# changelog

author: Karolina Surma <ksurma@redhat.com> - 3.14.4-1
changelog:
  - Update to Python 3.14.4
  - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865
  Related: RHEL-167918, RHEL-168160


author: Charalampos Stratakis <cstratak@redhat.com> - 3.14.4-2
changelog:
  - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100
  Resolves: RHEL-167918, RHEL-168160


author: Miro Hrončok <mhroncok@redhat.com> - 3.14.5~rc1-1
changelog:
  - Update to 3.14.5rc1
  - Move back to the generational from the incremental garbage collector
  - Security fix for CVE-2026-6019
  Resolves: RHEL-180642


author: Python Maint <python-maint@redhat.com> - 1.1.2-1
changelog:
  - Initial package
  - Fedora contributions by:
        Benjamin A. Beasley <code@musicinmybrain.net>
        Carl George <carl@george.computer>
        Damien Ciabrini <dciabrin@redhat.com>
        Haïkel Guémar <hguemar@fedoraproject.org>
        Iryna Shcherbina <ishcherb@redhat.com>
        Itamar Reis Peixoto <itamar@ispbrasil.com.br>
        Julien Enselme <jujens@jujens.eu>
        Lumír Balhar <lbalhar@redhat.com>
        Michal Schorm <mschorm@redhat.com>
        Miro Hrončok <mhroncok@redhat.com>
        Yaakov Selkowitz <yselkowi@redhat.com>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 5.0.2-5
changelog:
  - Initial package
  Fedora contributions by:
      Adam Williamson <awilliam@redhat.com>
      Alexander Bokovoy <abokovoy@redhat.com>
      Bill Nottingham <notting@fedoraproject.org>
      Dan Callaghan <dcallagh@redhat.com>
      David Malcolm <dmalcolm@redhat.com>
      Dennis Gilmore <dennis@ausil.us>
      Ignacio Vazquez-Abrams <ivazqueznet+rpm@gmail.com>
      Igor Gnatenko <ignatenko@redhat.com>
      Iryna Shcherbina <ishcherb@redhat.com>
      Jakub Dorňák <jdornak@redhat.com>
      James Bowes <jbowes@redhat.com> 1.0-1
      Jan Kaluza <jkaluza@redhat.com>
      Jesse Keating <jkeating@fedoraproject.org>
      Joe Orton <jorton@redhat.com>
      Josh Kayse <joshkayse@fedoraproject.org>
      Karolina Surma <ksurma@redhat.com>
      Kevin Fenzi <kevin@fedoraproject.org>
      Luboš Uhliarik <luhliari@redhat.com>
      Luke Macken <lmacken@redhat.com>
      Matthias Runge <mrunge@redhat.com>
      Miro Hrončok <mhroncok@redhat.com>
      Orion Poplawski <orion@cora.nwra.com>
      Peter Robinson <pbrobinson@fedoraproject.org>
      Richard W.M. Jones <rjones@redhat.com>
      Ricky Zhou <ricky@fedoraproject.org>
      Tomas Orsava <torsava@redhat.com>
      Tomas Hrnciar <thrnciar@redhat.com>
      Tom Stellard <tstellar@redhat.com>
      Troy Dawson <tdawson@redhat.com>
      Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 2.3.4-1
changelog:
  - Initial import
  - Fedora contributions by:
        Benjamin A. Beasley <code@musicinmybrain.net>
        Bill Nottingham <notting@fedoraproject.org>
        Charalampos Stratakis <cstratak@redhat.com>
        Christian Dersch <lupinix@mailbox.org>
        Dan Horák <dan@danny.cz>
        David Malcolm <dmalcolm@redhat.com>
        David Tardon <dtardon@redhat.com>
        Deji Akingunola <deji@fedoraproject.org>
        Dennis Gilmore <dennis@ausil.us>
        dmalcolm <dmalcolm@fedoraproject.org>
        Elliott Sales de Andrade <quantum.analyst@gmail.com>
        Gwyn Ciesla <gwync@protonmail.com>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Iñaki Úcar <iucar@fedoraproject.org>
        Iryna Shcherbina <shcherbina.iryna@gmail.com>
        Jarod Wilson <jwilson@fedoraproject.org>
        Jaromir Capik <jcapik@redhat.com>
        Jef Spaleta <jspaleta@fedoraproject.org>
        Jerry James <loganjerry@gmail.com>
        Jesse Keating <jkeating@fedoraproject.org>
        Kalev Lember <klember@redhat.com>
        Karolina Surma <ksurma@redhat.com>
        Lukáš Zaoral <lzaoral@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Merlin Mathesius <mmathesi@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Nikola Forró <nforro@redhat.com>
        Orion Poplawski <orion@nwra.com>
        Pavel Šimovec <psimovec@redhat.com>
        Peter Robinson <pbrobinson@gmail.com>
        Robert Kuska <rkuska@redhat.com>
        Scott Talbert <swt@techie.net>
        Simone Caronni <negativo17@gmail.com>
        Songsong Zhang <u2fsdgvkx1@gmail.com>
        Thomas Spura <thomas.spura@gmail.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Tomas Orsava <torsava@redhat.com>
        Tomas Tomecek <ttomecek@redhat.com>
        Tulio Magno Quites Machado Filho <tuliom@redhat.com>
        Ville Skyttä <scop@fedoraproject.org>
        Yaakov Selkowitz <yselkowi@redhat.com>


author: Lukáš Zachar <lzachar@redhat.com> - 25.2-5
changelog:
  - Fix gating plan
  - removed unnecessary older VERSION= tests
  - removed bootstrap test
  - fix pip_install_upgrade to run pip-3.14
  - fix bash completion + remove unused metadata file


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11-29
changelog:
  - Initial package
  Fedora contributions by:
      Dennis Gilmore <dennis@ausil.us>
      Bill Nottingham <notting@fedoraproject.org>
      Charalampos Stratakis <cstratak@redhat.com>
      Christian Heimes <cheimes@redhat.com>
      David Malcolm <dmalcolm@redhat.com>
      Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
      Igor Gnatenko <ignatenkobrain@fedoraproject.org>
      Jesse Keating <jkeating@fedoraproject.org>
      Miro Hrončok <miro@hroncok.cz>
      Orion Poplawski <orion@cora.nwra.com>
      Patrik Kopkan <pkopkan@redhat.com>
      Rob Crittenden <rcritten@redhat.com>
      Robert Kuska <rkuska@redhat.com>
      Slavek Kabrda <bkabrda@redhat.com>
      Stephen Gallagher <sgallagh@redhat.com>
      Thomas Spura <tomspur@fedoraproject.org>
      Tom Callaway <spot@fedoraproject.org>
      Troy Dawson <tdawson@redhat.com>


author: Charalampos Stratakis <cstratak@redhat.com> - 3.11^20251221git9d7c400-1
changelog:
  - Update to the latest and last upstream commit
  - The project won't have any new releases
  - Use modern pyproject macros
  Related: RHEL-120845


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 2.9.10-3
changelog:
  - Initial package
  Fedora contributions by:
      Ales Nezbeda <anezbeda@redhat.com>
      Bill Nottingham <notting@fedoraproject.org>
      Bohuslav Kabrda <bkabrda@redhat.com>
      Charalampos Stratakis <cstratak@redhat.com>
      David Malcolm <dmalcolm@redhat.com>
      Dennis Gilmore <dennis@ausil.us>
      Devrim Gündüz <devrim@gunduz.org>
      Filip Januš <fjanus@redhat.com>
      Honza Horak <hhorak@redhat.com>
      Ignacio Vazquez-Abrams <ivazqueznet+rpm@gmail.com>
      Igor Gnatenko <ignatenkobrain@fedoraproject.org>
      Jason L Tibbitts III <tibbs@math.uh.edu>
      Jesse Keating <jkeating@fedoraproject.org>
      Jozef Mlich <jmlich@redhat.com>
      Lumír Balhar <lbalhar@redhat.com>
      Miro Hrončok <mhroncok@redhat.com>
      Ondřej Sloup <ondrej.sloup@protonmail.com>
      Patrik Novotný <panovotn@redhat.com>
      Pavel Raiskup <praiskup@redhat.com>
      Petr Kubat <pkubat@redhat.com>
      Peter Robinson <pbrobinson@fedoraproject.org>
      Todd Zullinger <tmz@pobox.com>
      Tomas Hrnciar <thrnciar@redhat.com>
      Tom Lane <tgl@redhat.com>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 1.16.2-1
changelog:
  - Initial package
  - Fedora contributions by:
        Antonio Trande <anto.trande@gmail.com>
        Benjamin A. Beasley <code@musicinmybrain.net>
        Bill Nottingham <notting@fedoraproject.org>
        Björn Esser <me@besser82.io>
        Charalampos Stratakis <cstratak@redhat.com>
        Christian Dersch <lupinix@mailbox.org>
        David Abdurachmanov <davidlt@rivosinc.com>
        David Malcolm <dmalcolm@redhat.com>
        Deji Akingunola <deji@fedoraproject.org>
        Dennis Gilmore <dennis@ausil.us>
        dmalcolm <dmalcolm@fedoraproject.org>
        Elliott Sales de Andrade <quantum.analyst@gmail.com>
        Florian Weimer <fweimer@redhat.com>
        Gwyn Ciesla <gwync@protonmail.com>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Igor Gnatenko <ignatenko@redhat.com>
        Iñaki Úcar <iucar@fedoraproject.org>
        Jef Spaleta <jspaleta@fedoraproject.org>
        Jerry James <loganjerry@gmail.com>
        Jesse Keating <jkeating@fedoraproject.org>
        Jitka Plesnikova <jplesnik@redhat.com>
        Jonathan Wakely <jwakely@redhat.com>
        Kalev Lember <klember@redhat.com>
        Karolina Surma <ksurma@redhat.com>
        Kevin Fenzi <kevin@scrye.com>
        Lumir Balhar <lbalhar@redhat.com>
        Mamoru TASAKA <mtasaka@fedoraproject.org>
        Marcel Plch <mplch@redhat.com>
        Maxwell G <maxwell@gtmx.me>
        Miro Hrončok <miro@hroncok.cz>
        Nikola Forró <nforro@redhat.com>
        Nils Philippsen <nils@redhat.com>
        Orion Poplawski <orion@nwra.com>
        Pavel Šimovec <psimovec@redhat.com>
        Peter Robinson <pbrobinson@fedoraproject.org>
        Petr Viktorin <pviktori@redhat.com>
        Robert Kuska <rkuska@redhat.com>
        Than Ngo <than@redhat.com>
        Thomas Spura <thomas.spura@gmail.com>
        Tomas Tomecek <ttomecek@redhat.com>
        Toshio Kuratomi <toshio@fedoraproject.org>
        Troy Dawson <tdawson@fedoraproject.org>
        Yaakov Selkowitz <yselkowi@redhat.com>
        Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Benjamin A. Beasley <code@musicinmybrain.net> - 2.6.1-1
changelog:
  - Update to 2.6.1
  - Fixes CVE-2025-66471 / GHSA-2xpw-w6gg-jr37
  - Fixes CVE-2025-66418 / GHSA-gm62-xv2j-4w53


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 2.6.3-2
changelog:
  - Security fix for CVE-2026-44431 and CVE-2026-44432
  - Resolves: RHEL-184902
  - Resolves: RHEL-185127


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-9
changelog:
  - kvm-pcie_sriov-make-pcie_sriov_pf_exit-safe-on-non-SR-IO.patch [RHEL-131144]
  - kvm-accel-Add-Meson-and-config-support-for-MSHV-accelera.patch [RHEL-132193]
  - kvm-target-i386-emulate-Allow-instruction-decoding-from-.patch [RHEL-132193]
  - kvm-target-i386-mshv-Add-x86-decoder-emu-implementation.patch [RHEL-132193]
  - kvm-hw-intc-Generalize-APIC-helper-names-from-kvm_-to-ac.patch [RHEL-132193]
  - kvm-include-hw-hyperv-Add-MSHV-ABI-header-definitions.patch [RHEL-132193]
  - kvm-linux-headers-linux-Add-mshv.h-headers.patch [RHEL-132193]
  - kvm-accel-mshv-Add-accelerator-skeleton.patch [RHEL-132193]
  - kvm-accel-mshv-Register-memory-region-listeners.patch [RHEL-132193]
  - kvm-accel-mshv-Initialize-VM-partition.patch [RHEL-132193]
  - kvm-accel-mshv-Add-vCPU-creation-and-execution-loop.patch [RHEL-132193]
  - kvm-treewide-rename-qemu_wait_io_event-qemu_wait_io_even.patch [RHEL-132193]
  - kvm-accel-mshv-Add-vCPU-signal-handling.patch [RHEL-132193]
  - kvm-target-i386-mshv-Add-CPU-create-and-remove-logic.patch [RHEL-132193]
  - kvm-target-i386-mshv-Implement-mshv_store_regs.patch [RHEL-132193]
  - kvm-target-i386-mshv-Implement-mshv_get_standard_regs.patch [RHEL-132193]
  - kvm-target-i386-mshv-Implement-mshv_get_special_regs.patch [RHEL-132193]
  - kvm-target-i386-mshv-Implement-mshv_arch_put_registers.patch [RHEL-132193]
  - kvm-target-i386-mshv-Set-local-interrupt-controller-stat.patch [RHEL-132193]
  - kvm-target-i386-mshv-Register-CPUID-entries-with-MSHV.patch [RHEL-132193]
  - kvm-target-i386-mshv-Register-MSRs-with-MSHV.patch [RHEL-132193]
  - kvm-target-i386-mshv-Integrate-x86-instruction-decoder-e.patch [RHEL-132193]
  - kvm-target-i386-mshv-Write-MSRs-to-the-hypervisor.patch [RHEL-132193]
  - kvm-target-i386-mshv-Implement-mshv_vcpu_run.patch [RHEL-132193]
  - kvm-accel-mshv-Handle-overlapping-mem-mappings.patch [RHEL-132193]
  - kvm-qapi-accel-Allow-to-query-mshv-capabilities.patch [RHEL-132193]
  - kvm-target-i386-mshv-Use-preallocated-page-for-hvcall.patch [RHEL-132193]
  - kvm-docs-Add-mshv-to-documentation.patch [RHEL-132193]
  - kvm-MAINTAINERS-Add-maintainers-for-mshv-accelerator.patch [RHEL-132193]
  - kvm-accel-mshv-initialize-thread-name.patch [RHEL-132193]
  - kvm-accel-mshv-use-return-value-of-handle_pio_str_read.patch [RHEL-132193]
  - Resolves: RHEL-131144
    (qemu crash after hot-unplug disk from the multifunction enabled bus [RHEL.9.8])
  - Resolves: RHEL-132193
    ([rhel 9.8]L1VH qemu downstream initial merge RHEL9)


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-10
changelog:
  - kvm-monitor-generalize-query-mshv-info-mshv-to-query-acc.patch [RHEL-132193]
  - Resolves: RHEL-132193
    ([rhel 9.8]L1VH qemu downstream initial merge RHEL9)


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-11
changelog:
  - kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-138240]
  - Resolves: RHEL-138240
    (QEMU crashes when stopping source VM during live migration [rhel-9])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-12
changelog:
  - kvm-block-Improve-comments-in-BlockLimits.patch [RHEL-132989]
  - kvm-block-Expose-block-limits-for-images-in-QMP.patch [RHEL-132989]
  - kvm-qemu-img-info-Optionally-show-block-limits.patch [RHEL-132989]
  - kvm-qemu-img-info-Add-cache-mode-option.patch [RHEL-132989]
  - kvm-hw-intc-ioapic-Fix-ACCEL_KERNEL_GSI_IRQFD_POSSIBLE-t.patch [RHEL-140187]
  - kvm-q35-increase-default-tseg-size.patch [RHEL-139057]
  - Resolves: RHEL-132989
    (Expose block limits of block nodes in QMP and qemu-img [rhel-9])
  - Resolves: RHEL-140187
    (Intel IOMMU VM freezes: "call_irq_handler: 3.37 No irq handler for vector"[rhel-9.8])
  - Resolves: RHEL-139057
    ([qemu, rhel-9] increase default TSEG size)


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-13
changelog:
  - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147422]
  - kvm-hw-s390x-Fix-a-possible-crash-with-passed-through-vi.patch [RHEL-130620]
  - Resolves: RHEL-147422
    (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts)
  - Resolves: RHEL-130620
    (VM crashes during boot when virtio device is attached through vfio_ccw [rhel-9])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-14
changelog:
  - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-67115]
  - kvm-curl-Fix-coroutine-waking.patch [RHEL-67115]
  - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-67115]
  - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-67115]
  - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-67115]
  - Resolves: RHEL-67115
    ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled[rhel9.6])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-15
changelog:
  - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-149396]
  - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-149396]
  - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-149396]
  - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-149396]
  - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-149396]
  - Resolves: RHEL-149396
    (Migrate SCSI PR state and preempt reservation upon live migration [rhel-9])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-16
changelog:
  - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-151679]
  - Resolves: RHEL-151679
    ([rhel-9.8] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting)


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-17
changelog:
  - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155947 RHEL-155948]
  - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-154174]
  - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-154174]
  - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-154174]
  - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-154174]
  - Resolves: RHEL-155947
    (Mirror job can miss writes during startup, corrupting the copy [rhel-9.8])
  - Resolves: RHEL-155948
    (Mirror job can miss writes during startup, corrupting the copy [rhel-9])
  - Resolves: RHEL-154174
    (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-9.8])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-17.el9_8.1
changelog:
  - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164534]
  - Resolves: RHEL-164534
    (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-9.8.z])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-17.el9_8.2
changelog:
  - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166008]
  - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166008]
  - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166008]
  - Resolves: RHEL-166008
    (live migration failed the VM just register key only [rhel-9.8.z])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-17.el9_8.3
changelog:
  - kvm-accel-mshv-Remove-remap-overlapping-mappings-code.patch [RHEL-184951]
  - kvm-accel-mshv-implement-cpu_thread_is_idle-hook.patch [RHEL-184951]
  - Resolves: RHEL-184951
    (MSHV backport onto QEMU 10.1.0 is not able to launch MSHV guests [rhel-9.8.z])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-17.el9_8.4
changelog:
  - kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch [RHEL-184527]
  - Resolves: RHEL-184527
    (CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-9.8.z])


author: Danilo de Paula <ddepaula@redhat.com> - 10.1.0-17.el9_8.5
changelog:
  - kvm-file-posix-populate-pwrite_zeroes_alignment.patch [RHEL-207387]
  - kvm-block-use-pwrite_zeroes_alignment-when-writing-first.patch [RHEL-207387]
  - kvm-iotests-add-Linux-loop-device-image-creation-test.patch [RHEL-207387]
  - Resolves: RHEL-207387
    (qemu-img create/convert fails on target block device with 4k sector size [rhel-9.8.z])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-8
changelog:
  - kvm-file-posix-Handle-suspended-dm-multipath-better-for-.patch [RHEL-133303]
  - Resolves: RHEL-133303
    (The VM hit io error when do S3-PR integration on the pass-through  failover multipath device [rhel-9])


author: Jan Grulich <jgrulich@redhat.com> - 5.15.9-2
changelog:
  - Assimp: Fix heap-based overflow in Assimp::LWO::AnimResolver::UpdateAnimRangeSetup
    Resolves: RHEL-104999
  - Assimp: Fix heap-based overflow in Assimp::ASE::Parser::ParseLV4MeshBonesVertices
    Resolves: RHEL-105004


author: Jan Grulich <jgrulich@redhat.com> - 5.15.2-9
changelog:
  - Sync with Fedora:
    - sync kde/5.15 branch fixes
    - pull in candidate fix QTBUG-83890
    Resolves: bz#1988934


author: Pavel Reichl <preichl@redhat.com> - 1:4.09-1
changelog:
  - Update to new upstream version
  - Add tmpfs quota support
  - Remove rhel-only patches that were merged upstream


author: Aristeu Rozanski <aris@redhat.com> 0.6.7-16
changelog:
  - rasdaemon: Add support to parse the PPIN field of mce tracepoint  [RHEL-52911]
  - rasdaemon: Add support to parse microcode field of mce tracepoint [RHEL-52911]
  - rasdaemon: Update SMCA bank error descriptions [RHEL-52911]
  - rasdaemon: ras-mc-ctl: Add support to display mcastatus_msg string [RHEL-52911]


author: Pavel Cahyna <pcahyna@redhat.com> - 2.6-21
changelog:
  - Support saving and restoring hybrid BIOS/UEFI bootloader, PRs 3145 3136
  - make initrd accessible only by root (CVE-2024-23301), PR 3123


author: Pavel Cahyna <pcahyna@redhat.com> - 2.6-22
changelog:
  - Do not delete NetBackup logs in case of errors and save
    /usr/openv/netbackup/logs to the restored system after a successful recovery
  - Add /usr/openv/var to COPY_AS_IS_NBU, fixes an issue seen
    with NetBackup 10.2.0.1


author: Pavel Cahyna <pcahyna@redhat.com> - 2.6-23
changelog:
  - Resolve libs for executable links in COPY_AS_IS, PR 3073
  - Skip invalid disk drives when saving layout PR 3047


author: Pavel Cahyna <pcahyna@redhat.com> - 2.6-24
changelog:
  - Support "export TMPDIR" in user configuration again, print a warning
    when this is used - revert commit f464eae2, adapt PR 3163, add commit
    b422845f.
    Will be supported only until the update to 2.7


author: Pavel Cahyna <pcahyna@redhat.com> - 2.6-25
changelog:
  - Backport PR 3250 to fix useless warning that libsystemd-core requires
    additional libraries and ReaR recovery system needs additional libraries
  - Backport PR 3242 to fix IPv6 address in nfs:// and sshfs:// BACKUP/OUTPUT_URL
  - Backport PR 2576 to remove obsolete FAT16 options to avoid kernel warning


author: Pavel Cahyna <pcahyna@redhat.com> - 2.6-26
changelog:
  - Install GRUB on multipath disks, PR 3334
  - Improve docs of layout configuration in user guide, PR 3125


author: Pavel Cahyna <pcahyna@redhat.com> - 2.6-27
changelog:
  - add dependency on grub2-tools-extra and GRUB EFI modules on EFI machines
  - add dependency on syslinux-extlinux on x86
  - add initial support for aarch64 machines with UEFI
  - enhance the 300_map_disks.sh script to also print the disk sizes
  - support generation of ed25519 SSH host keys in the rescue image
  - create sshd home directory in the rescue image on systems upgraded from EL8
  - fix recovery of LUKS encrypted systems with multiple keyslots
  - fix PPC PReP Boot detection on GPT layouts
  - skip longhorn iscsi devices in disklayout.conf
  - error out if any unsupported OUTPUT used on s390x


author: Lukáš Zaoral <lzaoral@redhat.com> - 2.6-28
changelog:
  - use git to apply downstream patches
  - copy an sshd helper to the rescue ramdisk (RHEL-146037)
  - fix support for PowerNV machines without PPC PReP partitions (RHEL-134217)
  - add support for dbus broker (RHEL-31749)
  - abort when sourcing fails due to a syntax error (RHEL-104289)
  - fix recreation of multi-disk volume groups in migration mode (RHEL-23887)
  - skip unsupported partition tables (RHEL-78583)
  - do not attempt to use the disk with backup for recovery (RHEL-111612)


author: Akira TAGOH <tagoh@redhat.com> - 4.0.3-2
changelog:
  - Drop duplicate font files.
  - Correct broken font metadata in fontconfig.
  - Drop Italic variant of the variable fonts to workaround
    unexpected italic rendering and crash.
    Resolves: RHEL-1617


author: Michal Domonkos <mdomonko@redhat.com> - 208-1
changelog:
  - brp-mangle-shebangs: Strip env flags when mangling shebangs (RHEL-26961)
  - Fix automatic soname requires on non-versioned symlink targets (RHEL-28767)


author: Rich Megginson <rmeggins@redhat.com> - 1.114.0-0.1
changelog:
  - Resolves: RHEL-129416 : aide - cannot manage rhel9.7/10.1 or earlier - unexpected character - line database=file
  - Resolves: RHEL-136599 : ha_cluster - feat: add support for fencing-watchdog-timeout
  - remove hpc role


author: Rich Megginson <rmeggins@redhat.com> - 1.118.0-0.1
changelog:
  - Resolves: RHEL-144588 : Templates in some role license files [rhel-9]
  - Resolves: RHEL-144589 : ha_cluster - ha_cluster role does not work in container builds [rhel-9]
  - Resolves: RHEL-144592 : metrics - [RFE] configure TLS certificates in grafana using the metrics system role [rhel-9]
  - Resolves: RHEL-138279 : ssh - feat: Add new configuration option VersionAddendum [rhel-9]
  - Resolves: RHEL-144496 : sshd - feat: New OpenSSH configuration option GSSAPIDelegateCredentials [rhel-9]
  - Resolves: RHEL-138058 : storage - [RHEL10.2] in _get_device_id IndexError: list index out of range [rhel-9]
  - All roles support INJECT_FACTS_AS_VARS=false
  - metrics - test: do not restore service if final state not-found
  - sshd - feat: Add systemd ephemeral authorized_keys to the instantiated service file on Fedora
  - storage - fix: add vdo package for Fedora OSTree


author: Rich Megginson <rmeggins@redhat.com> - 1.118.0-0.2
changelog:
  - Resolves: RHEL-144588 : Templates in some role license files
  - Fix ansible-test issue with community.general.ini_file module 11.4.4 in documentation string


author: Rich Megginson <rmeggins@redhat.com> - 1.119.0-0.1
changelog:
  - Resolves: RHEL-122958 : postgresql - add PostgreSQL 18
  - fix upstream shellcheck issue in nbde_client role


author: Rich Megginson <rmeggins@redhat.com> - 1.119.1-0.0.1
changelog:
  - Resolves: RHEL-122958 : postgresql - add PostgreSQL 18 - fixes test issue
  - Resolves: RHEL-147822 : snapshot - Snapshot role ignores snapshot_lvm_bootable: true setting when creating a snapset [rhel-9]
  - Resolves: RHEL-147823 : storage - [RHEL10.2]  ZeroDivisionError when creating LVM volume without size specification [rhel-9]


author: Rich Megginson <rmeggins@redhat.com> - 1.120.1-0.1
changelog:
  - Resolves: RHEL-145215 : selinux - Missing proto 'sctp' and 'dccp'
  - Resolves: RHEL-145220 : vpn - [ERROR]: Task failed: object of type 'dict' has no attribute '1.1.1.1'


author: Rich Megginson <rmeggins@redhat.com> - 1.120.2-0.1
changelog:
  - Resolves: RHEL-145215 : selinux - Missing proto 'sctp' and 'dccp'
  - timesync - fix: use ansible_facts timesync_ntp_provider_current


author: Rich Megginson <rmeggins@redhat.com> - 1.120.3-0.1
changelog:
  - Resolves: RHEL-150782 : firewall - fix: el7 interface functionality requires NetworkManager [rhel-9]
  - Resolves: RHEL-145248 : selinux - [v 1.10.4] Prepare module installation -> "Template error: object of type 'dict' has no attribute 'path'" [rhel-9]
  - ha_cluster - fix: ostree - add dnf/dnf5 package, add firewall packages
  - metrics - test: ostree - add package pcp-pmda-apache, role certificate
  - systemd - test: ostree requires cronie package for testing


author: Rich Megginson <rmeggins@redhat.com> - 1.120.4-0.1
changelog:
  - Resolves: RHEL-150782 : firewall - fix: el7 interface functionality requires NetworkManager
  - firewall - test: ensure interface chosen is managed by NetworkManager


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-31
changelog:
  - Fix potential use of uninitialized pipe array (RHEL-22604)
  - Fix potential use of uninitialized pgp struct (RHEL-22605)
  - Don't confuse OpenScanHub with false array overrun (RHEL-22607)
  - Add SourceLicense tag to spec syntax (RHEL-28798)
  - Talk about rpmsign in the rpmsign(8) man page (RHEL-40895)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-33
changelog:
  - Fix root relocation regression (RHEL-28967)
  - Don't confuse OpenScanHub with false array overrun (RHEL-22607)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-35
changelog:
  - Fix %patch N applying Patch0 implicitly (RHEL-6294)
  - Issue deprecation warning for number-less %patch (RHEL-6294)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-37
changelog:
  - Allow parametric macros to opt out of option processing (RHEL-67161)
  - Report unsafe symlinks during installation as a specific case (RHEL-33393)
  - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63070)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-38
changelog:
  - Add support for spec local file attributes and generators (RHEL-52772)
  - Store configurable digest(s) on packages in rpmdb (RHEL-35619)
  - Fix a hard link race condition in brp-strip (RHEL-74011)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-40
changelog:
  - Improve error handling on keystore load (RHEL-114837)
  - Sort files before passing to file attr dependency generators (RHEL-95376)


author: Michal Domonkos <mdomonko@redhat.com> - 9.3-5
changelog:
  - Drop progressbar2 dependency and bundle a tiny replacement (#1927784)
  - Drop fakeroot dependency and qa-robot scripts (#1905465)


author: Miro Hrončok <mhroncok@redhat.com> - 1.11-10
changelog:
  - Don't use the %python_sitelib macro, because it errors
  - See https://fedoraproject.org/wiki/Changes/PythonMacroError


author: Dean Nelson <dnelson@redhat.com> - 2.0.8-1
changelog:
  - Update user-space rshim driver source to version 2.0.8
  - Modify rshim.spec accordingly
  - Resolves: rhbz#2196626


author: Michal Ruprich <mruprich@redhat.com> - 3.2.3-21
changelog:
  - Resolves: RHEL-70265 - Rebase rsync to 3.2.5
  - Resolves: RHEL-67142 - Wrong progress reported by rsync when using copy-devices
  - Resolves: RHEL-29340 - Slowness in rsync due to extra validation steps.
  - Resolves: RHEL-18216 - rysnc script /usr/share/doc/rsync/support/rrsync is unsecure


author: Michal Ruprich <mruprich@redhat.com> - 3.2.5-2
changelog:
  - Resolves: RHEL-70158 - Info Leak via Uninitialized Stack Contents
  - Resolves: RHEL-70208 - Path traversal vulnerability in rsync
  - Resolves: RHEL-70210 - --safe-links option bypass leads to path traversal
  - Resolves: RHEL-71657 - Race Condition in rsync Handling Symbolic Links


author: Michal Ruprich <mruprich@redhat.com> - 3.2.5-6
changelog:
  - Resolves: RHEL-169151 - CVE-2026-41035 - Use-after-free vulnerability in extended attribute handling


author: Attila Lakatos <alakatos@redhat.com> - 8.2310.0-3
changelog:
  - Rebase to 8.2310.0
    Resolves: RHEL-5196
  - Allow setting certificates for separate connections
    Resolves: RHEL-937
  - Capability dropping feature can be turned off
    Resolves: RHEL-943
  - imjournal: new module parameter filecreatemode
    Resolves: RHEL-949


author: Attila Lakatos <alakatos@redhat.com> - 8.2412.0-1
changelog:
  - Rebase to 8.2412.0
    Resolves: RHEL-65177
  - Fix segfault when $ControlCharacterEscapePrefix is set
    Resolves: RHEL-38222
    Resolves: RHEL-70099
  - Fix segfault due to processing malform queue message
    Resolves: RHEL-70100
  - Fix $ActionQueueDiscardMark default value to 80% queue size
    Resolves: RHEL-70109
  - Fix crash on startup when an invalid function is specified
    Resolves: RHEL-70111


author: Attila Lakatos <alakatos@redhat.com> - 8.2506.0-1
changelog:
  - Rebase to 8.2506.0
  - imuxsock: track dropped messages by ratelimiting
    Resolves: RHEL-66274
  - man page version update
    Resolves: RHEL-78220
  - omfwd: do not hang forever in case of broken TLS handshake
    Resolves: RHEL-67639


author: Attila Lakatos <alakatos@redhat.com> - 8.2510.0-2
changelog:
  - Rebase to 8.2510.0
  - gnutls netstream driver: improve doc
    Resolves: RHEL-86031
  - rsyslog.conf: use RainerSscript syntax in actions
    Resolves: RHEL-42508
  - gnutls netstream driver: report missing certificate just once
    Resolves: RHEL-105782


author: Jun Aruga <jaruga@redhat.com> - 3.0.7-162
changelog:
  - Upgrade to Ruby 3.0.7.
    Resolves: RHEL-35740
  - Fix HTTP response splitting in CGI.
    Resolves: RHEL-35741
  - Fix ReDoS vulnerability in URI.
    Resolves: RHEL-35742
  - Fix ReDoS vulnerability in Time.
    Resolves: RHEL-35743
  - Fix buffer overread vulnerability in StringIO.
    Resolves: RHEL-35744
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    Resolves: RHEL-35746
  - Fix arbitrary memory address read vulnerability with Regex search.
    Resolves: RHEL-35747


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-164
changelog:
  - Undefine GC compaction methods on ppc64le.
    Resolves: RHEL-83136
  - Fix printing warnings when using IRB from a script.
    Resolves: RHEL-83044


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-165
changelog:
  - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219)
    Resolves: RHEL-86104
  - Fix ReDoS in CGI::Util#escapeElement. (CVE-2025-27220)
    Resolves: RHEL-86130


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-166
changelog:
  - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316)
    Resolves: RHEL-171254


author: Jun Aruga <jaruga@redhat.com> - 3.1.2-142
changelog:
  - Bypass git submodule test failure on Git >= 2.38.1.
  - Fix tests with Europe/Amsterdam pre-1970 time on tzdata version 2022b.
  - Fix for tzdata-2022g.
  - Fix OpenSSL.fips_mode and OpenSSL::PKey.read in OpenSSL 3 FIPS.
    Resolves: RHEL-5590
  - ssl: use ffdhe2048 from RFC 7919 as the default DH group parameters
    Related: RHEL-5590
  - Disable fiddle tests that use FFI closures.
    Related: RHEL-5590


author: Jarek Prokop <jprokop@redhat.com> - 3.1.4-143
changelog:
  - Upgrade to Ruby 3.1.4.
    Resolves: RHEL-5586
  - Fix HTTP response splitting in CGI.
    Resolves: RHEL-5591
  - Fix ReDos vulnerability in URI.
    Resolves: RHEL-28919
    Resolves: RHEL-5612
  - Fix ReDos vulnerability in Time.
    Resolves: RHEL-28920
  - Make RDoc soft dependency in IRB.
    Resolves: RHEL-5613


author: Jun Aruga <jaruga@redhat.com> - 3.1.5-144
changelog:
  - Upgrade to Ruby 3.1.5.
    Resolves: RHEL-33978
  - Fix buffer overread vulnerability in StringIO.
    Resolves: RHEL-34129
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    Resolves: RHEL-34121
  - Fix arbitrary memory address read vulnerability with Regex search.
    Resolves: RHEL-33871


author: Jarek Prokop <jprokop@redhat.com> - 3.1.7-146
changelog:
  - Upgrade to Ruby 3.1.7.
    Resolves: RHEL-85235
  - Fix DoS vulnerability in REXML. (CVE-2024-39908)
    Resolves: RHEL-57050


author: Jarek Prokop <jprokop@redhat.com> - 3.3.1-2
changelog:
  - Upgrade to Ruby 3.3.1.
    Resolves: RHEL-33976
  - Fix buffer overread vulnerability in StringIO.
    (CVE-2024-27280)
    Resolves: RHEL-34130
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    (CVE-2024-27281)
    Resolves: RHEL-34122
  - Fix Arbitrary memory address read vulnerability with Regex search.
    (CVE-2024-27282)
    Resolves: RHEL-33872


author: Jarek Prokop <jprokop@redhat.com> - 3.3.5-3
changelog:
  - Upgrade to Ruby 3.3.5
    Resolves: RHEL-55411
  - Fix DoS vulnerability in rexml.
    (CVE-2024-39908)
    (CVE-2024-41946)
    (CVE-2024-43398)
    Resolves: RHEL-57575
    Resolves: RHEL-57572
    Resolves: RHEL-57068
  - Fix REXML DoS when parsing an XML having many specific characters such as
    whitespace character, >] and ]>.
    (CVE-2024-41123)
    Resolves: RHEL-57569
  - Fix incorrect symlink for rubygem-irb's library.
    Resolves: RHEL-42646


author: Jarek Prokop <jprokop@redhat.com> - 3.3.8-4
changelog:
  - Upgrade to Ruby 3.3.8.
    Resolves: RHEL-68631
  - Fix Net::IMAP vulnerable to possible DoS by memory exhaustion. (CVE-2025-25186)
  - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219)
    Resolves: RHEL-86109
  - Fix userinfo leakage in URI#join, URI#merge and URI#+. (CVE-2025-27221)


author: Jun Aruga <jaruga@redhat.com> - 3.3.10-5
changelog:
  - Upgrade to Ruby 3.3.10.
    Resolves: RHEL-127912
  - Fix possible denial of service in resolv gem (CVE-2025-24294)
  - Fix URI Credential Leakage Bypass previous fixes. (CVE-2025-61594)
  - Fix REXML denial of service. (CVE-2025-58767)
    Resolves: RHEL-122015


author: Jarek Prokop <jprokop@redhat.com> - 3.3.10-6
changelog:
  - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316)
    Resolves: RHEL-171255


author: Jun Aruga <jaruga@redhat.com> - 3.3.10-5
changelog:
  - Upgrade to Ruby 3.3.10.
    Resolves: RHEL-106821
  - Fix possible denial of service in resolv gem (CVE-2025-24294)
  - Fix URI Credential Leakage Bypass previous fixes. (CVE-2025-61594)
  - Fix REXML denial of service. (CVE-2025-58767)
    Resolves: RHEL-126728


author: Jarek Prokop <jprokop@redhat.com> - 3.3.10-6
changelog:
  - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316)
    Resolves: RHEL-171257


author: Jarek Prokop <jprokop@redhat.com> - 3.3.10-7
changelog:
  - Fix DoS via crafted IMAP responses in net-imap. (CVE-2026-42245)
    Resolves: RHEL-181693
  - Fix information disclosure via MITM attack bypassing TLS in net-imap.
    (CVE-2026-42246)
    Resolves: RHEL-181779
  - Fix command injection via Symbol arguments in net-imap. (CVE-2026-42258)
    Resolves: RHEL-181811


author: Tomas Juhasz <tjuhasz@redhat.com> - 4.0.3-32
changelog:
  - Upgrade to Ruby 4.0.3.
    Resolves: RHEL-171933
  - Fix ERB: Arbitrary code execution via deserialization bypass
   (CVE-2026-41316)
    Resolves: RHEL-171258
  - Fix JSON: Denial of Service or Information Disclosure via format string injection
   (CVE-2026-33210)
   Resolves: RHEL-173458


author: Tomas Juhasz <tjuhasz@redhat.com> - 4.0.3-33
changelog:
  - Fix Net::IMAP ResponseReader quadratic complexity vulnerability. (CVE-2026-42245)
    Resolves: RHEL-181690
  - Fix Net::IMAP STARTTLS stripping vulnerability. (CVE-2026-42246)
    Resolves: RHEL-181771
  - Fix Net::IMAP command injection vulnerability via unvalidated Symbol arguments. (CVE-2026-42258)
    Resolves: RHEL-181803


author: Dan Horák <dhorak@redhat.com> - 2:2.29.0-3
changelog:
  - add s390utils-se-data as a noarch subpackage with Secure Execution data files
  - Resolves: RHEL-10567


author: Dan Horák <dhorak@redhat.com> - 2:2.33.1-1
changelog:
  - rebased to 2.33.1 (RHEL-23704)
  - dbginfo.sh: missing data of new ROCE cards (RHEL-24109)
  - SE-tooling: New IBM host-key subject locality (RHEL-30273)
  - Fix disk type detection when running under QEMU (RHEL-40358)
  - Resolves: RHEL-23704 RHEL-24109 RHEL-30273 RHEL-40358


author: Dan Horák <dhorak@redhat.com> - 2:2.35.0-1
changelog:
  - rebased to 2.35.0 (RHEL-50026)
  - cpacfstats: support MSA 10 and MSA 11 (RHEL-50030)
  - Resolves: RHEL-50026 RHEL-50030


author: Dan Horák <dhorak@redhat.com> - 2:2.36.0-1
changelog:
  - rebased to 2.36.0 (RHEL-50026)
  - cpacfinfo: new tool to provide CPACF information (RHEL-50020)
  - chpstat: Additional Channel Measurements (RHEL-50023)
  - zPCI: Optics Monitoring for PF Access Mode (RHEL-50024)
  - KVM: Support extended attestation for Secure Execution (RHEL-50009)
  - KVM: genprotimg: validate if SE image can run on particular host(s) (RHEL-50008)
  - Vertical CPU Polarization Support Stage 2 (RHEL-64705)
  - KVM: Support unencrypted SE images by exposing resp. SE header flag (RHEL-70853)
  - KVM: Rewrite genprotimg in Rust (RHEL-72023)
  - Provide genprotimg / pvimg info command to display encrypted & unencrypted SE image information (RHEL-71819)
  - KVM: Support retrievable secrets in Secure Execution guests (RHEL-50019)
  - zkey key support for dm-crypt with XTS keys (RHEL-50010)
  - Resolves: RHEL-50026 RHEL-50020 RHEL-50023 RHEL-50024 RHEL-50009 RHEL-50008 RHEL-64705 RHEL-70853 RHEL-72023 RHEL-71819 RHEL-50019 RHEL-50010


author: Dan Horák <dhorak@redhat.com> - 2:2.38.0-1
changelog:
  - rebased to 2.38.0 (RHEL-73342)
  - LPAR level power consumption reporting (RHEL-72675)
  - Provide Topology-Map information to userspace (RHEL-72682)
  - Add CCK secret type for updating the Customer Communication Key (RHEL-73021)
  - Convert LUKS2 volume from AES keys to retrievable PAES keys (RHEL-85390)
  - Resolves: RHEL-73342 RHEL-72675 RHEL-72682 RHEL-73021 RHEL-85390


author: Dan Horák <dhorak@redhat.com> - 2:2.39.0-1
changelog:
  - rebased to 2.39.0 (RHEL-100439)
  - udev/rules.d: Set default io scheduler to 'none' for virtio-blk (RHEL-126743)
  - udev/rules.d: make virtio-blk devices non-rotational (RHEL-126745)
  - zipl: makedumpfile is required for ngdump support (RHEL-114663)
  - libekmfweb: Fix gen of cert or CSR to use RSA not RSA-PSS (RHEL-114885)
  - chpstat: Fix DPU utilization scaling in reports (RHEL-109215)
  - Resolves: RHEL-100439 RHEL-126743 RHEL-126745 RHEL-114663 RHEL-114885 RHEL-109215


author: Dan Horák <dhorak@redhat.com> - 2:2.40.0-1
changelog:
  - rebased to 2.40.0 (RHEL-100439)
  - zipl/boot: Fix unused loadparm when SCLP line-mode console is absent
  - Secure Execution: Add tool to verify host-key documents (RHEL-136796)
  - Resolves: RHEL-100439 RHEL-136796


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.5-1
changelog:
  - Update to version 4.23.5
  - resolves: RHEL-143401 - Fix winbind group resolution
  - resolves: RHEL-141027 - Fix winbind crash


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.5-9
changelog:
  - Security release for CVE-2026-1933 CVE-2026-2340  CVE-2026-3012
    CVE-2026-4480 CVE-2026-40170 CVE-2026-4408
  - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba:
    various flaws
  - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing
  - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2
  - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.4-1
changelog:
  - Update to version 4.23.4
  - resolves: RHEL-114548 - Update to version 4.23.4
  - resolves: RHEL-132995 - Fix Time Machine backup
  - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.0-2
changelog:
  - properly conflict with pacemaker not providing sync-default we need
    Resolves: rhbz#1979961
    Resolves: rhbz#1979573


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.1-2
changelog:
  - obviously autoconf is defining runstatedir - but with a
    wrong default - directly hand it over to configure
    and skip --with-runstatedir implemented in configure.ac
    for older versions of autoconf

    Resolves: rhbz#2011707


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.2-1
changelog:
  - rebase to upstream v1.5.2
  - convert license naming to SPDX
  - make static analysis happy with a few checks & rearanges with
    dynamic-memory-management

    Resolves: rhbz#2168579


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-26
changelog:
  - Update OpenSSL certificates set up
    Resolves: RHEL-118293
  - Eliminate use of obsolete %patchN syntax
    Related: RHEL-91101
  - Add sysusers.d config file to allow rpm to create users/groups automatically
    and drop attempt to delete group
    Related: RHEL-91101
  - Add support for Image Mode
    Resolves: RHEL-91101


author: Matthew Burket <mburket@redhat.com> - 0.1.74-1
changelog:
  - Rebase to a new upstream release 0.1.74 (RHEL-53865)
  - Ensure authselect features are preserved by enable_authselect rule (RHEL-39383)
  - Fix check for passwords last changed date (RHEL-47129)
  - Remediations of Journald configuration files now include a correct section (RHEL-38531)
  - Adjust service requirements for CIS profiles (RHEL-23852)
  - Update password hashing settings for ANSSI-BP-028 (RHEL-44983)


author: Matthew Burket <mburket@redhat.com> - 0.1.75-1
changelog:
  - Rebase to new release (RHEL-66154)
  - the rule sshd_use_priv_separation is no longer used (RHEL-66057)
  - add a rule checking for presence of chrony to CIS RHEL 9 profile (RHEL-60005)
  - remediation of Networkmanager DNS mode now remediates value "default" (RHEL-53426)
  - Adjust mount_option_nodev_nonroot_local_partitions to work in Image Builder environments. (RHEL-45018)
  - Adjusted rules related to sshd ensure constancy in checked values and ensure that drop in configuration files are checked. (RHEL-38206)


author: Vojtech Polasek <vpolasek@redhat.com> - 0.1.76-1
changelog:
  - rebase scap-security-guide to the latest upstream version 0.1.76 (RHEL-74240)
  - modify the rule require_singleuser_auth to honor overriding mechanism offered by Systemd (RHEL-71936)
  - make the rule sysctl_user_max_user_namespaces informational and unscored in RHEL 9 STIG profile (RHEL-40120)
  - align checking of approved SSH ciphers with latest STIG policy (RHEL-65432)


author: Matthew Burket <mburket@redhat.com> - 0.1.77-1
changelog:
  - Rebase to scap-security-guide version 0.1.77 (RHEL-94803)
  - rule networkmanager_dns_mode now checks dropin files and has more resilient regex (RHEL-62843)
  - rsyslog_remote_loghost checks for Rainer Script syntax as well (RHEL-62731)
  - improve checking of Grub2 superuser and password configuration (RHEL-58818)


author: Vojtech Polasek <vpolasek@redhat.com> - 0.1.77-3
changelog:
  - fix incorrect applicability of Grub2 UEFI specific rules
  - replace grub-mkconfig with grub2-mkconfig in rule descriptions


author: vojtapolasek <krecoun@gmail.com> - 0.1.78-1
changelog:
  - coverage of section 1.2.1.2 of CIS profile has been improved (RHEL-102328)
  - fix checks of rules related to sudo and cron (RHEL-89812)
  - rules allow white spaces around equal sign in Systemd configuration (RHEL-89714)
  - install package polkit-pkla-compat when needed (RHEL-87606)
  - rule auditd_freq correctly honors XCCDF variable (RHEL-64013)
  - rebase scap-security-guide package to version 0.1.78 (RHEL-111009)


author: adenisov <adenisov@redhat.com> - 0.1.79-1
changelog:
  - Rebase scap-security-guide package to version 0.1.79 (RHEL-130246)
  - add detection of non-existent directories in root's PATH for RHEL 9 CIS profiles (RHEL-102330)
  - replace systemd_service module with systemd module across Ansible playbooks (RHEL-117141)
  - add multiline support for detecting RainerScript statements in rsyslog configuration (RHEL-104207)
  - introduce a new template for kernel module loading audit rules (RHEL-102334)
  - add audit rules for monitoring changes to /etc/hostname and NetworkManager configuration (RHEL-102331)
  - remove aide_periodic_cron_checking rule from RHEL-09-651015 (RHEL-100924)
  - rule ensure_logrotate_activated inserts the rotation interval at the begining of the file, mitigating possible invalid configuration (RHEL-79123)
  - fix idempotency issue in require_singleuser_auth bash remediation (RHEL-106811)
  - add clarification about using /bin/false and /bin/true for disabling kernel modules (RHEL-106814)


author: Vojtech Polasek <vpolasek@redhat.com> - 0.1.80-1
changelog:
  - Fix inconsistent and missing audit keys in some audit rules (RHEL-141394)
  - Modify shipped kickstart files so that the size of boot partition aligns with official recommended size (RHEL-145201)
  - Disable SHA-1 for the RPM component in RHEL 9 CIS profiles (RHEL-138448)
  - Rule configure_ssh_crypto_policy has been removed from RHEL 9 and RHEL 10 profiles. (RHEL-65737)
  - Rules of type sshd_use_strong_kex have been removed from RHEL CIS profiles in favor of system wide crypto policies usage. (RHEL-62941)
  - Rebase scap-security-guide to the latest upstream version 0.1.80 (RHEL-136121)


author: Vojtech Polasek <vpolasek@redhat.com> - 0.1.80-1
changelog:
  - Fix inconsistent and missing audit keys in some audit rules (RHEL-141394)
  - Modify shipped kickstart files so that the size of boot partition aligns with official recommended size (RHEL-145201)
  - Disable SHA-1 for the RPM component in RHEL 9 CIS profiles (RHEL-138448)
  - Use correct permissions and consider the log_group option in rules file_permissions_var_log_audit and directory_permissions_var_log_audit (RHEL-138549)
  - Rule configure_ssh_crypto_policy has been removed from RHEL 9 and RHEL 10 profiles. (RHEL-65737)
  - Rules of type sshd_use_strong_kex have been removed from RHEL CIS profiles in favor of system wide crypto policies usage. (RHEL-62941)
  - Rebase scap-security-guide to the latest upstream version 0.1.80 (RHEL-136121)


author: Jan Černý <jcerny@redhat.com> - 0.1.81-1
changelog:
  - rule rsyslog_remote_access_monitoring handles Rainer syntax objects as case insensitive (RHEL-171951)
  - Fixed remediation problems occurring when authselect profiles contain multiple authselect features (RHEL-165050)
  - Rebase scap-security-guide to 0.1.81 (RHEL-180787)


author: Jan Černý <jcerny@redhat.com> - 1.2.1-5
changelog:
  - Remove qt5-devel from "Requires" section
    https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/WO625MVYEAAJNHNRLEEJDVZTIWMQOBRR/
  - Update for new CMake out of source builds
    https://fedoraproject.org/wiki/Changes/CMake_to_do_out-of-source_builds
  - Fix Qt5 deprecated symbols
  - Fix FTBS in Rawhide/F33 (RHBZ#1865462)


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.68-1
changelog:
  - Allow insights-client manage /etc symlinks
  Resolves: RHEL-108826
  - Allow insights-client get attributes of the rpm executable
  Resolves: RHEL-127329
  - Allow ras-mc-ctl get attributes of the kmod executable
  Resolves: RHEL-103975
  - Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
  Resolves: RHEL-101155
  - Allow bootupd delete symlinks in the /boot directory
  Resolves: RHEL-101155
  - Update policy for bootupd
  Resolves: RHEL-101155
  - Allow create kerberos files in postgresql db home
  Resolves: RHEL-123225


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.69-1
changelog:
  - Allow sysadm access to TPM
  Resolves: RHEL-119055
  - Update policy for dhcpc_hook_t
  Resolves: RHEL-113941
  - Allow stap server read virtual memory sysctls
  Resolves: RHEL-114157
  - Allow login_userdomain watch /home and /var directories
  Resolves: RHEL-119686
  - Allow login_userdomain read lastlog
  Resolves: RHEL-119686
  - Allow staff role read/write cockpit-session unix stream sockets
  Resolves: RHEL-108068
  - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t
  Resolves: RHEL-113941


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.70-1
changelog:
  - Add the rpm_signal() interface
  Related: RHEL-108826
  - Allow tuned_t use its private tmpfs files
  Related: RHEL-108826
  - Allow kdump search kdumpctl_tmp_t directories
  Resolves: RHEL-66119


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.71-1
changelog:
  - Revert "Allow NM nvme dispatcher script start systemd services"
  Resolves: RHEL-111946
  - Allow ssh_agent_type create a sockfile in /run/user/USERID
  Resolves: RHEL-121936
  - Allow NM nvme dispatcher script start systemd services
  Resolves: RHEL-111946
  - Allow aide get attributes of a filesystem with extended attributes
  Resolves: RHEL-121480
  - Label miscellaneous /dev/papr-* devices
  Resolves: RHEL-129879


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.72-1
changelog:
  - Add insights_client service interfaces
  Related: RHEL-140893
  - Confine rhc-worker-playbook.worker and rhc-playbook-verifier
  Resolves: RHEL-132748
  - Allow gpg manage rpm cache
  Related: RHEL-108775
  - Allow gpg read rpm cache
  Related: RHEL-108775
  - Allow aide get attributes of tmpfs and devtmpfs filesystems
  Resolves: RHEL-121480
  - Allow rules for confined users logged in plasma
  Resolves: RHEL-133898
  - Allow login_userdomain watch lnk_files in /usr
  Resolves: RHEL-133898


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.73-1
changelog:
  - Add the fs_write_tmpfs_files() interface
  Resolves: RHEL-142141
  - Dontaudit aide the execmem permission
  Resolves: RHEL-121480
  - Update gpg policy for interactions with rhc-playbook-verifier
  Resolves: RHEL-132748
  - Allow rhc_playbook_verifier_t stream connect to itself
  Resolves: RHEL-132748
  - Update policy for rhc-worker-playbook
  Resolves: RHEL-132748
  - Allow traceroute_t bind rawip sockets to unreserved ports
  Resolves: RHEL-130267
  - Revert "Allow traceroute_t bind rawip sockets to unreserved ports"
  Related: RHEL-130267
  - Allow sudodomain connect to gkeyringd over a unix stream socket
  Resolves: RHEL-121158
  - Allow samba-bgqd send to smbd over a unix datagram socket
  Resolves: RHEL-95985
  - Allow ssh_agent_type manage generic cache home files
  Resolves: RHEL-121165
  - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t
  Resolves: RHEL-121165
  - Allow boothd connect to systemd-machined over a unix socket
  Resolves: RHEL-140882


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.74-1
changelog:
  - Label /run/insights-client.ppid with insights_client_run_t
  Resolves: RHEL-146688
  - Update gpg_role() interface with unix_stream_socket permissions
  Resolves: RHEL-128542


author: Petr Lautrbach <lautrbach@redhat.com> - 4.4.3-1
changelog:
  - SETools 4.4.3 release
  - Improve man pages
  - seinfoflow: Add -r option to get flows into the source type.
  - seinfoflow.1: Remove references to sepolgen permission map.
  - AVRule/AVRuleXperm: Treat rules with no permissions as invalid policy.
  - SELinuxPolicy: Add explicit cast for libspol message


author: Petr Lautrbach <lautrbach@redhat.com> - 3.3.32-1
changelog:
  - Always reset pending alarms when alarm(0) (rhbz#2112573)
  - 'imp' module is deprecated in favor of 'importlib' (rhbz#2224393)
  - Fix build with pip 23.1.2+
  - Remove dbus-glib-devel BR as it's only needed when compiled with seappletlegacy
  - Rename session bus name to org.fedoraproject.sealert
  - seapplet: wrap SEApplet() to try except
  - util.py: Add doctext test for build_module_type_cache()
  - Update translations


author: Petr Lautrbach <lautrbach@redhat.com> - 3.3.35-1
changelog:
  - Update tmpfiles.d config (bz#2346971)
  - Do not hardcode /var/lib/selinux as store_root
  - data: update app icon
  - Enable Georgian and Arabic (ar) languages in configure.ac
  - Update translations
  - Ship with contemporary app icon
  - Check that SELinux is enabled before running (rhbz#2178950)


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.11-1
changelog:
  - Add plugin which analyzes execmem denials
  - Add missing "If " strings
  - Update qemu_blk_image and qemu_file_image
  - Update "xen_image" plugin
  - Update "file" plugin
  - Update "missing" scripts to automake-1.15


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.12-1
changelog:
  - Use get_package_nvr* functions instead of get_rpm_nvr*
  - Update deprecated type references
  - Update translations


author: Jindrich Novy <jnovy@redhat.com> - 1:1.22.2-1
changelog:
  - update to https://github.com/containers/skopeo/releases/tag/v1.22.2
  - fixes signature verification of images which only sign the per-platform
    manifest in skopeo proxy
  - Resolves: RHEL-168166


author: Jindrich Novy <jnovy@redhat.com> - 1:1.22.2-5
changelog:
  - Rebuild for CVE-2026-25679
  - Re-add test file installation to fix tier0 tests
  - Resolves: RHEL-158789


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-1
changelog:
  - upstream release 0.60.0
  - Change license from GPLv2 to GPLv3+ to follow 389-ds licensing
  - Fix ID views integration
  - Fix base scope lookups
  - Bump NIS max dgram size to 8KB by default instead of 1KB
  - Resolves: rhbz#2117299
    Allow to rebuild the compat tree


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-5
changelog:
  - Ignore updates from non-tracked subtrees during modify/modrdn/update
    to avoid deadlocks with retro changelog
  - Resolves: RHEL-11983


author: Jindrich Novy <jnovy@redhat.com> - 1.2.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.1
  - Related: #2176063


author: Jindrich Novy <jnovy@redhat.com> - 1.2.2-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.2
  - Related: Jira:RHEL-2112


author: Jindrich Novy <jnovy@redhat.com> - 1.2.3-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.3
  - Related: RHEL-2112


author: Jindrich Novy <jnovy@redhat.com> - 1.3.0-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.3.0
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 1.3.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.3.1
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 1.3.2-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.3.2
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 1.3.3-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.3.3
  - Resolves: RHEL-94765


author: Tomas Korbar <tkorbar@redhat.com> - 1.2.0-11
changelog:
  - CVE-2020-23903 speex: divide by zero in read_samples() via crafted WAV file
  - Resolves: CVE-2020-23903


author: Uri Lublin <uril@redhat.com> - 0.21.0-2
changelog:
  - Build without pciaccess
    Resolves: rhbz#1964922
  - Fix g_memdup deprecation warning with glib >= 2.68


author: Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-17
changelog:
  - Disable ESI support
  - Resolves: RHEL-65080 - CVE-2024-45802 squid: Denial of Service processing
    ESI response content


author: Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-20
changelog:
  - Resolves: RHEL-77282 - ”TCP connection to XX.XX.XX.XX/XXXX failed” message is
    output frequently on RHEL9


author: Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-23
changelog:
  - Resolves: RHEL-122493 - squid: Squid vulnerable to information disclosure via
    authentication credential leakage in error handling (CVE-2025-62168)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-24
changelog:
  - Resolves: RHEL-119047 - "ICAP_ERR_OTHER/408" occurs in icap.log when
    downloading a file on RHEL9


author: Tomas Korbar <tkorbar@redhat.com> - 7:5.5-25
changelog:
  - Resolves: RHEL-160695 - squid: Squid: Denial of Service via
    heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)


author: Tomas Korbar <tkorbar@redhat.com> - 7:5.5-26
changelog:
  - Resolves: RHEL-160694 - squid: Squid: Denial of Service via
    crafted ICP traffic (CVE-2026-32748)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.7-1
changelog:
  - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7
  - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9]
  - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID
  - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9]
  - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.7-3
changelog:
  - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9]
  - Resolves: RHEL-103434 - cache_credentials = true not working


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.7-4
changelog:
  - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9]
    Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted.


author: Tomas Halman <thalman@redhat.com> - 2.9.8-1
changelog:
  - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8
  - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites
  - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name 
  - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none'
  - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so
  - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges
  - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux
  - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache


author: Justin Stephenson <jstephen@redhat.com> - 2.9.8-5
changelog:
  - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation
  - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root


author: Chris White <chwhite@redhat.com> - 1.19.5-1
changelog:
  - Updated compile options for annocheck hardening
  - Ensure we resolve library symbols at load time (-z now) and are a Position Independent Executable (-pie). Refactored compile options to better deal with arch differences.
  - Added an 'annocheck' makefile target for local checking.
  - Makefile: change build to use FORTIFY_SOURCE=3
  - src/utils.c: fix off-by-one error in buffer allocation
  Resolves: RHEL-33662


author: Chris White <chwhite@redhat.com> - 1.19.6-1
changelog:
  - Makefile: add uninstall target
  - systemd: add BE environment variable to select backend
  Resolves: RHEL-33662


author: Wander Lairson Costa <wander@redhat.com> - 1.20.3-1
changelog:
  - Rebase to stalld-1.20.3
  - Make systemd start stalld with the SCHED_FIFO:10 priority
  Resolves: RHEL-109088


author: Wander Lairson Costa <wander@redhat.com> - 1.20.4-1
changelog:
  - Rebase to stalld-1.20.4
  - Remove duplicated ExecStart entry from the stalld.service file
  Resolves: RHEL-108827


author: Wander Lairson Costa <wander@redhat.com> - 1.26.3-1
changelog:
  - Rebase to stalld-1.26.3
  - Build System Improvements and added riscv64 arch
  - Remove LTO build flags
  - Make queue_track the default backend
  - Remove the -m64 build option
  Resolves: RHEL-111528 RHEL-111526 RHEL-96207 RHEL-96205 RHEL-111803


author: Bryan Gurney <bgurney@redhat.com> - 3.4.0-1
changelog:
  - Update to version 3.4.0
  - Resolves: rhbz#2124977
  - Return no-op on overprovision command on error
  - Resolves: rhbz#2131934
  - Return error on init-cache if cache is present
  - Resolves: rhbz#2141223


author: Bryan Gurney <bgurney@redhat.com> - 3.6.1-1
changelog:
  - Update to version 3.6.1
  - Resolves: RHEL-2278
  - Add filesystem growth limits
  - Resolves: RHEL-12898


author: John Kacur <jkacur@redhat.com> - 0.17.08-1
changelog:
  - Rebase to upstream V0.17.08
  - ARM: Don't declare inlined yield helper if yield is not available
  Resolves: RHEL-33304


author: John Kacur <jkacur@redhat.com> - 0.18.06-1
changelog:
  - Update the stress-ng-0.18.06 upstream
  - Include some upstream patches after 0.18.06
  Resolves: RHEL-65474


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-13
changelog:
  RHEL: 9.7.0 ERRATUM
  - sudo missing spacing and separator in log when using "--preserve-env=list"
  Resolves: RHEL-71916
  - CVE-2025-32462 sudo: LPE via host option
  Resolves: RHEL-100020


author: Alejandro López <allopez@redhat.com> - 1.9.17p2-2
changelog:
  - Request to backport support for regex in sudo [rhel-9]
  Resolves: RHEL-1376
  - Rebase of sudo to 1.9.17p2 [rhel-9]
  Resolves: RHEL-128623
  - sudo passes SHELL environment variable twice to the shell being executed [rhel-9]
  Resolves: RHEL-127359


author: Alejandro López <allopez@redhat.com> - 1.9.17p2-3
changelog:
  - CVE-2026-35535 sudo: Privilege escalation due to failure in privilege drop calls
  Resolves: RHEL-166069


author: Kalev Lember <klember@redhat.com> - 3.39.92-2
changelog:
  - Split sysprof-capture library and header files out to sysprof-capture-devel
  - Update minimum required glib2 version


author: Lukáš Zaoral <lzaoral@redhat.com> - 12.5.4-8
changelog:
  - fix allocation errors with malformed sa files (RHEL-35684)
  - reorder patches to prevent errors during their application


author: systemd maintenance team <systemd-maint@redhat.com> - 252-59
changelog:
  - test: rename TEST-53-ISSUE-16347 to TEST-53-TIMER (RHEL-118215)
  - test: restarting elapsed timer shouldn't trigger the corresponding service (RHEL-118215)
  - test: check the next elapse timer timestamp after deserialization (RHEL-118215)
  - timer: don't run service immediately after restart of a timer (RHEL-118215)
  - test: store and compare just the property value (RHEL-118215)
  - test: make test-fd-util more lenient when using fd_move_above_stdio() (RHEL-114974)
  - basic: add PIDFS magic (#31709) (RHEL-114974)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-60
changelog:
  - man: fix a missing word (RHEL-115182)
  - cryptsetup: Add optional support for linking volume key in keyring. (RHEL-97175)
  - cryptsetup: fix typo (RHEL-97175)
  - cryptsetup: HAVE_CRYPT_SET_KEYRING_TO_LINK is always defined (RHEL-97175)
  - coredump: make check that all argv[] meta data fields are passed strict (RHEL-104138)
  - coredump: restore compatibility with older patterns (RHEL-104138)
  - coredump: use %d in kernel core pattern (RHEL-104138)
  - pidref: add structure that can reference a pid via both pidfd and pid_t (RHEL-104138)
  - fd-util: introduce parse_fd() (RHEL-104138)
  - coredump: add support for new %F PIDFD specifier (RHEL-104138)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-61
changelog:
  - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215)
  - strv: introduce string_strv_hashmap_remove() (RHEL-14112)
  - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112)
  - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112)
  - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112)
  - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-62
changelog:
  - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558)
  - timer: rebase last_trigger timestamp if needed (RHEL-118215)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-63
changelog:
  - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859)
  - cryptsetup-generator: continue parsing after error (RHEL-127859)
  - cryptsetup-generator: parse all cmdline devices too (RHEL-127859)
  - cryptsetup-generator: always process cmdline devices (RHEL-127859)
  - logind: add "background-light" session class (RHEL-109833)
  - pam_systemd: honor session class provided via PAM environment (RHEL-109833)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-64
changelog:
  - core: fix array size in unit_log_resources() (RHEL-131338)
  - pid1: add env var to override default mount rate limit burst (RHEL-129153)
  - pid1: add env var to override default mount rate limit interval (RHEL-129153)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-65
changelog:
  - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-66
changelog:
  - core/service: fix error cause in the log (RHEL-138414)
  - fstab-generator: drop assertions for mount opts (RHEL-92752)
  - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752)
  - core: reorder systemd arguments on reexec (RHEL-111135)
  - basic: add RuntimeScope enum (RHEL-137252)
  - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252)
  - sd-path: add support for XDG_STATE_HOME (RHEL-137252)
  - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252)
  - path tool: add some basic ansi highlighing (RHEL-137252)
  - execude: include RuntimeScope field in ExecParameters (RHEL-137252)
  - execute: remove redundant assignment (RHEL-137252)
  - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252)
  - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252)
  - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252)
  - execute: shorten some code by using RET_NERRNO() (RHEL-137252)
  - execute: shorten code by making use of laccess() return code properly (RHEL-137252)
  - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252)
  - test: add test for new XDG_STATE_HOME handling (RHEL-137252)
  - man: mention the newly-added XDG_STATE_HOME (RHEL-137252)
  - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252)
  - man: properly close XML tags (RHEL-137252)
  - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252)
  - test: use XDG_STATE_HOME for %S and %L (RHEL-137252)
  - man: fully adopt ~/.local/state/ (RHEL-137252)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-67.3
changelog:
  - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870)
  - nspawn: normalize pivot_root paths (RHEL-163870)
  - udev: check for invalid chars in various fields received from the kernel (RHEL-163876)
  - udev: fix review mixup (RHEL-163876)
  - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876)


author: Martin Cermak <mcermak@redhat.com> - 5.1-4
changelog:
  - RHEL-50107.patch:  Make systemtap compatible with kernel
    commit 68cbd415dd4b .  Related: RHEL-56962 .


author: Frank Ch. Eigler <fche@redhat.com> - 5.2-1
changelog:
  - Upstream release, see wiki page below for detailed notes.
  - https://sourceware.org/systemtap/wiki/SystemTapReleases


author: Frank Ch. Eigler <fche@redhat.com> - 5.3-1
changelog:
  - Upstream release, see wiki page below for detailed notes.
    https://sourceware.org/systemtap/wiki/SystemTapReleases


author: Jan Macku <jamacku@redhat.com> - 6.22.03-1
changelog:
  - Update to tcsh-6.22.03
  - Drop tcsh-6.22.02-avoid-gcc-to-fail.patch                              - applied by upstream
  - Drop tcsh-6.22.02-call-seterror-consistently-and-abort-quickly.patch   - applied by upstream
  - Drop tcsh-6.22.02-avoid-crashing-when-loading-corrupted-history.patch  - applied by upstream


author: Petr Pisar <ppisar@redhat.com> - 2.5.9-2
changelog:
  - Modernize spec file
  - License corrected to
    ((LGPLv2+ or CPL) and (LGPLv2+ or GPLv2+ or MPLv2.0 or MPLv1.1))


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-82
changelog:
  - Changing LD_FLAGS to RPM_LD_FLAGS
  - Use make_build macro and remove hard-coded gcc
  - https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make


author: Than Ngo <than@redhat.com> - 9:20200327-19
changelog:
  - Related: #1960650, add create-clean-texlive.sh to generate clean tarball from released build tarballs, update URLs


author: Release Engineering <releng@rockylinux.org> - 140.10.1-1
changelog:
  - Add custom Rocky Linux Thunderbird prefs (Louis Abel)
  - Ensure s390x and riscv64 are locked to 3 CPU's (Louis Abel)


author: Jan Grulich <jgrulich@redhat.com> - 1.14.1-2
changelog:
  - Fix CVE-2024-9632: xorg-x11-server: heap-based buffer overflow privilege escalation vulnerability
    Resolves: RHEL-62001


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-1
changelog:
  - 1.15.0
    Resolves: RHEL-78617
  - Add SELinux policy rules allowing to access /proc/sys/fs/nr_open
    Resolves: RHEL-77973
  - Add SELinux policy rules allowing to create directories under /root
    Resolves: RHEL-77975
  - Fix CVE-2025-26594 xorg-x11-server Use-after-free of the root cursor
    Resolves: RHEL-80208
  - Fix CVE-2025-26595 xorg-x11-server Buffer overflow in XkbVModMaskText()
    Resolves: RHEL-80189
  - Fix CVE-2025-26596 xorg-x11-server Heap overflow in XkbWriteKeySyms()
    Resolves: RHEL-80194
  - Fix CVE-2025-26597 xorg-x11-server Buffer overflow in XkbChangeTypesOfKey()
    Resolves: RHEL-80196
  - Fix CVE-2025-26598 xorg-x11-server Out-of-bounds write in CreatePointerBarrierClient()
    Resolves: RHEL-80197
  - Fix CVE-2025-26599 xorg-x11-server Use of uninitialized pointer in compRedirectWindow()
    Resolves: RHEL-80206
  - Fix CVE-2025-26600 xorg-x11-server Use-after-free in PlayReleasedEvents()
    Resolves: RHEL-80205
  - Fix CVE-2025-26601 xorg-x11-server Use-after-free in SyncInitTrigger()
    Resolves: RHEL-80209


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-5
changelog:
  - Fix CVE-2025-49175: xorg-x11-server: Out-of-Bounds Read in X Rendering Extension Animated Cursors
    Resolves: RHEL-97284

  - Fix CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension
    Resolves: RHEL-97303

  - Fix CVE-2025-49178: xorg-x11-server: Unprocessed Client Request Due to Bytes to Ignore
    Resolves: RHEL-97379

  - Fix CVE-2025-49179: xorg-x11-server: Integer overflow in X Record extension
    Resolves: RHEL-97414

  - Fix CVE-2025-49180: xorg-x11-server: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension
    Resolves: RHEL-97429


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-7
changelog:
  - Fix CVE-2025-62229: xorg-x11-server: Use-after-free in XPresentNotify structures creation
    Resolves: RHEL-119989

  - Fix CVE-2025-62230: xorg-x11-server: Use-after-free in Xkb client resource removal
    Resolves: RHEL-120009

  - Fix CVE-2025-62231: xorg-x11-server: Value overflow in Xkb extension XkbSetCompatMap()
    Resolves: RHEL-120770


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-7.1
changelog:
  - Fix CVE-2026-33999, CVE-2026-34000, CVE-2026-34001, CVE-2026-34002,
    CVE-2026-34003 xorg-x11-server: various XKB and XSYNC vulnerabilities
    Resolves: RHEL-163213
    Resolves: RHEL-163281
    Resolves: RHEL-163267
  - Fix CVE-2026-34352
    Resolves: RHEL-167986


author: Justin Stephenson <jstephen@redhat.com> - 12.1
changelog:
  - Exit transfer loop when output fd is closed
  - Revert "Prevent infinite transfer loop on GDM login"


author: Justin Stephenson <jstephen@redhat.com> - 13-2
changelog:
  - Provide a sysusers.d file to get user() and group() provides
    (see https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format).


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-65
changelog:
  - Update OpenSSL certificates set up
    Resolves: RHEL-81721
  - Remove deprecated path from systemd service file
    Resolves: RHEL-81716


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-66
changelog:
  - Use systemd-sysusers for the 'pegasus' user and group creation
  - Fix Requires of subpackages
    Related: RHEL-90737
  - Add support for Image Mode
    Resolves: RHEL-90737


author: Sokratis Zappis <szappis@redhat.com> - 1:9.0.87-1
changelog:
  - Resolves: RHEL-35812 - Rebase tomcat to version 9.0.87
  - Resolves: RHEL-29257
    tomcat: Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)
  - Resolves: RHEL-29252
    tomcat: : Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)
  - Resolves: RHEL-53001 - Amend tomcat's changelog
    (CVE-2023-46589, CVE-2023-45648, CVE-2023-42795, CVE-2023-42794, CVE-2023-44487, CVE-2023-41080)


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-2
changelog:
  - Resolves: RHEL-46163
    tomcat: Improper Handling of Exceptional Conditions (CVE-2024-34750)
  - Resolves: RHEL-18245 - OpenJDK 21 support for RHEL Tomcat


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-3
changelog:
  - Resolves: RHEL-82945
    tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)
  - Resolves: RHEL-71723
    tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-4
changelog:
  - Resolves: RHEL-91763
    tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (CVE-2025-31650)
  - Resolves: RHEL-71985
    tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation (CVE-2024-56337)


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-5
changelog:
  - Resolves: RHEL-108489
    tomcat: Apache Commons FileUpload DOS via part headers (CVE-2025-48976)
  - Resolves: RHEL-108497
    tomcat: Dos in multipart upload (CVE-2025-48988)
  - Resolves: RHEL-108505
    tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
  - Resolves: RHEL-108513
    tomcat: Denial of service (CVE-2025-52434)
  - Resolves: RHEL-108529
    tomcat: Denial of service (CVE-2025-52520)
  - Resolves: RHEL-108523
    tomcat: Denial of service (CVE-2025-53506)


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-6
changelog:
  - Resolves: RHEL-102201
    tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)


author: Pietro Meloni <pmeloni@redhat.com> - 1:9.0.87-7
changelog:
  - Resolves: RHEL-124516
    tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)
  - Resolves: RHEL-132561
    tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)


author: Coty Sutherland <csutherl@redhat.com> - 1:9.0.110-1
changelog:
  - Resolves: RHEL-148687
    Update to 9.0.110 and compile with Java 25 to enable FFM features for PQC support


author: Coty Sutherland <csutherl@redhat.com> - 1:9.0.110-3
changelog:
  - Resolves: RHEL-168081 Fix copy/paste error in AJP connector that caused DELETE requests to be processed as OPTIONS requests (BZ#69848)


author: Pietro Meloni <pmeloni@redhat.com> - 1:9.0.117-1
changelog:
  - Resolves: RHEL-150714 Certificate revocation bypass due to improper OCSP response validation
  - Resolves:
    Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (CVE-2026-34500)
  - Resolves:
    Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token (CVE-2026-34487)
  - Resolves:
    Tomcat: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor (CVE-2026-34486)
  - Resolves:
    Tomcat: Incomplete escaping of JSON access logs (CVE-2026-34483)
  - Resolves:
    Tomcat: The fix for CVE-2025-66614 was incomplete (CVE-2026-32990)
  - Resolves:
    Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default (CVE-2026-29146)
  - Resolves:
    Tomcat: OCSP checks sometimes soft-fail even when soft-fail is disabled (CVE-2026-29145)
  - Resolves:
    Tomcat: Configured TLS cipher preference order not preserved (CVE-2026-29129)
  - Resolves:
    Tomcat: Occasionally open redirect (CVE-2026-25854)
  - Resolves:
    Tomcat: Request smuggling via invalid chunk extension (CVE-2026-24880)
  - Resolves:
    Tomcat: Incomplete OCSP verification checks (CVE-2026-24734)
  - Resolves:
    Tomcat: Security constraint bypass (CVE-2026-24733)
  - Resolves:
    Tomcat: Client certificate verification bypass due to virtual host mapping (CVE-2025-66614)


author: Pietro Meloni <pmeloni@redhat.com> - 1:9.0.117-2
changelog:
  - Resolves: RHEL-183992 Remove tomcat clustering JAR from RPM builds
  - Exclude i686 architecture from build


author: Debarshi Ray <rishi@fedoraproject.org> - 0.2-2
changelog:
  - Update to 0.2
  - Fix CVE-2025-23266, CVE-2025-23267, and GHSA-fv92-fjc5-jj9h or GO-2025-3787
  Resolves: RHEL-104455


author: Kalev Lember <klember@redhat.com> - 3.38.2-2
changelog:
  - Use conflicts for totem-video-thumbnailer split instead of self-obsoletes
  - Resolves: rhbz#1949422


author: Štěpán Horáček <shoracek@redhat.com> - 5.2-4
changelog:
  - Backport upstream fixes.
  - tpm2_checkquote: Fix check of magic number. (CVE-2024-29038)
  - tpm2_checkquote: Add comparison of pcr selection. (CVE-2024-29039)
  - Fix check of magic number.
    Resolves: RHEL-23198
    Resolves: RHEL-41031
    Resolves: RHEL-41035


author: Tom Stellard <tstellar@redhat.com> - 3.0.9-59
changelog:
  - Use make_build and make_install macros
  - https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make
  - https://docs.fedoraproject.org/en-US/packaging-guidelines/#_why_the_makeinstall_macro_should_not_be_used


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-50568
    - clear plugin repository when stopping tuning
    - man: add description of the balanced-battery profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-2
changelog:
  - Fixed privileged execution of arbitrary scripts by active local user,
    (CVE-2024-52336)
    Resolves: RHEL-66638
  - Added sanity checks for API methods parameters, (CVE-2024-52337)
    Resolves: RHEL-66615


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-70457
    - tuned-ppd: removed the use of StrEnum
    - tuned-ppd: fixed traceback
    - tuned-ppd: multiple fixes and updates
    - docs: plugins docs are now automatically generated from the docstrings
    - plugin_cpu: fixed no_turbo boolean option parsing
      resolves: RHEL-51760
    - plugin_cpu: allowed raw energy_performance_preference values
    - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
      resolves: RHEL-58820
    - plugin_bootloader: added variables to BLS entries only if grub is used
    - plugin_scheduler: do not assume that perf events have type attribute
    - plugin_scheduler: updated sched knobs for kernels 6.6+
    - plugin_scheduler: log process info when its affinity cannot be changed
    - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
      resolves: RHEL-72981
    - plugin_scheduler: made perf support optional
    - plugin_net: added support for hotplug and rename
      resolves: RHEL-60906
    - makefile: added support for installation to custom $BINDIR/$SBINDIR
    - functions: dropped cpuspeed support


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-70457
    - sap-hana: Set transparent_hugepages to madvise
    - plugin_bootloader: export Grub variables to make them available in submenus
    - utils.commands: fixed CPU online detection when not present
    - plugin_net: handled cqe-mode-rx ethtool option
    - profiles: correct CPU governor settings


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.1-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-70457
    - plugins: added missing instance parameters
    - disk: added missing remove parameter
    - plugin_scheduler: added switch to disable processing of kthreads
    - Makefile: added support for installation to custom LIBEXECDIR
    - functions: create a new parser object for each string expansion
      resolves: RHEL-75773


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.26.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-94808
    - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
    - tuned-ppd: enabled sysfs_acpi_monitor by default
    - tuned-ppd: fixed inotify watch for performance degradation
    - tuned-ppd: pinned virtual files in memory for inotify
    - fixed instance priority inheritance
    - hotplug: added fixes for device remove race condition
    - tuned-main.conf: added startup_udev_settle_wait option
    - functions: silenced errors if module kvm_intel does not exist
      resolves: RHEL-79943
    - functions: make calc_isolated_cores return CPU ranges
      resolves: RHEL-75751
    - scsi: used 'med_power_with_dipm' for SATA ALPM
    - scsi: do not set ALPM on external SATA ports
    - network_latency: Set non-zero rcutree.nohz_full_patience_delay
    - realtime: Disable appropriate P-State drivers
      resolves: RHEL-85637
    - plugin_disk: added support for MMC (MultiMediaCard) devices
    - udev: fix possible traceback in device matcher
    - udev-settle: obey udev buffer size and handle possible tracebacks
    - daemon: re-raise daemon init exception in no-daemon mode
      resolves: RHEL-71304
    - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
      resolves: RHEL-101578
    - gui: fix the profile deleter script


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.27.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-123607
    - cpu-partitioning: autodetect dracut hook directory, systemd workaround
    - openshift: optimize TCP settings for high throughput and low latency
    - profiles: Set boost=1 in *-performance profiles
    - sap-hana: force latency to 70 us, not to C-states
    - man: fixed instance_acquire_devices example in tuned-adm man
    - spec: use correct python interpreter for documentation installation
    - sysctl: add reapply_sysctl_exclude option
    - ppd: ask tuned recommend for base profile


author: Patsy Griffin <patsy@redhat.com> - 2024a-2
changelog:
  - Add java patch to fix incorrect calculations for
    Africa/Casablanca starting in 2027. (RHEL-26860)


author: Patsy Griffin <patsy@redhat.com> - 2024b-1
changelog:
  - Update to tzdata-2024b
    - Improve historical data for Mexico, Mongolia, and Portugal.
    - System V names are now obsolescent.
    - The main data form now uses %z.
    - The code now conforms to RFC 8536 for early timestamps.
    - Support POSIX.1-2024, which removes asctime_r and ctime_r.
    - Assume POSIX.2-1992 or later for shell scripts.
    - SUPPORT_C89 now defaults to 1.
    - Include two upstream patches for month names as in April vs Apr.


author: Patsy Griffin <patsy@redhat.com> - 2025a-1
changelog:
  Update to tzdata-2025a (RHEL-74308)
    - Paraguay is now permanently at -03. This impacts timestamps
      starting on 2025-03-22.
    - Includes improvements to pre-1991 data for the Philippines.
    - Etc/Unknown is now reserved.


author: Patsy Griffin <patsy@redhat.com> - 2025b-1
changelog:
  - Update to tzdata-2025b (RHEL-84741)
    - Chile's Aysén Region moves from -04/-03
      to -03 year-round, diverging from America/Santiago and
      creating a new zone America/Coyhaique.


author: Patsy Griffin <patsy@redhat.com> - 2026a-1
changelog:
  - Update to tzdata-2026a (RHEL-154025)
    - Correct the transition times for Moldova.
    - The POSIXRULES option is now obsolete.


author: Patsy Griffin <patsy@redhat.com> - 2026b-1
changelog:
  - Update to tzdata-2026b (RHEL-170784)
    - British Columbia’s 2026-03-08 spring forward is expected
      to be its last transition as it moves to permanent -07.


author: Vit Mojzis <vmojzis@redhat.com> - 0.2.8-1
changelog:
  - Improve code readability based on lint and black findings
  - Fix generating policy for Crio mounts
  - Add --devices option
  - v0.2.7 release changes:
  - Improve label collection for mounts and devices (RHEL-16245)
  - Add support for containerd via "nerdctl inspect"
  - Avoid duplicate rules for accessing mounts and devices


author: Vit Mojzis <vmojzis@redhat.com> - 0.2.8-2
changelog:
  - Add option to generate custom policy for a confined user (RHEL-28166)
  - Add tests covering confined user policy generation
  - confined: make "-l" non optional
  - confined: allow asynchronous I/O operations


author: RHEL Packaging Agent <jotnar@redhat.com> - 2.3.12-1
changelog:
  - Rebase to version 2.3.12
  - Add unixODBC-c89.patch for GCC 14 compatibility
  - Update so-version-bump.patch for new version
  - Fix multilib_fix_c_header path to match actual header location
  - Resolves: RHEL-94798


author: Victor Toso <victortoso@redhat.com> - 0.13.0-1
changelog:
  - Rebase to latest upstream: 0.13.0
  - Keeps usbredirserver binary (removed upstream)
    Related: rhbz#2135760


author: Victor Toso <victortoso@redhat.com> - 0.13.0-2
changelog:
  - Fixes 100% CPU usage when usbredirect used as TCP server
    Related: rhbz#2157520
  - Fixes USB redirection of identical devices
    Resolves: rhbz#2157520


author: Mark Wielaard <mjw@redhat.com> - 3.24.0-2
changelog:
  - Add VALGRIND_3_24_BRANCH patches
    0001-Prepare-NEWS-for-branch-3.24-fixes.patch
    0002-vgdb.c-fork_and_exec_valgrind-Fix-off-by-one-error-w.patch
    0003-vgdb.c-fork_and_exec_valgrind-Fix-another-off-by-one.patch
    0004-regtest-add-a-fdleak-filter-for-write-on-write-on-li.patch
    0005-Add-exp-and-supp-patterns-for-missing-main-frame-for.patch
    0006-Add-additional-exp-ppc64le-files-to-EXTRA_DIST.patch
    0007-Add-support-for-landlock_create_ruleset-444-landlock.patch
    0008-helgrind-tests-tc17_sembar.c-Remove-bool-typedef.patch
    0009-drd-tests-swapcontext.c-Rename-typedef-struct-thread.patch
    0010-none-tests-bug234814.c-sa_handler-take-an-int-as-arg.patch
    0011-Add-open_tree-move_mount-fsopen-fsconfig-fsmount-fsp.patch


author: Mark Wielaard <mjw@redhat.com> - 3.24.0-3
changelog:
  - Add more VALGRIND_3_24_BRANCH patches
    0012-Recognize-new-DWARF5-DW_LANG-constants.patch
    0013-Bug-498317-FdBadUse-is-not-a-valid-CoreError-type-in.patch
    0014-linux-support-EVIOCGRAB-ioctl.patch


author: Mark Wielaard <mjw@redhat.com> - 3.24.0-4
changelog:
  - Split main valgrind package into several subpackages:
    - valgrind now contains just the core tools.
    - valgrind-scripts contains the post-processing scripts for callgrind,
      cachegrind, massif and dhat which depend on perl and python.
    - valgrind-gdb contains the debuginfo client/server and (v)gdb support.
    - valgrind-docs contains the man pages, html and pdf manual.
  - Adjust Requires/Recommends to subpackages can be installed independently.
    - valgrind-devel now Recommends, instead of Requires, valgrind.
    - valgrind-gdb Requires valgrind
    - valgrind-scripts Recommends valgrind-gdb
    - valgrind-gdb Recommends gdb


author: Mark Wielaard <mjw@redhat.com> - 3.25.1-2
changelog:
  - Add VALGRIND_3_25_BRANCH patches
    - 0001-Prepare-NEWS-for-branch-3.25.x-fixes.patch
    - 0002-Bug-503241-s390x-Support-z17-changes-to-the-NNPA-ins.patch


author: Mark Wielaard <mjw@redhat.com> - 3.26.0-1
changelog:
  - Valgrind 3.26.0 final
  - Remove all VALGRIND_3_25_BRANCH and proposed upstream patches
  - Refresh some-stack-protector and some-Wl-z-now patches.
  - Add vgstack to valgrind-gdb.
  - Update License to GPL-3.0-or-later


author: Mark Wielaard <mjw@redhat.com> - 3.26.0-4
changelog:
  - Add VALGRIND_3_26_BRANCH patches
    - 0001-Prepare-NEWS-for-branch-3.26-fixes.patch
    - 0002-Bug-511972-valgrind-3.26.0-tests-fail-to-build-on-up.patch
    - 0003-readlink-proc-self-exe-overwrites-buffer-beyond-its-.patch
    - 0004-Linux-DRD-suppression-add-an-entry-for-__is_decorate.patch
    - 0005-Linux-Helgrind-add-a-suppression-for-_dl_allocate_tl.patch
    - 0006-Disable-linux-madvise-MADV_GUARD_INSTALL.patch
    - 0007-Bug-514613-Unclosed-leak_summary-still_reachable-tag.patch
    - 0008-Bug-514206-Assertion-sr_isError-sr-failed-mmap-fd-po.patch


author: Remi Collet <rcollet@redhat.com> - 7.2.6.1
changelog:
  - rebase to 7.2.6
  - merge limit.conf in main service files
  - drop /etc/sysconfig/valkey
  - rename compat package
  - fix working dir
  - partially enable upstream test suite


author: Luboš Uhliarik <luhliari@redhat.com> - 6.6.2-6
changelog:
  - Resolves: RHEL-30337 - varnish: HTTP/2 Broken Window Attack may result
    in denial of service (CVE-2024-30156)


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 0.17.0-0.1.klarlack.20200916git
changelog:
  - Switched upstream to Nils Goroll's fork which is the defacto current upstream
  - Synced description to reality
  - This is a snapshot build that needs autotools for building
  - Rebuilt for varnish-6.5.0


author: Ingvar Hagelund <ingvar@redpill-linpro.com> 0.17.1-1
changelog:
  - New upstream release
  - Switched back to original varnish github upstream, as it has catched up
  - Includes fix for CVE-2021-28543, VSV00006, bz#1939669


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-26.1
changelog:
  - RHEL-159630 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-26.5
changelog:
  - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite
    via path traversal bypass


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-23
changelog:
  - RHEL-112005 CVE-2025-53905 vim: Vim path traversial
  - RHEL-112009 CVE-2025-53906 vim: Vim path traversal


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-26
changelog:
  - RHEL-155438 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin
  - RHEL-155423 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file


author: William Poteat <wpoteat@redhat.com> 1.31.25-1
changelog:
  - 2099925: Drop support for RHEVM on RHEL 9 (jhnidek@redhat.com)
  - Update virt-who-config.5 (s10w.1ife.31@gmail.com)
  - Big optimization and refactoring of Nutanix code (jhnidek@redhat.com)


author: Jiri Hnidek <jhnidek@redhat.com> 1.31.26-1
changelog:
  - Fix stylish issue in migrateconfiguration.py (jhnidek@redhat.com)
  - Added next rhel-9.x subversion to releasers.conf file. (jhnidek@redhat.com)
  - 2158710: Migrated virt-who.conf, when necessary (jhnidek@redhat.com)
  - Added documentation for the 'rhsm_insecure' option, for insecure connections
    (fernandez.santos.d@gmail.com)
  - Added configuration for rhel-9.x into releasers.conf (jhnidek@redhat.com)


author: Jiri Hnidek <jhnidek@redhat.com> 1.31.27-1
changelog:
  - ci: bump actions/checkout from 3 to 4
    (49699333+dependabot[bot]@users.noreply.github.com)
  - Change /var/run -> /run (orion@nwra.com)
  - ci: add dependabot config for GitHub Actions (ptoscano@redhat.com)
  - Drop unused copy of python-daemon sources (ptoscano@redhat.com)
  - Migrate to SPDX license (jhnidek@redhat.com)
  - fix: disable complex tests for ESX (jhnidek@redhat.com)
  - fix: use ssl.SSLContext.wrap_socket for wrapping socket (jhnidek@redhat.com)
  - fix: stylish issue discovered by flake8 (jhnidek@redhat.com)
  - fix: Use ConfigParser and not SafeConfigParser (jhnidek@redhat.com)
  - spec: drop unused openssl dependency (ptoscano@redhat.com)
  - spec: hardcode/inline Python 3 variables (ptoscano@redhat.com)
  - spec: drop unused Group tag (ptoscano@redhat.com)
  - spec: do not Require setuptools (ptoscano@redhat.com)
  - spec: drop $RPM_BUILD_ROOT manual cleanup (ptoscano@redhat.com)
  - Updated README.md file to reflect current state (jhnidek@redhat.com)
  - Drop outdated/unused requirements (ptoscano@redhat.com)
  - Removed support for Jenkins (jhnidek@redhat.com)
  - Added support for GitHub actions (jhnidek@redhat.com)
  - Removed some unused parts of Makefile (jhnidek@redhat.com)
  - Removed support for docker (jhnidek@redhat.com)
  - spec: assume the python3-libvirt package name everywhere
    (ptoscano@redhat.com)
  - spec: drop redundant "release_number" variable (ptoscano@redhat.com)
  - spec: drop outdated variables and comments (ptoscano@redhat.com)
  - spec: drop six dependency (ptoscano@redhat.com)
  - Drop non-systemd support (ptoscano@redhat.com)
  - Feature: improve log message, when wrong value is provided
    (jhnidek@redhat.com)
  - Fix: default value for prism_central cannot be None (jhnidek@redhat.com)
  - spec: drop support for Python < 3 (ptoscano@redhat.com)
  - spec: drop support for Fedora < 36 (ptoscano@redhat.com)
  - spec: drop support for RHEL < 8 (ptoscano@redhat.com)


author: Ville-Pekka Vainio <vpvainio AT iki.fi> - 2.4-2
changelog:
  - Review fixes:
  - Fix Obsoletes
  - Use the prefix macro in the dictionary path
  - Use the license macro
  - Do not own the whole data directory, just the version 5 subdirectory


author: Debarshi Ray <rishi@fedoraproject.org> - 0.64.2-1
changelog:
  - Update to 0.64.2
  - Add missing _VTE_CXX_NOEXCEPT to downstream patches (#1973174)
  - Fix the License fields and ship the correct license texts (#1973299)


author: Brian C. Lane <bcl@redhat.com> - 35.12-1
changelog:
  - Copy rhel-9.4.json test repository from osbuild-composer
  - New release: 35.12 (bcl)
    Resolves: RHEL-1035
  - Add support for compose start warning messages (bcl)
  - Update documentation urls for new locations (bcl)
  - weldr: go fmt changes to a couple comments (bcl)
  - weldr: Update ostree test for parentid with no url (bcl)
  - Makefile: Turn off seccomp for build-in-podman (bcl)
  - composer-cli: Update doc links (simon.steinbeiss)
  - docs: fix typo/formatting in HACKING.md (idiez)
  - Add release creation documentation (bcl)
  - spec: Require createrepo_c for weldr-client-tests package (bcl)
  - spec: migrate the license field to SPDX (ondrej)
  - Go: Switch to go 1.19 (bcl)
  - CI: Update terraform hash (bcl)
  - Actions: add workflow for marking and closing stale issues and PRs (thozza)
  - workflows: Stop using golint (bcl)
  - workflows: Add Go 1.21 and 1.22 to test matrix (bcl)
  - workflows: Update to golangci-lint 1.56.2 (bcl)
  - workflow: Ignore govulncheck failures (bcl)
  - workflow: Switch to testing on go 1.18, 1.19, 1.20 (bcl)
  - build(deps): bump actions/setup-go from 3 to 5 (49699333+dependabot[bot])
  - build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.8.0 (49699333+dependabot[bot])
  - build(deps): bump actions/checkout from 3 to 4 (49699333+dependabot[bot])
  - build(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.2 (49699333+dependabot[bot])
  - build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.4 (49699333+dependabot[bot])


author: Brian C. Lane <bcl@redhat.com> - 35.12-3
changelog:
  - tests: OSTree does not support the qcow2 image type
  - Add test repositories for RHEL 9.6 and 9.7
  - Rebuild for CVE-2025-22871
    Resolves: RHEL-89344


author: Brian C. Lane <bcl@redhat.com> - 35.12-4
changelog:
  - Bump release for y-stream AND z-stream building using
    centpkg build --rhel-target=zstream
    Related: RHEL-89344


author: Debarshi Ray <rishi@fedoraproject.org> - 41.1-2
changelog:
  - Make the Supplements specific to Fedora to retain consistency with
    xdg-desktop-portal-gtk
  Resolves: #2051473


author: Pavel Reichl <preichl@redhat.com> - 6.3.0-1
changelog:
  - Rebase to upstream version 6.3.0
  -
  - Following is a list of dropped backported patches which
  - are contained in the current rebase:
  - xfsprogs-5.19.0-xfs-hoist-refcount-record-merge-predicates.patch (v6.2.0)
  - xfsprogs-5.19.0-xfs_db-fix-dir3-block-magic-check.patch (v6.1.0)
  - xfsprogs-5.19.0-xfs-estimate-post-merge-refcounts-correctly.patch (v6.2.0)
  - xfsprogs-5.19.0-xfs-get-rid-of-assert-from-xfs_btree_islastblock.patch (v6.2.0)
  - xfsprogs-5.19.0-xfs-fix-off-by-one-error-in-xfs_btree_space_to_heigh.patch (v6.2.0)
  - xfsprogs-5.19.0-xfs-fix-sb-write-verify-for-lazysbcount.patch (v6.1.0)
  - xfsprogs-5.19.0-xfs-removed-useless-condition-in-function-xfs_attr_n.patch (v6.0.0)
  - xfsprogs-5.19.0-xfs_repair-retain-superblock-buffer-to-avoid-write-h.patch (v6.1.0)
  -
  - Rename the remaining patches so the name contains upstream version in which
  - they are implemented, or "rhelonly".
  -
  - Drop Eric Sandeen's public key used to check tarball signature and replace it by
  - Carlos Maiolino's (current upstream xfsprogs maintainer).
  -
  - Following is a list of newly backported patches from versions released after 6.3
  - which are fixing patches present in version 6.3:
  - xfsprogs-6.4.0-xfs_repair-don-t-add-junked-entries-to-the-rebuilt-d.patch
  - xfsprogs-6.4.0-xfs_repair-don-t-spray-correcting-imap-all-by-itself.patch
  - xfsprogs-6.4.0-xfs_repair-fix-messaging-when-fixing-imap-due-to-spa.patch
  - xfsprogs-6.4.0-xfs_repair-fix-messaging-when-shortform_dir2_junk-is.patch
  -
  - Backport:
  - xfsprogs-6.4.0-xfs_db-move-obfuscate_name-assertion-to-callers.patch
  - xfsprogs-6.4.0-xfs_db-fix-metadump-name-obfuscation-for-ascii-ci-fi.patch
  - xfsprogs-6.4.0-xfs-stabilize-the-dirent-name-transformation-functio.patch
  - to implement RHEL-RHEL-8284
  -
  - Backport xfsprogs-rhelonly-xfs_quota-fix-missing-mount-point-warning.patch
  - to implement RHEL-7900
  -
  - Related: RHEL-15399
  - Related: RHEL-8284
  - Related: RHEL-7900


author: Pavel Reichl <preichl@redhat.com> - 6.4.0-1
changelog:
  - Rebase to a more recent upstream release
  - Related: RHEL-28339
  - Following is a list of dropped backported patches which
  - are contained in the current rebase:
  - xfsprogs-6.4.0-set-bnobt-cntbt-numrecs-correctly-when-formattin.patch
  - xfsprogs-6.4.0-mkfs-fix-man-s-default-value-for-sparse-option.patch
  - xfsprogs-6.4.0-xfs_repair-don-t-add-junked-entries-to-the-rebuilt-d.patch
  - xfsprogs-6.4.0-xfs_repair-fix-messaging-when-fixing-imap-due-to-spa.patch
  - xfsprogs-6.4.0-xfs_repair-don-t-spray-correcting-imap-all-by-itself.patch
  - xfsprogs-6.4.0-xfs_repair-fix-messaging-when-shortform_dir2_junk-is.patch
  - xfsprogs-6.4.0-xfs_db-move-obfuscate_name-assertion-to-callers.patch
  - xfsprogs-6.4.0-xfs_db-fix-metadump-name-obfuscation-for-ascii-ci-fi.patch
  - xfsprogs-6.4.0-xfs-stabilize-the-dirent-name-transformation-functio.patch
  -
  - Rename xfs_quota-fix-missing-mount-point-warning.patch to reflect upstream
  -	version it was merged in.


author: Bill O'Donnell <bodonnel@redhat.com> - 6.4.0-2
changelog:
  - Fix various CVE issues.
  - Related: RHEL-32996
  - Following is the patch list:
  - xfsprogs-6.5.0-xfs_db.xfs.8-xfs_db-fix-leak-in-flist_find_ftyp.patch
  - xfsprogs-6.5.0-xfs_repair.xfs.8-xfs_repair-make-duration-take-time_t.patch
  - xfsprogs-6.5.0-xfs_repair.xfs.8-xfs_scrub-don-t-call-phase_end-if-phase_rusage-was-n.patch
  - xfsprogs-6.5.0-xfs_fsr.xfs.8-xfs_fsr-convert-fsrallfs-to-use-time_t-instead-of-in.patch
  - xfsprogs-6.5.0-xfs_fsr.xfs.8-xfs_fsr-replace-atoi-with-strtol.patch
  - xfsprogs-6.5.0-xfs_db.xfs.8-xfs_db-add-helper-for-flist_find_type-for-clearer-fi.patch
  - xfsprogs-6.5.0-xfs_repair.xfs.8-xfs_repair-catch-strtol-errors.patch
  - xfsprogs-rhelonly-xfs_db-fix-unitialized-variable-in-check_parents-function.patch


author: Bill O'Donnell <bodonnel@redhat.com> - 6.4.0-3
changelog:
  - Fix coverity issue
  - Related: RHEL-39449
  - Following is the patch list:
  - xfsprogs-6.5.0-xfs.8-xfs-fix-bounds-check-in-xfs_defer_agfl_block.patch


author: Pavel Reichl <preichl@redhat.com> - 6.4.0-7
changelog:
  - xfs unrepairable filesystem if directory block not junked in phase 3 - more
  - fixes
  - Related: RHEL-54342


author: Peter Hutterer <peter.hutterer@redhat.com> 2.32-1
changelog:
  - xkeyboard-config 2.32
  - build with meson now
  - drop the xorg ruleset, no longer in use. Everything is hardcoded to evdev
    these days.


author: Peter Hutterer <peter.hutterer@redhat.com> 2.32-3
changelog:
  - Restore the xorg ruleset, console-setup and possibly others are still
    using those (#1951875)
  - Allow for a "custom" layout
  - Don't mark the DTD document as XML document (#1952283)
  - Remove a duplicate keyboard layout to prevent a crash in gnome-desktop's
    xkbinfo


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.0.0-5
changelog:
  - Emulate a zero axis events after REL_WHEEL (RHEL-153540)
  - Fix ToolSerials assignment for serials greater than INT_MAX (RHEL-153532)


author: Peter Hutterer <peter.hutterer@redhat.com> 7.5-29
changelog:
  - BuildRequire mkfontscale now that it's separated out from
    xorg-x11-font-utils (#1938069)
  - Use the make_build rpm macro


author: Peter Hutterer <peter.hutterer@redhat.com> 7.5-30
changelog:
  - Replace the external xorg-x11-fonts-update-dirs script with an rpm macro
    doing the same thing, removing our runtime reliance on
    xorg-x11-font-utils (#1938074)


author: Peter Hutterer <peter.hutterer@redhat.com> 7.5-31
changelog:
  - Drop the daewoo-misc fonts, they have no upstream license terms and may be
    proprietary (#1952727)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-28
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-80201), CVE-2025-26595 (RHEL-80186),
                 CVE-2025-26596 (RHEL-80188), CVE-2025-26597 (RHEL-80191),
                 CVE-2025-26598 (RHEL-80192), CVE-2025-26599 (RHEL-80199),
                 CVE-2025-26600 (RHEL-80198), CVE-2025-26601 (RHEL-80200)


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.11-30
changelog:
  - xfree86: Fix potentially NULL reference to platform device's PCI device
    Resolves: https://issues.redhat.com/browse/RHEL-84253


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-31
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97285), CVE-2025-49176 (RHEL-97308),
                 CVE-2025-49178 (RHEL-97387), CVE-2025-49179 (RHEL-97409),
                 CVE-2025-49180 (RHEL-97253)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-32
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119963), CVE-2025-62230 (RHEL-120035),
                 CVE-2025-62231 (RHEL-125003)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-34
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163226
    Resolves: https://redhat.atlassian.net/browse/RHEL-163308
    Resolves: https://redhat.atlassian.net/browse/RHEL-163239


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-34.1
changelog:
  - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258,
                 CVE-2026-50259, CVE-2026-50260, CVE-2026-50261,
                 CVE-2026-50262, CVE-2026-50263, CVE-2026-50264
    Resolves: https://redhat.atlassian.net/browse/RHEL-182435


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-3
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-80204), CVE-2025-26595 (RHEL-80187),
                 CVE-2025-26596 (RHEL-80190), CVE-2025-26597 (RHEL-80193),
                 CVE-2025-26598 (RHEL-80195), CVE-2025-26599 (RHEL-80202),
                 CVE-2025-26600 (RHEL-80203), CVE-2025-26601 (RHEL-80207)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-4
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97288), CVE-2025-49176 (RHEL-97334),
                 CVE-2025-49177 (RHEL-97357), CVE-2025-49178 (RHEL-97393),
                 CVE-2025-49179 (RHEL-97404), CVE-2025-49180 (RHEL-97244)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-5
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119977), CVE-2025-62230 (RHEL-120023),
                 CVE-2025-62231 (RHEL-125018)


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-3
changelog:
  - Fix a regression in Xwayland 24.1.9 with XTS test Xlib10
    Resolves: https://redhat.atlassian.net/browse/RHEL-170368


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-4
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163199
    Resolves: https://redhat.atlassian.net/browse/RHEL-163295
    Resolves: https://redhat.atlassian.net/browse/RHEL-163253


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-4.1
changelog:
  - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258,
                 CVE-2026-50259, CVE-2026-50260, CVE-2026-50261,
                 CVE-2026-50262, CVE-2026-50263
    Resolves: https://redhat.atlassian.net/browse/RHEL-182426


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-4.3
changelog:
  - CVE fix for: CVE-2026-55999, CVE-2026-56000
    Resolves: https://redhat.atlassian.net/browse/RHEL-191532
    Resolves: https://redhat.atlassian.net/browse/RHEL-191524


author: Vladis Dronov <vdronov@redhat.com> - 0.8.2-1
changelog:
  - Update to version 0.8.2
  - Drop patch 1-fix-man-page-installation.patch
  - Use SPDX license identifiers


author: Matej Mužila <mmuzila@redhat.com> - 1.2.11-34
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.11-37
changelog:
  - Rebased Power 8 optimization patches
  - Fix for Unnecessary IFUNC resolver for crc32_z
  - Fix for python3.11 broken libxml2 and lxml on s390x


