mapping braces problem
  - Resolves: RHEL-4981 - p11_child currently has an infinite timeout
  - Resolves: RHEL-5042 - IDM homedir %o is not working, returns /home/domain/user instead of AD POSIX unixHomeDir
  - Resolves: RHEL-13086 - [RFE] Anonymous bind requests on RootDSE
  - Resolves: RHEL-45824 - SSSD unable to enumerate LDAP groups if LDAP server contains any group with # character in their names


author: Alexey Tikhonov <atikhono@redhat.com> - 2.11.1-1
changelog:
  - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1
  - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache


author: Alexey Tikhonov <atikhono@redhat.com> - 2.11.1-2
changelog:
  - Related: RHEL-77184 - AD user in external group is not cleared when expiring the cache
    Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted.


author: Sumit Bose <sbose@redhat.com> - 2.11.1-2.1
changelog:
  - Resovles: RHEL-120288 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows
    privilege escalation on AD-joined Linux systems [rhel-10.1.z]


author: Sumit Bose <sbose@redhat.com> - 2.12.0-1
changelog:
  - Resolves: RHEL-139110 - Rebase SSSD for RHEL 10.2
  - Resolves: RHEL-132552 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so[7f6fd25ae000+4d000]
  - Resolves: RHEL-132505 - RFE: package LDAP provider support for subid ranges
  - Resolves: RHEL-130571 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none'
  - Resolves: RHEL-129636 - sssd service fails to start after updating to 2.9.6-4 or 2.9.7-4
  - Resolves: RHEL-128594 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name
  - Resolves: RHEL-127792 - Remove SSSD option ipa_enable_dns_sites
  - Resolves: RHEL-120501 - Crash in 'sss_client/autofs/sss_autofs.c'
  - Resolves: RHEL-120287 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.2]
  - Resolves: RHEL-114468 - Spam in 'sssd_kcm.log' during normal operations
  - Resolves: RHEL-113111 - Including innapropriate IPv6 addresses in dyndns_update
  - Resolves: RHEL-104221 - The SSSD cache is filled with groups having GID=0, causing the cache index to grow excessively large. This, in turn, leads to timeouts
  - Resolves: RHEL-94545 - When the user name of an AD user in an IPA-AD trust environment overwritten, the user private group, the users primary group, cannot be lookup up by the overwritten name.
  - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache
  - Resolves: RHEL-72935 - sss_override does not work on AD UPN
  - Resolves: RHEL-11913 - GDM Support for IdM IdP feature and MFA [SSSD]
  - Resolves: RHEL-4990 - [RFE] SSSD support for Azure AD / Microsoft Entra ID (or general direct support of OIDC authentication)


author: Tomas Halman <thalman@redhat.com> - 2.12.0-3
changelog:
  - Resolves: RHEL-167749 - SSSD IdP (Entra ID): listing group members does not work
  - Resolves: RHEL-167757 - sssd-kcm fails to start if krb5_renew_interval is specified


author: - Tomas Halman <thalman@redhat.com> - 2.12.0-3.1
changelog:
  - Resolves: RHEL-192056 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole
  - Resolves: RHEL-192064 - CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass


author: Clark Williams <williams@redhat.com> - 1.18.1
changelog:
  - queue_track: Use LIBBPF_MAJOR/MINOR_VERSION to detect deprecated functions
  - utils: Close file descriptor
  - stalld: Fix function name of daemonize()
  - docs: Fix typo in the manual
  - queue_track: Use bpf_map__resize on older libbpf versions
  - utils: Let tgid to arrive at the fill proccess comm
  - stalld: Fix log message on idle detection
  - stalld: Add -b/--backend option
  - stalld: Add queue track eBPF based backend
  - stalld: Add fill_process_comm helper
  - stalld: Include regex.h on stalld.h
  - stalld: Get nr of cpus only once
  - stalld: Add the backend abstraction
  - sched_debug: Move sched debug functions to an specific file


author: Clark Williams <williams@redhat.com> - 1.19.1
changelog:
  - Conditionalize BPF and queue_track build per architecture
  - clean up Makefile install logic and add .bz2 to .gitignore
  - modify Makefiles so install works with relative paths
  - rename 'redhat' to 'systemd' and remove redhat packaging logic
  - update SPDX tags to non-deprecated values
  - stalld: Add -a/--affinity option
  - Adding SPDX license info to each file
  - man/stalld.8:  change starving threshold to match code
  - utils: Fix freeing of invalid pointer
  - add bpftool as BuildRequires


author: Chris White <chwhite@redhat.com> - 1.19.2
changelog:
  - stalld.conf: Fix stalld service start fail
  - throttling.c:  null terminate input buffer
  - stalld: free malloc'd buffer on function exit
  - throttlectl.sh: use legal value for exit on fail
  - Make fill_process_comm() open comm file as READ_ONLY
  Resolves: RHEL-34055


author: Chris White <chwhite@redhat.com> - 1.19.3
changelog:
  - Makefile: change build to use FORTIFY_SOURCE=3
  - src/utils.c: fix off-by-one error in buffer allocation
  Resolves: RHEL-34055


author: Chris White <chwhite@redhat.com> - 1.19.5
changelog:
  - Refactor Makefile to fix passing options to koji builds
  - Updated compile options for annocheck hardening
  - Ensure we resolve library symbols at load time (-z now) and are a Position Independent Executable (-pie). Refactored compile options to better deal with arch differences.
  - Added an 'annocheck' makefile target for local checking.
  Resolves: RHEL-34055


author: Chris White <chwhite@redhat.com> - 1.19.6-1
changelog:
  - Makefile: add uninstall target
  - systemd: add BE environment variable to select backend
  Resolves: RHEL-34055


author: Clark Williams <williams@redhat.com> - 1.19.8-1
changelog:
  - sched_debug: fix non x86 support
  - stalld.h:  fix prototype mis-patch with cleanup_regex()
  - throttlectl.sh:  add errexit
  - stalld.h:  fix incorrect default umask value
  - version bump
  - Fix building with glibc 2.41
  - throttlectl: clean up throttling script due to reported CVE-2024-54159
  - Makefile:  change modes on throttled and stalld
  - stalld.c: use a more reasonable size for reading /proc/stat
  Resolves: RHEL-69567
  Resolves: RHEL-40146
  Resolves: RHEL-79159
  Resolves: RHEL-67223
  Resolves: RHEL-50356


author: Wander Lairson Costa <wander@redhat.com> - 1.20.3-1
changelog:
  - Rebase to stalld-1.20.3
  - Make systemd start stalld with the SCHED_FIFO:10 priority
  Resolves: RHEL-109112


author: Wander Lairson Costa <wander@redhat.com> - 1.20.4-1
changelog:
  - Rebase to stalld-1.20.4
  - Remove duplicated ExecStart entry from the stalld.service file
  Resolves: RHEL-109112


author: Wander Lairson Costa <wander@redhat.com> - 1.26.3-1
changelog:
  - Rebase to stalld-1.26.3
  - Build System Improvements and added riscv64 arch
  - Make queue_track the default backend
  - Remove LTO build flags
  - Remove the -m64 build flag
  Resolves: RHEL-105604 RHEL-114506


author: John Kacur <jkacur@redhat.com> - 0.18.06-2
changelog:
  - Revert a patch to use that creates a gcc flags mismatch on power
  - Remove duplicate sqrt function
  Resolves:RHEL-65475


author: John Kacur <jkacur@redhat.com> - 0.18.06-3
changelog:
  - Remove the revert patch and replace it with an upstream fix for power
  - Include all of the stress-ng patches available past 0.18.06
  Resolves:RHEL-65475


author: John Kacur <jkacur@redhat.com> - 0.18.06-6
changelog:
  - Due to the special nature of stress-ng, it's not even possible to compile
    with -fpic or -fPIC, so turning annocheck off
  Resolves: RHEL-33521


author: Radovan Sroka <rsroka@redhat.com> - 1.9.15-1.p5
changelog:
  - Rabase to 1.9.15p5
  - sudo-1_9_15p5 is available Resolves: rhbz#2248505
  - TRIAGE CVE-2023-42465 sudo: Targeted Corruption of Register and Stack
    Variables Resolves: rhbz#2255569


author: Radovan Sroka <rsroka@redhat.com> - 1.9.15-5.p5
changelog:
  - RHEL 10.0 ERRATUM
  - sudo-1.9.15-2.p5.el10: RHEL SAST Automation: address 4 High impact true
    positive(s) Resolves: RHEL-44436
  - sudo subpackage sudo-logsrvd should not be built Resolves: RHEL-52864


author: Alejandro López <allopez@redhat.com> - 1.9.15-9.p5
changelog:
  - RHEL 10.1 ERRATUM
  - CVE-2025-32462 sudo: LPE via host option Resolves: RHEL-100009
  - CVE-2025-32463 sudo: LPE via chroot option Resolves: RHEL-100022


author: Alejandro López <allopez@redhat.com> - 1.9.15-10.p5
changelog:
  - Resolves: RHEL-164619 - CVE-2026-35535 sudo: Sudo: Privilege escalation
    due to failure in privilege drop calls


author: Yaakov Selkowitz <yselkowi@redhat.com> - 1.9.14-1.p3
changelog:
  - Rebase to 1.9.14p3
  - sudo-1_9_14p2 is available Resolves: rhbz#2175672
  - sudo fails to build with Python 3.12: FAILED: testcase
    check_example_group_plugin_is_able_to_debug() Resolves: rhbz#2186412


author: Alejandro López <allopez@redhat.com> - 1.9.17-2.p2
changelog:
  - Resolves: RHEL-59136 - sudo passes SHELL environment variable twice to
    the shell being executed [rhel-10]
  - Resolves: RHEL-128212 - [RFE] request to backport support for regex in
    sudo [rhel-10]
  - Resolves: RHEL-112100 - Rebase of sudo to 1.9.17p2 [rhel-10]


author: Alejandro López <allopez@redhat.com> - 1.9.17-3.p2
changelog:
  - Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation
    due to failure in privilege drop calls


author: Alejandro López <allopez@redhat.com> - 1.9.17-4.p2
changelog:
  - Bump release number
  - Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation
    due to failure in privilege drop calls


author: Stefan Berger <stefanb@linux.ibm.com> - 0.8.1-2
changelog:
  - Don't build tools-pkcs11 for i686 since python-tpm2-pytss is not built for it
  - Set license to BSD-3-Clause for all packages


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.9.0-1
changelog:
  - Update to v0.9.0 release
    Resolves: RHEL-42590
  - Fix SHA-1 algorithm availability
    Resolves: RHEL-46754


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.9.0-4
changelog:
  - Add extra SELinux policies.
    Related: RHEL-53967
  - Fix FTBFS, add gmp-devel
    Resolves: RHEL-65460


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.9.0-5
changelog:
  - Add extra SELinux policies.
    https://github.com/stefanberger/swtpm/issues/970
    Resolves: RHEL-70835
    Resolves: RHEL-73809


author: Miroslav Lichvar <mlichvar@redhat.com> 1.1.0-4
changelog:
  - remove existing smc socket on start (RHEL-40673)
  - fix crash observed with newer E810 firmware (RHEL-55261)
  - fix initial pin ID to not match an existing pin (RHEL-55261)
  - fix requested thread stack size on aarch64 (RHEL-55260)


author: Leo Sandoval <lsandova@redhat.com> - 6.04-0.32
changelog:
  - Bump version and include previous resolves ticket number on commit message
  - Resolves: #RHEL-51170


author: Lukáš Zaoral <lzaoral@redhat.com> - 12.7.2-1
changelog:
  - Update to v12.7.2 (rhbz#2165400)
  - Use SPDX license format
  - Modernize the spec file according to the current packaging guidelines


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.5.18-8
changelog:
  - RHEL-28165 - configure-printer exits with failure status when device is already handled
  - RHEL-26328 - Drop the dependency on python3-pycurl


author: systemd maintenance team <systemd-maint@redhat.com> - 257-8
changelog:
  - Rebase to new upstream stable release v257.3 (RHEL-71409)
  - udev: introduce several features to make debugging rules easier (RHEL-75774)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-10
changelog:
  - resolved: pick up new DNSSEC KSC from 2024 (RHEL-77718)
  - test_ukify: Skip on riscv64 (RHEL-85854)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-11
changelog:
  - fuzz-journal-remote: use ASSERT_OK() and friends (RHEL-79976)
  - logs-show: skip journal entry with an invalid timestamp (RHEL-79976)
  - man: mention that rhel-9.0 net naming scheme is the same as v251 (RHEL-87179)
  - backlight: Drop support for actual_brightness (RHEL-86713)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-12
changelog:
  - mkosi: use C10S repo for building RPMs (RHEL-79976)
  - test: adapt TEST-22 to the downstream --purge behavior (RHEL-79976)
  - mkosi: reconfigure the CI for CentOS Stream 10 (RHEL-79976)
  - test: skip tests for components not shipped in RHEL 10 (RHEL-79976)
  - ci: add a unique identifier to each GH Actions job (RHEL-79976)
  - test: limit logging when running TEST-21-DFUZZER (RHEL-79976)
  - man: mention RHEL documentation in systemctl's man page (RHEL-97762)
  - ukify: switch from zstd to zstandard (RHEL-97625)
  - ukify: fix zboot parsing with zstd (RHEL-97625)
  - ukify: if the specified kernel is not a valid PE file try to decompress it (RHEL-97625)
  - ukify: fix version detection for aarch64 zboot kernels with gzip or lzma compression (RHEL-97625)
  - ukify: when decompressing kernel before signing, call verify on decompressed file (RHEL-97625)
  - udev/net_id: introduce naming scheme for RHEL-10.1 (RHEL-44419)
  - udev/net_id: introduce naming scheme for RHEL-9.7 (RHEL-44419)
  - sd-event: drop inotify event from buffer when no event source is triggered (RHEL-104555)
  - test: add test case for issue #38265 (RHEL-104555)
  - tree-wide: check more log message format in log_struct() and friends (RHEL-106260)
  - core: output log cycle path in one log message, not many (RHEL-106260)
  - core: make log cycle messages recognizable via message IDs (RHEL-106260)
  - core: change ordering cycle log message log levels (RHEL-106260)
  - core: cast log_oom() got void (RHEL-106260)
  - core: when removing a job from a transaction, include in structured log message which (RHEL-106260)
  - catalog: add entries for the order cycle log messages (RHEL-106260)
  - flush_ports: flush POSIX message queues properly (RHEL-100553)
  - Add --entry-type=type1|type2 option to kernel-install. (RHEL-103354)
  - kernel-install: regroup options in help meesage (RHEL-103354)
  - kernel-install: do not mix || and && (RHEL-103354)
  - man/kernel-install: mention --entry-type= option in the man page (RHEL-103354)
  - bootspec: rename boot_entry_type_to_string() to boot_entry_type_description_to_string() (RHEL-103354)
  - bootspec: include 'UKI' in descriptive name for type #2 (RHEL-103354)
  - bootspec: rename BootEntryType values (RHEL-103354)
  - bootspec: rename boot_entry_source_to_string() to boot_entry_source_description_to_string() (RHEL-103354)
  - bootspec: boot_entry_source_to_json_string() to boot_entry_source_to_string() (RHEL-103354)
  - 90-uki-copy.install: Skip removing UKI related when BOOT_ENTRY_TYPE=type1 (RHEL-103354)
  - hwdb: add front button support for MSI Claw 7 AI+ A2VM (RHEL-72701)
  - hwdb: add accel orientation and location for the BMAX Y14 (RHEL-72701)
  - hwdb.d: add support for Akoya P15645 (RHEL-72701)
  - hwdb.d: add ANP09 Intel n100 tablet sensor configuration (#36390) (RHEL-72701)
  - hwdb: add axis range corrections for the Lenovo Yoga Slim 7 14ARE05 (RHEL-72701)
  - hwdb: add GOLD WARRIOR SIM PhoenixRC 10411R (RHEL-72701)
  - hwdb: add Code Mercenaries Hard- und Software GmbH Virtual RC USB (RHEL-72701)
  - hwdb: Add accel orientation quirk for the GPD Pocket 4 (RHEL-72701)
  - hwdb: add rotation profile matrix for Rog Ally X (2024) (#36591) (RHEL-72701)
  - hwdb: fix backspace not working on HP Pavilion laptop (#36777) (RHEL-72701)
  - hwdb/keyboard: Map FN key on TUXEDO NB02 devices (RHEL-72701)
  - hwdb/keyboard: Map FN key on TUXEDO InfinityFlex 14 Gen1 (RHEL-72701)
  - hwdb: add G-Mode key support (#37175) (RHEL-72701)
  - Add emulated release to G-Mode key (RHEL-72701)
  - hwdb: keyboard: Add Alienware special keys (RHEL-72701)
  - hwdb: add bladeRF SDR devices (RHEL-72701)
  - hwdb: append ID_SOFTWARE_RADIO to hwdb parser (RHEL-72701)
  - hwdb.d: reword and simplify boilerplate texts (RHEL-72701)
  - hwdb.d: update/expand boilerplate on various hwdb files (RHEL-72701)
  - hwdb: say that settings can be also set to 0 (RHEL-72701)
  - hwdb: add Analog Devices PLUTO SDR (RHEL-72701)
  -  hwdb: append ID_MM_DEVICE_IGNORE to hwdb parser (RHEL-72701)
  - hwdb: run "update-hwdb" (RHEL-72701)
  - hwdb: run "update-hwdb-autosuspend" (RHEL-72701)
  - hwdb: add missing PLUTO SDR vendor name (RHEL-72701)
  - hwdb: add Ettus Research SDR devices (RHEL-72701)
  - hwdb: add RTL-SDR devices (RHEL-72701)
  - hwdb: merge entries for Ettus Research B200 (RHEL-72701)
  - hwdb: make Saitek PLC Pro Flight Rudder Pedals a joystick (#37601) (RHEL-72701)
  - hwdb: fix touchpad for ASUS X1504ZA (#37696) (RHEL-72701)
  - hwdb: add support for Loupedeck devices (RHEL-72701)
  - hwdb: Acer Nitro ANV15-51 Mic Toggle (RHEL-72701)
  - hwdb: Added Beacn and TC-Helicon Audio controllers (#37798) (RHEL-72701)
  - hwdb: Add support for Lenovo IdeaPad Slim 5 series (RHEL-72701)
  - hwdb: Add hwbd definitions for maker tools (RHEL-72701)
  - hwdb: Add accel orientation quirk for the Microtech e-tab Pro (RHEL-72701)
  - hwdb: add 70-maker-tools.hwdb to meson.build (RHEL-72701)
  - hwdb: fix typo in 70-maker-tools.hwdb (RHEL-72701)
  - hwdb: update (RHEL-72701)
  - Fix Positivo K116J search key and www shortcut (RHEL-72701)
  - hwdb: Acer Nitro ANV15-51 Nitro Sense Toggle (RHEL-72701)
  - hwdb: several cleanups (RHEL-72701)
  - hwdb: disable Asus ROG keyboards sending poweroff (RHEL-72701)
  - hwdb: update (RHEL-72701)
  - hwdb: update autosuspend rules (RHEL-72701)
  - hwdb: set touchpad resolution for ThinkPad T14 Gen2a (RHEL-72701)
  - Revert "hwdb: disable Asus ROG keyboards sending poweroff" (RHEL-72701)
  - hwdb: Add launch emoji keyboard mapping for Asus M1607KA (RHEL-72701)
  - Enable KEY_PERFORMANCE key present on Linux 6.17 (RHEL-72701)
  - hwdb: add HP 150 Wired Mouse (#37341) (RHEL-72701)


author: Darren Archibald <darren.archibald@oracle.com> - 257-13.0.1
changelog:
  - Fix detection of Oracle Virtualization or BM envs [Orabug: 37531877]
  - Avoid udevadm warnings when using udev valid configs [Orabug: 37503197]
  - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469]
  - set "RemoveIPC=no" in logind.conf as default [Orabug: 22224874]
  - Fix missing netdev for iscsi entry in fstab [Orabug: 25897792]
  - udev rules: fix memory hot add and remove [Orabug: 31310273]
  - Disable unprivileged BPF by default [Orabug: 32870980]
  - Remove upstream references [Orabug: 33995357]
  - Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407]
  - Removed unneeded patches from the systemd.spec
  - 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490]
  - 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490]
  - 1006-orabug34467234-shutdown-get-only-active-md-arrays.patch [Orabug: 34467234]
  - 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110]
  - 1008-path-drop-IN_ATTRIB-from-parent-directory-watches.patch [Orabug: 36780432]


author: systemd maintenance team <systemd-maint@redhat.com> - 257-13.1
changelog:
  - coredump: verify pidfd after parsing data in usermode helper (RHEL-104135)
  - coredump: restore compatibility with older patterns (RHEL-104135)
  - coredump: wrap long lines, fix grammar in comments (RHEL-104135)
  - coredump: get rid of _META_MANDATORY_MAX (RHEL-104135)
  - coredump: use %d in kernel core pattern (RHEL-104135)
  - coredump: also stop forwarding non-dumpable processes (RHEL-104135)
  - coredump: get rid of a bogus assertion (RHEL-104135)
  - coredump: add support for new %F PIDFD specifier (RHEL-104135)
  - coredump: when %F/pidfd is used, again allow forwarding to containers (RHEL-104135)
  - coredump: introduce an enum to wrap dumpable constants (RHEL-104135)
  - Define helper to call PR_SET_DUMPABLE (RHEL-104135)
  - coredump: fix 0-passed-as-pointer warning (RHEL-104135)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-13.2
changelog:
  - Revert "coredump: fix 0-passed-as-pointer warning" (RHEL-104135)
  - Revert "Define helper to call PR_SET_DUMPABLE" (RHEL-104135)
  - Revert "coredump: introduce an enum to wrap dumpable constants" (RHEL-104135)
  - Revert "coredump: when %F/pidfd is used, again allow forwarding to containers" (RHEL-104135)
  - Revert "coredump: add support for new %F PIDFD specifier" (RHEL-104135)
  - Revert "coredump: get rid of a bogus assertion" (RHEL-104135)
  - Revert "coredump: also stop forwarding non-dumpable processes" (RHEL-104135)
  - Revert "coredump: use %d in kernel core pattern" (RHEL-104135)
  - Revert "coredump: get rid of _META_MANDATORY_MAX" (RHEL-104135)
  - Revert "coredump: wrap long lines, fix grammar in comments" (RHEL-104135)
  - Revert "coredump: restore compatibility with older patterns" (RHEL-104135)
  - Revert "coredump: verify pidfd after parsing data in usermode helper" (RHEL-104135)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-13.3
changelog:
  - ci: re-enable bpf-framework option for build and unit test jobs (RHEL-155394)
  - ci: add bpftool workaround to codeql job too (RHEL-155394)
  - ci: fix workaround about bpftool for codeql (RHEL-155394)
  - ci: add bpftool workaround to coverity too (RHEL-155394)
  - ci: pin Packit/mkosi to the latest RHEL 10.1 commit (RHEL-155394)
  - ci: run apt-get update before running mkosi (RHEL-155394)
  - path-util: add flavour of path_startswith() that leaves a leading slash in place (RHEL-155394)
  - cgroup: port some code over to path_startswith_full() (RHEL-155394)
  - path-util: invert PATH_STARTSWITH_ACCEPT_DOT_DOT flag (RHEL-155394)
  - sd-json: fix off-by-one issue when updating parent for array elements (RHEL-155394)
  - core/cgroup: avoid one unnecessary strjoina() (RHEL-155394)
  - core: validate input cgroup path more prudently (RHEL-155394)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-16
changelog:
  - test: rename TEST-53-ISSUE-16347 to TEST-53-TIMER (RHEL-118216)
  - test: restarting elapsed timer shouldn't trigger the corresponding service (RHEL-118216)
  - test: check the next elapse timer timestamp after deserialization (RHEL-118216)
  - timer: don't run service immediately after restart of a timer (RHEL-118216)
  - test: store and compare just the property value (RHEL-118216)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-17
changelog:
  - pam_systemd: honor session class provided via PAM environment (RHEL-109832)
  - udev/net_id: introduce naming scheme for RHEL-10.2 (RHEL-72813)
  - udev/net_id: introduce naming scheme for RHEL-9.8 (RHEL-72813)
  - test: split VM-only subtests from TEST-74-AUX-UTILS to new VM-only test (RHEL-112205)
  - core/transaction: first drop unmergable jobs for anchor jobs (RHEL-112205)
  - test: add test case for issue #38765 (RHEL-112205)
  - strv: add strv_equal_ignore_order() helper (RHEL-109902)
  - pam: minor coding style tweaks (RHEL-109902)
  - user-record: add helper that checks if a provided user name matches a record (RHEL-109902)
  - user-record: add support for alias user names to user record (RHEL-109902)
  - pam_systemd_home: use right field name in error message (RHEL-109902)
  - pam_systemd_home: support login with alias names + user names with realms (RHEL-109902)
  - homed: support user record aliases (RHEL-109902)
  - homectl: add support for creating users with alias names (RHEL-109902)
  - test: add test for homed alias and realm user resolution (RHEL-109902)
  - update TODO (RHEL-109902)
  - udev: create symlinks for s390 PTP devices (RHEL-120177)
  - test: build the crashing test binary outside of the test (RHEL-113920)
  - test: exclude test-stacktrace(-not)?-symbolized from the coredump check (RHEL-113920)
  - mkosi: install test dependencies for EnterNamespace= test (RHEL-113920)
  - coredump: verify pidfd after parsing data in usermode helper (RHEL-104135)
  - coredump: restore compatibility with older patterns (RHEL-104135)
  - coredump: wrap long lines, fix grammar in comments (RHEL-104135)
  - coredump: get rid of _META_MANDATORY_MAX (RHEL-104135)
  - coredump: use %d in kernel core pattern (RHEL-104135)
  - coredump: also stop forwarding non-dumpable processes (RHEL-104135)
  - coredump: get rid of a bogus assertion (RHEL-104135)
  - coredump: add support for new %F PIDFD specifier (RHEL-104135)
  - coredump: when %F/pidfd is used, again allow forwarding to containers (RHEL-104135)
  - coredump: introduce an enum to wrap dumpable constants (RHEL-104135)
  - Define helper to call PR_SET_DUMPABLE (RHEL-104135)
  - coredump: fix 0-passed-as-pointer warning (RHEL-104135)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-19
changelog:
  - man: fix a missing word (RHEL-120277)
  - sd_bus_open_user_machine(): Don't shortcut without necessary env (RHEL-129179)
  - udev: set clock group for PTP and RTC devices (RHEL-113051)
  - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-126122)
  - strv: introduce string_strv_hashmap_remove() (RHEL-126937)
  - unit-file: introduce unit_file_remove_from_name_map() (RHEL-126937)
  - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-126937)
  - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-126937)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-20
changelog:
  - tools/check-version-history: avoid DeprecationWarning with newer lxml (RHEL-128767)
  - man: don't duplicate version in History section (RHEL-128767)
  - tools: ignore root element explicitly in check-version-history (RHEL-128767)
  - systemd-logind: Add signal section in man systemd-logind (RHEL-128767)
  - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118216)
  - timer: rebase last_trigger timestamp if needed (RHEL-118216)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-22
changelog:
  - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-125822)
  - hwdb: Add Accelerometer mount matrix for Irbis TW43 (RHEL-72702)
  - hwdb: map FN key on TongFang X4SP4NAL laptops (RHEL-72702)
  - hwdb: update rules (RHEL-72702)
  - hwdb: update autosuspend rules (RHEL-72702)
  - Add Razer Cobra mouse to hwdb (RHEL-72702)
  - hwdb: enable autosuspend for Dell DW5826e WWAN modem (RHEL-72702)
  - hwdb: sort SDR devices by vendor name (RHEL-72702)
  - 70-mouse.hwdb: Add Razer Basilisk V3, Asus Cerberus, +2 more (RHEL-72702)
  - hwdb: run "update-hwdb" (RHEL-72702)
  - Add Hantek DSO-6022 oscilloscopes and compatible devices (RHEL-72702)
  - Update 60-sensor.hwdb - Add support for Lenovo Legion Go (RHEL-72702)
  - hwdb: add Airspy devices (RHEL-72702)
  - hwdb: add more devices (RHEL-72702)
  - hwdb: add MiriSDR MSi2500 devices (RHEL-72702)
  - hwdb: add missing Ettus Research B200 rule (RHEL-72702)
  - hwdb: add LimeSDR XTRX devices (RHEL-72702)
  - hwdb: add HydraSDR RFOne (RHEL-72702)
  - hwdb: add SDRplay devices (RHEL-72702)
  - hwdb: update (RHEL-72702)
  - hwdb: fix calibrate rotation sensor for Positivo K116J (#39189) (RHEL-72702)
  - Add Nulea M501 trackball to hwdb (RHEL-72702)
  - add comment to 70-mouse.hwdb regarding generic name for Nulea M501 USB dongle (RHEL-72702)
  - remove extra space from new hwdb.d/70-mouse.hwdb entries to fix failing test (RHEL-72702)
  - remove bonus line (RHEL-72702)
  - hwdb: drop trailing whitespace (RHEL-72702)
  - remove Nulea M501 usb entry from hwdb (RHEL-72702)
  - test/parse_hwdb: wrap Or inside an And in a Group (RHEL-72702)
  - rules: extend 60-input-id.rules to allow for bus/vid/pid/name matches (RHEL-72702)
  - hwdb: don't tag a named Mouse device as pointingstick (RHEL-72702)
  - hwdb: Add V64x_V65xAU to list of Clevo models where scancode f7+f8 get mapped to touchpad-toggle (RHEL-72702)
  - hwdb: gpd micropc2 sensor (#39493) (RHEL-72702)
  - hwdb: add support for the Logitech MX Master 4 (#39490) (RHEL-72702)
  - hwdb: add entry for Acer Switch One 10 (SW1-011) (#39716) (RHEL-72702)
  - keymap: Ignore brightness keys on Dell Inspiron 3505 to avoid double events (RHEL-72702)
  - Update hwdb (RHEL-72702)
  - hwdb: Add Elecom IST Pro trackball (#39762) (RHEL-72702)
  - hwdb: Fix keyboard backlight keys on Acer Nitro 5 AN515-58 (#39769) (RHEL-72702)
  - hwdb: Add alternative mode for Beacn Mic (#39868) (RHEL-72702)
  - Update hwdb (RHEL-72702)
  - hwdb: add ProtoArc EM01 NL mouse configuration (RHEL-72702)
  - hwdb: add Magic Trackpad v2 USB-C (2024) to quirks (#40032) (RHEL-72702)
  - hwdb: sensor: Remove Lenovo IdeaPad D330 accel mount matrix (RHEL-72702)
  - Update hwdb (RHEL-72702)
  - hwdb: update autosuspend rules (RHEL-72702)
  - hwdb: Add ACCEL_MOUNT_MATRIX for variant of TERRA PAD 1061 (RHEL-72702)
  - hwdb: sensor: Add HP OmniBook Ultra Flip 14 accel mount matrix (#40076) (RHEL-72702)
  - hwdb: sensor: Remove Lenovo IdeaPad Duet 3 accel mount matrix (#40075) (RHEL-72702)
  - hwdb: Fix ACCEL_MOUNT_MATRIX for Lenovo Ideapad MIIX 310-ICR (#40067) (RHEL-72702)
  - hwdb: fix unstable button triggering on Mipad 2 under GNOME (#40071) (RHEL-72702)
  - Update hwdb (RHEL-72702)
  - hwdb: touchpad config for Apple MacbookPro12,1 Early 2015 (RHEL-72702)
  - Add Lenovo Y50-70 touchpad to 60-evdev.hwdb (RHEL-72702)
  - quirks: sensor: add info about ACPI accel_matrix (RHEL-72702)
  - quirks: Re-add D330 accel_matrix as identity one (#40226) (RHEL-72702)
  - quirks: touchpad: Set Duet 3 bt touchpad internal (RHEL-72702)
  - hwdb: Add missing scancodes for Lenovo Legion devices (RHEL-72702)
  - hwdb: Add missing vendor names for older AYANEO devices Adds AYADEVICE and AYA NEO vendor names. Early founders editon and 2021 models used these DMI values instead of AYANEO (RHEL-72702)
  - hwdb: add matrix for ASUS 2-in-1 T101HA (RHEL-72702)
  - hwdb: add HP EliteBoard Mic mute key mapping (RHEL-72702)
  - hwdb: Add GPD Pocket 4 chassis quirk (RHEL-72702)
  - hwdb: make three more hwdb files parsed by parse_hwdb.py (RHEL-72702)
  - hwdb: set touchpad resolution for all ThinkPad T49x chassis laptops (RHEL-72702)
  - hwdb: Update Lenovo Legion Go Models - Different BIOS versions of the Legion Go 2 can init the keyboard   device as set 1 (appears as raw set 2) or as set 2 (appears as   translated set 2). Add the Legion Go 2 to the Translated list. - While at it, specify the models in a more verbose manner for   posterity. (RHEL-72702)
  - hwdb: Add extended SteelSeries Arctis headset device support (#40479) (RHEL-72702)
  - hwdb: keyboard: fix typo CAPSLOCK to NUMLOCK (RHEL-72702)
  - hwdb: keyboard: uppercase apple id (RHEL-72702)
  - integritysetup: Add support for hmac-sha512 (RHEL-27852)
  - integritysetup: Add PHMAC algorithm to list of known algorithms (RHEL-27852)
  - core: increment start limit counter only when we can start the unit (RHEL-115032)
  - TEST-07-PID1: wait for systemd-resolved being stopped (RHEL-115032)
  - test: extend start limit interval (RHEL-115032)
  - userdbctl: optionally show user/group data from JSON filerather than from system (RHEL-143029)
  - man: fix typo (RHEL-143029)
  - test: fix test with -Dnetworkd=false (RHEL-143029)
  - ci: run apt-get update before running mkosi (RHEL-115001)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-23
changelog:
  - test-journal-dump: dump the headers of journal files (RHEL-106795)
  - journal: store counts, not byte sizes, in table size constants (RHEL-106795)
  - journal: treble field hash table size (RHEL-106795)
  - nspawn: move uid shift/chown() code into shared/ (RHEL-143036)
  - user-classification: add new "foreign" UID range (RHEL-143036)
  - userdb: synthesize stub user records for the foreign UID (RHEL-143036)
  - dissect: add new --shift command (RHEL-143036)
  - userdb: optionally parse numeric UIDs/GIDs where a username is expected (RHEL-143036)
  - userdbd: separate parameter structure of GetMemberships() varlink call from the GetUserRecord() one (RHEL-143036)
  - userdb: move setting of 'service' varlink parameter into userdb_connect() (RHEL-143036)
  - user-record: make a NULL UserDBMatch be equivalent to no filtering (RHEL-143036)
  - sd-varlink: add sd_varlink_get_description() call (RHEL-143036)
  - user-record: add helper for dispatching a disposition mask (RHEL-143036)
  - user-record: rename USER_DISPOSITION_MASK_MAX → USER_DISPOSITION_MASK_ALL (RHEL-143036)
  - user-record: add some helpers for working with UserDBMatch (RHEL-143036)
  - varlink: add new calls for server-side user record filtering to varlink IDL + to spec (RHEL-143036)
  - userdb: move UserDBMatch handling from userdbctl into generic userdb code to allow it to be done server side (RHEL-143036)
  - userdbd: implement server side filtering in the Multiplexer API (RHEL-143036)
  - homectl: port has_regular_user() + acquire_group_list() to use server-side filtering (RHEL-143036)
  - update TODO (RHEL-143036)
  - JSON User/Group records: Add properties for UUIDs (RHEL-143036)
  - userdb: add support for printing the UUID from user and group records (RHEL-143036)
  - userdb: add support for looking up users or groups by uuid. (RHEL-143036)
  - userdbctl: add --uuid filtering option (RHEL-143036)
  - userdbctl: add missing --uuid= to --help text (RHEL-143036)
  - userdb: fix typo (RHEL-143036)
  - man/userdbctl: fixup version info (RHEL-143036)
  - user-record: add a concept of inverting per-host matching sections in user record (RHEL-143034)
  - homectl: add interface for controlling storage for negative machine ID matches (RHEL-143034)
  - logind: also save pidfdid as part of session state, even if we don't parse it (RHEL-53112)
  - logind: support deserializing session leader through pidfdid (RHEL-53112)
  - TEST-35-LOGIN: test coldplug without fdstore on kernels with pidfd id (RHEL-53112)
  - logind: fix potential fd leak in deliver_session_leader_fd_consume() (RHEL-53112)
  - Revert "coredump: lock down EnterNamespace= mount even more" (RHEL-95219)
  - coredump: add compat support for SYSTEMD_COREDUMP_ALLOW_NAMESPACE_CHANGE (RHEL-95219)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-23.1
changelog:
  - ci: re-enable bpf-framework option for build and unit test jobs (RHEL-152080)
  - ci: add bpftool workaround to codeql job too (RHEL-152080)
  - ci: fix workaround about bpftool for codeql (RHEL-152080)
  - ci: add bpftool workaround to coverity too (RHEL-152080)
  - path-util: add flavour of path_startswith() that leaves a leading slash in place (RHEL-152080)
  - cgroup: port some code over to path_startswith_full() (RHEL-152080)
  - path-util: invert PATH_STARTSWITH_ACCEPT_DOT_DOT flag (RHEL-152080)
  - sd-json: fix off-by-one issue when updating parent for array elements (RHEL-152080)
  - core/cgroup: avoid one unnecessary strjoina() (RHEL-152080)
  - core: validate input cgroup path more prudently (RHEL-152080)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-23.2
changelog:
  - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163873)
  - nspawn: normalize pivot_root paths (RHEL-163873)
  - udev: check for invalid chars in various fields received from the kernel (RHEL-163879)
  - udev: ensure there is space for trailing NUL before calling sprintf (RHEL-163879)
  - udev: ensure tag parsing stays within bounds (RHEL-163879)
  - udev: fix review mixup (RHEL-163879)
  - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163879)
  - udev-builtin-net-id: print cescaped bad attributes (RHEL-163879)


author: Jan Macku <jamacku@redhat.com> - 257-3
changelog:
  - udev/net_id: introduce naming scheme for RHEL-9.6 (RHEL-44417)
  - Rebase to new upstream stable release v257.2 (RHEL-71409)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-4
changelog:
  - ci: use ubuntu 22:04 for deploy of man pages (RHEL-57603)
  - tree-wide: Fix python formatting (RHEL-57603)
  - ci: fix Packit (RHEL-57603)
  - ci: drop testing farm test (RHEL-57603)
  - dbus: stash the subscriber list when we disconenct from the bus (RHEL-73780)
  - manager: s/deserialized_subscribed/subscribed_as_strv (RHEL-73780)
  - shared/bus-util: move bus_message_read_id128() to bus-message-util (RHEL-73780)
  - shared/bus-util: move bus_message_hash_ops to bus-message-util (RHEL-73780)
  - shared/bus-util: move string set append/get funcs to bus-message-util and bus-get-properties, respectively (RHEL-73780)
  - shared/serialize: make input params const (RHEL-73780)
  - shared/serialize: introduce serialize_id128() (RHEL-73780)
  - bus-util: do not reset the count returned by sd_bus_track_count_name() (RHEL-73780)
  - core/manager: use FOREACH_ARRAY at one more place (RHEL-73780)
  - core/manager: drop duplicate bus track deserialization (RHEL-73780)
  - bus-util: introduce bus_get_instance_id() (RHEL-73780)
  - core: serialize API bus id and validate before deserializing bus tracks (RHEL-73780)
  - core/manager: restore bus track deserialization cleanup in manager_reload() (RHEL-73780)
  - shared/bus-util: add missing `set.h` include (RHEL-73780)
  - udevadm-test: add missing oom check (RHEL-75774)
  - udev-rules: replace 'type *func()' -> 'type* func()' (RHEL-75774)
  - udev-rules: do not change maximum log level when running in test mode (RHEL-75774)
  - udevadm-test: introduce -v/--verbose option to show verbose log messages (RHEL-75774)
  - udev-rules: show original token string in log_event_error() and friends (RHEL-75774)
  - udev-rules: logs result of format substitution (RHEL-75774)
  - udev-rules: add more trace logs for string match (RHEL-75774)
  - udev-rules: introduce udev_replace_chars_and_log() (RHEL-75774)
  - udev-rules: ignore whole command result if it is too long and does not contain newline (RHEL-75774)
  - udev-rules: update log messages (RHEL-75774)
  - udev-rules: add trace logs for GOTO and parent conditions (RHEL-75774)


author: Frank Ch. Eigler <fche@redhat.com> - 5.2-1
changelog:
  - Upstream release, see wiki page below for detailed notes.
  - https://sourceware.org/systemtap/wiki/SystemTapReleases


author: Frank Ch. Eigler <fche@redhat.com> - 5.3-1
changelog:
  - Upstream release, see wiki page below for detailed notes.
    https://sourceware.org/systemtap/wiki/SystemTapReleases


author: Petr Pisar <ppisar@redhat.com> - 2.5.9-12
changelog:
  - Correct a license tag to "(LGPL-2.1-or-later OR CPL-1.0) AND
    (LGPL-2.1-or-later OR GPL-2.0-or-later OR MPL-2.0 OR MPL-1.1)"


author: Petr Pisar <ppisar@redhat.com> - 2.5.12-1
changelog:
  - 2.5.12 bump
  - Correct a license tag to "(LGPL-2.1-or-later OR CPL-1.0) AND
    (LGPL-2.1-or-later OR GPL-2.0-or-later OR MPL-2.0)"


author: Than Ngo <than@redhat.com> - 12:20230311-18
changelog:
  - Fixed eufm font mapping
  - Added missing license and fixed file list in texlive-plain
  Related: RHEL-34826


author: Than Ngo <than@redhat.com> - 13:20240311-2
changelog:
  - removed obsoleted patch
  - fixed file conflicts in bibtex, oberdiek, xetex, attachfile, xepersian
  - fixed texlive-docindex conflict with texlive-base
  Related: RHEL-59868
  Resolves: RHEL-53483, RHEL-53786


author: Than Ngo <than@redhat.com> - 13:20240311-3
changelog:
  - include luajit for x86_64 only as it only supports this arch
  - fix requirement on tex-kpathsea, texlive-base
  - fix unicode issues
  - add rpminspect.yaml

  Related: RHEL-59868


author: Than Ngo <than@redhat.com> - 13:202403
changelog:
  - Add two subpackages for texlive 2024: firstaid, hypcap
    can't find latex2e-first-aid-for-external-files.ltx file
  - Drop luajittex
  Resolves: RHEL-65862


author: Than Ngo <than@redhat.com> - 13:20240311-6
changelog:
  - Resolves: RHEL-70243, remove xdvi due to removal of X11 in ghostscript
  - Resolves: RHEL-69757, fix python-sphinx FTBFS


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.14.1-75
changelog:
  - Add epoch prefix to version-release in requires
  - Add rpminspect.yaml to adjust configuration for rpminspect run
    Resolves: RHEL-56884


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-77
changelog:
  - Update OpenSSL certificates set up
    Resolves: RHEL-86503
  - Remove deprecated path from systemd service file
    Resolves: RHEL-86502


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-2
changelog:
  - Resolves: RHEL-50166 - Rebase tomcat to version 9.0.87
  - Resolves: RHEL-12274 - Use src.zip file as a Source0 instead of tar.gz
  - Resolves: RHEL-51277 - Prune changelog to remove non-relevant history
  - Resolves: RHEL-52906 - tomcat: Switch to using Java 21 as the default JDK
  - Resolves: RHEL-55194 - Fix changelog version
  - Resolves: RHEL-46156
    tomcat: Improper Handling of Exceptional Conditions (CVE-2024-34750)


author: Adam Krajcik <akrajcik@redhat.com> - 1:10.1.36-1
changelog:
  - Rebase tomcat to 10.1.36
  - Resolves: RHEL-82925
    tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)
  - Resolves: RHEL-87272
    tomcat: DoS in examples web application (CVE-2024-54677)
  - Resolves: RHEL-87273
    tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)
  - Resolves: RHEL-85343 - NoClassDefFoundError when using migration tool


author: Darren Archibald <darren.archibald@oracle.com> - 1:10.1.36-1.2
changelog:
  - tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
  - tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
  - apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
  - tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
  - tomcat: Apache Tomcat denial of service (CVE-2025-52520)
  - tomcat: Apache Tomcat denial of service (CVE-2025-53506)


author: Adam Krajcik <akrajcik@redhat.com> - 1:10.1.36-2
changelog:
  - Resolves: RHEL-108900
    tomcat: Apache  FileUpload DOS via part headers (CVE-2025-48976)
  - Resolves: RHEL-108902
    tomcat: Dos in multipart upload (CVE-2025-48988)
  - Resolves: RHEL-108904
    tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
  - Resolves: RHEL-108908
    tomcat: Denial of service (CVE-2025-53506)


author: Adam Krajcik <akrajcik@redhat.com> - 1:10.1.36-3
changelog:
  - Resolves: RHEL-102184
    tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
  - Resolves: RHEL-108906
    tomcat: Denial of service (CVE-2025-52520)


author: Adam Krajcik <akrajcik@redhat.com> - 1:10.1.36-3.el10_1.1
changelog:
  - Resolves: RHEL-124494
    tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)
  - Resolves: RHEL-91729
    tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)
  - Resolves: RHEL-132527
    tomcat: Denial of service (CVE-2025-61795)


author: Pietro Meloni <pmeloni@redhat.com> - 1:10.1.36-4
changelog:
  - Resolves: RHEL-124493
    tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)
  - Resolves: RHEL-132560
    tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)
  - Resolves: RHEL-132526
    tomcat: Denial of service (CVE-2025-61795)


author: Pietro Meloni <pmeloni@redhat.com> - 1:10.1.36-3.el10_1.1
changelog:
  - Resolves: RHEL-150719
    Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)


author: Pietro Meloni <pmeloni@redhat.com> - 1:10.1.49-2
changelog:
  - Resolves: RHEL-168577 Remove tomcat clustering JAR from RPM builds
    Resolves: CVE-2026-29146
    tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor
    Resolves: CVE-2026-34486
    tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-5
changelog:
  - Resolves: RHEL-82927
    tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-5.el10_0.1
changelog:
  - Resolves: RHEL-91750
    tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (CVE-2025-31650)
  - Resolves: RHEL-94960
    tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation (CVE-2024-56337)


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-7
changelog:
  - Resolves: RHEL-108485
    tomcat: Apache Commons FileUpload DOS via part headers (CVE-2025-48976)
  - Resolves: RHEL-108493
    tomcat: Dos in multipart upload (CVE-2025-48988)
  - Resolves: RHEL-108501
    tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
  - Resolves: RHEL-108509
    tomcat: Denial of service (CVE-2025-52434)
  - Resolves: RHEL-108522
    tomcat: Denial of service (CVE-2025-52520)
  - Resolves: RHEL-108517
    tomcat: Denial of service (CVE-2025-53506)


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-8
changelog:
  - Resolves: RHEL-102186
    tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)


author: Pietro Meloni <pmeloni@redhat.com> - 1:9.0.87-9
changelog:
  - Resolves: RHEL-124496
    tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)
  - Resolves: RHEL-132559
    tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)


author: Coty Sutherland <csutherl@redhat.com> - 1:9.0.110-1
changelog:
  - Resolves: RHEL-148687
    Update to 9.0.110 and compile with Java 25 to enable FFM features for PQC support


author: Coty Sutherland <csutherl@redhat.com> - 1:9.0.110-3
changelog:
  - Resolves: RHEL-168243 Fix copy/paste error in AJP connector that caused DELETE requests to be processed as OPTIONS requests (BZ#69848)


author: Pietro Meloni <pmeloni@redhat.com> - 1:9.0.117-1
changelog:
  - Resolves: RHEL-150720
    Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)
  - Resolves:
    Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (CVE-2026-34500)
  - Resolves:
    Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token (CVE-2026-34487)
  - Resolves:
    Tomcat: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor (CVE-2026-34486)
  - Resolves:
    Tomcat: Incomplete escaping of JSON access logs (CVE-2026-34483)
  - Resolves:
    Tomcat: The fix for CVE-2025-66614 was incomplete (CVE-2026-32990)
  - Resolves:
    Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default (CVE-2026-29146)
  - Resolves:
    Tomcat: OCSP checks sometimes soft-fail even when soft-fail is disabled (CVE-2026-29145)
  - Resolves:
    Tomcat: Configured TLS cipher preference order not preserved (CVE-2026-29129)
  - Resolves:
    Tomcat: Occasionally open redirect (CVE-2026-25854)
  - Resolves:
    Tomcat: Request smuggling via invalid chunk extension (CVE-2026-24880)
  - Resolves:
    Tomcat: Incomplete OCSP verification checks (CVE-2026-24734)
  - Resolves:
    Tomcat: Security constraint bypass (CVE-2026-24733)
  - Resolves:
    Tomcat: Client certificate verification bypass due to virtual host mapping (CVE-2025-66614)


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-2
changelog:
  - Initial commit on c10s
    Resolves: RHEL-69841
  - tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)


author: Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com> - 1:9.0.87-5.1
changelog:
  - Resolves: RHEL-91765
    tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (CVE-2025-31650)
  - Resolves: RHEL-71981
    tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation (CVE-2024-56337)


author: Craig Guiller <craig.guiller@oracle.com> - 1:9.0.87-5.3
changelog:
  - Resolves:
    tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
  - Resolves:
    tomcat: Apache Commons FileUpload DOS via part headers (CVE-2025-48976)
  - Resolves:
    tomcat: Dos in multipart upload (CVE-2025-48988)
  - Resolves:
    tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
  - Resolves:
    tomcat: Denial of service (CVE-2025-52434)
  - Resolves:
    tomcat: Denial of service (CVE-2025-52520)
  - Resolves:
    tomcat: Denial of service (CVE-2025-53506)


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-8.el10_1.1
changelog:
  - Resolves: RHEL-124497
    tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)
  - Resolves: RHEL-91732
    tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)


author: Adrian Freihofer <adrian.freihofer@gmail.com> 1.2.0-2
changelog:
  - tito: use release tagger (adrian.freihofer@gmail.com)
  - Revert "Automatic commit of package [tpm2-openssl] release [1.2.1-1]."
    (adrian.freihofer@gmail.com)
  - Automatic commit of package [tpm2-openssl] release [1.2.1-1].
    (adrian.freihofer@gmail.com)
  - run-with-simulator: backport from upstream (adrian.freihofer@gmail.com)


author: Sandro Bonazzola <sbonazzo@redhat.com> - 3.6.1-2
changelog:
  - Do not include RSS miner service on RHEL/ELN
    Original patch by Carlos Garnacho <cgarnach@redhat.com>
    https://gitlab.com/redhat/centos-stream/rpms/tracker-miners/-/commit/4507ad77005aad38cb17b7a72a779446dce0981c


author: Tomas Popela <tpopela@redhat.com> - 3.7.4-1
changelog:
  - Update to 3.7.4 and sync the macro naming with Fedora
    Resolves: RHEL-71387
  - Drop references to non-existent tracker-extract-3.service
    Resolves: RHEL-70242


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-50567
    - spec: create /etc/tuned/profiles directory
      resolves: RHEL-46721
    - hotplug: wait for device initialization
    - sap-netweaver: increased vm.max_map_count
    - daemon: buffer sighup signal
    - added an option to configure profile directories
    - api: added commands to dynamically create/destroy instances
    - functions: added 'intel_recommended_pstate'
    - functions: added 'log' which helps with debugging
    - functions: added 'package2cpus' and 'packages2uncores' matchers
    - functions: added 'lscpu' to list CPU details
    - plugins: added plugin_irq
    - plugin_video: added support for amdgpu `panel_power_savings` attribute
    - plugin_cpu: check that writes are necessary if they may cause redundant IPIs
    - plugin_uncore: allow to configure frequency limits using percent
    - amd-pstate: added support for controlling core performance boost
    - plugin_scheduler: adjusted error logging in _set_affinity
    - plugin_audio: enabled controller reset to fix suspend with NVIDIA
    - plugin_irq: fixed expansion of variables
    - plugin_irqbalance: switched to IRQBALANCE_BANNED_CPULIST


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-50567
    - clear plugin repository when stopping tuning
    - man: add description of the balanced-battery profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-3
changelog:
  - Fixed privileged execution of arbitrary scripts by active local user,
    (CVE-2024-52336)
    Resolves: RHEL-66636
  - Added sanity checks for API methods parameters, (CVE-2024-52337)
    Resolves: RHEL-66613


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.0-0.1.rc1
changelog:
  - new release
    - tuned-ppd: removed the use of StrEnum
    - tuned-ppd: fixed traceback
      resolves: RHEL-74384
    - tuned-ppd: multiple fixes and updates
    - docs: plugins docs are now automatically generated from the docstrings
    - plugin_cpu: fixed no_turbo boolean option parsing
    - plugin_cpu: allowed raw energy_performance_preference values
    - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
    - plugin_bootloader: added variables to BLS entries only if grub is used
    - plugin_scheduler: do not assume that perf events have type attribute
    - plugin_scheduler: updated sched knobs for kernels 6.6+
    - plugin_scheduler: log process info when its affinity cannot be changed
      resolves: RHEL-69933
    - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
    - plugin_scheduler: made perf support optional
    - plugin_net: added support for hotplug and rename
    - makefile: added support for installation to custom $BINDIR/$SBINDIR
    - functions: dropped cpuspeed support


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-70454
    - sap-hana: Set transparent_hugepages to madvise
      resolves: RHEL-68454
    - plugin_bootloader: export Grub variables to make them available in submenus
    - utils.commands: fixed CPU online detection when not present
    - plugin_net: handled cqe-mode-rx ethtool option
    - profiles: correct CPU governor settings


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.1-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-70454
    - plugins: added missing instance parameters
    - disk: added missing remove parameter
    - plugin_scheduler: added switch to disable processing of kthreads
    - Makefile: added support for installation to custom LIBEXECDIR
    - functions: create a new parser object for each string expansion


author: EL Errata <el-errata_ww@oracle.com> - 2.25.1-1.0.1
changelog:
  - Fix RPS/XPS and busy polling optimization not getting applied [Orabug: 32153315]
  - Fix error in uninstalling tuned [Orabug: 351528377]
  - Updated patch with the more recent version [Orabug: 30730976]
  - Set AMD CPU freq governor to ondemand when unapplying cpu tunings [Orabug: 30033199]
  - Restored the system rules in recommend.conf [Orabug: 29962987]
  - Added oci-nic profile and updated profiles-oci-recommend [Orabug: 29869969]
    for increasing combined channels to 16 on NICs with bnxt_en driver on BM
  - Do not access xps_cpus on single queue devices [Orabug: 29894296]
  - OL8 does not support System Purpose [Orabug: 29443881]
    Remove syspurpose_role option in recommend.conf.
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Modified the patch for ol8 [Orabug: 29560068] (james.cheng@oracle.com)
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.26.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-94809
    - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
    - tuned-ppd: enabled sysfs_acpi_monitor by default
    - tuned-ppd: fixed inotify watch for performance degradation
    - tuned-ppd: pinned virtual files in memory for inotify
    - fixed instance priority inheritance
      resolves: RHEL-94842
    - hotplug: added fixes for device remove race condition
    - tuned-main.conf: added startup_udev_settle_wait option
      resolves: RHEL-88238
    - functions: silenced errors if module kvm_intel does not exist
    - functions: make calc_isolated_cores return CPU ranges
    - scsi: used 'med_power_with_dipm' for SATA ALPM
    - scsi: do not set ALPM on external SATA ports
      resolves: RHEL-79913
    - network_latency: Set non-zero rcutree.nohz_full_patience_delay
    - realtime: disable appropriate P-State drivers
    - plugin_disk: added support for MMC (MultiMediaCard) devices
    - udev: fix possible traceback in device matcher
      resolves: RHEL-97087
    - udev-settle: obey udev buffer size and handle possible tracebacks
      resolves: RHEL-92637
    - daemon: re-raise daemon init exception in no-daemon mode
    - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
    - gui: fix the profile deleter script


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.27.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-123608
    - cpu-partitioning: autodetect dracut hook directory, systemd workaround
      resolves: RHEL-40619
    - openshift: optimize TCP settings for high throughput and low latency
    - profiles: Set boost=1 in *-performance profiles
    - sap-hana: force latency to 70 us, not to C-states
      resolves: RHEL-142285
    - man: fixed instance_acquire_devices example in tuned-adm man
      resolves: RHEL-90575
    - spec: use correct python interpreter for documentation installation
    - sysctl: add reapply_sysctl_exclude option
    - ppd: ask tuned recommend for base profile


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
  - Rebase to tzdata-2023d
    - Include time zone changes for Ittoqqortoormiit, Greenland
      and Vostok, Antarctica.
    - Update the expiration date for the leap-seconds.list file.
      No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2023d-2
changelog:
  - Migrate License field to SPDX identifiers for
    https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
  - Rebase to tzdata-2024a
    - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
    - Palestine will spring forward a week later than previously
      predicted.


author: Patsy Griffin <patsy@redhat.com> - 2024a-3
changelog:
  - Add java patch to fix incorrect calculations for
    Africa/Casablanca starting in 2027. (RHEL-32178)
  - Remove hardcoded versioned path to javac.


author: Patsy Griffin <patsy@redhat.com> - 2024b-1
changelog:
  - Update to tzdata-2024b
    - Improve historical data for Mexico, Mongolia, and Portugal.
    - System V names are now obsolescent.
    - The main data form now uses %z.
    - The code now conforms to RFC 8536 for early timestamps.
    - Support POSIX.1-2024, which removes asctime_r and ctime_r.
    - Assume POSIX.2-1992 or later for shell scripts.
    - SUPPORT_C89 now defaults to 1.
    - Include two upstream patches for month names as in April vs Apr.
  - Harden against links to removed zones


author: Patsy Griffin <pats@redhat.com> - 2025a-1
changelog:
  Update to tzdata-2025a (RHEL-74296)
    - Paraguay is now permanently at -03. This impacts timestamps
      starting on 2025-03-22.
    - Includes improvements to pre-1991 data for the Philippines.
    - Etc/Unknown is now reserved.


author: Patsy Griffin <patsy@redhat.com> - 2025b-1
changelog:
  - Update to tzdata-2025b (RHEL-84740)
    - Chile's Aysén Region moves from -04/-03
      to -03 year-round, diverging from America/Santiago and
      creating a new zone America/Coyhaique.


author: Patsy Griffin <patsy@redhat.com> - 2026a-1
changelog:
  - Update to tzdata-2026a (RHEL-154023)
    - Correct the transition times for Moldova.
    - The POSIXRULES option is now obsolete.


author: Patsy Griffin <patsy@redhat.com> - 2026b-1
changelog:
  - Update to tzdata-2026b (RHEL-170780)
    - British Columbia’s 2026-03-08 spring forward is expected
      to be its last transition as it moves to permanent -07.


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2026c-1
changelog:
  - Update to tzdata-2026c (RHEL-194097)
    - Alberta moved to permanent -06 on 2026-06-18.
    - Morocco moves to permanent +00 on 2026-09-20.


author: Vit Mojzis <vmojzis@redhat.com> - 0.2.7-5
changelog:
  - Show diff when checking formatting
  - Fix several lint findings
  - Fix generating policy for Crio mounts


author: Jens Petersen <petersen@redhat.com> - 15.1.0-0.1
changelog:
  - update to draft 15.1.0: https://unicode.org/versions/Unicode15.1.0/
  - do not add copyright.html file from website
  - add missing Unicode-TOU license tag


author: Packit <hello@packit.dev> - 2.3.12-1
changelog:
  - New Release 2.3.12 (lurcher)
  - Don't check state with shared env (lurcher)
  - Add --enable-singleenv option (lurcher)
  - Allow longer messages via SQLGetDiag (lurcher)
  - Add --enable-utf8ini flag and coding (lurcher)
  - Fix possible seg faults with SQLAPI and pooling (lurcher)
  - Fix possible seg faults with SQLAPI and pooling (lurcher)
  - Remove self-reference (Stefan)
  - Avoid implicit function declarations, for C99 compatibility (Florian Weimer)
  - Fix --enable-stats config error (lurcher)
  - Allow diagnostics to be retrieved on SQL_NO_DATA (Kevin Adler)
  - isql.1: Add information about passwords containing semicolons (Hugh McMaster)
  - isql.1: Various text updates (Hugh McMaster)
  - Export __clear_ini_cache from libodbcinst (lurcher)
  - Revert "Add call to atexit to clear the ini cache" (lurcher)
  - Add call to atexit to clear the ini cache (lurcher)
  - Add extra iusql connectionstring syntax (lurcher)
  - Allow longer connection strings (part 3) (lurcher)
  - Allow longer connection strings (part 2) (lurcher)
  - Allow longer connection strings (lurcher)
  - Fixed Connection String (Stefan)
  - Add extra connection syntax to isql help (lurcher)
  - Add extra logging for ODBCINST connect settings (lurcher)
  - Allow isql to handle SQLPrepare returning SQL_SUCCESS_WITH_INFO (and report warning) (lurcher)
  - Allow isql to handle SQLPrepare returning SQL_SUCCESS_WITH_INFO (lurcher)
  - Allow passing complete connection string into iusql (lurcher)
  - Remove __get_connection from cursor lib (lurcher)
  - Avoid failed build if clock_gettime() is not available (lurcher)
  - Update change log (lurcher)
  - DriverManager/_info.c: Get locale encoding on Windows. (Markus Mützel)
  - DriverManager/drivermanager.h: fix build without threads (Fabrice Fontaine)
  - Fix iconv handle leak with pooling (lurcher)
  - Fix buffer overrun (lurcher)
  - Create SECURITY.md (Nick Gorham)
  - Move to 2.3.12pre (lurcher)
  - Makefile.am: Do not install config.h (Hugh McMaster)


author: Kate Hsuan <hpa@redhat.com> - 1.90.6-1
changelog:
  - Update to upstream version 1.90.6
  - Update to the upstream version 1.90.6
  - Include a fix patch for "incorrect external device battery update" issue.
    Link: https://gitlab.freedesktop.org/upower/upower/-
    /commit/7d7bb84fde91bef9ee7eba924cbdfa74639cc4fe


author: Kate Hsuan <hpa@redhat.com> - 1.90.8-1
changelog:
  - Update to the upstream version 1.90.8
  - Update to 1.90.8
  - README and HACKING were renamed to README.md and HACKING.md
  - Support zsh-completion
  - Resolve memory leak when connecting/disconnecting and refreshing the
    battery info.


author: Attila Lakatos <alakatos@redhat.com> - 1.1.3-2
changelog:
  - Rebase to 1.1.3
  - Update usbguard-selinux subpackage
  - Include usbguard-notifier subpackage
  Resolves: RHEL-37322
  - Disable logging to console


author: Attila Lakatos <alakatos@redhat.com> - 1.1.4-1
changelog:
  - Rebase to 1.1.4
  - selinux: comply with with the "Unify bin and sbin" change
    Resolves: RHEL-113206
  - Restore permissions of the log directory
    Resolves: RHEL-92260


author: Sérgio Basto <sergio@serjux.com> - 1.6.2-61
changelog:
  - Use standard Fedora linker flags (bug #1548666)
    https://src.fedoraproject.org/rpms/uuid/pull-request/1


author: Mark Wielaard <mjw@redhat.com> - 3.23.0-1
changelog:
  - Upstream 3.23.0 final
  - configure --enable-lto
  - Remove all upstreamed patches
  - Add BuildRequires: python3-devel for running testsuite.
  - Update license tags to spdx


author: Mark Wielaard <mjw@redhat.com> - 3.23.0-4
changelog:
  Add upstream VALGRIND_3_23_BRANCH patches
    0001-Prepare-NEWS-for-branch-3.23-fixes.patch
    0002-486180-MIPS-VexGuestArchState-has-no-member-named-gu.patch
    0003-Bug-486293-memccpy-false-positives.patch
    0004-Bug-486569-linux-inotify_init-syscall-wrapper-missin.patch
    0005-aarch64-frinta-and-frinta-vector-instructions.patch
    0006-mips-skip-using-shared-syscall-numbers-for-mips32.patch
    0007-Fix-uninitialized-err-in-handle_extension.patch
    0008-Avoid-use-of-guest_IP_AT_SYSCALL-in-handle_extension.patch
    0009-s390x-Minor-fixes-in-extension-s390x.c.patch
    0010-Bug-453044-gbserver_tests-failures-in-aarch64.patch
    0011-Linux-regtest-reallocarray-needs-malloc.h.patch
    0012-Bug-487439-SIGILL-in-JDK11-JDK17.patch
    0013-Don-t-leave-fds-created-with-log-file-xml-file-or-lo.patch
    0014-Close-both-internal-pipe-fds-after-VG_-fork-in-paren.patch
    0015-Don-t-allow-programs-calling-fnctl-on-valgrind-s-own.patch
    0016-mips-skip-using-shared-syscall-numbers-for-mips64.patch
    0017-gdbserver_tests-filters-remove-python-rpm-module-loa.patch
    0018-Implement-VMOVQ-xmm1-xmm2-m64.patch
    0019-arm64-Fix-fcvtas-instruction.patch
    0020-gdbserver_tests-filters-remove-more-verbose-python-r.patch
    0021-Avoid-dev-inode-check-on-btrfs-with-sanity-level-3.patch


author: Mark Wielaard <mjw@redhat.com> - 3.24.0-2
changelog:
  - Add VALGRIND_3_24_BRANCH patches
    0001-Prepare-NEWS-for-branch-3.24-fixes.patch
    0002-vgdb.c-fork_and_exec_valgrind-Fix-off-by-one-error-w.patch
    0003-vgdb.c-fork_and_exec_valgrind-Fix-another-off-by-one.patch
    0004-regtest-add-a-fdleak-filter-for-write-on-write-on-li.patch
    0005-Add-exp-and-supp-patterns-for-missing-main-frame-for.patch
    0006-Add-additional-exp-ppc64le-files-to-EXTRA_DIST.patch
    0007-Add-support-for-landlock_create_ruleset-444-landlock.patch
    0008-helgrind-tests-tc17_sembar.c-Remove-bool-typedef.patch
    0009-drd-tests-swapcontext.c-Rename-typedef-struct-thread.patch
    0010-none-tests-bug234814.c-sa_handler-take-an-int-as-arg.patch
    0011-Add-open_tree-move_mount-fsopen-fsconfig-fsmount-fsp.patch


author: Mark Wielaard <mjw@redhat.com> - 3.24.0-3
changelog:
  - Add more VALGRIND_3_24_BRANCH patches
    0012-Recognize-new-DWARF5-DW_LANG-constants.patch
    0013-Bug-498317-FdBadUse-is-not-a-valid-CoreError-type-in.patch
    0014-linux-support-EVIOCGRAB-ioctl.patch


author: Mark Will <mark.will@oracle.com> - 3.24.0-5
changelog:
  - More VALGRIND_3_24_BRANCH patches
    0015-ppc-test_dfp2-build-fix-for-GCC-15.patch
    0016-syswrap-generic-Emit-pp_ExeContext-after-the-file-de.patch
    0017-add_hardwired_spec-for-ld-linux-x86-64.so.2-memcmp.patch
    0018-gdbserver_tests-filter-out-new-Missing-rpms-message.patch


author: Mark Wielaard <mjw@redhat.com> - 3.24.0-4
changelog:
  - Split main valgrind package into several subpackages:
    - valgrind now contains just the core tools.
    - valgrind-scripts contains the post-processing scripts for callgrind,
      cachegrind, massif and dhat which depend on perl and python.
    - valgrind-gdb contains the debuginfo client/server and (v)gdb support.
    - valgrind-docs contains the man pages, html and pdf manual.
  - Adjust Requires/Recommends to subpackages can be installed independently.
    - valgrind-devel now Recommends, instead of Requires, valgrind.
    - valgrind-gdb Requires valgrind
    - valgrind-scripts Recommends valgrind-gdb
    - valgrind-gdb Recommends gdb


author: Mark Wielaard <mjw@redhat.com> - 3.25.1-2
changelog:
  - Add VALGRIND_3_25_BRANCH patches
    - 0001-Prepare-NEWS-for-branch-3.25.x-fixes.patch
    - 0002-Bug-503241-s390x-Support-z17-changes-to-the-NNPA-ins.patch


author: Mark Wielaard <mjw@redhat.com> - 3.26.0-1
changelog:
  - Valgrind 3.26.0 final
  - Remove all VALGRIND_3_25_BRANCH and proposed upstream patches
  - Refresh some-stack-protector and some-Wl-z-now patches.
  - Add vgstack to valgrind-gdb.
  - Update License to GPL-3.0-or-later
  - Clarify License of valgrind-scripts.


author: Mark Wielaard <mjw@redhat.com> - 3.26.0-4
changelog:
  - Add VALGRIND_3_26_BRANCH patches
    - 0001-Prepare-NEWS-for-branch-3.26-fixes.patch
    - 0002-Bug-511972-valgrind-3.26.0-tests-fail-to-build-on-up.patch
    - 0003-readlink-proc-self-exe-overwrites-buffer-beyond-its-.patch
    - 0004-Linux-DRD-suppression-add-an-entry-for-__is_decorate.patch
    - 0005-Linux-Helgrind-add-a-suppression-for-_dl_allocate_tl.patch
    - 0006-Disable-linux-madvise-MADV_GUARD_INSTALL.patch
    - 0007-Bug-514613-Unclosed-leak_summary-still_reachable-tag.patch
    - 0008-Bug-514206-Assertion-sr_isError-sr-failed-mmap-fd-po.patch


author: Remi Collet <rcollet@redhat.com> - 7.2.6.1
changelog:
  - rebase to 7.2.6
  - merge limit.conf in main service files
  - drop /etc/sysconfig/valkey
  - rename compat package
  - fix working dir
  - partially enable upstream test suite


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.4.2-1
changelog:
  - New upstream release. A security release
  - Includes fix for CVE-2023-44487 aka VSV00013, rhbz#2243328, HTTP/2 Rapid Reset Attack


author: Luboš Uhliarik <luhliari@redhat.com> - 7.6.0-3
changelog:
  - Resolves: RHEL-59267 - varnish rebase to 7.6.0
  - Resolves: RHEL-30333 CVE-2024-30156 varnish: HTTP/2 Broken Window
    Attack may result in denial of service


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.076-2
changelog:
  - enable building without GPM support - build with GPM in Fedora
  - 2262371 - gvim: symbol lookup error: gvim: undefined symbol: g_once_init_enter_pointer


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-5.1
changelog:
  - RHEL-113550 CVE-2025-53906 vim: Vim path traversal
  - RHEL-113544 CVE-2025-53905 vim: Vim path traversial


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-6
changelog:
  - RHEL-113549 CVE-2025-53906 vim: Vim path traversal
  - RHEL-113543 CVE-2025-53905 vim: Vim path traversial


author: Petr Dancak <pdancak@redhat.com> - 2:9.1.083-6.2
changelog:
  - RHEL-155425 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin


author: Petr Dancak <pdancak@redhat.com> - 2:9.1.083-6.2
changelog:
  - RHEL-155409 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file


author: Petr Dancak <pdancak@redhat.com> - 2:9.1.083-6.3
changelog:
  - RHEL-159615 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:9.1.083-9.7
changelog:
  - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave()
  - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-9
changelog:
  - RHEL-155426 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-9
changelog:
  - RHEL-155410 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-9.1
changelog:
  - RHEL-159616 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-9.3
changelog:
  - RHEL-170123 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite
    via path traversal bypass


author: Jonathon Jongsma <jjongsma@redhat.com> - 4.1.0-7
changelog:
  - cloner: Sync <uuid> and <sysinfo> system uuid (RHEL-34608)
  - virtinstall: fix regression with --boot and no install method (RHEL-34608)
  - progress: Fix showing correct final total (RHEL-34608)
  - virtinstall: Fix the allocating disk size printed by the progress bar (RHEL-34608)
  - virtinstall: Hide total_size in the progress bar if it doesn't need (RHEL-34608)
  - virt-install: Recommend '--boot uefi' (RHEL-34608)
  - virt-install: Document Secure Boot setups (RHEL-34608)
  - tests: Add more cloud-init and TPM test cases (RHEL-34608)
  - installer: drop default TPM for --cloud-init install phase (RHEL-34608)
  - Add gating for centos stream 10 (RHEL-34608)
  - xmleditor: make gtksourceview optional (RHEL-35859)


author: Pavel Hrdina <phrdina@redhat.com> - 5.0.0-1
changelog:
  - Rebased to virt-manager-5.0.0 (RHEL-46783)
  - The rebase also fixes the following bugs:
      RHEL-50653, RHEL-65105, RHEL-62960, RHEL-46282, RHEL-65371
      RHEL-65189, RHEL-66768


author: Pavel Hrdina <phrdina@redhat.com> - 5.1.0-1
changelog:
  - Rebased to virt-manager-5.1.0 (RHEL-119228)
  - The rebase also fixes the following bugs:
      RHEL-105818


author: Pavel Hrdina <phrdina@redhat.com> - 5.1.0-2
changelog:
  - virtinst: interface: add support for backend.hostname and backend.fqdn (RHEL-95370)
  - maint: use constants instead of strings for boot devices (RHEL-71842)
  - virtinst: rework get_boot_order (RHEL-71842)
  - virtinst: guest: introduce can_use_device_boot_order (RHEL-71842)
  - virtinst: remove legacy attribute from set_boot_order/get_boot_order (RHEL-71842)
  - installer: add support to use device boot order (RHEL-71842)


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.10.0-5
changelog:
  - Rebase to virt-v2v 2.10.0
    resolves: RHEL-111241
  - Synchronize spec file with Fedora.
  - Tighten permissions on windows C:\Program Files\Guestfs
    resolves: RHEL-104352
  - Don't output floppy XML with qemu lacks support
    resolves: RHEL-90175
  - convert: linux: Ignore /etc/lvm/archive/*.vg files
    resolves: RHEL-113820
  - mlcustomize/inject_virtio_win.ml: Use viostor.inf instead of guestor
    resolves: RHEL-112517
  - Fix for setting boot order for Linux guests based on grub location
    resolves: RHEL-115989, RHEL-115990
  - Remove virt-v2v subscription manager options
    resolves: RHEL-122308
  - Handle subdirectories in nbdkit vddk export wildcard
    resolves: RHEL-121728
  - Further fixes for nbdkit vddk export wildcard
    resolves: RHEL-122753
  - Fix ESP conversion if C:\Windows\Temp has alternate case
    resolves: RHEL-124569
  - setfiles runs out of memory in glibc fts_read (doc fix)
    resolves: RHEL-125116
  - Use AV and GPO information from inspection instead of open coding
    resolves: RHEL-125956
  - Remove reduce-memory-pressure=on as workaround for Dell Powermax 8000
    resolves: RHEL-135617
  - Hard depend on libnbd 1.24
    resolves: RHEL-140894
  - Add documentation about BitLocker Recovery
    resolves: RHEL-103915
  - Fix regression when converting vmx+ssh with snapshots
    resolves: RHEL-102938
  - Expose XFS version in virt-v2v-inspector
    resolves: RHEL-144075
  - Fix Debian 12 UEFI conversions
    resolves: RHEL-144467
  - Fix import when datastore name has characters like '+'
    resolves: RHEL-133729
  - Replace /etc/crypttab /dev/sdX with UUID
    resolves: RHEL-93583
  - Replace '/' in output name with '_'
    resolves: RHEL-136479


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.10.0-13
changelog:
  - Stop using maxmem (xfs_repair -m option)
    resolves: RHEL-169321
  - Fix CHS geometry error for Veritas/Sun partitions
    resolves: RHEL-169225


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.10.0-16
changelog:
  - Fix binary LUKS keys
    resolves: RHEL-174520
  - Windows firstboot: Add exit code 250 to skip reboots
    Rework documentation for firstboot feature
    resolves: RHEL-174516
  - Use cgroups in SMP calculation
    resolves: RHEL-174512


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.10.0-17
changelog:
  - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing)
    related: RHEL-174515
  - Fix location of Windows Vista and Windows 2008 Server R1 drivers
    resolves: RHEL-174513


author: EL Errata <el-errata_ww@oracle.com> - 2.10.0-17.0.1
changelog:
  - Replaced bugzilla.oracle.com references [Orabug: 34202300]
  - replaced upstream references [Orabug:34089586]


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.10.0-18
changelog:
  - Add <disk> <boot-order>#</boot-order> to XML output
    resolves: RHEL-193138
  - Add new --collect option to collect pre-conversion information
    resolves: RHEL-192947
  - Retry qemu-ga installer on failure
    resolves: RHEL-193139
  - Fix conversions of encrypted Ubuntu guests (second attempt)
    resolves: RHEL-192921
  - Skip fsck after conversion for RHEL 7
    resolves: RHEL-192948


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.10.0-20
changelog:
  - Fix SELinux relabelling of podman rootless containers
    resolves: RHEL-239852
  - Add --selinux-relabel-exclude parameter
    resolves: RHEL-239809
  - Add --selinux-relabel-at-boot parameter
    resolves: RHEL-RHEL-240649
  - Change '::' to 'REM' in Windows batch files for improved reliability
    resolves: RHEL-239810


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.7.1-4
changelog:
  - Rebase to virt-v2v 2.7.1
    resolves: RHEL-56814
  - Replace Jansson with json-c
    resolves: RHEL-65297
  - Find drivers for win2025 guests
    resolves: RHEL-65009
  - in-place: Add new -O option to write inspector XML
    resolves: RHEL-70538
  - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper
    resolves: RHEL-78505
  - convert: Use yum/apt/... for package removals
    resolves: RHEL-78657


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.8.1-9
changelog:
  - Rebase to virt-v2v 2.8.1
    related: RHEL-81735
  - Fix virt-v2v -v --install dnf5 error
    resolves: RHEL-83288
  - Print blkhash of converted image in virt-v2v debugging output
    resolves: RHEL-85514
  - Document dracut network-legacy conversion failure
    resolves: RHEL-55732
  - Print nbdcopy command in debug output
    resolves: RHEL-86088
  - Remove usage of nbdkit-cacheextents-filter
    resolves: RHEL-88860
  - Print better mountpoint stats in debug output
    resolves: RHEL-88862
  - Remove several ancient, deprecated options
    resolves: RHEL-88867
  - virt-v2v-inspector is failing on snapshots of running VMs
    resolves: RHEL-88544
  - Add virt-v2v-open tool
    resolves: RHEL-89993
  - Run filesystem check before and after conversion
    resolves: RHEL-91931
  - virt-v2v fails to convert XFS guest with dirty filesystem
    resolves: RHEL-95365
  - virt-v2v fails to convert guests with e2fsck errors
    resolves: RHEL-97600
  - Improve layout of man page
    resolves: RHEL-99745
  - Fix xfs_repair out of memory error
    resolves: RHEL-99313
  - Remove virt-v2v -io vddk-noextents=true option
    resolves: RHEL-102619
  - Add -o kubevirt -oo disk and -oo create options
    resolves: RHEL-101599
  - Fix escaping of nbdkit-vddk-plugin export parameter
    resolves: RHEL-102734
  - Fix installation of drivers on firstboot with pending reboots
    resolves: RHEL-103356
  - Log the version of libnbd / nbdcopy in virt-v2v output
    resolves: RHEL-104018
  - Fix SELinux relabelling in Linux split-/usr
    resolves: RHEL-109130
  - Set boot order for Linux guests based on grub location
    resolves: RHEL-108991


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.8.1-10
changelog:
  - Fix setting boot order for Linux BIOS guests
    resolves: RHEL-108991
  - Set boot order for guests in -o kubevirt output mode
    resolves: RHEL-110742


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.8.1-15
changelog:
  - v2v can't convert guest with multiple windows OS on rhel10
  - Add runtime requires for nbdkit-1.44.1-3.el10_1
    resolves: RHEL-137304


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.8.1-22
changelog:
  - Stop using maxmem (xfs_repair -m option)
    resolves: RHEL-169173
  - Fix CHS geometry error for Veritas/Sun partitions
    resolves: RHEL-169224


author: Colin Walters <walters@verbum.org> - 1.7.0-5
changelog:
  - Rebuild with latest vhost-user-backend; xref
    https://gitlab.com/virtio-fs/virtiofsd/-/issues/62#note_1584371000


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.11.1-1
changelog:
  - Update to upstream version 1.11.1 [RHEL-48645]
  - Resolves: RHEL-48645
    (Rebase virtiofsd to latest version for RHEL 10.0 Beta)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.13.0-1
changelog:
  - Rebase to 1.13.0 [RHEL-69290]
  - Resolves: RHEL-69290
    (Rebase virtiofsd to latest version for RHEL 10.0)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.13.2-1
changelog:
  - Rebase to 1.13.2 [RHEL-97010]
  - Resolves: RHEL-97010
    (Rebase virtiofsd to latest version for RHEL 9.6.z)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.13.3-1
changelog:
  - Rebase to 1.13.3 [RHEL-133034]
  - Resolves: RHEL-133034
    (Rebase virtiofsd to latest version for RHEL 10.2)


author: Brian C. Lane <bcl@redhat.com> - 35.11-1
changelog:
  - New release: 35.11 (bcl)
  - build(deps): bump github.com/BurntSushi/toml from 1.3.0 to 1.3.1 (49699333+dependabot[bot])
  - build(deps): bump github.com/stretchr/testify from 1.8.3 to 1.8.4 (49699333+dependabot[bot])
  - CI: Update terraform hash (bcl)
  - build(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.0 (49699333+dependabot[bot])
  - build(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.3 (49699333+dependabot[bot])
  - docs: fix typo/formatting in HACKING.md (idiez)
  - Add release creation documentation (bcl)


author: Daiki Ueno <dueno@redhat.com> - 1.24.5-5
changelog:
  - Revert back to using GnuTLS as the TLS backend
  - Use bundled implementation of MD4 for NTLM
    Resolves: RHEL-69748 - wget cannot open pkcs11 uri


author: Michal Ruprich <mruprich@redhat.com> - 1:4.4.2-1
changelog:
  - Resolves: RHEL-69442 - Rebase wireshark to 4.4.2
  - Resolves: RHEL-68453 - Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
  - Resolves: RHEL-68452 - Buffer Over-read in Wireshark


author: Michal Ruprich <mruprich@redhat.com> - 1:4.4.2-2
changelog:
  - Resolves: RHEL-80274 - Uncontrolled Recursion in Wireshark
  - Resolves: RHEL-93153 - wireshark-cli's %post uses /usr/bin/udevadm but missing systemd-udev


author: Craig Guiller <craig.guiller@oracle.com> - 0.18-6.1
changelog:
  - Backport patches to install systemd units to fix initialization races
    Resolves: RHEL-79119
  - Fix minor spec formatting inconsistencies


author: Rafael Guterres Jeffman <rjeffman@redhat.com> - 1.1.3-15
changelog:
  - Use "grep -E" instead of the obsoleted "egrep"
    Resolves: BZ#2140197
  - mark LICENSE as %license
  - Spec cleanup
  - Small patches, as a rule, are in git dist, to be more easy to read.
  - Migrated to SPDX license (noop)


author: Eric Sandeen <sandeen@redhat.com> - 6.10.1-1
changelog:
  - Update to latest upstream version
  - Fix C++ compilation errors in xfs_fs.h
  - Related: rhbz#2309693, rhbz#2308609


author: Darrick J. Wong <darrick.wong@oracle.com> 6.12.0-1.0.1
changelog:
  - Add mkfs configuration files for OL.
  - Add mkfs.xmem script.
  - Enable background online fsck services by default.  Users must set autofsck=1 on their filesystems.
  - Rebase atop latest upstream.


author: Tomas Halman <thalman@redhat.com> - 1.2.39-1
changelog:
  - Resolves: RHEL-46771
    Rebase to version 1.2.39
    Fix openssl engine dependency
    Stop building gcrypt and gnutls implementations


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.1-4
changelog:
  - Remove unneeded build dependencies on xorg-x11-util-macros and libXpm
  - Remove unneeded build dependency on wayland-eglstream-protocols (RHEL-66317)


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.5-2
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-80504), CVE-2025-26595 (RHEL-80505),
                 CVE-2025-26596 (RHEL-80510), CVE-2025-26597 (RHEL-80511),
                 CVE-2025-26598 (RHEL-80513), CVE-2025-26599 (RHEL-80512),
                 CVE-2025-26600 (RHEL-80517), CVE-2025-26601 (RHEL-80516)


author: Tomas Pelka <tpelka@redhat.com> - 24.1.5-3
changelog:
  Rebuild for 10.0.z required due to issue when releasing original erratum.
  - CVE fix for: CVE-2025-26594 (RHEL-80504), CVE-2025-26595 (RHEL-80505),
                 CVE-2025-26596 (RHEL-80510), CVE-2025-26597 (RHEL-80511),
                 CVE-2025-26598 (RHEL-80513), CVE-2025-26599 (RHEL-80512),
                 CVE-2025-26600 (RHEL-80517), CVE-2025-26601 (RHEL-80516)


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.5-4
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97129), CVE-2025-49176 (RHEL-97135),
                 CVE-2025-49177 (RHEL-97141), CVE-2025-49178 (RHEL-97147),
                 CVE-2025-49179 (RHEL-97153), CVE-2025-49180 (RHEL-97159)


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.5-2
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-79127), CVE-2025-26595 (RHEL-79131),
                 CVE-2025-26596 (RHEL-79142), CVE-2025-26597 (RHEL-79144),
                 CVE-2025-26598 (RHEL-79145), CVE-2025-26599 (RHEL-79147),
                 CVE-2025-26600 (RHEL-79155), CVE-2025-26601 (RHEL-79151)


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.5-4
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97130), CVE-2025-49176 (RHEL-97136),
                 CVE-2025-49177 (RHEL-97142), CVE-2025-49178 (RHEL-97148),
                 CVE-2025-49179 (RHEL-97154), CVE-2025-49180 (RHEL-97160)


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.5-5
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119964), CVE-2025-62230 (RHEL-120013),
                 CVE-2025-62231 (RHEL-125006)


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.5-5
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119965), CVE-2025-62230 (RHEL-120014),
                 CVE-2025-62231 (RHEL-125004)


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.5-6
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163188
    Resolves: https://redhat.atlassian.net/browse/RHEL-163284
    Resolves: https://redhat.atlassian.net/browse/RHEL-163242


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.5-5
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119966), CVE-2025-62230 (RHEL-120012),
                 CVE-2025-62231 (RHEL-125005)


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-3
changelog:
  - Fix a regression in Xwayland 24.1.9 with XTS test Xlib10
    Resolves: https://redhat.atlassian.net/browse/RHEL-169767


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-4
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163189
    Resolves: https://redhat.atlassian.net/browse/RHEL-163285
    Resolves: https://redhat.atlassian.net/browse/RHEL-163243


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-4.1
changelog:
  - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258,
                 CVE-2026-50259, CVE-2026-50260, CVE-2026-50261,
                 CVE-2026-50262, CVE-2026-50263
    Resolves: https://redhat.atlassian.net/browse/RHEL-182443


author: Olivier Fourdan <ofourdan@redhat.com> - 0.0.4-1
changelog:
  - Update to 0.0.4
  - Require xorg-x11-xauth and dbus-daemon
  - Use mutter as default compositor if none is specified


author: Olivier Fourdan <ofourdan@redhat.com> - 0.0.4-2
changelog:
  - Backport fix for waitpid errors (RHEL-46355)
  - Suggest mutter since this is the default compositor


author: Jakub Martisko <jamartis@redhat.com> - 0.13.78-2
changelog:
  - Fix directory traversal in unzip binary
  - Disable the CVE tests during the check phase - the reproducers for these are downloaded from the github
  - Resolves: RHEL-105822


