# changelog

author: Viktor Ashirov <vashirov@redhat.com> - 2.6.1-1
changelog:
  - Update to 2.6.1
  - Resolves: RHEL-5151 - [RFE] defer memberof nested updates
  - Resolves: RHEL-54148 - leaked_storage: Variable "childelems" going out of scope leaks the storage it points to.
  - Resolves: RHEL-60135 - deadlock during cleanAllRuv
  - Resolves: RHEL-61341 - After an initial failure, subsequent online backups will not work.
  - Resolves: RHEL-61349 - Remove deprecated setting for HR time stamps in logs
  - Resolves: RHEL-62875 - Passwords are not being updated to use the configured storage scheme ( nsslapd-enable-upgrade-hash is enabled ).
  - Resolves: RHEL-64438 - VLV errors with RSNv3 and pruning enabled [rhel-9]
  - Resolves: RHEL-64854 - cleanallruv consums CPU and is slow
  - Resolves: RHEL-65506 - AddressSanitizer: double-free
  - Resolves: RHEL-65512 - AddressSanitizer: heap-use-after-free in import_abort_all
  - Resolves: RHEL-65561 - LeakSanitizer: detected memory leaks in dbmdb_public_db_op
  - Resolves: RHEL-65662 - Replication issue between masters using cert based authentication
  - Resolves: RHEL-65664 - LDAP unprotected search query during certificate based authentication
  - Resolves: RHEL-65665 - Ambiguous warning about SELinux in dscreate for non-root user
  - Resolves: RHEL-65741 - LeakSanitizer: memory leak in ldbm_entryrdn.c
  - Resolves: RHEL-65776 - Wrong set of entries returned for some search filters [rhel-9]
  - Resolves: RHEL-67004 - "dsconf config replace" should handle multivalued attributes.
  - Resolves: RHEL-67005 - Online backup hangs sporadically.
  - Resolves: RHEL-67008 - Some replication status data are reset upon a restart.
  - Resolves: RHEL-67020 - 389DirectoryServer Process Stops When Setting up Sorted VLV Index
  - Resolves: RHEL-67024 - Some nsslapd-haproxy-trusted-ip values are discarded upon a restart.
  - Resolves: RHEL-69806 - ipahealthcheck.ds.replication displays WARNING '1 conflict entries found under the replication suffix'
  - Resolves: RHEL-69826 - "Duplicated DN detected" errors when creating indexes or importing entries. [rhel-9]
  - Resolves: RHEL-70127 - Crash in attrlist_find() when the Account Policy plugin is enabled. [rhel-9]
  - Resolves: RHEL-70252 - Freelist ordering causes high wtime
  - Resolves: RHEL-71218 - Sub suffix causes "id2entry - Could not open id2entry err 0" error when the Directory Server starts [rhel-9]
  - Resolves: RHEL-74153 - backup/restore broken [rhel-9]
  - Resolves: RHEL-74158 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex [rhel-9]
  - Resolves: RHEL-74163 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set [rhel-9]
  - Resolves: RHEL-74168 - On replica consumer, account policy plugin fails to manage the last login history [rhel-9]
  - Resolves: RHEL-74174 - Replication broken after backup restore with freeipa configuration [rhel-9]
  - Resolves: RHEL-74353 - nsslapd-haproxy-trusted-ip is not in schema [rhel-9]
  - Resolves: RHEL-76019 - IPA LDAP error code T3 when no exceeded time limit from a paged search result [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.6.1-3
changelog:
  - Resolves: RHEL-18333 Can't rename users member of automember rule
  - Resolves: RHEL-61341 After an initial failure, subsequent online backups will not work.
  - Resolves: RHEL-63887 nsslapd-mdb-max-dbs autotuning doesn't work properly
  - Resolves: RHEL-63891 dbscan crashes when showing statistics for MDB
  - Resolves: RHEL-63998 dsconf should check for number of available named databases
  - Resolves: RHEL-78344 During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.6.1-4
changelog:
  - Resolves: RHEL-78722 - Failed to set sslversionmax to TLS1.3 in FIPS mode with dsconf $INSTANCE security set --tls-protocol-max TLS1.3


author: Viktor Ashirov <vashirov@redhat.com> - 2.7.0-3
changelog:
  - Resolves: RHEL-77983 - Defects found by OpenScanHub
  - Resolves: RHEL-79673 - Improve the "result" field of ipa-healthcheck if replicas are busy
  - Resolves: RHEL-80496 - Can't rename users member of automember rule [rhel-9]
  - Resolves: RHEL-81141 - Healthcheck tool should warn admin about creating a substring index on membership attribute [rhel-9]
  - Resolves: RHEL-89736 - dsconf backend replication monitor fails if replica id starts with 0 [rhel-9]
  - Resolves: RHEL-89745 - ns-slapd crash in dbmdb_import_prepare_worker_entry() [rhel-9]
  - Resolves: RHEL-89753 - Nested group does not receive memberOf attribute [rhel-9]
  - Resolves: RHEL-89769 - Crash in __strlen_sse2 when using the nsRole filter rewriter. [rhel-9]
  - Resolves: RHEL-89782 - RHDS12.2 NSMMReplicationPlugin - release_replica Unable to parse the response [rhel-9]
  - Resolves: RHEL-95768 - Improve error message when bulk import connection is closed [rhel-9]
  - Resolves: RHEL-101189 - lib389/replica.py is using unexisting datetime.UTC in python3.9


author: Viktor Ashirov <vashirov@redhat.com> - 2.7.0-4
changelog:
  - Resolves: RHEL-61347 - Directory Server is unavailable after a restart with nsslapd-readonly=on and consumes 100% CPU


author: Viktor Ashirov <vashirov@redhat.com> - 2.7.0-5
changelog:
  - Resolves: RHEL-89762 - dsidm Error: float() argument must be a string or a number, not 'NoneType' [rhel-9]
  - Resolves: RHEL-92041 - Memory leak in roles_cache_create_object_from_entry
  - Resolves: RHEL-95444 - ns-slapd[xxxx]: segfault at 10d7d0d0 ip 00007ff734050cdb sp 00007ff6de9f1430 error 6 in libslapd.so.0.1.0[7ff733ec0000+1b3000] [rhel-9]
  - Resolves: RHEL-104821 - ipa-restore fails to restore SELinux contexts, causes ns-slapd AVC denials on /dev/shm after restore.
  - Resolves: RHEL-107005 - Failure to get Server monitoring data when NDN cache is disabled. [rhel-9]
  - Resolves: RHEL-107581 - segfault - error 4 in libpthread-2.28.so [rhel-9]
  - Resolves: RHEL-107585 - ns-slapd crashed when we add nsslapd-referral [rhel-9]
  - Resolves: RHEL-107586 - CWE-284 dirsrv log rotation creates files with world readable permission [rhel-9]
  - Resolves: RHEL-107587 - CWE-532 Created user password hash available to see in audit log [rhel-9]
  - Resolves: RHEL-107588 - CWE-778 Log doesn't show what user gets password changed by administrator [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.7.0-7
changelog:
  - Resolves: RHEL-104591 - RHDS12: Web console doesn't show Server Version [rhel-9]
  - Resolves: RHEL-104593 - The numSubordinates value is not matching the number of direct children. [rhel-9]
  - Resolves: RHEL-109034 - Allow Uniqueness plugin to search uniqueness attributes using custom matching rules [rhel-9]
  - Resolves: RHEL-109885 - Wrong backend database name syntax causes "Red Hat Directory Server" => "Databases" menu blank in Cockpit [rhel-9]
  - Resolves: RHEL-109889 - RootDN Access Control Plugin with wildcards for IP addresses fails with an error "Invalid IP address" [rhel-9]
  - Resolves: RHEL-109892 - On RHDS 12.6 The user password policy for a user was created, but the pwdpolicysubentry attribute for this user incorrectly points to the People OU password policy instead of the specific user policy.  [rhel-9]
  - Resolves: RHEL-109897 - AddressSanitizer: leak in do_search [rhel-9]
  - Resolves: RHEL-113981 - AddressSanitizer: memory leak in memberof_add_memberof_attr [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-1
changelog:
  - Resolves: RHEL-111229 - Error showing local password policy on web UI [rhel-9]
  - Resolves: RHEL-112680 - Statistics about index lookup report a wrong duration [rhel-9]
  - Resolves: RHEL-116426 - RetroCL plugin generates invalid LDIF [rhel-9]
  - Resolves: RHEL-117050 - Replication online reinitialization of a large database gets stalled. [rhel-9]
  - Resolves: RHEL-117748 - The numSubordinates value is not matching the number of direct children. [rhel-9]
  - Resolves: RHEL-117771 - When deferred memberof update is enabled after the server crashed it should not launch memberof fixup task by default
  - Resolves: RHEL-117782 - Ignore the memberOfDeferredUpdate setting when LMDB is used.  [rhel-9]
  - Resolves: RHEL-121170 - Units for changing MDB max size are not consistent across different tools [rhel-9]
  - Resolves: RHEL-123231 - Improve the way to detect asynchronous operations in the access logs [rhel-9]
  - Resolves: RHEL-123244 - Attribute uniqueness is not enforced upon modrdn operation [rhel-9]
  - Resolves: RHEL-123258 - Typo in errors log after a Memberof fixup task. [rhel-9]
  - Resolves: RHEL-123272 - LDAP high CPU usage while handling indexes with IDL scan limit at INT_MAX [rhel-9]
  - Resolves: RHEL-123279 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue [rhel-9]
  - Resolves: RHEL-123368 - IPA health check up script shows time skew is over 24 hours [rhel-9]
  - Resolves: RHEL-123766 - 389-ds-base OpenScanHub Leaks Detected [rhel-9]
  - Resolves: RHEL-123893 - Improve output dsctl dbverify when backend does not exist [rhel-9]
  - Resolves: RHEL-123897 - [WebUI] Replication tab crashes after enabling replication as a consumer [rhel-9]
  - Resolves: RHEL-123923 - Changelog trimming - add number of scanned entries to the log [rhel-9]
  - Resolves: RHEL-126552 - RHDS 12.6 doesn't handle 'ldapsearch' filter with space char in DN name correctly [rhel-9]
  - Resolves: RHEL-129559 - Online initialization of consumers fails with error -23 [rhel-9]
  - Resolves: RHEL-129580 - Fix paged result search locking [rhel-9]
  - Resolves: RHEL-138481 - Memory leak observed in ns-slapd with 389-ds-base-2.6.1-12 [rhel-9]
  - Resolves: RHEL-139825 - Rebase 389-ds-base to 2.8.x
  - Resolves: RHEL-140089 - Upgrading IDM  to latest version: 389-ds-base and ipa-server breaks replication  [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-2
changelog:
  - Resolves: RHEL-140089 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-3
changelog:
  - Resolves: RHEL-117050 - Replication online reinitialization of a large database gets stalled. [rhel-9]
  - Resolves: RHEL-123244 - Attribute uniqueness is not enforced upon modrdn operation [rhel-9]
  - Resolves: RHEL-123279 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue [rhel-9]
  - Resolves: RHEL-140275 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. [rhel-9]
  - Resolves: RHEL-142980 - Scalability issue of replication online initialization with large database [rhel-9]
  - Resolves: RHEL-146899 - memory corruption in alias entry plugin [rhel-9]
  - Resolves: RHEL-147212 - Access logs are not getting deleted as configured. [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-4
changelog:
  - Resolves: RHEL-117050 - Replication online reinitialization of a large database gets stalled. [rhel-9]
  - Resolves: RHEL-123279 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue [rhel-9]
  - Resolves: RHEL-140275 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. [rhel-9]
  - Resolves: RHEL-142980 - Scalability issue of replication online initialization with large database [rhel-9]
  - Resolves: RHEL-146899 - memory corruption in alias entry plugin [rhel-9]
  - Resolves: RHEL-147212 - Access logs are not getting deleted as configured. [rhel-9]
  - Resolves: RHEL-150907 - Remove memberof_del_dn_from_groups from MemberOf plugin [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-5
changelog:
  - Resolves: RHEL-137084 - CVE-2025-14905 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow [rhel-9.8]
  - Resolves: RHEL-152335 - Crash in trim_changelog() during the Retro Changelog trimming. [rhel-9.8]
  - Resolves: RHEL-152338 - Crash ( Segmentation fault ) in atomic_compare_exchange() [rhel-9.8]


author: Viktor Ashirov <vashirov@redhat.com> - 2.9.0-1
changelog:
  - Bump version to 2.9.0
  - Resolves: RHEL-165978 - Replication halt caused by an incorrect setting of "nsslapd-changelogmaxage"
  - Resolves: RHEL-166003 - Crash in replica_config_add when manually configuring a replica with an incorrect nsds5ReplicaRoot.
  - Resolves: RHEL-166004 - Possible memory leak when using the Retro Changelog plugin.
  - Resolves: RHEL-168908 - ns-slapd fails to shutdown when deferred memberof update is in progress
  - Resolves: RHEL-168964 - Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. [rhel-9]
  - Resolves: RHEL-168972 - Replica installation is failing with message MDB_BAD_VALSIZE: Unsupported size of key/DB name/data, or wrong DUPFIXED [rhel-9]
  - Resolves: RHEL-169530 - Rebase 389-ds-base to 2.9.x
  - Resolves: RHEL-170270 - DS 12 does not handle escape char in bind user [rhel-9]
  - Resolves: RHEL-170275 - dnaSharedConfig: "dnaPortNum: 0" [rhel-9]
  - Resolves: RHEL-170280 - Memory leaks in syncrepl plugin during persistent search operations [rhel-9]
  - Resolves: RHEL-170287 - access log - suspicious wtime  optime negative and large values in internal op [rhel-9]
  - Resolves: RHEL-170477 - An online reinitialization with LMDB is terminating the receiving server [rhel-9]
  - Resolves: RHEL-170480 - dsctl healthcheck DSMOLE0001 inaccurate recommendations when there is more than 1 LDAP backend [rhel-9]
  - Resolves: RHEL-170651 - passwordbadwords attribute of the local password policy is not functioning [rhel-9]
  - Resolves: RHEL-170732 - Memory leaks in IPA context on server restart [rhel-9]
  - Resolves: RHEL-174525 - [RFE] Add OS-level thread names to all server threads [rhel-9]
  - Resolves: RHEL-180717 - Online export is failing when using the option "-s" [rhel-9]


author: Simon Pichugin <spichugi@redhat.com> - 2.9.0-2
changelog:
  - Bump version to 2.9.0-2
  - Resolves: RHEL-88942 - LDAP healthcheck and ignoring entrydn index and associated config
  - Resolves: RHEL-168964 - Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com.
  - Resolves: RHEL-212097 - Online reinitialization is failing with the supplier being busy calling idrange_add_id()
  - Resolves: RHEL-212816 - import_monitor_threads and average rate 214748364.8/sec rate calculation issue [rhel-9]
  - Resolves: RHEL-190777 - CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser [rhel-9.9]
  - Resolves: RHEL-183108 - CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [rhel-9.9]


author: Caolán McNamara <caolanm@redhat.com> - 2.4.1-5
changelog:
  - disable building BOX2D_BUILD_UNIT_TESTS due to "SIGSTKSZ ... no
    longer constant on Linux ... redefined to sysconf(_SC_SIGSTKSZ)"
    https://github.com/bminor/glibc/blob/master/NEWS causing build failure


author: Paul Howarth <paul@city-fan.org> - 1.0.5-23
changelog:
  - Don't pass gcc-only compiler flags to other compilers, e.g. clang
    (based on https://src.fedoraproject.org/rpms/Judy/pull-request/3 from
    Timm Baeder)


author: Íñigo Huguet <ihuguet@redhat.com> - 1:1.53.1-1
changelog:
  - Update to 1.53.1 (dev)
  - Update MPTCP endpoints creation order (RHEL-78752)
  - Print all warnings from nmcli to stderr (RHEL-74255)


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.53.2-1
changelog:
  - Update to 1.53.2 (dev)
  - Fix invalid memory access on Dnsconfd DBUS error (RHEL-83175)
  - Avoid getting transient hostname when "localhost" set in /etc/hostname (RHEL-55730)


author: Filip Pokrývka <fpokryvk@redhat.com> - 1:1.53.3-1
changelog:
  - Update to 1.53.3 (dev)
  - Add more IPv6 prefix delegation options (RHEL-85765)
  - Fix order of parsing port/controller properties in nmcli (RHEL-85767)
  - Improve interface activation logic (RHEL-85766)
  - Fix WireGuard IPv6 firewall rules (RHEL-85763)
  - Support OVS-DPDK dpdk-lsc-interrupt and mtu_request configurations (RHEL-77148)


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.53.4-1
changelog:
  - Update to 1.53.4 (dev)
  - initrd: add new NBFT parser (RHEL-83061)
  - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083)
  - Support reapply on OVS settings (RHEL-86877)
  - Add support for configuring the loopback interface in nmtui (RHEL-85770)
  - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764)
  - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778)
  - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168)

  Resolves: RHEL-83061
  Resolves: RHEL-59083
  Resolves: RHEL-87596
  Resolves: RHEL-85770
  Resolves: RHEL-85764
  Resolves: RHEL-85778
  Resolves: RHEL-87168


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.53.90-1
changelog:
  - Update to 1.54.0 (rc1)
  - Devices not becoming managed sometimes (RHEL-93108)
  - Crash on _l3cfg_notify_cb (RHEL-92314)
  - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610)


author: Filip Pokryvka <fpokryvk@redhat.com> - 1:1.53.91-1
changelog:
  - Update to 1.54.0 (rc2)
  - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728)
  - Fix a race condition in ovs tun interface (RHEL-98551)


author: Filip Pokryvka <fpokryvk@redhat.com> - 1:1.53.92-1
changelog:
  - Update to 1.54.0 (rc3)
  - Fix ipv6 static route deleted with dualstack (RHEL-102772)
  - Allow setting IP method to disabled in port connection (RHEL-102768)


author: Filip Pokryvka <fpokryvk@redhat.com> - 1:1.54.0-1
changelog:
  - Update to 1.54.0
  - Fix reaply on bridge port VLAN (RHEL-102743)
  - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787)


author: Vladimír Beneš <vbenes@redhat.com>- 1:1.54.1-1
changelog:
  - Update to 1.54.1
  - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954)
  - Fix connection.autoconnect-ports of OVS ports (RHEL-114200)
  - Global DNS config without domains silently ignored from D-Bus (RHEL-115973)


author: Íñigo Huguet <ihuguet@redhat.com> - 1:1.54.2-1
changelog:
  - Update to 1.54.2
  - Support setting protocol version of HSR/PRP (RHEL-122172)
  - Support interlink for HSR/PRP (RHEL-122175)
  - Improve logging of networking off (RHEL-122173 )
  - Don't delete unrelated OVS ports (RHEL-121104)


author: Ján Václav <jvaclav@redhat.com> - 1:1.54.4-1
changelog:
  - Update to 1.54.4
  - fix handling onlink route flag for ECMP routes (RHEL-157391)
  - Add Geneve support (RHEL-154245)
  - Fix arp_missed_max/lacp_active error on reapply (RHEL-157392)
  - Removed 802.1x auth patch as it was released upstream


author: Ján Václav <jvaclav@redhat.com> - 1:1.54.4-1
changelog:
  - Update to 1.54.4
  - fix handling onlink route flag for ECMP routes (RHEL-157391)
  - Add Geneve support (RHEL-154245)
  - Fix lacp_active error on reapply (RHEL-157392)
  - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182630)
  - Removed 802.1x auth patch as it was released upstream


author: Rahul Rajesh <rrajesh@redhat.com> - 1:1.54.4-3
changelog:
  - Fix DHCP release on OVS bridge interface (RHEL-157393)
  - Fix avc error on print-config (RHEL-247438)
  - Fix ipv6.ignore-auto-dns=yes fails to suppress DHCPv6 DNS after reapply (RHEL-247440)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1.2.18-2
changelog:
  - Support point-to-point IPSec tunnel (RHEL-20690)
  - Fix crash in libreswan_nmstate_iface_dpd_rsa (RHEL-21221)
  - Support configuring IPSec mode with 'type' (RHEL-21554)


author: Vladimír Beneš <vbenes@redhat.com> - 1.2.27-1
changelog:
  - Update to later upstream release to address regressions (RHEL-56551)
  - Support rightca in ipsec section (RHEL-118819)


author: Vladimír Beneš <vbenes@redhat.com> - 1.2.27-2
changelog:
  - Symetric import/export with nm-auto-default (RHEL-122306)
  - Esp param properly exported (RHEL-122626)
  - Correct leftid export when it contains @


author: Gris Ge <fge@redhat.com> - 1.2.29-1
changelog:
  - Upgrade to 1.2.29
  - Support creating both ends of IPsec (Libreswan) tunnels. (RHEL-85789)
  - Support leftprotoport and rightprotoport options. (RHEL-130907)
  - Fix error on duplicate key 'phase2alg'. (RHEL-131233)
  - Fix import connection with RSA key. (RHEL-127863)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.0.32-2
changelog:
  - Resolve issues found by rpmdiff
    - add explicit Requires: on subpackages to avoid the need to test
      interoperability between the various combinations of old and new
      subpackages


author: Pavel Cahyna <pcahyna@redhat.com> - 2.0.32-3
changelog:
  - Add a patch to resolve one more issue found by rpmdiff/rpminspect:
    fix getaddrinfo detection to avoid using gethostbyname.


author: Richard Hughes <rhughes@redhat.com> - 1.2.2-1
changelog:
  - New upstream release
  - Notify systemd when beginning to shutdown
  - Fix possible information disclosure


author: Richard Hughes <rhughes@redhat.com> - 1.2.3-1
changelog:
  - New upstream release
  - Add support for coercing upgrade to distupgrade
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon disappears
  - Remove large transaction size sanity check


author: Milan Crha <mcrha@redhat.com> - 1.2.4-1
changelog:
  - New upstream release
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Honor install_weak_deps=False
  - Improve thread safety on an operation cancellation
  - Let the finish understand the 'cancelled' exit code
  - Only set polkit interactive flag if method call has too
  - Read update information also when getting list of updates
  - Use 'hy_query_get_advisory_pkgs', if available


author: Pete Walter <pwalter@fedoraproject.org> - 2.0.14-1
changelog:
  - Update to 2.0.14
  - Rebase multilib.patch
  - Don't use globs in the form of libFOO.so.* for listing files


author: Neal Gompa <ngompa13@gmail.com> - 2.0.14-6
changelog:
  - Switch to CMake to build SDL2
  - Build JACK support unconditionally since PipeWire-JACK exists in RHEL 9


author: Neal Gompa <ngompa@centosproject.org> - 2.0.18-1
changelog:
  - Update to 2.0.18
    Resolves: rhbz#2028076
  - Fix multilib conflict with SDL_revision.h (rhbz#2008838)
  - Backport fix for building against wayland-1.20+
  - Add patch to split SDL2 CMake targets for static libraries (rhbz#1965359)


author: Ray Strode <rstrode@redhat.com> - 0.6.55-10
changelog:
  - Synchronize permissions and group ownership for icon and users dirs
    between rpm file manifest and daemon expectations.
    Resolves: #2057576


author: Kalev Lember <klember@redhat.com> - 3.28-12
changelog:
  - Split highcontrast-icon-theme out to a new subpackage
  - Explicitly require cursor and icon themes required for the gtk2 themes


author: Radovan Sroka <rsroka@redhat.com> - 0.16-102
changelog:
  RHEL 9.5.0 ERRATUM
  - aide fails with "Not enough parameters in db:15384. Trying to continue." unexpectedly
  Resolves: RHEL-27606
  - AIDE fails when using root_prefix option
  Resolves: RHEL-28882


author: Radovan Sroka <rsroka@redhat.com> - 0.16-103
changelog:
  RHEL 9.6.0 ERRATUM
  - /boot/grub2/grubenv's timestamp is getting modified continuously due to "boot_success" implementation
  Resolves: RHEL-4331


author: Attila Lakatos <alakatos@redhat.com> - 0.16-105
changelog:
  RHEL 9.7 ERRATUM
  - CVE-2025-54389 aide: improper output neutralization enables bypassing
  Resolves: RHEL-109912


author: Attila Lakatos <alakatos@redhat.com> - 0.19.2-1
changelog:
  RHEL 9.8.0 ERRATUM
  - rebase to 0.19.2
  Resolves: RHEL-110573
  - Switch to libnettle for hashing
  - prevent aide from crashing if database is a HTTPS URL
  Resolves: RHEL-76014
  - prevent aide from exiting if a file is truncated during check
  Resolves: RHEL-1569


author: Attila Lakatos <alakatos@redhat.com> - 0.19.2-4
changelog:
  - /boot/grub2/grubenv is excluded from check due to boot_success implementation
  Resolves: RHEL-83776


author: Attila Lakatos <alakatos@redhat.com> - 0.19.2-6
changelog:
  - Add aide-migrate-config to automate config migration from pre-0.19 syntax
  Resolves: RHEL-178317
  - Re-add syslog_format config option dropped during rebase to 0.19.2


author: Patrik Koncity <pkoncity@redhat.com> - 0.19.2-7
changelog:
  - Support for included files in /etc/aide.d/
  Resolves: RHEL-178122
  - Increase default values for num_workers
  Resolves: RHEL-178123
  - Add pre-configured systemd timer for aide check
  Resolves: RHEL-178121


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.7.4-1
changelog:
  - Revert "s390x - enable raid1 as a stage2 device" (jkonecny)
    Reverts: RHEL-21691
  - test_module_part_blivet: fix pylint disable (jkonecny)
    Related: RHEL-85416
  - pyanaconda: module.common.task fix cyclic import (jkonecny)
    Related: RHEL-85416
  - pyanaconda: module_manager: fix ciclic import (k.koukiou)
    Related: RHEL-85416
  - pyanaconda: bootloader: fix ImportError (k.koukiou)
    Related: RHEL-85416
  - ruff: enable isort rules and autofix all isort warnings Autofixed with: ruff
    check --exclude pyanaconda/core/kickstart/commands.py --fix --select I .
    (jkonecny)
    Resolves: RHEL-85416
  - Add ruff, a very fast linter (vslavik)
    Related: RHEL-85416
  - Relabel /var/log/ and /root/original-ks.cfg (champetier.etienne)
    Resolves: RHEL-85298


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.7.5-1
changelog:
  - bootloader: drop write_config_console, just preserve console= (awilliam)
    Resolves: RHEL-98670
  - payload/rpm-ostree: Include program output in exception (walters)
    Resolves: RHEL-45184


author: Martin Kolman <mkolman@redhat.com> - 34.25.7.6-1
changelog:
  - Fix vconsole layout doesn't work for ostree (jkonecny)
    Resolves: RHEL-101057
  - test: make dnf substitutions test check only relevant values (rvykydal)
  - test: add new substitution members in dnf tests (rvykydal)


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.7-1
changelog:
  - pyanaconda: payload: return exception details for payload failures
    (k.koukiou)
  - ui: tui: installation_source: show error message in the TUI screen
    (k.koukiou)
    Resolves: RHEL-4705
  - storage: fix mount point assignment of non-formatted swap partitions
    (rvykydal)
    Related: RHEL-16355
  - storage: include only fstab devices in fsset swap devices property (rvykydal)
    Resolves: RHEL-16355


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.8-1
changelog:
  - Fix: UnboundLocalError: local variable 'e' referenced before assignment
    (k.koukiou)
    Related to: RHEL-4705
  - Emit authselect in KS when fingerprint is enabled (adamkankovsky)
    Resolves: RHEL-85175


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.9-1
changelog:
  - Set Authselect agruments after run in Security module (adamkankovsky)
    Resolves: RHEL-85175
  - Authselect code simplification (adamkankovsky)
    Resolves: RHEL-85175
  - custom: Reallocate partitions when removing a partition (vtrefny)
    Resolves: RHEL-114169


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.10-1
changelog:
  - Fixing authselect logical differences not resolved during backporting
    (adamkankovsky)
    Resolves: RHEL-85175


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.11-1
changelog:
  - bootloader: efi: utilize grub2-common script for handling config file
    generation (k.koukiou)
    Resolves: RHEL-36187


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.12-1
changelog:
  - Fix permissions of the ssh config created by Anaconda (ppolawsk)
    Resolves: RHEL-129787
  - pyanaconda: rpm_ostree: fix _handle_boot_if_not_mount_point method issues
    (k.koukiou)
    Related: RHEL-74145
  - ostree needs to have /boot be bindmounted into sysroot. (a.badger)
    Resolves: RHEL-74145


author: Adam Kankovsky <adamkankovsky@gmail.com> - 34.25.7.15-1
changelog:
  - Increase GUI startup timeout to 120 seconds (mkolman)
    Related: RHEL-148965
    Resolves: RHEL-92999
  - chore: Support multiple console= kernel entries (ppolawsk)
    Resolves: RHEL-101787


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.17-1
changelog:
  - rescue: Set system root to OSTree deployment path (k.koukiou)
    Related: RHEL-135123
  - pyanaconda: storage: fix FindExistingSystems API for ostree based OSes
    (k.koukiou)
    Related: RHEL-135123
  - rescue: detect OSTree deployments in rescue mode and show deployment path
    (k.koukiou)
    Resolves: RHEL-135123
  - rescue: Add warning for immutable systems (k.koukiou)
    Related: RHEL-135123
  - storage: stop creating /etc/mtab symlink during installation (k.koukiou)
    Related: RHEL-135123
  - localization: ensure console font persists via systemd-vconsole-setup
    (k.koukiou)
    Resolves: RHEL-154012


author: Katerina Koukiou <kkoukiou@redhat.com> - 34.25.7.18-1
changelog:
  - rescue: skip SELinux autorelabel for ostree/bootc systems (rvykydal)
    Resolves: RHEL-191846
  - fix: use static string for tmux status line to reduce CPU usage (tfratrik)
    Resolves: RHEL-188432


author: Nick Clifton <nickc@redhat.com> - 12.83-1
changelog:
  - Annocheck: Remove spurious debugging messages.
  - Annocheck: Always look for annobin notes in separate debug info files.  (RHEL-75778)
  - Annocheck: Support multiple --debug-rpm and --debug-file options.  (RHEL-73349)
  - Annocheck: Add support for sys-root'ed glibc packages.  (RHEL-71296)
  - GCC Plugin: Tidy up use of gcc's diagnoatic headers.  (#32429)
  - Testsuite: Use configured compiler when running tests.
  - GCC Plugin: Fix building with gcc 15.  (#32429)
  - Annocheck: Fix overly long debug messages.
  - Annocheck: Rename rwx-seg test to load-segments.  Add more checks.  Add check for gaps as a future fail.
  - Annocheck: Add --no-allow-excpetions to disable exceptions for known special binaries.
  - Annocheck: Add --enable-future to enable future fail components in normal tests.
  - Annocheck: Fix bug preventing the inclusion of the rpm name in reports.
  - Annocheck: Add more exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Add --skip-passes option.
  - Annocheck: Add exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Skip property note test for i386 binaries created by LLVM.  (#2323797)
  - Annocheck: Skip FORTIFY and GLIBC_ASSERTIONS tests for LLVM produced binaries with unparseable DW_AT_producer attributes in their DWARF debug info.  (RHEL-65411)
  - GCC Plugin: Change type of the .annobin.notes section from SHT_STRTAB to SHT_PROGBITS.
  - Clang & LLVM Plugins: Include install directory in binary.  (RHEL-54069)
  - BuiltBy: Fix seg-fault when comparing language version strings.  (RHEL-53497)
  - Annocheck: Stop spurious assembler warnings.  (RHEL-53213)
  - Annocheck: Stop warnings about known gaps.    (RHEL-53218)
  - Annocheck: Fix stack realign test.  (#2302427)


author: Nick Clifton <nickc@redhat.com> - 12.87-1
changelog:
  - Annocheck: Fix locating string notes (again).  Add exception for glibc benchmark tests.  (RHEL-76809)
  - Annocheck: Add crtoffloadtableS.o to list of known gcc binaries.  (RHEL-76040)


author: Nick Clifton <nickc@redhat.com> - 12.91-1
changelog:
  - Annocheck: Fix resource leak.  (RHEL-79253)
  - Annocheck: Fix double free. Add special handling for COMBOOT modules.
  - Annocheck: Improve diagnostics when a separate debug info file cannot be found.


author: Nick Clifton <nickc@redhat.com> - 12.92-1
changelog:
  - Annocheck: Do not rely upon libelf's ability to detect links to separate debuginfo files.  (RHEL-79264)


author: Nick Clifton <nickc@redhat.com> - 12.93-1
changelog:
  - Rebuild against LLVM v20.  (RHEL-82001)
  - Rebase to 12.93.
  - Annocheck: Fix test for GO revision.  (RHEL-56031)


author: Nick Clifton <nickc@redhat.com> - 12.96-1
changelog:
  - Annocheck: Fix bugs in debug rpm location code.  Add more glibc exceptions.  (RHEL-95216)
  - Annocheck: Improve performance with multiple debug info files and multiple files to scan.  (#2366180)
  - Annocheck: Update heuristic for detecting gcc files to cope with gcc 15.  (#2365824)


author: Nick Clifton <nickc@redhat.com> - 12.98-1
changelog:
  - Rebase to 12.98.  (RHEL-105574)
  - Improve configure and meson files for consistent builds.
  - Annocheck: Delete the temporary debug info directory after the tests have finished.


author: Nick Clifton <nickc@redhat.com> - 13.14-1
changelog:
  - Rebase to allow rebuilding against LLVM 22.  (RHEL-140420)
  - Annocheck: Do not complain about GO binaries that do not support branch protection.
  - Annocheck: Do not complain about Rust binaries that do not support branch protection.
  - Annocheck: Skip the dynamic-tags test if a GNU Property note is present.
  - Annocheck: Look for compromising characters in pathnames.
  - Require C++17 for building.
  - Annocheck: Ignore Risc-V attribute sections.
  - Annocheck: Change result of failing not-XXX tests from FAIL to MAYB.  Update documentation.
  - Annocheck: Process the .ARM.attributes section.
  - Annocheck: Add more files to the gcc heuristics list.  (RHEL-150659)
  - Annocheck: Add .fc44 to list of known rpm file extensions.
  - Annocheck: Fix compile time warnings from GCC-15 re: strchr returning a const char *.
  - Annocheck: Skip production test for gcc libraries.  (RHEL-123175)
  - Annocheck: Update heuristic to detect gcc libraries.  (RHEL-124869)
  - Annocheck: Change FAIL for binaries built by a cross compiler to a MAYBE.  (RHEL-123175)
  - Annocheck: Improve detection of glibc static maths libraries.  (RHEL-107470)


author: Nick Clifton <nickc@redhat.com> - 13.25-1
changelog:
  - Annocheck: Improve bad filename detection.  (RHEL-211396)
  - Annocheck: Enable stack-clash test for Risc-V binaries built by gcc-15+.
  - LLVM & Clang Plugins: Build with -fexceptions enabled.  (RHEL-184482)
  - Annocheck: Add support for ZIP files and TAR balls.
  - Testsuite: Fixes for the glibcxx and hardening tests.
  - GCC Plugin: Fix several minor bugs.
  - Annocheck: Fix several minor bugs.
  - Testsuite: Fix discrepancies.
  - GCC Plugin: Fix recording the setting of __GLIBCXX_ASSERTIONS.
  - Annocheck: Add exceptions for kernel bootstrap tools.  (RHEL-73522)
  - Testsuite: Add new tests.
  - GCC Plugin: Fix error when checking for function level changes in the PIC and GOW settings. 
  - Annocheck: LTO test: Add exceptions for Clang runtime support object files.  (RHEL-176052)


author: Nick Clifton <nickc@redhat.com> - 13.28-1
changelog:
  - Testsuite: Fix hardening test.
  - Annocheck: Fix seg-fault in code checking for gcc components.
  - Annocheck: Allow ~ in filenames.  Add more exceptions for gcc components.  (RHEL-213510)
  - GCC-Plugin: Only use a 64-bit pointer size for s390x binaries built by GCC 17+  (#2502729)


author: Neal Gompa <ngompa@centosproject.org> - 0.15.5-2
changelog:
  - Create symlinks manually to make it build
    (the symlinks were not created because of reverting the patch to
    upgrade to Meson 0.62)


author: Neal Gompa <ngompa@centosproject.org> - 0.16.1-1
changelog:
  - Rebase to 0.16.1
    Resolves: rhbz#2169103
  - Drop unneeded downstream hacks to build with older Meson


author: Tom Stellard <tstellar@redhat.com> - 1.6.1-13
changelog:
  - Use make_build and make_install macros
  - https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make


author: Kalev Lember <klember@redhat.com> - 2.28.1-1
changelog:
  - Update to 2.28.1
  - Switch to meson build system
  - Update source URLs
  - Tighten -devel subpackage deps
  - Tighten soname globs


author: Richard W.M. Jones <rjones@redhat.com> - 1.13.0-2
changelog:
  - Parse auto_reset_crashkernel in kdump
    resolves: rhbz#2042772
  - Add new directives and options for chrony


author: Richard W.M. Jones <rjones@redhat.com> - 1.13.0-4
changelog:
  - Fix parsing of /usr/lib/tmpfiles.d/provision.conf
  - Fix parsing of /etc/kernel/cmdline
    resolves: rhbz#2155136, rhbz#2159282


author: Michal Sekletar <msekleta@redhat.com> - 0.8-21
changelog:
  - fix file attributes on /run/avahi-daemon (RHEL-5633)
  - avahi-client: fix resource leak (RHEL-27722)
  - fix resource leak in avahi_time_event_queue_new (RHEL-27717)


author: Nils Philippsen <nils@tiptoe.de> - 0.1.72-2
changelog:
  - BR: librsvg2-tools for rsvg-convert
  - mark license files as %license
  - use %apiver macro consistently
  - don't ship .gitignore file


author: Pavel Cahyna <pcahyna@redhat.com> - 11.0.1-5
changelog:
  - Make nagios-plugin build conditional and disabled on RHEL to avoid
    generating this subpackage that has missing dependencies
  - Fix flags for annobin in Qt tools (bat & tray-monitor) build
  - Add a forgotten RHEL 8 patch to use openssl crypto (random numbers, hmac,
    hashing functions)
    Resolves: rhbz#1935458


author: Jerome Marchand <jmarchan@redhat.com> - 0.30.0-3
changelog:
  - Really prevent the loading of compromised headers (RHEL-28769, CVE-2024-2314)
  - Add python3-pyelftools dependency (RHEL-36583)


author: Jerome Marchand <jmarchan@redhat.com> - 0.34.0-1
changelog:
  - Rebase to version 0.34.0 (RHEL-78920)
  - Rebuild with LLVM 20 (RHEL-81773)
  - Fix biosnoop pattern option (RHEL-90848)
  - Fix bpf-klockstat on aarch64 and ppc64le (RHEL-78619)
  - Remove unsupported bpf-bcachefs* and bpf-zfs* tools (RHEL-78166)
  - Remove unsupported slaratetop tool (RHEL-78162)


author: Jerome Marchand <jmarchan@redhat.com> - 0.36.1-1
changelog:
  - Rebase to version 0.36.1 (RHEL-162981)
  - Rebuild with LLVM 22 (RHEL-170955)
  - Got rid of the RHEL only bio tool fix thanks to comnmit 36305815
  - Fix filegone, kvmexit, netqtop and tcpconnect on s390x (RHEL-118750)
  - Fix profile on s390x (RHEL-112865)
  - Fix bpf-cpufreq (RHEL-78168)
  - Fix bpf-syncsnoop (RHEL-78171)


author: Petr Menšík <pemensik@redhat.com> - 32:9.16.23-35
changelog:
  - Prevent cache poisoning due to weak PRNG (CVE-2025-40780)
  - Replace downstream fixes with upstream changes
  - Address various spoofing attacks (CVE-2025-40778)


author: Fedor Vorobev <fvorobev@redhat.com> - 32:9.16.50-4
changelog:
  - Fix uninitialized boolean in dig/host downstream patch that was
    leading to incorrectly canceled queries in certain scenarios. (RHEL-212648)


author: Fedor Vorobev <fvorobev@redhat.com> - 32:9.16.50-5
changelog:
  - Remove compile-time OpenSSL API version check that was preventing
    bind from fetching the engine for RSA algorithms. (RHEL-213788)


author: Fedor Vorobev <fvorobev@redhat.com> - 32:9.16.50-6
changelog:
  - Fix NSEC3 signer validation (CVE-2026-10723)
  - Fix reject out-of-zone NSEC next owner names (CVE-2026-13321)
  - Fix RPZ name-too-long wildcard expansion (CVE-2026-11331)
  - Fix dns_rdataset_addnoqname() accepting unsigned NSEC/NSEC3 (CVE-2026-13204)
  - Fix dnssec-signzone and RRSIG wildcard validation (CVE-2026-11721)
  - Prevent cache memory exhaustion under sustained attack (CVE-2026-11622)


author: Petr Menšík <pemensik@redhat.com> - 32:9.18.29-6
changelog:
  - Refuse malformed DNSKEY records (CVE-2025-8677)
  - Address various spoofing attacks (CVE-2025-40778)
  - Prevent cache poisoning due to weak PRNG (CVE-2025-40780)


author: Petr Menšík <pemensik@redhat.com> - 32:9.18.29-7
changelog:
  - Fix upstream reported regression in recent CVE fix (CVE-2025-8677)
  - Add upstream created test to this regression


author: Petr Menšík <pemensik@redhat.com> - 32:9.18.29-16
changelog:
  - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone
    (CVE-2026-1519)
  - Correct backport issue in the patch (CVE-2026-1519)


author: Petr Menšík <pemensik@redhat.com> - 32:9.18.27-2
changelog:
  - Disable building of DLZ packages
  - Conflict explicitly with more bind subpackages
  - Merge license subpackage into libs


author: Petr Menšík <pemensik@redhat.com> - 32:9.18.29-2
changelog:
  - Backport nsupdate TLS support into 9.18 (RHEL-76331)
  - Update nsupdate manual about new TLS options
  - Test nsupdate TLS support


author: Petr Menšík <pemensik@redhat.com> - 32:9.18.29-3
changelog:
  - Limit additional section records CPU processing (CVE-2024-11187)
  - Read HTTPS requests in limited chunks and prevent overload (CVE-2024-12705)


author: Bastien Nocera <bnocera@redhat.com> - 5.86-1
changelog:
  - Update to 5.86
  - Re-add btmgmt as it does not require bluetoothd to be running,
    unlike bluetoothctl mgmt
  - Fix audio output not working in some circumstances
    Resolves: RHEL-147734


author: Adrian Reber <adrian@lisas.de> - 1.2.5-1
changelog:
  - Updated to 1.2.5
  - No longer necessary to re-package sources: All problematic files have
    been re-licensed
  - All 19 patches are part of the 1.2.5 release and have been removed


author: Patrick Palka <ppalka@redhat.com> - 1.75.0-9
changelog:
  - Apply upstream Boost.Asio patch to resolve RHEL-67973
  - Fix %patch directive compatibility with RPM 4.20


author: Jonathan Wakely <jwakely@redhat.com> - 1.75.0-7
changelog:
  - Build with zstd support (#2091041)
  - Fix rpminspect CI warnings about missing versioned dependencies


author: Colin Walters <walters@verbum.org> - 1.12.1-1
changelog:
  - Update to 1.12.1
  - Fix mount point check regression breaking bootc-image-builder
  - Resolves: RHEL-142112


author: Colin Walters <walters@verbum.org> - 1.13.0-1
changelog:
  - Update to 1.13.0
  - https://github.com/bootc-dev/bootc/releases/tag/v1.13.0
  - Resolves: RHEL-151443


author: Joseph Marrero <jmarrero@fedoraproject.org> - 1.15.1-1
changelog:
  - Update to 1.15.1
  - https://github.com/bootc-dev/bootc/releases/tag/v1.15.1
  - Resolves: #RHEL-168117


author: Joseph Marrero <jmarrero@fedoraproject.org> - 1.15.2-1
changelog:
  - Update to 1.15.2
  - https://github.com/bootc-dev/bootc/releases/tag/v1.15.2
  - Resolves: #RHEL-172417


author: Joseph Marrero <jmarrero@fedoraproject.org> - 1.16.2-1
changelog:
  - Update to 1.16.2
  - https://github.com/bootc-dev/bootc/releases/tag/v1.16.2
  - Resolves: #RHEL-156438


author: Joseph Marrero <jmarrero@fedoraproject.org> - 0.2.18-1
changelog:
  - https://github.com/coreos/bootupd/releases/tag/v0.2.18
    backport patch to support GRUB console.cfg
    Resolves: RHEL-26439


author: Joseph Marrero <jmarrero@fedoraproject.org> - 0.2.32-2
changelog:
  - Backport https://github.com/coreos/bootupd/pull/1068
  - Backport https://github.com/coreos/bootupd/pull/1074
    Resolves: #RHEL-168652


author: Viktor Malik <vmalik@redhat.com> - 0.19.1-1
changelog:
  - Rebase on bpftrace 0.19.1 (RHEL-10693)
  - Rebuild for LLVM 17 (RHEL-10592)
  - Enhancements and fixes for PowerPC (RHEL-3690, RHEL-11476)


author: Viktor Malik <vmalik@redhat.com> - 0.20.3-1
changelog:
  - Rebase on bpftrace 0.20.3 (RHEL-30779)
  - Fix CVE allowing unprivileged users loading of compromised linux headers
    (RHEL-28765, CVE-2024-2313)
  - Fix bpftrace creating BPF programs with truncated names (RHEL-8502)


author: Viktor Malik <vmalik@redhat.com> - 0.20.4-1
changelog:
  - Rebase on bpftrace 0.20.4
  - Fix CVE allowing unprivileged users loading of compromised linux headers
    (RHEL-28765, CVE-2024-2313)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 6.1-8
changelog:
  - Dropped explicit brlapi dependency (brltty) and relaxed brltty
    dependency (brlapi)
    Related: rhbz#1765611


author: Jindrich Novy <jnovy@redhat.com> - 2:1.43.2-2
changelog:
  - bump golang.org/x/crypto to v0.53.0 to fix CVE-2026-46597
  - Switch Source0 to consume tarball from the internal GitLab sustaining-engineering repo instead of GitHub.
  - Resolves: RHEL-219427


author: Jindrich Novy <jnovy@redhat.com> - 2:1.43.2-3
changelog:
  - Rebuild for golang-1.26.6 CVE fixes (CVE-2026-33811 CVE-2026-33818
    CVE-2026-56860 CVE-2026-56853 CVE-2026-56858 CVE-2026-56862) - Resolves:
    RHEL-241182 RHEL-241409 RHEL-241591 RHEL-241734 RHEL-242149


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.14.2-3
changelog:
  - Switch from autotools to meson; enable the tests, since the meson build system
    permits us to use a shared boost library
  - Install examples in the -doc subpackage


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.14.2-4
changelog:
  - Prepare for future upgrade to API/ABI version 1.16 by introducing virtual
    Provides for a name for API/ABI version 1.0: cairomm1.0. This will be the name
    of a future package that continues to provide API/ABI version 1.0 after the
    upgrade.


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.14.2-7
changelog:
  - Working (but weak, dependent on SHA1) source signature verification
  - Added API/ABI version to descriptions


author: Jon Maloy <jmaloy@redhat.com> - 4.0.2-11
changelog:
  - Fix CVE-2025-68114 (memory corruption) and CVE-2025-67873 (heap buffer overflow)
    Resolves: RHEL-137760


author: Kaleb S. KEITHLEY <kkeithle[at]redhat.com> - 2:16.1.0-0.5.snapshot
changelog:
  - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb)
  -  rpmbuild apparently unable to automatically derive 'Requires: rocksdb' from 'BuildRequires: rocksdb-devel' for librocksdb.so.6.13


author: Rob Crittenden <rcritten@redhat.com> - 0.79.14-5
changelog:
  - Certmonger SCEP renewal should not use old challenges (#1990926)
  - Certmonger certificates stuck in NEED_GUIDANCE (#2001082)
  - certmonger creates CSRs with invalid DER syntax for X509v3 extensions
    with critical=FALSE (#2012261)


author: Rob Crittenden <rcritten@redhat.com> - 0.79.14-6
changelog:
  - Certificate format validation when adding the SCEP server's CA
    (#1492112)
  - Replace some SHA1 usages with SHA256 in the unit tests


author: Jerry James <loganjerry@gmail.com> - 0.15.0-1
changelog:
  - Version 0.15.0
  - Add -formatspec and -attribute-format patches
  - Build with both cmake and autotools


author: <thalman@redhat.com> - 0.6.1-16
changelog:
  - CVE-2023-37464 cjose: AES GCM decryption uses the Tag length from the actual
    Authentication Tag provided in the JWE
    Resolves: rhbz#2223308


author: Kashyap Chamarthy <kchamart@redhat.com> - 20.1.7-2
changelog:
  - Add riscv64 enablement bits; thanks: Songsong Zhang
     (U2FsdGVkX1@gmail.com) and David Abdurachmanov (davidlt@rivosinc.com)


author: Paul Murphy <murp@redhat.com> - 20.1.8-3
changelog:
  - Backport fix for pgo optimized rust toolchain on ppc64le (rhbz#2382683)
  - Backport fix for crbit spill miscompile on ppc64le power9 and power10 (rhbz#2383037)
  - Backport fix for build of highway package on ppc64le (rhbz#2383182)


author: Richard Hughes <richard@hughsie.com> 1.4.5-1
changelog:
  - New upstream version
  - Add new API for gnome-settings-daemon
  - Check for errors from more sqlite calls
  - Fix owner and permissions on existing state files
  - Fix segfault due to dereferencing NULL pointer
  - Make the build reproductible


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-2
changelog:
  - Remove support for building FIPS mode binaries for the
    compat libraries
  - Ships openssl11.cnf as the configuration file.
  - Resolves: rhbz#1993795
  - Related: rhbz#1947584


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
    Resolves: rhbz#2063148
  - Disable FIPS mode; it does not work and will not be certified
    Resolves: rhbz#2013669


author: Petr Hybl <phybl@redhat.com> - 1:1.1.1k-5.2
changelog:
  - Fixes CVE-2025-69419 OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing
    Resolves: RHEL-142723


author: Pavol Žáčik <pzacik@redhat.com> - 1:1.1.1k-5.3
changelog:
  - Fixes CVE-2026-28390: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing
    Resolves: RHEL-165863


author: Jindrich Novy <jnovy@redhat.com> - 3:2.2.1-1
changelog:
  - update to https://github.com/containers/conmon/releases/tag/v2.2.1
  - enable RELRO
  - Related: RHEL-111919


author: Phil Sutter <psutter@redhat.com> - 1.4.5-15
changelog:
  - conntrack: fix compiler warnings
  - src: fix strncpy -Wstringop-truncation warnings
  - connntrack: Fix for memleak when parsing -j arg
  - Drop pointless assignments
  - Don't call exit() from signal handler
  - read_config_yy: Drop extra argument from dlog() call
  - helpers: ftp: Avoid ugly casts
  - Fix potential buffer overrun in snprintf() calls
  - cache: Fix features array allocation
  - hash: Flush tables when destroying


author: Phil Sutter <psutter@redhat.com> - 1.4.7-1
changelog:
  - config: Fix -Wimplicit-function-declaration
  - network: Fix -Wstrict-prototypes
  - build: don't suppress various warnings
  - build: conntrack-tools requires libnetfilter_conntrack >= 1.0.9
  - New version 1.4.7


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.4.1
  - Resolves: RHEL-28855


author: Jindrich Novy <jnovy@redhat.com> - 1:1.5.0-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.5.0
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 1:1.5.1-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.5.1
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 1:1.6.0-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.6.0
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 1:1.6.1-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.6.1
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 1:1.6.2-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.6.2
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 1:1.7.1-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.7.1
  - Resolves: RHEL-89428


author: Jindrich Novy <jnovy@redhat.com> - 1:1.8.0-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.8.0
  - Related: RHEL-111919


author: Jindrich Novy <jnovy@redhat.com> - 1:1.9.0-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.9.0
  - Related: RHEL-111919


author: Jindrich Novy <jnovy@redhat.com> - 1:1.9.1-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.9.1
  - Resolves: RHEL-212439


author: Jindrich Novy <jnovy@redhat.com> - 1:1.9.1-2
changelog:
  - Rebuild for golang-1.26.6 CVE fixes (CVE-2025-68121 CVE-2026-27145
    CVE-2026-33811 CVE-2026-33818 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859
    CVE-2026-56860 CVE-2026-56862)
  - Resolves: RHEL-187322 RHEL-190005 RHEL-241162 RHEL-241355 RHEL-241481
    RHEL-241714 RHEL-242161


author: Aashish Radhakrishnan <aaradhak@redhat.com> - 0.24.0-2
changelog:
  - Restore single-decimal precision to stream output
    Backport https://github.com/coreos/coreos-installer/pull/1654


author: Joel Capitao <jcapitao@redhat.com> - 0.24.0-3
changelog:
  - Use the full path for the 'root=' kernel arg when rootfs on mpath
    Backport https://github.com/coreos/coreos-installer/pull/1677


author: Jan Friesse <jfriesse@redhat.com> - 3.1.10-2
changelog:
  - Resolves: RHEL-163817
  - Resolves: RHEL-163838

  - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091)
  - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092)


author: Marek Polacek <polacek@redhat.com> 11.5.0-2
changelog:
  - fix TARGET_CPU_DEFAULT (PR target/105157, RHEL-50037)
  - libstdc++: Workaround kernel-headers on s390x-linux (RHEL-50054)
  - fix wrong code with memcpy from _Complex (PR tree-optimization/116034)


author: Florian Weimer <fweimer@redhat.com> - 11.5.0-10
changelog:
  - Exception handling performance improvements (RHEL-105072)
  - libgcc: Use _dl_find_object to find DWARF data in unwinder
  - libgcc: Use lock-free data structures for run-time unwinder registration


author: David Malcolm <dmalcolm@redhat.com> - 11.5.0-14
changelog:
  - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding
    branches and calls to gcov output, but not conditions (RHEL-105416).


author: Marek Polacek <polacek@redhat.com> 11.4.1-3
changelog:
  - update from releases/gcc-11-branch (RHEL-17638)
    - PRs c++/106310, c++/106890, c++/109666, c++/109761, c++/111357,
  	c++/111512, c++/112795, d/108842, d/110359, d/110511, d/110516,
  	debug/110295, fortran/95947, fortran/103506, fortran/107397,
  	fortran/110288, fortran/110585, fortran/110658, fortran/111837,
  	fortran/111880, libstdc++/95048, libstdc++/99327, libstdc++/104161,
  	libstdc++/104242, libstdc++/108178, libstdc++/111050,
  	libstdc++/111511, libstdc++/112314, libstdc++/112491,
  	middle-end/110200, middle-end/111699, middle-end/111818,
  	middle-end/112733, rtl-optimization/110237, sanitizer/112727,
  	target/96762, target/101177, target/101469, target/105325,
  	target/109800, target/109932, target/110011, target/110044,
  	target/110170, target/110309, target/110741, target/111001,
  	target/111340, target/111367, target/111408, target/111815,
  	target/112672, target/112816, target/112837, target/112845,
  	target/112891, testsuite/66005, tree-optimization/110298,
  	tree-optimization/110731, tree-optimization/110914,
  	tree-optimization/111015, tree-optimization/111614,
  	tree-optimization/111764, tree-optimization/111917
  - use -fno-stack-protector in some aarch64 tests


author: Marek Polacek <polacek@redhat.com> 11.5.0-1
changelog:
  - update from releases/gcc-11 branch (RHEL-35635)
    - GCC 11.5 release
    - PRs ada/113893, ada/113979, analyzer/104042, c/113262, c/114007, c/114493,
  	c++/89224, c++/92145, c++/92407, c++/97990, c++/99710, c++/100667,
  	c++/100772, c++/101765, c++/103185, c++/104051, c++/111485,
  	c++/111529, c++/113598, c++/113674, c++/114537, c++/114561,
  	c++/114562, c++/114572, c++/114634, c++/114691, d/113125, d/113758,
  	d/114171, debug/111080, debug/112718, driver/115440, fortran/50410,
  	fortran/103715, fortran/104908, fortran/107426, fortran/114474,
  	fortran/114825, gcov-profile/114115, libfortran/110651,
  	libgomp/113192, libquadmath/114533, libstdc++/104259,
  	libstdc++/104606, libstdc++/105417, libstdc++/110054,
  	libstdc++/113250, libstdc++/114147, libstdc++/114401,
  	libstdc++/114750, libstdc++/114803, libstdc++/115269,
  	libstdc++/115454, libstdc++/115575, middle-end/90348,
  	middle-end/95351, middle-end/107385, middle-end/108789,
  	middle-end/110027, middle-end/110115, middle-end/110176,
  	middle-end/111422, middle-end/111632, middle-end/112732,
  	middle-end/113907, middle-end/113921, middle-end/114599,
  	middle-end/114734, middle-end/114753, middle-end/115527,
  	middle-end/115836, objc/101666, objc/101718, preprocessor/105608,
  	rtl-optimization/100303, rtl-optimization/108086,
  	rtl-optimization/110079, rtl-optimization/114768,
  	rtl-optimization/114902, rtl-optimization/115092, sanitizer/97696,
  	sanitizer/111736, sanitizer/114956, sanitizer/115172, target/88309,
  	target/101737, target/101865, target/105522, target/108120,
  	target/108743, target/110411, target/111610, target/111677,
  	target/112397, target/113122, target/113281, target/114049,
  	target/114098, target/114130, target/114184, target/114310,
  	target/114837, target/114846, target/115253, target/115297,
  	target/115360, target/115457, target/115475, target/115611,
  	target/115691, testsuite/113175, testsuite/114034, testsuite/114036,
  	tree-optimization/110386, tree-optimization/110422,
  	tree-optimization/111039, tree-optimization/111070,
  	tree-optimization/111331, tree-optimization/111407,
  	tree-optimization/111445, tree-optimization/111736,
  	tree-optimization/112495, tree-optimization/112505,
  	tree-optimization/112793, tree-optimization/113372,
  	tree-optimization/113552, tree-optimization/113603,
  	tree-optimization/114027, tree-optimization/114115,
  	tree-optimization/114566, tree-optimization/114876,
  	tree-optimization/115192, tree-optimization/115337,
  	tree-optimization/115843
  - fix FLUSH IOSTAT value (PR libfortran/101255, RHEL-32536)
  - fix conditions for using memcmp in
    std::lexicographical_compare_three_way (PR libstdc++/113960)


author: Lianbo Jiang <lijiang@redhat.com> - 8.0.4-2
changelog:
  - Fix the "dis -lr" not displaying the source file names
    and line numbers
  - Fix incorrect symbol translation by the 'struct blk_mq_ops'


author: Lianbo Jiang <lijiang@redhat.com> - 9.0.0-2
changelog:
  - vmware_guestdump: Version 7 support
  - Fix incorrect task state during exit
  - Add multi-threads support in crash target
  - Call cmd_bt silently after "set pid"
  - x86_64: Add gdb multi-stack unwind support
  - arm64: Add gdb multi-stack unwind support
  - ppc64: Add gdb multi-stack unwind support
  - Fix the issue of "page excluded" messages flooding
  - Fix "kmem -p" option on Linux 6.16-rc1 and later kernels


author: Lianbo Jiang <lijiang@redhat.com> - 9.0.0-3
changelog:
  - x86_64: filter unwanted warning message for "bt -T" cmd
  - doc: Update requirements for building on Fedora
  - gdb: Fix a regression for eppic extension on gdb-16.2
  - Fix crash initialization failure on LoongArch with recent GDB versions
  - gdb: Disable DT_DEBUG lookup by GDB inside the vmcore


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.17.2-1
changelog:
  - Update to 0.17.2
  - Fix Python deprecation (PY_SSIZE_T_CLEAN) (RhBug:1891785)
  - Revert back to old c API for destination file of cr_compress_file_with_stat and cr_compress_file to prevent a memory leak
  - Never leave behind .repodata lock on exit (RhBug:1906831)
  - Disable drpm for RHEL >= 9 (RhBug:1914828)
  - Setting updated/issued_date to None doesn't produce garbage values (RhBug:1921715)
  - Allow taking __repr__ (__str__) of closed xmlfile and sqlite (RhBug:1913465)


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.17.7-1
changelog:
  - Update to 0.17.7
  - Remove insecure hashes SHA-1 and MD5 from the default build (RhBug:1935486)
  - Fix error when updating repo with removed modules metadata
  - Exit with status code 1 when loading of repo's metadata fails
  - Fix memory leaks (RhBug:1998426)
  - Fix valgrind warnings caused by subprocess calls


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.17.7-2
changelog:
  - Switch default of --keep-all-metadata to TRUE and add --discard-additional-metadata (RhBug:2055032)


author: Lukas Hrazky <lhrazky@redhat.com> - 0.20.1-1
changelog:
  - Update to 0.20.1
  - createrepo_c shouldn't silently produce duplicate-NEVRA repos
  - Fix bad performance with task queue management
  - Update errno usage to fix incorrect GError messages
  - Install header for createrepo_shared module
  - Remove C API for cr_xml_parse_main_metadata_together
  - Remove python bindings for xml_parse_main_metadata_together
  - Fix '&' encoding in attributes when parsing repodata
  - Add a streaming parsing API that is user-controllable.
  - Fix a memory leak of primary pkg when parsing interrupted
  - Fix a memory leak when removing the first link in a list
  - Remove `allow_out_of_order` option for `xml_parse_main_metadata_together`
  - Make parse warnings visible through cr.Repomd(), cr.UpdateInfo()
  - Use --error-exit-val option by default
  - If new and old repomd matches during --update don't update
  - Add `cr_repomd_compare` for comparing two repomds
  - Store parsed repomd in `cr_MetadataLocation`
  - Set database version only for the database records, not everything
  - Use copy+delete fallback when moving of a dir fails
  - Fix memory leaks
  - [spec] Option for legacy hashes, enable on RHEL <= 8 (RhBug:2022271)


author: Vladis Dronov <vdronov@redhat.com> - 15.9-10
changelog:
  - Bring in important patches from the upstream (39fb38..eaea31 in a git repo)
  - Fix the upstream tarball URL
  - Remove outdated patch files


author: Vladis Dronov <vdronov@redhat.com> - 15.9-14
changelog:
  - Add distrubution patches which were not upstreamed (bz 2072635)
  - Add self-tests
  - Add OSCI harness


author: Vladis Dronov <vdronov@redhat.com> - 15.9-26
changelog:
  - Update cscope to 15.9-26 from Fedora (RHEL-65465)
  - Fix signal handling at exit
  - Minor edits in the rpm scripts and the changelog
  - Make xemacs a bcond


author: Vladislav Dronov <vdronov@redhat.com> - 15.9-31
changelog:
  - Add two latest distribution patches (RHEL-158208)
  - Correct the erroneous brace count caused by the unbalanced { }
  - Make it possible to add the new keywords


author: Pavol Zacik <pzacik@redhat.com> - 1:2.3.3op2-28
changelog:
  - RHEL-39940 cups: Cupsd Listen arbitrary chmod 0140777
  - Delete the domain socket file after stopping the cups.socket service
  - Fix cupsd Listener checks


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.2.3.3op2-34
changelog:
  - RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
  - RHEL-113078 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-35
changelog:
  - RHEL-102665 The KONICA MINOLTA C352 is not distributed using cups-browsed and the included ppd file


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-37
changelog:
  - RHEL-129747 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack
  - RHEL-129740 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.28.7-14
changelog:
  - RHEL-19201 redhat-lsb unnecessary pulls in cups and avahi dependencies
  - RHEL-16026 Cups Browsed does not correctly pull printer location and description information from print server


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.28.7-18
changelog:
  - CVE-2024-47175 cups-filters: remote command injection via attacker controlled data in PPD file
  - CVE-2024-47076 cups-filters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes
  - CVE-2024-47176 cups-filters: cups-browsed binds on UDP INADDR_ANY:631 trusting any packet from any source


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.28.7-27
changelog:
  - CVE-2026-64612 cups-filters: handle libpng errors via
    longjmp()/setjmp() to prevent process abort on malformed PNG files


author: Kamil Dudka <kdudka@redhat.com> - 7.76.1-3
changelog:
  - fix TLS session caching disaster (CVE-2021-22901)
  - fix TELNET stack contents disclosure (CVE-2021-22898)


author: Kamil Dudka <kdudka@redhat.com> - 7.76.1-8
changelog:
  - fix TELNET stack contents disclosure again (CVE-2021-22925)
  - fix bad connection reuse due to flawed path name checks (CVE-2021-22924)


author: Kamil Dudka <kdudka@redhat.com> - 7.76.1-12
changelog:
  - fix STARTTLS protocol injection via MITM (CVE-2021-22947)
  - fix protocol downgrade required TLS bypass (CVE-2021-22946)
  - fix use-after-free and double-free in MQTT sending (CVE-2021-22945)


author: Bryan Gurney <bgurney@redhat.com> - 71.1-7
changelog:
  - Pull in fixes from upstream v72 and v73 (Jeff Moyer)
  - Fix enable-namespace all reporting errors incorrectly
  - Add support for inject-smart on papr scm
  - Related: rhbz#2040075
  - Related: rhbz#1873851
  - Related: rhbz#1880578
  - Related: rhbz#1922538
  - Related: rhbz#2087707


author: Jeff Moyer <jmoyer@redhat.com> - 71.1-8
changelog:
  - Backport changes up to v74, excluding the config file changes. (Jeff Moyer)
    This includes support for the CXL commands, and adds the following
    packages: cxl-cli, cxl-devel, cxl-libs
  - Resolves: rhbz#2132167


author: Jeff Moyer <jmoyer@redhat.com> - 78-1
changelog:
  - Rebase to v78
  - Add support for legacy monitor.conf file location
  - Fix a test failure.
  - Resolves: RHEL-10382
  - Resolves: RHEL-8204
  - Resolves: RHEL-29151


author: Martin Osvald <mosvald@redhat.com> - 3.4.1-7
changelog:
  - Resolves: #2096149 - Fatal error when running "squatter -r user"
  - Resolves: #2096885 - Enhanced TMT testing for centos-stream


author: Martin Osvald <mosvald@redhat.com> - 3.4.1-11
changelog:
  - Resolves: RHEL-20925 - Seen/Unseen Flag not working correctly
    for shared mailboxes
  - cyrus-imapd.spec: rename patches to correspond with others


author: Martin Osvald <mosvald@redhat.com> - 3.4.8-5
changelog:
  - reconstruct: Fix missing uidvalidity in mbentry
    Resolves: RHEL-76907
  - Update rpminspect.yaml to ignore /usr/lib/cyrus-imapd


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 2.1.27-11
changelog:
  - Set default sasldb database to GDBM instead of BerkeleyDB
  - Add the migration tool from BerkeleyDB
  - Add some PLAIN auth tests
  - Resolves rhbz#1947971


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 2.1.27-12
changelog:
  - Incorporate the upstream gdbm specific patch from
    https://github.com/cyrusimap/cyrus-sasl/pull/554
  - Resolves rhbz#1947971


author: Bryan Gurney <bgurney@redhat.com> - 1.10-8.el9
changelog:
  - Supersede uninitialized value patch with upstream version
  - Add upstream patch: common: fix mismatch between prototype and body
  - Makefile: bypass check-doc in check target
  - Related: rhbz#1985096


author: Bryan Gurney <bgurney@redhat.com> - 1.10.1-1
changelog:
  - Update to PMDK version 1.10.1
  - Related: rhbz#1874208
  - Remove BuildRequires line for libfabric-devel
  - Related: rhbz#2009502


author: Mark Wielaard <mjw@redhat.com> - 5.0-8
changelog:
  - Add 0001-debug_str_offsets-header-version-and-padding-are-2-b.patch
  - Add 0001-debugedit-Handle-unused-.debug_str_offsets-entries.patch


author: Mark Wielaard <mjw@redhat.com> - 5.0-11
changelog:
  - Add 0001-Add-basic-find-debuginfo-script-tests.patch
  - Add debugedit-5.0-find-debuginfo-tests-fixups.patch


author: Mark Wielaard <mjw@fedoraproject.org> - 0.1-3
changelog:
  - Fix some rpmlint issues, add comments, add license and doc,
    gpg verification, use pkgconfig BuildRequires, enable _hardened_build


author: Mark Wielaard <mjw@redhat.com> - 5.0-1
changelog:
  - Upgrade to upstream 5.0 release.
    - Removes find-debuginfo .sh suffix.
    - This release still has a find-debuginfo.sh -> find-debuginfo symlink.


author: Alejandro Sáez <asm@redhat.com> - 1.21.2-1
changelog:
  - Rebase to 1.21.2
  - Add support for ppc64le and aarch64
  - Enable the test suite
  - Resolves: RHEL-22429


author: Alejandro Sáez <asm@redhat.com> - 1.21.2-2
changelog:
  - Modify ports: Some CI systems complain about the usage of the 8888 port.
  - Improve the way PPC64LE support is enabled.
  - Resolves: RHEL-22429


author: Kalev Lember <klember@redhat.com> - 0.26-1
changelog:
  - Update to 0.26
  - Switch to the meson build system
  - Avoid hardcoding man page extensions
  - Drop old emacs-desktop-file-utils obsoletes/provides


author: Petr Menšík <pemensik@redhat.com> - 2.85-19
changelog:
  - Prevent overflow in extract_name function (CVE-2026-2291)
  - Prevent DoS in DNSSEC validation (CVE-2026-4890)
  - Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891)
  - Prevent out-of-bounds write in DHCPv6 server (CVE-2026-4892)
  - Prevent source check avoidance by RFC 7871 client-subnet (CVE-2026-4893)


author: Omair Majid <omajid@redhat.com> - 10.0.100~rc.2.25502.107-0.10
changelog:
  - Update to .NET SDK 10.0.100-rc.2.25502.107 and Runtime 10.0.0-rc.2.25502.107
  - Resolves: RHEL-121559


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-14
changelog:
  - fix CVE-2024-23184: using a large number of address headers may trigger a denial of service (RHEL-55212)
  - fix CVE-2024-23185: very large headers can cause resource exhaustion when parsing message (RHEL-55224)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-16
changelog:
  - add /var/lib/dovecot to tmpfiles for image mode (RHEL-139098)
  - fix building with latest openssl (RHEL-140619)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-17
changelog:
  - fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161640)
  - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162288)
  - fix CVE-2026-27857: denial of service via specially crafted NOOP command (RHEL-161679)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.6.0-6
changelog:
  - Gating rebuild [bz#1974188]
  - Resolves: bz#1974188
    (Define tests, including gating tests, for dtc)


author: Jiri Olsa <jolsa@redhat.com> - 1.22-1
changelog:
  - New release: v1.22
  - Resolves: rhbz#2010414
  - Introduce -j/--jobs option to specify the number of threads to use.
  - Multithreaded DWARF loading, requires elfutils >= 0.178.
  - Preparatory work for multithreaded BTF encoding, the focus for 1.23.
  - Allow encoding BTF to a separate file.
  - Show all different types with the same name, not just the first one found.
  - Stop assuming that reading from stdin means pretty, add --prettify.
  - Improve type resolution for the --header command line option.
  - Do not consider the ftrace filter when encoding BTF for kernel functions.
  - Lock calls to non-thread safe elfutils' dwarf_decl_file() and dwarf_decl_line().
  - Change hash table size to one that performs better with current typical vmlinux files.
  - Allow tweaking the hash table size from the command line.
  - Add --kabi_prefix to avoid deduplication woes when using _RH_KABI_REPLACE().
  - Add --with_flexible_array to show just types with flexible arrays.
  - Support btfdiff with a detached BTF file.
  - Introduce sorted type output (--sort).
  - Disable incomplete CTF encoder.


author: Viktor Malik <vmalik@redhat.com> - 1.24-1
changelog:
  - Resolves: rhbz#2140020
  - New release: v1.23
  - Process DW_TAG_LLVM_annotation tags.
  - Initial support for DW_TAG_skeleton_unit.
  - Encode BTF_KIND_TYPE_TAG and BTF_KIND_DECL_TAG
  - Fix handling of percpu symbols on s390.
  - Use cacheline size to infer struct member alignment from BTF.
  - Add --skip_missing to not stop when not finding one of -C arguments.
  - Fix __attribute__((__aligned__(N)) printing alignment for struct members.
  - Fix nested __attribute__(__aligned__(N)) struct printing order.
  - New release: v1.24
  - Add support to BTF_KIND_ENUM64.
  - Support multithreaded BTF encoding.
  - Encode char type as signed in BTF.
  - Introduce --lang and --lang_exclude to pahole.
  - Introduce --compile to pahole.
  - Don't segfault when processing bogus files.


author: Viktor Malik <vmalik@redhat.com> - 1.25-1
changelog:
  - Resolves: rhbz#2190484
  - Build with system libbpf
  - New release: v1.25
  - Support for DW_TAG_unspecified_type more generally.
  - Make sure struct member offsets are in ascending order. Rust BTF needs this.
  - Support C atomic types (DW_TAG_atomic_type).
  - Initial support for DW_TAG_LLVM_annotation, used for BTF type tags, for __rcu, __user, etc
  - Exclude functions with the same name (static functions in different CUs), inconsistent prototypes or not following calling convention.
  - Allow generation of BTF for optimized functions, those that end with a .isra*, .constprop*.
  - Support 'pahole --lang=/--lang_exclude=asm'
  - Support --compile from DWARF in addition to from BTF.
  - Exclude RUST CUs in 'btfdiff', as those are not yet being BTF encoded.


author: Viktor Malik <vmalik@redhat.com> - 1.27-1
changelog:
  - Resolves: RHEL-30780
  - New release: v1.26
  - When expanding types using 'pahole -E' do it for union and struct typedefs and for enums too.
  - Print number of holes, bit holes and bit paddings in class member types.
  - Introduce --contains_enumerator=ENUMERATOR_NAME:
  - Fix pretty printing using DWARF, waiting for a CU with both class (-C) and a specified "type_enum".
  - Add support for DW_TAG_constant in the DWARF loader, first seen in Go DWARF.
  - Fix loading DW_TAG_subroutine_type generated by the Go compiler.
  - Fix loading of 32-bit signed enums from BTF.
  - Add 'pahole --btf_features' to allow consumers to specify an opt-in set of features they want to use in BTF encoding.
  - Parallelize loading BTF and DWARF, speeding up a bit btfdiff.
  - Do type expansion to cover "private" types and enumerations in btfdiff.
  - New release: v1.27
  - Reproducible parallel builds: multiple runs with different number of loading/encoding threads produce the same result.
  - Inject kfunc decl tags into BTF from the BTF IDs ELF section in the Linux kernel vmlinux file.
  - Sanitize unsupported DWARF int type with greater-than-16 byte, as BTF doesn't support it.
  - Initial support for BTF_KIND_DECL_TAG in the BTF loader, adding support in pfunct output.
  - Fix hole discovery with inheritance in C++.


author: Gregory Bell <grbell@redhat.com> - 1.30-1
changelog:
  - New release: 1.30
  - Better detection of abort during DWARF loader thread processing
  - pahole now detects presence of libbpf APIs and BTF features using weak function
    declarations when built using a shared library libbpf
  - Type tags are emitted for BPF arena pointers with new BTF "attributes" feature
  - New release: 1.29
  - Multithreading is now in the DWARF loader using a jobs queue and a pool of worker threads.
  - The BTF encoding now is always reproducible, and as fast/faster than before.
  - The memory consumption is reduced.
  - Support for multiple BTF_DECL_TAGs pointing to same tag.
  - Verify that pfunct prints btf_decl_tags read from BTF.
  - Don't print functions twice when using 'pfunct -f function_name'.
  - New release: 1.28
  - Various improvements to reduce the memory footprint of pahole, notably when doing BTF encoding.
  - Show flexible arrays statistics
  - Add '--padding N' and '--padding_ge N' to show structs with paddings
  - Introduce --running_kernel_vmlinux to find a vmlinux that matches the build-id of the running kernel.
  - Don't stop pfunct output at the first function that matches a filter, show all of them
  - Allow encoding data about all global variables, not just per CPU ones
  - Handle .BTF_ids section endianness, fully supporting cross builds
  - Generate decl tags for bpf_fastcall for eligible kfuncs
  - Add "distilled_base" BTF feature to split BTF generation.
  - Use the ELF_C_READ_MMAP mode with libelf, reducing peak memory utilization
  - Allow overriding /sys/kernel/btf/vmlinux via the PAHOLE_VMLINUX_BTF_FILENAME env var
  - Allow setting the list of compile units via PAHOLE_LANG_EXCLUDE env var
  - Serialize access to elfutils dwarf_getlocation().
  - Honour --lang_exclude when merging LTO built CUs.
  - Add the debuginfod client cache directory to the vmlinux search path.
  - Print the CU's language when a tag isn't supported.
  - Initial support for GNU_formal_parameter_pack, GNU_template_parameter_pack, template_value_param and template_type_param DWARF tags.
  - Improve the parameter parsing by checking DW_OP_[GNU_]entry_value
  - Introduce a tests/ directory with regression tests


author: Gregory Bell <grbell@redhat.com> - 1.31-1
changelog:
  - Rework the selection of functions to represent in BTF, for instance:
  - Skip functions that passes values thru the stack when those structs don't
  have expected alignment due to some attribute usage that then causes
  problems with BTF trampolines due to lack of expressiveness in BTF to
  signal such special cases.
  - Skip objects (compile units) without DWARF: don't stop a multi object
  encoding session just because one doesn't have any DWARF in it.
  - Fix BTF dedup by updating libbpf. 
  - Fix the inference of the explicit alignment attribute of zero length arrays,
  like struct skb_ext->data[] in the Linux kernel. Important as BTF has no no
  explicit alignment attribute encoding.
  - Fix the inference of alignments after bitfields, such as in struct
  nft_rule_dp->data[] after ->handle:42, also in the Linux kernel.    
  - Fix segfault with --show_reorg_steps option, e.g. pahole -R -S -C task_struct.
  - Add comparision of functions encoded in BTF between baseline 'master' branch
  and current branch, i.e. 'next'.


author: Jakub Jelinek <jakub@redhat.com> 0.13-6
changelog:
  - DW_FORM_implicit_const handling fixes (sw#27212, sw#27213)
  - temporarily build odr tests with -gdwarf-4 as they are incompatible with
    DWARF 5


author: Mark Wielaard <mjw@redhat.com> - 0.189-3
changelog:
  - Add elfutils-0.189-elf_getdata_rawchunk.patch
  - Add elfutils-0.189-debuginfod_config_cache-double-close.patch


author: Mark Wielaard <mjw@redhat.com> - 0.190-1
changelog:
  - Upgrade to upstream elfutils 0.190
  - Add eu-srcfiles
  - Drop upstreamed patches
    elfutils-0.189-debuginfod_config_cache-double-close.patch
    elfutils-0.189-elf_getdata_rawchunk.patch
    elfutils-0.189-elfcompress.patch
  - Only package debuginfod-client-config.7 manpage for debuginfod-client


author: Aaron Merey <amerey@redhat.com> - 0.191-1
changelog:
  - Upgrade to upstream elfutils 0.191
  - Drop upstreamed patches
    elfutils-0.190-fix-core-noncontig.patch
    elfutils-0.190-gcc-14.patch
    elfutils-0.190-remove-ET_REL-unstrip-test.patch
  - Drop testcore-noncontig.bz2
  - Add elfutils-0.191-profile-empty-urls.patch
  - Add elfutils-0.191-riscv-flatten.patch
  - Add feature flag for reenabling elfutils-libelf-devel-static and elfutils-devel-static


author: Aaron Merey <amerey@redhat.com> - 0.191-3
changelog:
  - eu-srcfiles directly links to libdebuginfod.so so explicitly
    Require elfutils-debuginfod-client not just Recommends.


author: Aaron Merey <amerey@redhat.com> - 0.192-1
changelog:
  - Upgrade to upstream elfutils 0.192
  - Drop upstreamed patches
    elfutils-0.190-riscv-flatten.patch
    elfutils-0.191-riscv-flatten.patch
    elfutils-0.191-profile-empty-urls.patch
  - Add elfutils-0.192-libelf-static.patch


author: Aaron Merey <amerey@redhat.com> - 0.193-1
changelog:
  - Upgrade to upstream elfutils 0.193
  - Drop upstreamed patches
    elfutils-0.192-fix-free.patch
    elfutils-0.192-libelf-static.patch
    elfutils-0.192-stacktrace-lto.patch


author: Aaron Merey <amerey@redhat.com> - 0.195-1
changelog:
  - Upgrade to upstream elfutils 0.195
  - Drop upstreamed patches
    elfutils-0.194-alloc-jobs.patch
  - Add gelf.3 to %files
  - Enable eu-stacktrace on aarch64


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-9
changelog:
  - Fix etags local command injection vulnerability (#2175190)
  - Fix htmlfontify.el command injection vulnerability (#2175179)
  - Fix ruby-mode.el local command injection vulnerability (#2175142)
  - Fix ob-latex.el command injection vulnerability (#2180590)


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-10
changelog:
  - Disable xwidgets (RHEL-14551)
  - org-file-contents: Consider all remote files unsafe (CVE-2024-30205)
  - Make Gnus treats inline MIME contents as untrusted (CVE-2024-30203)
  - Add protection for LaTeX preview (CVE-2024-30204)
  - org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331)


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-18
changelog:
  - Fix nsm-should-check for "google.com" failure (RHEL-94297)
  - Fix package tests for tetris no longer existing as a package (RHEL-94297)
  - Introduce untrusted-content variable (RHEL-94297)


author: Jeff Law <law@redhat.com> - 1.1.2-7
changelog:
  - Force C++14 as this code is not C++17 ready
  - Fix sprintf format issue
  - Fix ordered comparison of a pointer against zero issue


author: Jeff Law <law@redhat.com> - 1.1.2-7
changelog:
  - Force C++14 as this code is not C++17 ready
  - Fix sprintf format issue
  - Fix ordered comparison of a pointer against zero issue
  -


author: Jack Magne <jmagne@redhat.com> - 1.1.2-14
changelog:
  Resolves: rhbs #2007544,2000928,2000929
  - Bugzilla Bug  2007544 - The esc provides outdated configuration for opensc
  - Bugzilla Bug  2000928 - ESC does not detect smart cards and crashes upon launch [rhel-9.0.0]
  - Bugzilla Bug  2000929 - [RHEL-9][AppStream] esc present in comps but missing from repository [rhel-9.0.0]


author: Jack Magne <jmagne@redhat.com> - 1.1.2-16
changelog:
  Resolves: rhbs #2050849
  - Bug 2050849 - Volkswagen Siemens CardOS M4.4 and 5.0 cards display incorrect status in ESC [RHEL 9.1]


author: Kalev Lember <klember@redhat.com> - 40.1-1
changelog:
  - Update to 40.1
  - Remove various minimum version requires
  - Remove old obsoletes
  - Don't use ldconfig_scriptlets
  - Filter private library provides


author: Felipe Borges <feborges@redhat.com> - 40.1-3
changelog:
  - Split evince-previewer into its own package
  - See https://github.com/fedora-silverblue/issue-tracker/issues/122


author: Marek Kasik <mkasik@redhat.com> - 40.1-5
changelog:
  - Use tmp dir as containing folder for non-native files
  - Backport fixes for issues found by Coverity Scan
  - Fix some other issues found by Coverity Scan
  - Resolves: #1975150


author: Milan Crha <mcrha@redhat.com> - 3.40.4-10
changelog:
  - Related: RHEL-12405 (Move WebKitGTK parts in Evolution Data Server into optional subpackage)
  - Add dependency on newly introduced evolution-data-server-ui


author: Milan Crha <mcrha@redhat.com> - 3.40.4-4
changelog:
  - Resolves: #2071056 (Addressbook: Switch from GData Contacts API to CardDAV API for Google books)
  - Resolves: #2071742 (Add patch to use correct colors in mail preview with webkit2gtk3 2.36.x)


author: Milan Crha <mcrha@redhat.com> - 3.40.4-8
changelog:
  - Resolves: #2129703 (EShellWindow: The 'New' menu is not filled after start)
  - Correct Requires for the 'devel' subpackage to enchant-2


author: Milan Crha <mcrha@redhat.com> - 3.40.4-8
changelog:
  - Resolves: RHEL-12405 (Move WebKitGTK parts in Evolution Data Server into optional subpackage)
  - Add requirement on ui subpackage into ui-devel subpackage


author: Milan Crha <mcrha@redhat.com> - 3.40.4-2
changelog:
  - Resolves: RHEL-19371 (Backport upstream patch to workaround broken text/calendar mail attachments by the server)


author: Jan Grulich <jgrulich@redhat.com> - 0.27.3-7
changelog:
  - CVE-2021-3482: Fix heap-based buffer overflow in Jp2Image::readMetadata()
    CVE-2021-29458 exiv2: out-of-bounds read in Exiv2::Internal::CrwMap::encode
    CVE-2021-29457 exiv2: heap-based buffer overflow in Exiv2::Jp2Image::doWriteMetadata
    CVE-2021-29470 exiv2: out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header
    CVE-2021-29473 exiv2: out-of-bounds read in Exiv2::Jp2Image::doWriteMetadata
    Resolves: bz#1956174


author: Jan Grulich <jgrulich@redhat.com> - 0.27.3-8
changelog:
  - CVE-2021-29623 exiv2: a read of uninitialized memory may lead to information leak
    Resolves: bz#1964183

  - CVE-2021-32617 exiv2: DoS due to quadratic complexity in ProcessUTF8Portion
    Resolves: bz#1964189


author: Jan Grulich <jgrulich@redhat.com> - 0.27.4-4
changelog:
  - Fix out-of-bounds read in Exiv2::Jp2Image::printStructure
    Resolves: bz#1993247

  - Fix out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header
    Resolves: bz#1993284


author: Jan Grulich <jgrulich@redhat.com> - 0.27.5-1
changelog:
  - Exiv2 0.27.5
    Resolves: bz#2018421

    Fix stack exhaustion issue in the printIFDStructure function leading to DoS
    Resolves: bz#2003670


author: Petr Lautrbach <lautrbach@redhat.com> - 1.4-1
changelog:
  - fapolicyd-1.4 and fapolicyd-selinux-1.0
    https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v1.4


author: Petr Lautrbach <lautrbach@redhat.com> - 1.4.3-1
changelog:
  - fapolicyd-1.4.3
    https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v1.4.3
    https://github.com/linux-application-whitelisting/fapolicyd-selinux/releases/tag/v1.1


author: Petr Lautrbach <lautrbach@redhat.com> - 1.4.3-2
changelog:
  - Fix binary path of rpm-loader
  - Map file with MAP_SHARED instead of MAP_PRIVATE
  - Fix segfault when interrupting fapolicyd startup


author: Petr Lautrbach <lautrbach@redhat.com> - 1.4.5-2
changelog:
  - fagenrules: Validate new compiled rules
  - Add fapolicyd-cli --check-rules option
  - Bump maximum length of a configuration file line


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-105
changelog:
  - bundled urllib3: fix CVE-2025-66471
  - bundled urllib3: fix CVE-2026-21441
    Resolves: RHEL-139799, RHEL-140796


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-110
changelog:
  - bundled urllib3: fix CVE-2024-37891, CVE-2025-66418, CVE-2025-66471,
    CVE-2026-21441, and pyasn1 CVE-2026-23490 on all archs
    Resolves: RHEL-146344


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-111
changelog:
  - bundled cryptography: replace with dependency to fix CVE-2026-26007
  - bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597
    Resolves: RHEL-148437, RHEL-155677


author: Arslan Ahmad <arahmad@redhat.com> - 4.10.0-116
changelog:
  - fence_openstack: fix list-action to avoid timeout when
    there are 100+ VMs on the hypervisor
    Resolves: RHEL-154985


author: W. Michael Petullo <mike@flyn.org> - 2.5.0-8
changelog:
  - Remove empty lib subpackage
  - Fix make command line (add missing '\')
  - Use -p with install
  - Do not create /etc/festival
  - Do not create /usr/share/info
  - Simplify %files
  - Note BSD license for hts_engine module
  - Split data into noarch package
  - The festival-devel package now provides festival-static
  - Markup additional files as licenses


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 6.4.24-1
changelog:
  - Update to fetchmail-6.4.24 (fixes CVE-2021-36386 and CVE-2021-39272)
    Resolves: #2005307, #1999276


author: Richard W.M. Jones <rjones@redhat.com> 3.23-5
changelog:
  - Disable automatic provides for fio engines (RHBZ#1884954).
  - Apply patch to change SONAME of fio engines (see comment 8 of above bug).


author: Eric Sandeen <sandeen@redhat.com> 3.25-3
changelog:
  - Fix segfault with external IO engines and multiple threads
  - Enable dev-dax, pmemblk, libpmem engines for ppc64le


author: Pavel Reichl <preichl@redhat.com> - 3.35-1
changelog:
  - Rebase to new upstream release
  - Do NOT drop support for pmemblk https://github.com/axboe/fio/commit/04c1cdc
  - Add signature check
  - Related: rhbz#2188805


author: Richard Hughes <richard@hughsie.com> 1.2-7
changelog:
  - Disable JLink support to remove one extra dep we are not going to support
  - Resolves: rhbz#1948597


author: Kalev Lember <klember@redhat.com> - 1.12.9-2
changelog:
  - Backport upstream patches for CVE-2024-42472
  - Require bubblewrap version that has new --bind-fd option backported for
    addressing CVE-2024-42472


author: Jan Grulich <jgrulich@redhat.com> - 1.12.9-5
changelog:
  - Fix arbitrary code execution via crafted symlinks in sandbox-expose options
    Resolves: RHEL-165644
  - Fix arbitrary file deletion on host via improper cache file path validation
    Resolves: RHEL-170172


author: Arjun Shankar <arjun@redhat.com> - 2.6.4-6
changelog:
  - Re-work flex subpackages and provide shared libraries (#1327851):
  - Remove and obsolete the flex-devel subpackage containing static libraries
  - Provide shared libraries in a new subpackage named libfl2
  - Provide development files in a new subpackage named libfl-devel
  - Provide static libraries in a new subpackage named libfl-static


author: Lukáš Zaoral <lzaoral@redhat.com>- 3.0.4-9
changelog:
  - backport the following fixes from Fedora:
    - fix header conflicts in multilib installs (RHEL-134741)
    - fix rpmlint warnings


author: Adam Jackson <ajax@redhat.com> - 1.3.5-9
changelog:
  - Remove BuildRequires xprop entirely. If present, the configure script will call
    it looking for a property on the root window that Fedora's X server does not
    set, and which would not work anyway since there is no X server running in the
    buildroot, so we can just remove the dependency.


author: Akira TAGOH <tagoh@redhat.com> - 2.13.93-3
changelog:
  - Add back fullname property at the scan matching phase for the backward compatibility.
    Resolves: rhbz#1902881


author: Akira TAGOH <tagoh@redhat.com> - 2.13.93-4
changelog:
  - cherry pick some upstream patches
    - Skip leading white space in style.
    - Remove abort from FcCompareSize.
    - Fix memory leaks
    - Check qual and compare for family tests.
  -


author: Akira TAGOH <tagoh@redhat.com> - 2.13.94-2
changelog:
  - Fix the score calculation on matching for multiple values.
  - Enable 11-lcdfilter-default.conf.
    Resolves: rhbz#1965684
  - Rebase to the latest release.
    Resolves: rhbz#2023161


author: Akira TAGOH <tagoh@redhat.com> - 2.13.95-1
changelog:
  - New upstream release.
  - Update deps to font(notosans)
    https://fedoraproject.org/wiki/Changes/DefaultToNotoFonts


author: Akira TAGOH <tagoh@redhat.com> - 2.14.0-1
changelog:
  - New upstream release.
  - Rebase to 2.14 and revert Noto Default change happened in f36.
    Resolves: rhbz#2075393


author: Benjamin Berg <bberg@redhat.com> - 1.94.0-3
changelog:
  - Use GFDL abbreviation as GFDLv1.1+ is not listed
  - Install PAM module into /usr
  - Pull in further test fixes


author: José Expósito <jexposit@redhat.com> - 3.2.1-10
changelog:
  - Fix CVE-2024-24258 and CVE-2024-24259
    Resolves: https://issues.redhat.com/browse/RHEL-25176
    Resolves: https://issues.redhat.com/browse/RHEL-25178


author: Pavel Cahyna <pcahyna@redhat.com> - 1.6.14-2
changelog:
  - Apply upstream patch 41d0d70f
    ipmi-config: fix incorrect output of IPv6_Dynamic_Address_Source_Type


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-1
changelog:
  - Update to 2.11.7 (CVE-2024-32039, CVE-2024-32040, CVE-2024-32041,
    CVE-2024-32458, CVE-2024-32459, CVE-2024-32460, CVE-2024-32658,
    CVE-2024-32659, CVE-2024-32660, CVE-2024-32661, CVE-2024-32662)


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-3
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-142427, RHEL-142411, RHEL-142395, RHEL-142379, RHEL-142363
    Resolves: RHEL-142348, RHEL-142332


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-6
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-148052, RHEL-148053, RHEL-148056, RHEL-148075, RHEL-148081
    Resolves: RHEL-148098, RHEL-148105, RHEL-148106, RHEL-148941, RHEL-149032
    Resolves: RHEL-149043, RHEL-149066, RHEL-155994


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-8
changelog:
  - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)
  - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983)
    Resolves: RHEL-162960, RHEL-162986


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-9
changelog:
  - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986)
  - Fix growth of preallocated buffers (CVE-2026-27951)
  - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775)
  - Add DSP format checks (CVE-2026-31884)
  - Fix DSP array bounds checks (CVE-2026-31883)
  - Fix DSP array bounds checks (CVE-2026-31885)
  - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985)
    Resolves: RHEL-168466, RHEL-169222, RHEL-161048, RHEL-161483
    Resolves: RHEL-161520, RHEL-161086, RHEL-167804


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:2.11.7-12
changelog:
  - Backport several CVE fixes (CVE-2026-64624, CVE-2026-67289, CVE-2026-67299,
    CVE-2026-68580)
    Resolves: RHEL-213171, RHEL-222788, RHEL-223001, RHEL-223611


author: Akira TAGOH <tagoh@redhat.com> - 1.0.10-6.el9.2
changelog:
  - Security fixes for CVE-2022-25308, CVE-2022-25309, CVE-2022-25310
    Resolves: rhbz#2050086, rhbz#2050069, rhbz#2050063


author: Akira TAGOH <tagoh@redhat.com> - 1.0.8-2
changelog:
  - Restore the deprecated API that was accidentally removed in the previous release.
    Resolves: rhbz#1787293


author: Michal Ruprich <mruprich@redhat.com> - 8.5.3-9
changelog:
  - Resolves: RHEL-87730 - frr-k8s CI started failing using latest rpm, failures around BFD sessions
  - Resolves: RHEL-87731 - FRR bgp session not recovered due to incorect error no AF activated for peer


author: Michal Ruprich <mruprich@redhat.com> - 0.17-85
changelog:
  - Use make_build macro and remove hard-coded gcc
  - https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make


author: Richard Hughes <rhughes@redhat.com> 1.7.9-2
changelog:
  - Include the new dbx updates on the filesystem; clients typically do not have LVFS enabled.
  - Resolves: rhbz#2120708


author: Richard Hughes <richard@hughsie.com> 1.8.10-1
changelog:
  - Rebase to latest upstream release to fix multiple ESP detection problems
  - Resolves: rhbz#2128384, needed for rhbz#2119436 and rhbz#2128384


author: Richard Hughes <richard@hughsie.com> 1.8.10-2
changelog:
  - Rebuild because distrobaker did entirely the wrong thing.
  - Resolves: rhbz#2128384, needed for rhbz#2119436 and rhbz#2128384


author: Richard Hughes <richard@hughsie.com> 1.9.26-1
changelog:
  - Rebase to get hardware support for CERTPX-13842
  - Resolves: #RHEL-16637
  - Resolves: #RHEL-35373
  - Resolves: #RHEL-61930


author: Nick Clifton <nickc@redhat.com> - 10.69-1
changelog:
  - Annocheck: Do not complain about unenabled -mbranch-protection option in AArch64 binaries if compiled using LTO.  (#2082146)


author: Nick Clifton <nickc@redhat.com> - 10.73-2
changelog:
  - Annocheck: Fix handling of command line options that take arguments.  (#2086850)
  - Annocheck: Do not complain about unenabled -mbranch-protection option in AArch64 binaries.  (#2078909)


author: Nick Clifton <nickc@redhat.com> - 10.75-1
changelog:
  - Annocheck: Fix covscan detected race condition between stat() and open().
  - Annocheck: Handle binaries created by Rust 1.18.  (#2094420)
  - Annocheck: Add optional function name to --skip arguments.  (PR 29229)


author: Nick Clifton <nickc@redhat.com> - 10.76-1
changelog:
  - Spec file: Correct the Provides for the annobin-doc subpackage.  (#2097065)
  - Annocheck: Check build-id of separate debuginfo files.
  - Annocheck: Add GAPS test replacing --ignore-gaps.
  - Annocheck: Fix covscan detected race condition between stat() and open().


author: Nick Clifton <nickc@redhat.com> - 11.08-4
changelog:
  - Fix building with Clang-16.  (#2216918)
  - Re-enable building with LTO.  (#2166579)
  - Annocheck: Fix atexit test.  Fix recording of version numbers.  (#2165528)
  - Annocheck: Fix handling of file built by multiple versions of gcc.  (#2160700)
  - Spec file: Enable annotated building.
  - Annocheck: Fix handling of empty files.  (#2159292)
  - Annocheck: Add crti.o and crtn.o to the list of known glibc special files.  (#2158740)
  - Annocheck: Fix memory leaks.
  - Annocheck: Do not assume that object files contain no code simply because they do not have an executable segment.  (#2158386)
  - Annocheck: Add more special glibc filenames.  (#2158100)
  - Annocheck: Improve handling of tool versions.
  - GCC Plugin: Fix building with gcc-13.
  - Annocheck: Add test for binaries built by cross compilers.
  - Annocheck: Improve heuristic used to detect binaries without code. (#2144533)
  - Annocheck: Use real filename rather than debuginfo filename.  (#2152280)
  - Rename gcc plugin to gts-annobin.  (#2111977)
  - Rebase to 10.94, brining in support for LLVM 15.  (#2118992)
  - Annocheck: Better detection of binaries which do not contain code.  (#2144533)
  - Annocheck: Provide more information when a test is skipped because the file being tested was not compiled.
  - Annocheck: Try harder not to run mutually exclusive tests.
  - Tests: Fix future-test so that it properly handles the situation where the compiler does not support the new options.
  - Libannocheck: Actually set result fields after tests are run.
  - Libannocheck: Replace libannocheck_version variable with LIBANNOCHECK_VERSION define.
  - Libannocheck: Remove 'Requires binutils-devel' from libannocheck.pc.
  - Libannocheck: Move into separate sub-package.
  - Libannocheck: Add libannocheck.pc pkgconfig file.
  - Libannocheck: Add libannocheck_reinit().
  - GCC Plugin: Record -ftrivial-auto-var-init and -fzero-call-used-regs.
  - Annocheck: Add future tests for  -ftrivial-auto-var-init and -fzero-call-used-regs.
  - Clang Plugin: Fix for building with Clang-15.  (#2125875)
  - Annocheck: Add a test for the inconsistent use of -Ofast.  (#1248744)
  - Plugin: Fix top level configuration support for RiscV.
  - Annocheck: Improvements to the size tool.
  - Annocheck: Fixes for libannocheck.h.
  - Annocheck: Add automatic profile selection.
  - Annocheck: Improve gap detection and reporting.
  - Spec File: Use the %dir directive in the %files section to ensure that
  -  plugin directories are useable.  (#2080454)


author: Nick Clifton <nickc@redhat.comn> - 2.38-17
changelog:
  - NVR Bump: Fix the Provides fields of the binutils-gold and binutils-devel subpackages.  (#2216446)


author: Nick Clifton <nickc@redhat.comn> - 2.38-17.1
changelog:
  - Use z-stream NVR: Fix the Provides fields of the binutils-gold and binutils-devel subpackages.  (#2220917)


author: Nick Clifton <nickc@redhat.comn> - 2.38-18
changelog:
  - Use z-stream NVR: Fix the Provides fields of the binutils-gold and binutils-devel subpackages.  (#2216456)


author: Marek Polacek <polacek@redhat.com> 12.1.1-3
changelog:
  - update from releases/gcc-12 branch
    - PRs c++/49387, c++/102307, c++/102651, c++/104470, c++/105491, c++/105589,
  	c++/105623, c++/105652, c++/105655, c++/105725, c++/105734,
  	c++/105756, c++/105761, c++/105779, c++/105795, c++/105852,
  	c++/105871, c++/105885, c++/105908, c++/105925, c++/105931,
  	c++/105964, c++/106001, c/105635, d/105544, fortran/105230,
  	gcov-profile/105535, ipa/100413, ipa/105600, ipa/105639, ipa/105739,
  	libgomp/105745, libgomp/106045, libstdc++/104731, libstdc++/105284,
  	libstdc++/105671, libstdc++/105681, middle-end/105537,
  	middle-end/105604, middle-end/105711, middle-end/105951,
  	middle-end/105998, middle-end/106030, other/105527,
  	preprocessor/105732, rtl-optimization/105455, rtl-optimization/105559,
  	rtl-optimization/105577, sanitizer/105714, sanitizer/105729,
  	target/101891, target/104871, target/105162, target/105209,
  	target/105292, target/105472, target/105556, target/105599,
  	target/105854, target/105879, target/105953, target/105960,
  	target/105970, target/105981, target/106096, tree-optimization/103116,
  	tree-optimization/105431, tree-optimization/105458,
  	tree-optimization/105528, tree-optimization/105562,
  	tree-optimization/105618, tree-optimization/105726,
  	tree-optimization/105736, tree-optimization/105786,
  	tree-optimization/105940
  - enable tsan and lsan on s390x (#2101610)
  - fix up libtsan on s390x
  - fix nvptx build (PRs bootstrap/105551, target/105938)


author: Marek Polacek <polacek@redhat.com> 12.2.1-4
changelog:
  - update from releases/gcc-12 branch (#2110583)
  - fix up std::from_chars behavior in rounding modes other than FE_TONEAREST
    (PR libstdc++/107468)


author: Marek Polacek <polacek@redhat.com> 12.2.1-7.5
changelog:
  - fix conditions for using memcmp in
    std::lexicographical_compare_three_way (PR libstdc++/113960, RHEL-30832)


author: Kevin Buettner - 11.2-2
changelog:
  - On ix86, add -Wno-format-overflow to --enable-gdb-build-warnings. 
    (This is a workaround for the bogus warning/error that we now see
    on i686 regarding a "may write a terminating nul past the end of
    the destination" message for the sprintf() call in
    global_symbol_searcher::search() in gdb/symtab.c.)


author: Kevin Buettner - 11.2-3
changelog:
  - Backport upstream patch which removes sizes from debuginfod download
    messages when the size is not available (RHBZ 2068280, Aaron Merey).


author: Nick Clifton <nickc@redhat.com> - 12.14-1
changelog:
  - Annocheck: Do not ignore separate debuginfo files that do not contain any DWARF.  (#2144553)
  - Annocheck: Ignore /dev/null filename in string notes.
  - Annocheck: More tweaks to glibc detection heuristics.  (#2215968)


author: Nick Clifton <nickc@redhat.com> - 12.16-1
changelog:
  - Spec File: Rebuild with annobin annotation.  (#2217814)
  - Annocheck: Ignore weak/undef function symbols when checking to see if a binary contains code.  (#2217840)
  - Annocheck: Add --suppress-version-warnings option.


author: Nick Clifton <nickc@redhat.com> - 12.20-1
changelog:
  - Annocheck: Ignore AArch64 $x and $d symbols.  (#2221192)
  - GCC Plugin: Suppress active checks for fortran sources.  Improve scanning of COLLECT_GCC_OPTIONS.


author: Nick Clifton <nickc@redhat.com> - 12.32-1
changelog:
  - LLVM Plugin: Fix building with LLVM version 17.  (RHEL-17311)
  - GCC Plugin: Add support for -fhardended.
  - Update glibc detection heuristics for PPC64.  (RHEL-16453)
  - Fix another atexit test failure.  (#2247481)
  - Fix atexit test failure.
  - Notes: Add support for string format notes.
  - GCC Plugin: Record settings of -Wstrict-flex-arrays and -fstrict-flex-arrays
  - Annobin: Add future test of these options.
  - GCC Plugin: Record settings of -Wimplicit-int and -Wimplicit-function-declaration.
  - Annobin: Add test for these warnings.
  - GCC Plugin: Enable string note format by default.
  - Annocheck: Change GO FIPS test to look for CGO_ENABLED markers.
  - Annocheck: Add test for FIPS compliant GO binaries.
  - Annocheck: Fix double free.  (#2226749)


author: Nick Clifton <nickc@redhat.com> - 12.32-2
changelog:
  - GCC Plugin: Add %verify tokens to show that the default plugin names are symbolic links. (RHEL-17505)


author: Nick Clifton <nickc@redhat.com> - 12.65-1
changelog:
  - Rebase to 12.65.  (RHEL-51018)
  - Annocheck: Fix recording arguments for later re-use.  (RHEL-50802)
  - GCC Plugin: Fix building AArch64 components with gcc earlier than 11.3.
  - Annocheck: Add improvements to the builtby utility.
  - Annocheck: Add support for ADA binaries.
  - Annocheck: Add support for binaries built from more than two high level source languages.
  - Annocheck: Add support for object files containing no executable code.
  - Annocheck: Do not FAIL LLVM compiled binaries that have not been built with sanitize-cfi and/or sanitize-safe-stack.
  - Annocheck: Add support for Fortran binaries.
  - Annocheck: Add heuristic for detecting parts of the CGO runtime library.
  - Annocheck: Add improvements for handling Clang runtime binaries.
  - Annocheck: Add tweaks for mixed Rust/C binaries.  (#2284605)
  - Annocheck: Add more glibc source file names.
  - Annocheck: Skip GAPS test for GO binaries.  (RHEL-36308)
  - Annocheck: Remove some false positives for Rust binaries.  (#2280239)
  - Annocheck: Defer passing the branch protection test until all notes have been checked.
  - GCC Plugin: Add extra code for detecting the branch protection setting.  (RHEL-35958)


author: Nick Clifton <nickc@redhat.com> - 12.69-1
changelog:
  - BuiltBy: Fix seg-fault when comparing language version strings.  (RHEL-53497)
  - Spec File: Use correct names for the symlinks.  (RHEL-53574)


author: Nick Clifton <nickc@redhat.com> - 12.92-1
changelog:
  - Rebase to bring in improvements for locating string notes.  (RHEL-79807)
  - Annocheck: Do not rely upon libelf's ability to detect links to separate debuginfo files.  (RHEL-79264)
  - Annocheck: Fix resource leak.  (RHEL-79253)
  - Annocheck: Fix double free. Add special handling for COMBOOT modules.
  - Annocheck: Improve diagnostics when a separate debug info file cannot be found.
  - Annocheck: Look for -fstack-clash-protection in DW_AT_producer string.  (RHEL-77328)
  - Annocheck: Fix locating string notes (again).  Add exception for glibc benchmark tests.  (RHEL-76456)
  - Annocheck: Add crtoffloadtableS.o to list of known gcc binaries.  (RHEL-760404)
  - Annocheck: Fix the --debug-dir option.
  - Annocheck: Fix corrupt warning message when unable to locate separate debug info files.
  - Annocheck: Remove spurious debugging messages.
  - Annocheck: Always look for annobin notes in separate debug info files.  (RHEL-75778)
  - Annocheck: Support multiple --debug-rpm and --debug-file options.  (RHEL-73349)
  - Annocheck: Add support for sys-root'ed glibc packages.  (RHEL-71296)
  - GCC Plugin: Tidy up use of gcc's diagnoatic headers.  (#32429)
  - Testsuite: Use configured compiler when running tests.
  - GCC Plugin: Fix building with gcc 15.  (#32429)
  - Annocheck: Fix overly long debug messages.
  - Annocheck: Rename rwx-seg test to load-segments.  Add more checks.  Add check for gaps as a future fail.
  - Annocheck: Add --no-allow-excpetions to disable exceptions for known special binaries.
  - Annocheck: Add --enable-future to enable future fail components in normal tests.
  - Annocheck: Fix bug preventing the inclusion of the rpm name in reports.
  - Annocheck: Add more exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Add --skip-passes option.
  - Annocheck: Add exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Skip property note test for i386 binaries created by LLVM.  (#2323797)
  - Annocheck: Skip FORTIFY and GLIBC_ASSERTIONS tests for LLVM produced binaries with unparseable DW_AT_producer attributes in their DWARF debug info.  (RHEL-65411)
  - GCC Plugin: Change type of the .annobin.notes section from SHT_STRTAB to SHT_PROGBITS.


author: Nick Clifton <nickc@redhat.com> - 2.40-1
changelog:
  - Rebase to 2.40.
  - Retire: binutils-package-metadata.patch
  - Retire: binutils-gas-dwarf-skip-empty-functions.patch
  - Retire: binutils-CVE-38128-dwarf-abbrev-parsing.patch
  - Retire: binutils-readelf-no-sections.patch
  - Retire: binutils-libiberty-configure-compile-warnings.patch
  - Retire: binutils-CVE-2022-4285.patch


author: Nick Clifton <nickc@redhat.com> - 2.40-2
changelog:
  - Spec file: Remove duplicate gprofng debug file entries.
  - Spec file: Fix testsuite failures for RiscV64.


author: Nick Clifton <nickc@redhat.com> - 2.40-7
changelog:
  - Spec File: Fix typo.  (#2186396)
  - BFD library: Fix illegal memory access when loading corrupt symbol version info.  (#2186579)


author: Nick Clifton <nickc@redhat.com> - 2.40-12
changelog:
  - Spec File: Enable building with GTS-13 gcc.  (#2217819)
  - Spec File: Sync version number with c8s.


author: Nick Clifton <nickc@redhat.com> - 2.40-17
changelog:
  - Spec File: Do not use of the system zlib by default.  (RHEL-19373)
  - Spec File: Do not check the mtime of ld.bfd. (RHEL-21303)


author: Nick Clifton <nickc@redhat.com> - 2.40-19
changelog:
  - Spec File: Restore the SElinux context to %{_libdir}.  (RHEL-22818)
  - [2.40-18: was a failed attempt to fix RHEL-22818]


author: Marek Polacek <polacek@redhat.com> 13.1.1-4
changelog:
  - update from releases/gcc-13 branch (#2188499)
    - PRs bootstrap/110085, c++/109871, fortran/100607, libgcc/109670,
  	libgcc/109685, libstdc++/108178, libstdc++/109261, libstdc++/109758,
  	libstdc++/109822, libstdc++/109949, libstdc++/110139,
  	middle-end/110200, target/82931, target/92729, target/104327,
  	target/105753, target/106907, target/109547, target/109650,
  	target/109800, target/109939, target/109954, target/110036,
  	target/110044, target/110088, target/110108, target/110227,
  	tree-optimization/109505, tree-optimization/110165,
  	tree-optimization/110166


author: Marek Polacek <polacek@redhat.com> 13.2.1-4
changelog:
  - update from releases/gcc-13 branch
    - PRs ada/110488, ada/111434, c++/99631, c++/111471, c++/111485, c++/111493,
  	c++/111512, fortran/68155, fortran/92586, fortran/111674,
  	libstdc++/108046, libstdc++/111050, libstdc++/111102,
  	libstdc++/111511, middle-end/111699, modula2/111510, target/111121,
  	target/111411, tree-optimization/110315, tree-optimization/110386,
  	tree-optimization/111331, tree-optimization/111519


author: Marek Polacek <polacek@redhat.com> 13.2.1-5
changelog:
  - update from releases/gcc-13 branch
    - PRs c++/89038, c/111884, d/110712, d/112270, fortran/67740, fortran/97245,
  	fortran/111837, fortran/112316, libbacktrace/111315,
  	libbacktrace/112263, libstdc++/110944, libstdc++/111172,
  	libstdc++/111936, libstdc++/112089, libstdc++/112314,
  	middle-end/111253, middle-end/111818, modula2/111756, modula2/112110,
  	target/101177, target/110170, target/111001, target/111366,
  	target/111367, target/111380, target/111935, target/112443,
  	tree-optimization/111397, tree-optimization/111445,
  	tree-optimization/111489, tree-optimization/111583,
  	tree-optimization/111614, tree-optimization/111622,
  	tree-optimization/111694, tree-optimization/111764,
  	tree-optimization/111820, tree-optimization/111833,
  	tree-optimization/111917
    - fix aarch64 RA ICE (#2241139, PR target/111528)
  - fix ia32 doubleword rotates (#2238781, PR target/110792)


author: Marek Polacek <polacek@redhat.com> 13.2.1-6
changelog:
  - update from releases/gcc-13 branch
    - PRs c++/33799, c++/102191, c++/111703, c++/112269, c++/112301, c++/112633,
  	c/112339, fortran/111880, fortran/112764, libgomp/111413,
  	libstdc++/112348, libstdc++/112491, libstdc++/112607,
  	middle-end/111497, target/53372, target/110411, target/111408,
  	target/111815, target/111828, target/112672, tree-optimization/111137,
  	tree-optimization/111465, tree-optimization/111967,
  	tree-optimization/112496
  - add -fno-stack-protector to aarch64 tests (RHEL-17684)


author: Marek Polacek <polacek@redhat.com> 13.3.1-1
changelog:
  - update from releases/gcc-13 branch
    - GCC 13.3 release
    - PRs analyzer/104042, analyzer/108171, analyzer/109251, analyzer/109577,
  	analyzer/110014, analyzer/110112, analyzer/110700, analyzer/110882,
  	analyzer/111289, analyzer/112790, analyzer/112889, analyzer/112969,
  	analyzer/113253, analyzer/113333, analyzer/114408, analyzer/114473,
  	bootstrap/106472, bootstrap/114369, c/112571, c/114780, c++/89224,
  	c++/97990, c++/100667, c++/103825, c++/110006, c++/111284, c++/112769,
  	c++/113141, c++/113966, c++/114303, c++/114377, c++/114537,
  	c++/114561, c++/114562, c++/114572, c++/114580, c++/114634,
  	c++/114691, c++/114709, debug/112718, driver/111700, fortran/36337,
  	fortran/50410, fortran/55978, fortran/89462, fortran/93678,
  	fortran/95374, fortran/101135, fortran/102003, fortran/103707,
  	fortran/103715, fortran/103716, fortran/104352, fortran/106987,
  	fortran/106999, fortran/107426, fortran/110987, fortran/112407,
  	fortran/113799, fortran/113866, fortran/113885, fortran/113956,
  	fortran/114001, fortran/114474, fortran/114535, fortran/114739,
  	fortran/114825, fortran/115039, gcov-profile/114115,
  	gcov-profile/114715, ipa/92606, ipa/108007, ipa/111571, ipa/112616,
  	ipa/113359, ipa/113907, ipa/113964, jit/110466, libgcc/111731,
  	libquadmath/114533, libstdc++/66146, libstdc++/93672,
  	libstdc++/104606, libstdc++/107800, libstdc++/108976,
  	libstdc++/110050, libstdc++/110054, libstdc++/113841,
  	libstdc++/114147, libstdc++/114316, libstdc++/114359,
  	libstdc++/114367, libstdc++/114401, libstdc++/114750,
  	libstdc++/114803, libstdc++/114863, libstdc++/115063, lto/114655,
  	middle-end/110027, middle-end/111151, middle-end/111632,
  	middle-end/111683, middle-end/112684, middle-end/112732,
  	middle-end/113396, middle-end/113622, middle-end/114070,
  	middle-end/114348, middle-end/114552, middle-end/114599,
  	middle-end/114734, middle-end/114753, middle-end/114907,
  	rtl-optimization/54052, rtl-optimization/114415,
  	rtl-optimization/114768, rtl-optimization/114924, sanitizer/97696,
  	sanitizer/114687, sanitizer/114743, sanitizer/114956,
  	sanitizer/115172, target/88309, target/101865, target/105522,
  	target/110621, target/111234, target/111600, target/111610,
  	target/111822, target/112397, target/113095, target/113233,
  	target/113950, target/114049, target/114130, target/114160,
  	target/114172, target/114175, target/114272, target/114747,
  	target/114752, target/114794, target/114837, target/114848,
  	target/114981, testsuite/111066, testsuite/112297, testsuite/114034,
  	testsuite/114036, testsuite/114662, tree-optimization/91838,
  	tree-optimization/109925, tree-optimization/110838,
  	tree-optimization/111009, tree-optimization/111268,
  	tree-optimization/111407, tree-optimization/111736,
  	tree-optimization/111882, tree-optimization/112281,
  	tree-optimization/112303, tree-optimization/112793,
  	tree-optimization/112961, tree-optimization/112991,
  	tree-optimization/113552, tree-optimization/113630,
  	tree-optimization/113670, tree-optimization/113831,
  	tree-optimization/113910, tree-optimization/114027,
  	tree-optimization/114115, tree-optimization/114121,
  	tree-optimization/114203, tree-optimization/114231,
  	tree-optimization/114246, tree-optimization/114375,
  	tree-optimization/114396, tree-optimization/114485,
  	tree-optimization/114566, tree-optimization/114672,
  	tree-optimization/114733, tree-optimization/114736,
  	tree-optimization/114749, tree-optimization/114787,
  	tree-optimization/114799, tree-optimization/114876,
  	tree-optimization/114965, tree-optimization/115143,
  	tree-optimization/115152, tree-optimization/115154
  - add --without-clang-plugin --without-llvm-plugin to annobin configure
    options


author: Marek Polacek <polacek@redhat.com> 13.3.1-2
changelog:
  - update from releases/gcc-13 branch
    - PRs ada/114398, ada/114708, c/114493, c++/111529, c++/113598,
  	fortran/110415, fortran/114827, fortran/115150, libstdc++/114940,
  	libstdc++/115269, middle-end/108789, rtl-optimization/114902,
  	rtl-optimization/115092, target/113281, target/113719, target/115297,
  	target/115317, target/115324, tree-optimization/115192,
  	tree-optimization/115307, tree-optimization/115337
  - fix a shell condition (RHEL-40722)
  - backport a fix for modes_1.f90 (RHEL-40234)
  - fix up pointer types to may_alias structures (PR c/114493, RHEL-40244)


author: Kevin Buettner <kevinb@redhat.com> - 12.1-13
changelog:
  - Backport fix for problems associated with GCC 13's self-move warning.
    (Jan-Benedict Glaw)
  - Tweak gdb-6.6-buildid-locate-rpm.patch so that running GDB's configure
    script will not error out due to GCC 13's warnings.


author: Keith Seitz <keiths@redhat.com> - 12.1-14
changelog:
  From Sergey Mende:
  - Backport upstream patch "gdb: call check_typedef at beginning of
    dwarf_expr_context::fetch_result". (Simon Marchi)


author: Kevin Buettner <kevinb@redhat.com> - 12.1-16
changelog:
  - Tweak gdb-6.3-rh-testversion-20041202.patch so that $_gdb_major
    and $_gdb_minor will be obtained correctly.


author: Keith Seitz <keiths@redhat.com> - 12.1-2.el9
changelog:
  - Backport binutls/29699 "Fix an illegal memory access when parsing..."
    (Nick Clifton, RHBZ 2153228)


author: Guinevere Larsen <blarsen@redhat.com> - 12.1-4.el9
changelog:
  - Backport "Fix typo in recent code to add stack recursion limit to the Rust demangler."
    (Nick Clifton)
  - Backport "Add a recursion limit to the demangle_const function in the Rust demangler."
    (Nick Clifton, RHEL-4234)


author: Nick Clifton <nickc@redhat.com> - 12.65-1
changelog:
  - Rebase to 12.65.  (RHEL-51056)
  - Annocheck: Fix recording arguments for later re-use.  (RHEL-50802)
  - GCC Plugin: Fix building AArch64 components with gcc earlier than 11.3.
  - Annocheck: Add improvements to the builtby utility.
  - Annocheck: Add support for ADA binaries.
  - Annocheck: Add support for binaries built from more than two high level source languages.
  - Annocheck: Add support for object files containing no executable code.
  - Annocheck: Do not FAIL LLVM compiled binaries that have not been built with sanitize-cfi and/or sanitize-safe-stack.
  - Annocheck: Add support for Fortran binaries.
  - Annocheck: Add heuristic for detecting parts of the CGO runtime library.
  - Annocheck: Add improvements for handling Clang runtime binaries.
  - Annocheck: Add tweaks for mixed Rust/C binaries.  (#2284605)
  - Annocheck: Add more glibc source file names.
  - Annocheck: Skip GAPS test for GO binaries.  (RHEL-36308)
  - Annocheck: Remove some false positives for Rust binaries.  (#2280239)
  - Annocheck: Defer passing the branch protection test until all notes have been checked.
  - GCC Plugin: Add extra code for detecting the branch protection setting.  (RHEL-35958)


author: Nick Clifton <nickc@redhat.com> - 12.67-1
changelog:
  - Annocheck: Stop spurious assembler warnings.  (RHEL-53213)
  - Annocheck: Stop warnings about known gaps.    (RHEL-53218)
  - Annocheck: Fix stack realign test.  (#2302427)


author: Nick Clifton <nickc@redhat.com> - 12.67-2
changelog:
  - Spec File: Use correct directory for plugin installation.  (RHEL-53209)
  - Spec File: Disable plugin when running on wrong major version of the compiler.


author: Nick Clifton <nickc@redhat.com> - 12.69-1
changelog:
  - BuiltBy: Fix seg-fault when comparing language version strings.  (RHEL-53497)
  - Spec File: Use correct names for the symlinks.  (RHEL-53209)


author: Nick Clifton <nickc@redhat.com> - 12.87-1
changelog:
  - Rebase for GTS 14.1 release.  (RHEL-76932)
  - Annocheck: Fix locating string notes (again).  Add exception for glibc benchmark tests.  (RHEL-76456)
  - Annocheck: Add crtoffloadtableS.o to list of known gcc binaries.  (RHEL-760404)
  - Annocheck: Fix the --debug-dir option.
  - Annocheck: Fix corrupt warning message when unable to locate separate debug info files.
  - Annocheck: Remove spurious debugging messages.
  - Annocheck: Always look for annobin notes in separate debug info files.  (RHEL-75778)
  - Annocheck: Support multiple --debug-rpm and --debug-file options.  (RHEL-73349)
  - Annocheck: Add support for sys-root'ed glibc packages.  (RHEL-71296)
  - GCC Plugin: Tidy up use of gcc's diagnoatic headers.  (#32429)
  - Testsuite: Use configured compiler when running tests.
  - GCC Plugin: Fix building with gcc 15.  (#32429)
  - Annocheck: Fix overly long debug messages.
  - Annocheck: Rename rwx-seg test to load-segments.  Add more checks.  Add check for gaps as a future fail.
  - Annocheck: Add --no-allow-excpetions to disable exceptions for known special binaries.
  - Annocheck: Add --enable-future to enable future fail components in normal tests.
  - Annocheck: Fix bug preventing the inclusion of the rpm name in reports.
  - Annocheck: Add more exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Add --skip-passes option.
  - Annocheck: Add exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Skip property note test for i386 binaries created by LLVM.  (#2323797)
  - Annocheck: Skip FORTIFY and GLIBC_ASSERTIONS tests for LLVM produced binaries with unparseable DW_AT_producer attributes in their DWARF debug info.  (RHEL-65411)
  - GCC Plugin: Change type of the .annobin.notes section from SHT_STRTAB to SHT_PROGBITS.


author: Marek Polacek <polacek@redhat.com> 14.2.1-1
changelog:
  - update from releases/gcc-14 branch
    - GCC 14.2 release
    - PRs analyzer/114899, c++/99241, c++/99242, c++/104981, c++/106760,
  	c++/111890, c++/115165, c++/115476, c++/115550, c++/115561,
  	c++/115583, c++/115623, c++/115754, c++/115783, c++/115865,
  	c++/115897, c++/115900, c++/115986, fortran/59104, fortran/84006,
  	fortran/93635, fortran/98534, fortran/99798, fortran/100027,
  	fortran/103115, fortran/103312, fortran/113363, fortran/115700,
  	ipa/111613, ipa/113291, ipa/113787, ipa/114207, ipa/115033,
  	ipa/115277, ipa/116055, libstdc++/113376, libstdc++/114387,
  	libstdc++/115399, libstdc++/115482, libstdc++/115522,
  	libstdc++/115585, libstdc++/115807, libstdc++/115854,
  	libstdc++/116070, middle-end/115527, middle-end/115836,
  	middle-end/115887, pch/115312, rtl-optimization/115049,
  	rtl-optimization/115565, target/87376, target/88236, target/97367,
  	target/98762, target/105090, target/113715, target/114759,
  	target/114890, target/114936, target/114988, target/115068,
  	target/115153, target/115188, target/115351, target/115389,
  	target/115456, target/115457, target/115459, target/115475,
  	target/115526, target/115554, target/115562, target/115591,
  	target/115611, target/115691, target/115725, target/115726,
  	target/115752, target/115763, target/115840, target/115872,
  	target/115978, target/115981, target/115988, target/116035,
  	testsuite/115826, testsuite/116061, tree-optimization/113673,
  	tree-optimization/115382, tree-optimization/115646,
  	tree-optimization/115669, tree-optimization/115694,
  	tree-optimization/115701, tree-optimization/115723,
  	tree-optimization/115841, tree-optimization/115843,
  	tree-optimization/115867, tree-optimization/115868,
  	tree-optimization/116034, tree-optimization/116057


author: Marek Polacek <polacek@redhat.com> 14.2.1-7
changelog:
  - update from releases/gcc-14 branch (RHEL-74061)
    - PRs ada/113036, ada/113868, ada/115917, ada/117328, ada/117996,
  	analyzer/115724, c/117641, c/117745, c/117802, c++/100358, c++/101463,
  	c++/102594, c++/109859, c++/113108, c++/114854, c++/115008,
  	c++/115430, c++/115657, c++/116108, c++/116634, c++/117158,
  	c++/117317, c++/117614, c++/117615, c++/117792, c++/117825,
  	c++/117845, c++/117880, c++/117925, c++/117985, c++/118060,
  	c++/118069, driver/117942, fortran/84674, fortran/84869,
  	fortran/105054, fortran/109105, fortran/109345, fortran/115070,
  	fortran/115348, fortran/116388, fortran/117730, fortran/117763,
  	fortran/117774, fortran/117791, fortran/117797, fortran/117819,
  	fortran/117820, fortran/117843, fortran/117897, libgomp/117851,
  	libstdc++/89624, libstdc++/106212, libstdc++/106676, libstdc++/108236,
  	libstdc++/109517, libstdc++/109976, libstdc++/112349,
  	libstdc++/112641, libstdc++/117520, libstdc++/117560,
  	libstdc++/117822, libstdc++/117962, libstdc++/117966,
  	libstdc++/118035, libstdc++/118093, middle-end/43374,
  	middle-end/102674, middle-end/116997, middle-end/117433,
  	middle-end/117458, middle-end/117459, middle-end/117847,
  	middle-end/118024, modula2/114529, modula2/115003, modula2/115057,
  	modula2/115164, modula2/115276, modula2/115328, modula2/115536,
  	modula2/115540, modula2/115804, modula2/115823, modula2/115957,
  	modula2/116048, modula2/116181, modula2/116378, modula2/116557,
  	modula2/116918, modula2/117120, modula2/117371, modula2/117555,
  	modula2/117660, modula2/117904, modula2/117948, other/116603,
  	preprocessor/117118, rtl-optimization/113994, rtl-optimization/116799,
  	rtl-optimization/117095, sanitizer/117960, target/64242,
  	target/114801, target/114942, target/116371, target/116629,
  	target/116999, target/117045, target/117105, target/117304,
  	target/117357, target/117408, target/117418, target/117443,
  	target/117500, target/117525, target/117562, target/117564,
  	target/117642, target/117659, target/117675, target/117744,
  	target/117926, testsuite/103298, testsuite/109360,
  	tree-optimization/94589, tree-optimization/112376,
  	tree-optimization/116463, tree-optimization/117142,
  	tree-optimization/117254, tree-optimization/117307,
  	tree-optimization/117333, tree-optimization/117398,
  	tree-optimization/117417, tree-optimization/117439,
  	tree-optimization/117574, tree-optimization/117594,
  	tree-optimization/117612, tree-optimization/117912
  - fix up -freport-bug default (#2330362, RHEL-70192)
  - revert -mearly-ldp-fusion and -mlate-ldp-fusion default to enabled on
    aarch64 to match upstream (RHEL-74059)
  - consider TARGET_EXPR invariant like SAVE_EXPR (PR c++/118509)
  - have gfortran require install-info (RHEL-62417)


author: Marek Polacek <polacek@redhat.com> 13.3.1-2
changelog:
  - update from releases/gcc-13 branch
    - PRs ada/114398, ada/114708, c/114493, c++/111529, c++/113598,
  	fortran/110415, fortran/114827, fortran/115150, libstdc++/114940,
  	libstdc++/115269, middle-end/108789, rtl-optimization/114902,
  	rtl-optimization/115092, target/113281, target/113719, target/115297,
  	target/115317, target/115324, tree-optimization/115192,
  	tree-optimization/115307, tree-optimization/115337
  - fix a shell condition (RHEL-40722)
  - backport a fix for modes_1.f90 (RHEL-40234)
  - fix up pointer types to may_alias structures (PR c/114493, RHEL-39736)


author: Marek Polacek <polacek@redhat.com> 15.1.1-1
changelog:
  - update from releases/gcc-15 branch
    - GCC 15.1 release
    - PRs fortran/119836, target/119327, target/119873, tree-optimization/118407


author: Marek Polacek <polacek@redhat.com> 15.1.1-2
changelog:
  - update from releases/gcc-15 branch
    - PRs ada/112958, ada/120104, c/120057, c++/119863, c++/119864, c++/119938,
     c++/119939, c++/119981, c++/119996, c++/120012, c++/120013,
     c++/120023, c++/120125, c++/120161, c++/120350, fortran/102891,
     fortran/102900, fortran/119928, fortran/119986, fortran/120049,
     fortran/120107, fortran/120139, fortran/120163, fortran/120179,
     fortran/120191, ipa/119852, ipa/119973, ipa/120006, ipa/120146,
     libfortran/120152, libfortran/120153, libfortran/120158,
     libfortran/120196, libstdc++/118260, libstdc++/119427,
     libstdc++/119714, libstdc++/120029, libstdc++/120114,
     libstdc++/120159, libstdc++/120187, libstdc++/120190,
     libstdc++/120198, libstdc++/120293, modula2/115276, modula2/119914,
     modula2/119915, modula2/120117, modula2/120188, preprocessor/116047,
     preprocessor/120061, target/119610, testsuite/119909,
     tree-optimization/111873, tree-optimization/119712,
     tree-optimization/120043, tree-optimization/120048,
     tree-optimization/120074, tree-optimization/120089,
     tree-optimization/120143, tree-optimization/120211


author: Siddhesh Poyarekar <siddhesh@redhat.com> 15.2.1-7
changelog:
  - update from releases/gcc-15 branch (RHEL-116513)
    - PRs ada/68179, ada/123060, ada/123088, ada/123096, ada/123138, ada/123185,
  	ada/123289, ada/123302, ada/123306, ada/123371, ada/123589,
  	analyzer/122975, analyzer/123085, c/123156, c++/91388, c++/114764,
  	c++/116952, c++/120446, c++/121854, c++/121966, c++/122048,
  	c++/122070, c++/122550, c++/122668, c++/122752, c++/122772,
  	c++/122834, c++/122922, c++/123331, c++/123597, debug/121964,
  	diagnostics/120063, fortran/107406, libfortran/122936,
  	libstdc++/120446, libstdc++/122812, libstdc++/122907,
  	libstdc++/123147, middle-end/111817, middle-end/123107,
  	middle-end/123392, middle-end/123703, rtl-optimization/121773,
  	rtl-optimization/122215, rtl-optimization/123121,
  	rtl-optimization/123523, target/117575, target/119130,
  	target/120250, target/121192, target/121485, target/123022,
  	target/123092, target/123155, target/123217, target/123460,
  	target/123484, target/123489, target/123521, target/123607,
  	target/123742, testsuite/123353, tree-optimization/122793,
  	tree-optimization/122868, tree-optimization/123040,
  	tree-optimization/123300, tree-optimization/123351,
  	tree-optimization/123372, tree-optimization/123431,
  	tree-optimization/123513, tree-optimization/123602,
  	tree-optimization/123736, tree-optimization/123741


author: Marek Polacek <polacek@redhat.com> 16.1.1-4
changelog:
  - update from releases/gcc-16 branch
    - PRs ada/18205, ada/125695, c/124303, c/124532, c/124985, c/125252,
  	c++/65271, c++/113563, c++/115314, c++/117259, c++/121094, c++/123536,
  	c++/124584, c++/124978, c++/125007, c++/125123, c++/125135,
  	c++/125284, c++/125333, c++/125334, c++/125376, c++/125378,
  	c++/125384, c++/125408, c++/125412, c++/125423, c++/125454,
  	c++/125490, c++/125498, c++/125745, c++/125759, c++/125764,
  	c++/125768, c++/125770, c++/125889, c++/125900, c++/125939,
  	fortran/60576, fortran/105582, fortran/106546, fortran/115260,
  	fortran/125021, fortran/125051, fortran/125391, fortran/125393,
  	fortran/125416, fortran/125430, fortran/125481, fortran/125527,
  	fortran/125528, fortran/125529, fortran/125530, fortran/125531,
  	fortran/125534, fortran/125535, fortran/125606, fortran/125650,
  	fortran/125669, fortran/125902, fortran/126018, ipa/125699,
  	libstdc++/71301, libstdc++/78302, libstdc++/118158, libstdc++/125228,
  	libstdc++/125312, libstdc++/125369, libstdc++/125374,
  	libstdc++/125450, libstdc++/125890, libstdc++/125956,
  	middle-end/125156, middle-end/125621, middle-end/125977, other/125348,
  	rtl-optimization/125173, rtl-optimization/125375, target/106895,
  	target/120144, target/120870, target/122665, target/122827,
  	target/124870, target/124895, target/124908, target/125148,
  	target/125215, target/125320, target/125351, target/125355,
  	target/125362, target/125373, target/125409, target/125448,
  	target/125469, target/125478, target/125611, target/125628,
  	target/125670, target/125751, target/125752, target/125795,
  	target/125818, target/125838, target/125883, target/125949,
  	target/125972, target/125992, tree-optimization/124151,
  	tree-optimization/125250, tree-optimization/125291,
  	tree-optimization/125419, tree-optimization/125431,
  	tree-optimization/125477, tree-optimization/125501,
  	tree-optimization/125502, tree-optimization/125545,
  	tree-optimization/125553, tree-optimization/125646,
  	tree-optimization/125652, tree-optimization/125686,
  	tree-optimization/125774, tree-optimization/125776
  - don't remove openacc tests for s390x and ppc64le (RHEL-183931)


author: Marek Polacek <polacek@redhat.com> 16.1.1-4.1
changelog:
  - fix gating problems (RHEL-194141)
  - adjust libstdc++_nonshared symbols (RHEL-194261)
  - fix asneeded libraries (RHEL-194145)
  - add libgdiagnostics and libgdiagnostics-devel


author: Marek Polacek <polacek@redhat.com> 16.2.1-1
changelog:
  - update from releases/gcc-16 branch (RHEL-220997)
    - GCC 16.2.0 release
    - PRs ada/126379, ada/126482, ada/126553, algol68/126330, c/123569,
  	c/125072, c/125604, c/125935, c++/91155, c++/119343, c++/121552,
  	c++/125541, c++/125591, c++/125601, c++/125674, c++/125680,
  	c++/125901, c++/126007, c++/126031, c++/126036, c++/126057,
  	c++/126066, c++/126209, c++/126215, c++/126280, c++/126309,
  	c++/126310, c++/126343, c++/126406, c++/126420, c++/126423,
  	c++/126508, driver/124058, fortran/97592, fortran/125172,
  	fortran/125866, fortran/125998, fortran/126127, fortran/126170,
  	fortran/126210, fortran/126234, fortran/126303, fortran/126386,
  	ipa/124128, ipa/125121, ipa/125207, libfortran/126116, libgcc/123976,
  	libstdc++/122197, libstdc++/123165, libstdc++/124851,
  	libstdc++/124852, libstdc++/124853, libstdc++/124854,
  	libstdc++/125200, libstdc++/126111, lto/125257, middle-end/124637,
  	middle-end/125875, middle-end/126084, middle-end/126341,
  	middle-end/126405, middle-end/126410, middle-end/126447,
  	middle-end/126497, preprocessor/125048, rtl-optimization/125209,
  	rtl-optimization/126184, sanitizer/126307, target/67459, target/96446,
  	target/96530, target/96808, target/97360, target/98872, target/100777,
  	target/101849, target/102976, target/103127, target/104923,
  	target/105116, target/106016, target/106017, target/106833,
  	target/110411, target/119210, target/121957, target/122948,
  	target/123625, target/124364, target/124948, target/126049,
  	target/126054, target/126081, target/126098, target/126148,
  	target/126320, target/126429, target/126438, target/126446,
  	target/126450, target/126484, target/126581, testsuite/112728,
  	testsuite/118407, testsuite/124043, testsuite/124112,
  	testsuite/124361, testsuite/124726, testsuite/126261,
  	tree-optimization/120201, tree-optimization/124663,
  	tree-optimization/125040, tree-optimization/125290,
  	tree-optimization/125296, tree-optimization/125396,
  	tree-optimization/125597, tree-optimization/125668,
  	tree-optimization/125730, tree-optimization/125786,
  	tree-optimization/125953, tree-optimization/126008,
  	tree-optimization/126150, tree-optimization/126171,
  	tree-optimization/126194, tree-optimization/126225,
  	tree-optimization/126257, tree-optimization/126262,
  	tree-optimization/126404, tree-optimization/126457,
  	tree-optimization/126464, tree-optimization/126471,
  	tree-optimization/126476, tree-optimization/126490,
  	tree-optimization/126503, tree-optimization/126504,
  	tree-optimization/126547, tree-optimization/126549,
  	tree-optimization/126564, tree-optimization/126576,
  	tree-optimization/126601
     - fix up s390x ICE on botan (PR target/126667)
  - fix s390x libstdc++_nonshared symbols (RHEL-223968)
  - always inline _M_extract_name (RHEL-212553)


author: Filip Januš <fjanus@redhat.com> - 2.2.5-12
changelog:
  - Add patch(gd-2.2.5-null-pointer.patch) - fix Null pointer reference in gdImageClone (gdImagePtr src)
  - Resolves: #1599032


author: Filip Januš <fjanus@redhat.com> - 2.3.1-1
changelog:
  - Upstream released new version 2.3.1
  - patch bug615 is no more needed - fixed by upstream in release
  - gdimagestring16/gdimagestring16 gdimagestringup16/gdimagestringup16 passed on
    x390s - XFAIL_TEST definition for x390s is no more necessary


author: Filip Januš <fjanus@redhat.com> - 2.3.2-1
changelog:
  - Add condition if fedora for packages not available in RHEL
  - enable avif support
  - use bcond
  - rebase to version 2.3.2


author: Andrew Burgess <aburgess@redhat.com>
changelog:
  - Remove gdb-rhbz1261564-aarch64-hw-watchpoint-test.patch.  This test
    should be covered by gdb.base/watchpoint-unaligned.exp which was
    added upstream in commit a3b60e4588606354b93508a0008a5.


author: Guinevere Larsen <guinevere@redhat.com>
changelog:
  - remove gdb-test-bt-cfi-without-die.patch.  This test has been
    accepted upstream and will make its way back to testing with
    the GDB 17 release.


author: Alexandra Hájková <ahajkova@redhat.com> - 16.2-1
changelog:
  - Rebase to FSF GDB 16.2.
    Dropped:  gdb-backport-buildid-related-changes.patch
              gdb-catchpoint-re-set.patch
              gdb-remove-qnx-neutrino-support.patch
    Modified: gdb-add-rpm-suggestion-script.patch


author: Kevin Buettner <kevinb@redhat.com>
changelog:
  - Backport upstream commit c1da013915e from Kevin Buettner to fix
    gcore failures caused by glibc 2.42 guard page changes (RHBZ 2413405).
  - Backport upstream commit d2cc16cd7fc from Jan Vrany to fix
    FAILs in gdb.base/fileio.exp caused by macro expansion of
    path components in OUTDIR.


author: Andrew Burgess <aburgess@redhat.com>
changelog:
  - Backport upstream commits 8bd08ee92c4 and cd289df068e to address
    rhbz2366461.  These backports will not be needed once we rebase to
    GDB 18.


author: Keith Seitz <keiths@redhat.com>
changelog:
  - Backport upstream commit ef7727ae from Tom de Vries to
    fix the test suite for newer Tcl releases.


author: Andrew Burgess <aburgess@redhat.com>
changelog:
  - Backport the following upstream commits in order to address RHBZ
    2467251: d980317c7f1, 958d06262a7, 7d1d7386561, 8915de0883c,
    8f65ab7b71f.  These commits will all drop out when we rebase to GDB
    18.


author: Kevin Buettner <kevinb@redhat.com>
changelog:
  - Applied proposed patch "[gdb/testsuite, Tcl 9] Fix EILSEQ problems for
    UTF8 related tests".  This is required in order to complete a build
    with testing.


author: Michal Kolar <mkolar@redhat.com>
changelog:
  - Rebase to FSF GDB 17.2.
    Deleted: gdb-rhbz2435950-skip-revert.patch
    Backport e492fb22b70, gdb: backport DAP core file support
    Replace manual, multi-file patch inclusion with modern autosetup
    Add rpminspect.yaml to define package-specific testing policy


author: Andrew Burgess <aburgess@redhat.com>
changelog:
  - Adjust commit message in gdb-backport-dap-core-file-support.patch to
    remove '---' string which confuses git.


author: Andrew Burgess <aburgess@redhat.com>
changelog:
  - Backport upstream commit be3a9405ceb4d6d6 to fix and issue with the
    D demangler (RHBZ 2368350).  This commit will drop out when we
    rebase to GDB 18.


author: Andrew Burgess <aburgess@redhat.com>
changelog:
  - Backport upstream commit 93f536d813c41527 to fix RHBZ 2498034.  This
    commit will drop out when we rebase to GDB 18.


author: Tomas Popela <tpopela@redhat.com> - 2.42.6-3
changelog:
  - Backport fixes for CVE-2021-46829 and CVE-2021-44648
  - Resolves: rhbz#2115213
  - Resolves: rhbz#2044346


author: Joan Torres <joantolo@redhat.com> - 40.1-32
changelog:
  - Leave session-opened signature the same as before and use a new
    session-opened-with-session-id signal to keep ABI compatibility
    Related: RHEL-46383


author: Joan Torres <joantolo@redhat.com> - 40.1-35
changelog:
  - Instead of allowing adding custom parameters to Xorg,
    only allow adding -nocursor. Allowing adding custom parameters
    is a potential security issue.
    Related: RHEL-81194


author: Joan Torres Lopez <joantolo@redhat.com> - 40.1-43
changelog:
  - Backport passwordless feature to RHEL 9
    Resolves: https://redhat.atlassian.net/browse/RHEL-139178


author: Joan Torres Lopez <joantolo@redhat.com> - 40.1-44
changelog:
  - Add pam-extension helpers in pam-extensions-devel
    Related: https://redhat.atlassian.net/browse/RHEL-139178


author: Joan Torres Lopez <joantolo@redhat.com> - 40.1-45
changelog:
  - Update how GDM handles Registering session/display
    to properly terminate plymouth
    Resolves: https://redhat.atlassian.net/browse/RHEL-178686


author: Joan Torres Lopez <joantolo@redhat.com> - 40.1-46
changelog:
  - Fix last change when setting xsession program
    Related: https://redhat.atlassian.net/browse/RHEL-178686


author: Joan Torres Lopez <joantolo@redhat.com> - 40.1-47
changelog:
  - Create display in "legacy-xorg" mode checking displays in tty
    Resolves: https://redhat.atlassian.net/browse/RHEL-180822


author: Joan Torres Lopez <joantolo@redhat.com> - 40.1-48
changelog:
  - Fix auth bypass in authselect pam substacks
    Resolves: https://redhat.atlassian.net/browse/RHEL-194090


author: Joan Torres Lopez <joantolo@redhat.com> - 40.1-49
changelog:
  - Fix crash in session-settings related with ActUser
    Resolves: https://redhat.atlassian.net/browse/RHEL-240874


author: Joan Torres Lopez <joantolo@redhat.com> - 40.1-50
changelog:
  - Update unified authentication patch to drop passkey/web auth settings
    Resolves: https://redhat.atlassian.net/browse/RHEL-236551


author: Milan Crha <mcrha@redhat.com> - 2.6.0-8
changelog:
  - Backport Fedora change to provide a sysusers.d file to get user() and group() provides
    (see https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format)
  - Resolves: RHEL-78739


author: Sundeep Anand <suanand@redhat.com> - 0.21-6
changelog:
  - Add gettext-0.21-covscan.patch to fix issues detected by static analyzers
    Add gettext-0.21-disable-libtextstyle.patch
    Do not build libtextstyle, as it depends on libcroco
    which is now unmaintained and has known security bugs.
    Obsolete libtextstyle and libtextstyle-devel packages.


author: Zdenek Dohnal <zdohnal@redhat.com> - 9.54.0-16
changelog:
  - RHEL-38839 CVE-2024-33871 ghostscript: OPVP device arbitrary code execution via custom Driver library


author: Zdenek Dohnal <zdohnal@redhat.com> - 9.54.0-17
changelog:
  - RHEL-44759 CVE-2024-33870 ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths
  - RHEL-44745 CVE-2024-33869 ghostscript: path traversal and command execution due to path reduction
  - RHEL-44731 CVE-2024-29510 ghostscript: format string injection leads to shell command execution (SAFER bypass)


author: Zdenek Dohnal <zdohnal@redhat.com> - 9.54.0-18
changelog:
  - RHEL-18397 CVE-2023-46751 ghostscript: dangling pointer in gdev_prn_open_printer_seekable()
  - RHEL-67048 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space
  - RHEL-67053 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding
  - RHEL-67053 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript
  - RHEL-67053 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution


author: Sandro Mani <manisandro@gmail.com> - 5.2.1-5
changelog:
  - Fix several defects found by Coverity scan
  - Generate HTML docs with consistent section IDs to avoid multilib difference


author: Josef Ridky <jridky@redhat.com> - 2:3.0.4-2
changelog:
  - fix CVE-2025-10920
  - fix CVE-2025-10921
  - fix CVE-2025-10922
  - fix CVE-2025-10923
  - fix CVE-2025-10924
  - fix CVE-2025-10925
  - fix CVE-2025-10934


author: Josef Ridky <jridky@redhat.com> - 2:3.0.4-6
changelog:
  - fix CVE-2026-4150
  - fix CVE-2026-4151
  - fix CVE-2026-4152
  - fix CVE-2026-4153
  - fix CVE-2026-4154
  - fix CVE-2026-4887


author: Josef Ridky <jridky@redhat.com> - 2:3.0.4-8
changelog:
  - fix CVE-2026-59090
  - fix CVE-2026-18301
  - fix CVE-2026-18302
  - fix CVE-2026-18303
  - fix CVE-2026-18304
  - fix CVE-2026-18305
  - fix CVE-2026-18306
  - fix CVE-2026-18307
  - fix CVE-2026-18308


author: Ondřej Pohořelský <opohorel@redhat.com> - 3.7.1-5
changelog:
  - Rebuild with new Golang
  - Resolves: RHEL-156656, RHEL-166700, RHEL-167695, RHEL-167389, RHEL-166345, RHEL-177321


author: Tomas Pelka <tpelka@redhat.com> - 1.68.6-5
changelog:
  - Disable meson test suite at build time (enable_tests=0); covered by QE gating
    Resolves: RHEL-183553


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-8
changelog:
  - Resolve use after free introduced by fixes for CVE-2023-24593/CVE-2023-25180
  - Related: #2181196
  - Related: #2181200


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-9
changelog:
  - Resolve s390x crashes introduced by fixes for CVE-2023-24593/CVE-2023-25180
  - Related: #2181196
  - Related: #2181200


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-11
changelog:
  - Really fix authentication failures when sd-bus clients connect to GDBus servers
  - Resolves: #2217771


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-17
changelog:
  - Add patches for CVE-2024-52533 and CVE-2025-4373
  - Update GDateTime test for new tzdata
  - Resolves: RHEL-94483
  - Resolves: RHEL-102844


author: Joan Torres Lopez <joantolo@redhat.com> - 2.68.4-21
changelog:
  - gdbusnameowning: Downgrade ReleaseName warning on closed connection to debug
    Resolves: RHEL-14597


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.68.4-24
changelog:
  - Fix CVE-2026-58010: off-by-one error in GVariant tuple normal form checking
    Resolves: RHEL-212171


author: Frédéric Bérat <fberat@redhat.com> - 2.34-265
changelog:
  - Fix null pointer dereference and assertion failures in __nss_database_get
    (bug 28940) (RHEL-150269)


author: Tamar Shacked <tshacked@redhat.com> - 6.0-56.3
changelog:
  - Rebase with latest RHGS-3.5.4
  - Fix changlog chronological order by removing unneeded changelogs
  - fixes bug bz#1939340


author: Jakub Martisko <jamartis@redhat.com> - 1:6.2.0-9
changelog:
  - Move the .hmac files to the fipscheck subfolder
  - Make symlinks from their original location (Fedora contains the .hmac files there) pointing to their new location
  Resolves: rhbz#1980758


author: Jakub Martisko <jamartis@redhat.com> - 1:6.2.0-13
changelog:
  - Fix: previous commit removed one function from the library and thus broke the ABI
  - function gmpn_preinv_divrem_1 should now not be removed
  Related: rhbz#2044216


author: Bastien Nocera <bnocera@redhat.com> - 3.34.3-4
changelog:
  + gnome-bluetooth-3.34.3-4
  - Revert “Require PulseAudio _or_ Pipewire for Bluetooth audio”
  - Closes: #1928166


author: Kalev Lember <klember@redhat.com> - 40.0-1
changelog:
  - Update to 40.0
  - Require hicolor-icon-theme for icon directories rather than adwaita
  - Use https source URL
  - Validate appdata file
  - Filter private libraries
  - Don't install various development files


author: Felipe Borges <feborges@redhat.com> - 40.0-38
changelog:
  - Scale up monitors drawing in display arrangment settings when multiple monitors
    Related: RHEL-4196


author: Ray Strode <rstrode@redhat.com> - 40.0-6
changelog:
  - Copy and run the script from XDG_RUNTIME_DIR
    Resolves: https://issues.redhat.com/browse/RHEL-25536


author: Olivier Fourdan <ofourdan@redhat.com> - 40.0-8
changelog:
  - Add Xwayland and dbus-daemon as weak dependencies
    Resolves: https://issues.redhat.com/browse/RHEL-66572


author: Milan Crha <mcrha@redhat.com> - 3.40.0-4
changelog:
  - Resolves: RHEL-10492 (Move account types that depend on WebKitGTK into separate optional subpackage)


author: Milan Crha <mcrha@redhat.com> - 3.40.0-5
changelog:
  - Resolves: RHEL-10492 (Move account types that depend on WebKitGTK into separate optional subpackage)
  - backport upstream fix to use external browser for OAuth2


author: Joan Torres <joantolo@redhat.com> - 40.1.1-11
changelog:
  - Add race fixes needed when terminating a conflicting session
    on GDM greeter.
    Resolves: RHEL-92341


author: Felipe Borges <feborges@redhat.com> - 40.0.1-10
changelog:
  - Default power-button-action to poweroff on servers
    (except when power-button-action=nothing)
    Resolves: #1885639


author: Ray Strode <rstrode@redhat.com> - 40.0.1-13
changelog:
  - Revert hard dependency on subscription-manager since we're going to put it in gnome-session instead
    Related: #2175675


author: Ray Strode <rstrode@redhat.com> - 40.0.1-15
changelog:
  - Fix crashers in g-s-d and control-center related to
    making subscription-manager a soft dep
    Related: RHEL-20449


author: Felipe Borges <feborges@redhat.com> - 40.0.1-22
changelog:
  - Use mount path in "Low disk" notification when multiple mount points have same name
    Related: RHEL-11910


author: Joan Torres <joantolo@redhat.com> - 40.10-27
changelog:
  - session-opened signature is reverted to keep ABI compatibility,
    use session-opened-with-session-id instead
    Related: RHEL-92307


author: Joan Torres <joantolo@redhat.com> - 40.10-30
changelog:
  - Fix regression on multiple remote sessions and same user
    Also, add missing fix to keep API/ABI compatibility on GDM greeter proxy.
    Resolves: RHEL-109190


author: Joan Torres Lopez <joantolo@redhat.com> - 40.10-37
changelog:
  - Update passwordless GDM backport patch series
    Add required pre-changes and update post-changes
    Resolves: RHEL-236554


author: Milan Crha <mcrha@redhat.com> - 41.0-2
changelog:
  - Resolves: #2012699 (Backport changes from Fedora 35)
  - Add patch to mark compulsory only repos, not apps from it
  - Resolves: #2011176 (flathub repo can't be added through gnome-software)
  - Resolves: #2010660 (gs-repos-dialog: Can show also desktop applications)
  - Resolves: #2010353 (Optional repos cannot be disabled)
  - Resolves: #2010740 (Refresh on repository setup change)
  - Resolves: #2009063 (Correct update notifications)


author: Milan Crha <mcrha@redhat.com> - 41.5-2
changelog:
  - Resolves: #2128812 (Correct property name in GsRemovalDialog .ui file)
  - Resolves: #2129021 (Hide some errors in non-debug builds)


author: Debarshi Ray <rishi@fedoraproject.org> - 3.40.1-1
changelog:
  - Update to 3.40.1
  - Rebase the patches
  - Backport yet-to-be-released patches from upstream to avoid translation
    conflicts
  Resolves: #1959384


author: Jakub Jelen <jjelen@redhat.com> - 2.3.3-3
changelog:
  - Mark SHA-1 digest as weak to follow SHA-1 disablement in RHEL9 (#2070722)
  - Fix interaction with SSH by not requiring the MD5 digest (#2073567)
  - Fix creation of AEAD packets (#2128058)


author: Alexander Sosedkin <asosedkin@redhat.com> - 3.8.10-1
changelog:
  - Rebase to 3.8.10
  - Revert defaulting to PBMAC1 in FIPS mode
  - Revert unapproving 1024-, 1280-, 1536- and 1792-bit RSA verification


author: Alexander Sosedkin <asosedkin@redhat.com> - 3.8.10-3
changelog:
  - Fix PKCS#11 token initialization label overflow (CVE-2025-9820)
  - Fix name constraint processing performance issue (CVE-2025-14831)


author: Alexander Sosedkin <asosedkin@redhat.com> - 3.8.10-4
changelog:
  - Fix CVE-2026-33846 (DTLS fragment reassembly, High, heap overwrite)
  - Fix CVE-2026-42009 (DTLS fragment reassembly, High, undefined behaviour)
  - Fix CVE-2026-33845 (DTLS fragment reassembly, High, heap overread)
  - Fix CVE-2026-42010 (PSK authentication, High, authentication bypass)
  - Fix CVE-2026-3833 (Name constraints, Medium, name constraint bypass)
  - Fix CVE-2026-42011 (Name constraints, Medium, name constraint bypass)
  - Fix CVE-2026-42012 (CN fallback, Medium, certificate misuse)
  - Fix CVE-2026-42013 (CN fallback, Medium, certificate misuse)
  - Fix CVE-2026-42014 (PKCS#11 PIN change, Medium, use-after-free)
  - Fix CVE-2026-5260 (PKCS#11 RSA, Medium, heap overread)
  - Fix CVE-2026-42015 (PKCS#12 appending, Low, heap overwrite)
  - Fix CVE-2026-3832 (OCSP, Low, revocation bypass)
  - Fix CVE-2026-5419 (PKCS#7, Low, timing side-channel)
  - Fix upstream security issue #1808 (PSK rehandshake)
  - Fix upstream security issue #1810 (EKU OID prefix match)
  - Fix upstream security issue #1813 (pkcs11-provider persistent keys)
  - Fix upstream security issue #1818 (RSA correctness, OpenSSL format import)
  - Fix upstream security issue #1819 (PKCS#11 trust removal error path)
  - Fix upstream security issue #1822 (SCT extension parser OOB read)
  - Fix upstream security issue #1841 (key zeroization in hybrid kex)
  - Fix upstream security issue #1823 (malformed certtool template)
  - Fix upstream security issue #1817 (session parameter loading robustness)
  - Fix upstream security issue #1820 (PKCS#11 KDF succeeding w/o deriving)
  - gnutls-3.8.10-CVE-2025-9820.patch: update Makefile.in


author: Fedora Release Engineering <releng@fedoraproject.org> - 1.20.7-20
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
  - Add upstream commits for git master which contains patches 9, 10 and 11
  - Add GCC10 fix
  - Cleanups


author: Miroslav Lichvar <mlichvar@redhat.com> - 1:3.26.1-2
changelog:
  - fix buffer overflow in NMEA2000 driver (CVE-2025-67268)
  - fix integer underflow in handling of Navcom packets (CVE-2025-67269)


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-15
changelog:
  - Resolves RHEL-97518: Rework grafana-selinux spec file sections
  - Resolves RHEL-87861: Add additional SELinux rules for grafana-selinux package to allow LDAP connections


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-18
changelog:
  - Resolves RHEL-125696: CVE-2025-58183
  - Resolves RHEL-132757: Grafana-selinux prevents plugins from searching cgroups


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-20
changelog:
  - Resolves RHEL-144960: CVE-2026-21721
  - Resolves RHEL-145419: CVE-2025-61728
  - Resolves RHEL-146103: CVE-2025-61726
  - Resolves RHEL-149639: CVE-2025-68121


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-22
changelog:
  - Resolves RHEL-161804: CVE-2026-27877
  - Resolves RHEL-166346: CVE-2026-33810
  - Resolves RHEL-166703: CVE-2026-32282
  - Resolves RHEL-167390: CVE-2026-32280
  - Resolves RHEL-167696: CVE-2026-32283


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-23
changelog:
  - Resolves RHEL-183848: CVE-2026-39821
  - Resolves RHEL-191577: CVE-2026-27136
  - Resolves RHEL-188281: Remove Lua ExclusiveArch macro for Konflux build


author: Sam Feifer <sfeifer@redhat.com> - 5.1.1-15
changelog:
  - Resolves RHEL-166347: CVE-2026-33810
  - Resolves RHEL-166704: CVE-2026-32282
  - Resolves RHEL-167391: CVE-2026-32280
  - Resolves RHEL-167697: CVE-2026-32283


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.44.0-19
changelog:
  - Conditionalized guile support
    Resolves: rhbz#1953974
  - Updated RHEL macros
    Resolves: rhbz#1957653


author: Paul Whalen <pwhalen@fedoraproject.org> - 0.16.0-2
changelog:
  - Update src to greenboot-rs, binaries remain greenboot
  - Obsoletes/Conflicts for bash greenboot, Provides greenboot


author: Sayan Paul <saypaul@redhat.com> - 0.16.1
changelog:
  - Ensure rollback trigger runs before systemd-update-done and only on updates
  - Log the correct system type when reporting rollback decisions
  - Fix CI/tests (Ansible callback config, GI deps) to keep gating green
  - Refresh Packit release config for Fedora delivery


author: Sayan Paul <saypaul@redhat.com> - 0.16.2
changelog:
  - restrict manual restart of healthcheck service
  - fixed error while running healtcheck inside container
  - removed bootupd dependency
  - fixed CI tests


author: Sayan Paul <saypaul@redhat.com> - 0.16.4
changelog:
  - Fixed false warning on first time boot
  - Added detection of grub fallback on faulty kernel
  - Fixed red.d script stdout/stderr not logged 
  - Fixed CI tests


author: Wim Taymans <wtaymans@redhat.com> - 1.22.12-4
changelog:
  - Bump version
  - Apply patches for CVE-2024-47538, CVE-2024-47541, CVE-2024-47542,
    CVE-2024-47600, CVE-2024-47607, CVE-2024-47615, CVE-2024-47835
    Resolves: RHEL-70983, RHEL-71035, RHEL-70932, RHEL-71037
    Resolves: RHEL-71019, RHEL-70995, RHEL-71163


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-9
changelog:
  - Limit maximum fragmentation unit size in RTP H264/H265
    depayloaders to prevent excessive memory usage
    (CVE-2026-18649)


author: Wim Taymans <wtaymans@redhat.com> - 1.22.12-4
changelog:
  - Apply patches for CVE-2024-47537, CVE-2024-47539, CVE-2024-47540
    CVE-2024-47543, CVE-2024-47544, CVE-2024-47545, CVE-2024-47546,
    CVE-2024-47596, CVE-2024-47597, CVE-2024-47598, CVE-2024-47599,
    CVE-2024-47601, CVE-2024-47602, CVE-2024-47603, CVE-2024-47606,
    CVE-2024-47613, CVE-2024-47774, CVE-2024-47775, CVE-2024-47776,
    CVE-2024-47777, CVE-2024-47778, CVE-2024-47834
  - Resolves: RHEL-70958, RHEL-70971, RHEL-71033, RHEL-71195
  - Resolves: RHEL-71210, RHEL-71202, RHEL-71171, RHEL-71200
  - Resolves: RHEL-71206, RHEL-71173, RHEL-71198, RHEL-71204
  - Resolves: RHEL-71208, RHEL-71031, RHEL-71007, RHEL-71039
  - Resolves: RHEL-71169, RHEL-71192, RHEL-71161, RHEL-71167
  - Resolves: RHEL-71189


author: Yaakov Selkowitz <yselkowi@redhat.com> - 1.22.8-2
changelog:
  - Enable asfdemux, dvdlpcmdec, dvdsub, and realmedia plugins
  - Disable AMR plugins in RHEL builds
  - Resolves: rhbz#2236889


author: Daniel P. Berrangé <berrange@redhat.com> - 1.2.0-1
changelog:
  - Update to 1.2.0 release
  - Drop outdated conditionals
  - Drop outdated ldconfig script
  - Use versioned obsoletes tags
  - Resolves: rhbz#1949474


author: Kalev Lember <klember@redhat.com> - 2.24.33-3
changelog:
  - Drop imsettings dependency on Fedora as well
  - Recommend libcanberra-gtk2 for sound theme events in gtk2 apps


author: Matthias Clasen <mclasen@redhat.com> - 4.12.3-3
changelog:
  - Stop using objcopy for resources
    Resolves: RHEL-186555
  - Add missing quotes
    Resolves: RHEL-178315


author: Kalev Lember <klember@redhat.com> - 4.1.2-1
changelog:
  - Update to 4.1.2
  - Disable gtk-doc support as we don't have gi-docgen in Fedora yet
  - Remove old obsoletes


author: Kalev Lember <klember@redhat.com> - 3.24.3-1
changelog:
  - Update to 3.24.3
  - Use https source URLs
  - Re-enable LTO now that we have upstream fix in place (#1898054)
  - Switch to meson build system
  - Tighten soname globs


author: Tom Stellard <tstellar@redhat.com> - 5.3.3-3
changelog:
  - Fix warning building with clang
  - non-void function 'stp_paths_copy_with_prefix' should return a value [-Wreturn-type]


author: Jindrich Novy <jnovy@redhat.com> - 6:0.7.4-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.7.4
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 6:0.7.5-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.7.5
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 6:0.8.0-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.0
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 6:0.8.1-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.1
  - Resolves: RHEL-69761


author: Jindrich Novy <jnovy@redhat.com> - 6:0.8.2-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.2
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 6:0.8.3-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.3
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 6:0.8.4-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.4
  - Resolves: RHEL-83036


author: Jindrich Novy <jnovy@redhat.com> - 6:0.8.5-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.5
  - Related: RHEL-80816


author: Jindrich Novy <jnovy@redhat.com> - 6:0.8.6-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.6
  - Related: RHEL-80816


author: Jindrich Novy <jnovy@redhat.com> - 6:0.8.7-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.7
  - Resolves: RHEL-112184


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-100
changelog:
  - fence_ibm_powervs: update description of api-type parameter to show
    correct default value
    Resolves: RHEL-114753


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-85
changelog:
  - fence_azure_arm: use azure-identity instead of msrestazure, which has
    been deprecated
    Resolves: RHEL-76493


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-87
changelog:
  - fence_ibm_vpc: refresh bearer-token if token data is corrupt, and
    avoid edge-case of writing empty token file
    Resolves: RHEL-83255


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-88
changelog:
  - fence_compute/fence_evacuate: dont use deprecated inspect.getargspec()
    Resolves: RHEL-84448
  - fence_sbd: get devices from SBD_DEVICE env variable if devices
    parameter isnt set
    Resolves: RHEL-79798


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-16
changelog:
  - fence_openstack: add support for reading config from clouds.yaml
    and openrc
    Resolves: rhbz#2041933, rhbz#2041935


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-22
changelog:
  - all agents: unify ssl parameters to avoid having to use --ssl when
    using --ssl-secure/--ssl-insecure for some agents
    Resolves: rhbz#2072420
  - fence_gce: update fence agent
    Resolves: rhbz#2079889


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-23
changelog:
  - fence_ibm_vpc: remove unused instance parameter and make limit
    optional
    Resolves: rhbz#2081235


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-25
changelog:
  - all agents: unify ssl parameters to avoid having to use --ssl when
    using --ssl-secure/--ssl-insecure for some agents
    Resolves: rhbz#2072420


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-27
changelog:
  - fence_ibm_powervs: add support for proxy, private API servers and
    get token via API key
    Resolves: rhbz#2093216


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 2.4.22-4
changelog:
  - Always clear retry flags in read/write functions to avoid CPU
    usage spikes
  - Fix "unable to load certificate chain from file" issue
    Resolves: RHEL-71925, RHEL-68780


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 2.8.14-2
changelog:
  - Add tmpfiles.d file to make systemd-tmpfiles create/set correct
    ownership/permissions of /var/lib/haproxy
    Resolves: RHEL-120178


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 2.8.14-4
changelog:
  - Fix uint16_t overflow in FCGI demux record length (CVE-2026-55203)
    Resolves: RHEL-211066
  - Fix NULL pointer dereference in hpack_dht_insert() (CVE-2026-55204)
    Resolves: RHEL-211074


author: Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-6
changelog:
  - Resolves:rh#2103849 CVE-2022-33068
    harfbuzz: integer overflow in the component hb-ot-shape-fallback.c


author: Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-7
changelog:
  - Resolves:rh#2103849 CVE-2022-33068
  - Fix Covscan compiler warning for inclusion of parenthesis
  - Update tests.yaml


author: Filip Januš <fjanus@redhat.com> - 1.5-1
changelog:
  - Nwe upstream version 1.5
  - Add patch to solve inconsistency between configure.ac and filename
  - Add Build requirement autoconf


author: Davide Caratti <dcaratti@redhat.com> - 2.9-15
changelog:
  - Disable 'badfuncs' in rpminspect tests
  - Build with -fPIE, and enable verbose build log
  - enable CONFIG_SUITEB192


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.20.11-4
changelog:
  - 1912147 - Enable matching for '<model>_series' drivers in PPD search algorithm
  - rework optional gui messages


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.20.11-5
changelog:
  - 1925259 - %pre scriptlet enables and starts cups.service, which is unnecessary
  - 1919556 - hp-fab crashed: QFileDialog.getOpenFileName is not used correctly


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.21.2-7
changelog:
  - CVE-2026-8632 hplip: HPLIP: Privilege escalation and arbitrary code execution
    via operating system command injection [rhel-9.9]


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.21.2-8
changelog:
  - CVE-2026-8631 hplip: HPLIP: Arbitrary code execution and privilege escalation via integer overflow in hpcups


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-3
changelog:
  - Resolves: RHEL-68660 - RewriteRule proxying to UDS (unix domain socket)
    configured in .htaccess doesn't work on httpd-2.4.62-1


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-4
changelog:
  - Resolves: RHEL-66488 - Apache HTTPD no longer parse PHP files with unicode
    characters in the name


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-7
changelog:
  - Resolves: RHEL-99815 - stickysession field does not work when specifying
    it in the query parameter after upgrade to 9.5
  - Resolves: RHEL-99953 - httpd: HTTP Session Hijack via a TLS
    upgrade (CVE-2025-49812)
  - Resolves: RHEL-99968 - httpd: access control bypass by trusted
    clients is possible using TLS 1.3 session resumption (CVE-2025-23048)
  - Resolves: RHEL-99977 - httpd: insufficient escaping of user-supplied
    data in mod_ssl (CVE-2024-47252)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-8
changelog:
  - Resolves: RHEL-114501 Image mode: The dir /var/www is not created when
    updating system in image mode


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-9
changelog:
  - Resolves: RHEL-105446 - mod_proxy_hcheck may stop healthchecks after a child
    process is reclaimed


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-10
changelog:
  - Resolves: RHEL-119000 - mod_ssl: allow more fine grained SSL SNI vhost check
    to avoid unnecessary 421 errors after CVE-2025-23048 fix
  - mod_ssl: add conf.d/snipolicy.conf to set 'SSLVHostSNIPolicy authonly' default


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-12
changelog:
  - Resolves: RHEL-135064 - httpd: Apache HTTP Server: mod_userdir+suexec bypass
    via AllowOverride FileInfo (CVE-2025-66200)
  - Resolves: RHEL-135049 - httpd: Apache HTTP Server: CGI environment variable
    override (CVE-2025-65082)
  - Resolves: RHEL-134481 - httpd: Apache HTTP Server: Server Side Includes adds
    query string to #exec cmd=... (CVE-2025-58098)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-14
changelog:
  - Resolves: RHEL-173563 - httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary
    code execution via heap-based buffer overflow (CVE-2026-28780)
  - Resolves: RHEL-175078 - httpd: NULL pointer dereference can cause a child
    process crash (CVE-2026-33007)
  - Resolves: RHEL-175099 - httpd: off-by-one out-of-bounds reads in AJP getter
    functions (CVE-2026-33857)
  - Resolves: RHEL-175035 - httpd: heap-based buffer over-read due to missing
    null-termination check (CVE-2026-34032)
  - Resolves: RHEL-175063 - httpd: heap-based buffer over-read and memory
    disclosure in ajp_parse_data() (CVE-2026-34059)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-15
changelog:
  - Resolves: RHEL-192753 - mod_proxy_html regression in CVE-2026-34355 fix
  - Resolves: RHEL-186226 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
    via malicious backend servers (CVE-2026-34356)
  - Resolves: RHEL-182580 - httpd: incomplete fix
    for CVE-2023-38709 (CVE-2024-42516)
  - Resolves: RHEL-186187 - httpd: mod_proxy_html buffer handling
    vulnerability (CVE-2026-34355)
  - Resolves: RHEL-175632 - httpd: mod_dav_lock uses wrong lock discovery
    (CVE-2026-29169)
  - Resolves: RHEL-186189 - mod_xml2enc: fix bblen accounting in fix_skipto
    (CVE-2026-42536)
  - Resolves: RHEL-186156 - httpd: fix OCSP write buffer advancement
    bug in mod_ssl (CVE-2026-44185)
  - Resolves: RHEL-191249 - httpd: Apache HTTP Server: Out-of-bounds Read in
    mod_headers and mod_mime (CVE-2026-43951)
  - Resolves: RHEL-193128 - httpd: Apache HTTP Server: Denial of Service in
    mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186)
  - Also addresses CVE-2026-24072, CVE-2026-33006, CVE-2026-42535, CVE-2026-44119


author: Peter Robinson <pbrobinson@fedoraproject.org> - 4.2-2
changelog:
  - Move eeprog to i2c-tools (shouldn't have been in eepromer sub package)
  - Drop/obsolete eepromer subpackage, deprecated for 6 years
  - Drop python2 conditionals
  - Minor cleanups


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.11-10
changelog:
  - Replace kasumi with kausmi-unicode
  - Delete to require intltool
  - Delete to call gettext.bind_textdomain_codeset()


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.24-5
changelog:
  - Fix covscan reviews. Related: rhbz#1963071

  - Implement ibus_im_context_set_surrounding_with_selection()


author: Mike FABIAN <mfabian@redhat.com> - 1.4.2-1
changelog:
  - Update to  1.4.2
  - New translations: tr (Turkish) 100%, uk (Ukrainian) 100%,
    id (Indonesian) 100%, ja_JP (Japanese) 100%.
  - Translation updates: zh_CN, pt_BR


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 5.2.1-1
changelog:
  - Rebase to JSS 5.2.1
  - Bug 2100807 - pki-tomcat/kra unable to decrypt when using RSA-OAEP padding in RHEL9 with FIPS enabled


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 5.3.0-0.3.beta2
changelog:
  - Rebase to JSS 5.3.0-beta2
  - Bug 2017098 - pki pkcs12-cert-add command failing with 'Unable to validate PKCS #12 file: Digests do not match' exception


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 11.3.0-1
changelog:
  - Rebase to PKI 11.3.0
  - Bug #2091993 - IdM Install fails on RHEL 8.5 Beta when DISA STIG is applied
  - Bug #2122409 - pki-tomcat/kra unable to decrypt when using RSA-OAEP padding in RHEL9 with FIPS enabled


author: Jeff Law <law@redhat.com> - 2.3.0-3
changelog:
  - Touch a couple autoconf related files to prevent undesired rebuilding
    if %configure changes one or more configure files.


author: Miguel Martín <mmartinv@redhat.com> - 2.19.0-3
changelog:
  - Update ignition-edge commit to support FIPS
      - https://github.com/fedora-iot/ignition-edge/pull/2


author: Yasmin Valim <ydesouza@redhat.com> - 2.21.0-1
changelog:
  - Re-sync with upstream changes adding ignition-grub subpackage
    and a few minor changes
  - New release


author: Kamal Heib <kheib@redhat.com> - 46.0-1
changelog:
  - Rebase to upstream release v46.0
  - Resolves: rhbz#2159650, rhbz#2167513, rhbz#2170367, rhbz#2189721 rhbz#2209688


author: Kamal Heib <kheib@redhat.com> - 57.0-1
changelog:
  - Rebase to upstream release v57.0
  - Resolves: RHEL-76570, RHEL-45644, RHEL-72077, RHEL-68506, RHEL-94449


author: Kamal Heib <kheib@redhat.com> - 60.0-1
changelog:
  - Rebase to upstream release v60.0
  - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331


author: Kamal Heib <kheib@redhat.com> - 60.0-2
changelog:
  - bump release to rebuild in sidetag
  - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331


author: Kamal Heib <kheib@redhat.com> - 60.0-3
changelog:
  - bump release to rebuild in sidetag
  - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331


author: Kamal Heib <kheib@redhat.com> - 61.0-1
changelog:
  - Rebase to upstream release v61.0
  - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-22
changelog:
  - Resolves: RHEL-107483 ipa-ca-install fails on CA-less replica due to inadequate key usage in master certificate


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-24
changelog:
  - Resolves: RHEL-118448 CVE-2025-7493 ipa: Privilege escalation from host to domain admin in FreeIPA


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-25
changelog:
  - Resolves: RHEL-128238 [RFE] Support storing LWCA private keys on an HSM [rhel-9]
  - Resolves: RHEL-126515 RFE: Enable external password reset agents to use ipa_pwd_extop in RHEL IdM [rhel-9]
  - Resolves: RHEL-73399 RFE: Update IdM password policy configurations to meet M-22-09 by restricting spaces and require number character class
  - Resolves: RHEL-128241 ATTR_NAME_BY_OID is missing OID 2.5.4.97, organizationIdentifier [rhel-9]
  - Resolves: RHEL-126514 [RFE] ipa-client-automount should have an option to include domain of the machine. [rhel-9]
  - Resolves: RHEL-124171 Include latest fixes in python3-ipatests package 
  - Resolves: RHEL-120514 Include fixes in python3-ipatests [rhel-9.8]
  - Resolves: RHEL-118609 test_cacert_manage fails due to expired Let's Encrypt R3 certificate


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.0-1
changelog:
  - Resolves: RHEL-134542 Add modern WebUI as submodule and enable routing in Apache 
  - Resolves: RHEL-134540 Switch IPA to use the PKI python API directly rather than RPC calls
  - Resolves: RHEL-134196 After upgrade from 9.7 to 9.8 ipactl restart fails to restart winbind service 
  - Resolves: RHEL-132334 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-129224 Fix ipatests for kdcproxy after CVE-2025-59088 fix
  - Resolves: RHEL-126974 Minor typo in ipa_idrange_fix.py
  - Resolves: RHEL-120954 Rebase ipa to latest 4.13.x version for RHEL 9.8


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-1
changelog:
  - Resolves: RHEL-141446 [RFE] Command that retrieve and install new CA certificates
  - Resolves: RHEL-140584 Support replaceable WebUI artwork for RHEL and CentOS
  - Resolves: RHEL-141297 Memory leaks in IPA plugins
  - Resolves: RHEL-141054 IPA fails to sign zone
  - Resolves: RHEL-138570 AddressSanitizer: SEGV ipa-pwd-extop/common.c:584 in ipapwd_gen_checks
  - Resolves: RHEL-138473 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-137585 ipa-server-upgrade succeeds but ipactl restart fails due to ipa-dnskeysyncd service failure caused by SELinux AVC denial on RHEL 9.8


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-2
changelog:
  - RHEL-147191 ipa uninstallation is failing with message "'NoneType' object has no attribute 'lower'"
  - RHEL-146185 Names of domains from a trusted forest should be compared case-insentive
  - RHEL-146184 ipa-advise client script requires keytab (should just require root access on client system)
  - RHEL-145854 Include latest fixes in python3-ipatests package
  - RHEL-143684 When using xmlrpc, ipa server failed with assert type(value) in (unicode, float, int, bool, type(None))
  - RHEL-141500 ipa use systemd-sysusers


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-3
changelog:
  - RHEL-148282 ipa-replica-conncheck fails with "an internal error has occured"
  - RHEL-148481 Pruning is enabled by default with RSN on RHEL 9.8


author: David Hanina <dhanina@redhat.com> - 4.13.1-3.1
changelog:
  - Resolves: RHEL-166865 Include latest fixes in python3-ipatests package [rhel-9.8.z]
  - Resolves: RHEL-155037 Pagure #9953: Adding a group with 32Bit Idrange fails. [rhel-9.8.z]
  - Resolves: RHEL-153146 IdM password policy Min lifetime is not enforced when high minlife is set [rhel-9.8.z]
  - Resolves: RHEL-168047 ipa ca-show ipa --all failing to list RSN version


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-20
changelog:
  - Resolves: RHEL-106285 Incorrect use of external IdP GitHub trademark
  - Resolves: RHEL-106026 Include fixes in python3-ipatests package
  - Resolves: RHEL-105512 kdb: prevent double crash in RBCD ACL free
  - Resolves: RHEL-101707 ipatests: use "sos report" instead of "sosreport" command
  - Resolves: RHEL-101544 ipa-client-encrypted-dns does not ensure bind-utils >= 9.18 for DoT-compatible nsupdate
  - Resolves: RHEL-100450 eDNS: multiple issues during encrypted DNS setup


author: David Hanina <dhanina@redhat.com> - 4.13.2-1
changelog:
  - Resolves: RHEL-166742 [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL9.9]
  - Resolves: RHEL-151581 Pagure #9948: Extend SELinux policy to allow use of SSSD authentication helpers on non-enrolled hosts [rhel-9]
  - Resolves: RHEL-151560 ipa-migrate doesn't process users' sshpublickeys [rhel-9]
  - Resolves: RHEL-179216 ipa-migrate tool is renaming host records & host info in automount information [RHEL 9.9]
  - Resolves: RHEL-212442 freeipa-client %triggerin and %post can fail (rpm scriptlets should never fail, by policy) [rhel-9]
  - Resolves: RHEL-212443 ipa-migrate doesn't properly handle replication conflicts [rhel-9]
  - Resolves: RHEL-212444 ipa-migrate doesn't migrate IPA locations [rhel-9]
  - Resolves: RHEL-212445 Pagure #9948: Extend SELinux policy to allow use of SSSD authentication helpers on non-enrolled hosts [rhel-9]
  - Resolves: RHEL-212446 [RFE] X-Content-Type-Options header in IdM WebUI [rhel-9]
  - Resolves: RHEL-212447 [RFE] Implement Referrer-Policy on IdM WebUI [rhel-9]
  - Resolves: RHEL-212448 [RFE] CSP not implemented in IdM WebUI [rhel-9]
  - Resolves: RHEL-212449 IPA compatibility with tomcat 10 [rhel-9]
  - Resolves: RHEL-212450 Webui 3007 Requirement error "userCertificate" is required (not allowing certificate management for idview) [rhel-9]
  - Resolves: RHEL-212451 To add "SameSite" flag to ipa_session cookies [rhel-9]
  - Resolves: RHEL-212452 FreeIPA JSON-RPC CSRF Referer Validation Uses Naive Prefix Match - [rhel-9]
  - Resolves: RHEL-212471 Pagure #9820: ipalockout_postop is incorrectly warning about locked user [rhel-9]
  - Resolves: RHEL-178920 Rebase ipa to latest version for RHEL 9.9


author: Václav Doležal <vdolezal@redhat.com> - 1.8.18-18
changelog:
  - Backport patch to autoselect best cipher suite when working over lanplus backend
  - Fixed 'ipmitool pef status/info' not printing final newline
  - Expanded column for sensor name in 'ipmi sdr/sensor' output so longer names are aligned


author: Václav Doležal <vdolezal@redhat.com> - 1.8.18-19
changelog:
  - Backport fix for CVE-2020-5208 (#1798722); for details see
    https://github.com/ipmitool/ipmitool/security/advisories/GHSA-g659-9qxw-p7cp


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.18-26
changelog:
  - Backport upstream PR 120 to fix segfault on invalid unit types
    Resolves: rhbz#2224578
  - Add vendor ID for NVIDIA BMCs
    Resolves: rhbz#2218358
  - Update /var/run to /run in ipmievd.service that systemd warns about
    Resolves: rhbz#2100475
  - Add upstream ipmievd patch to check received msg id against expectation
    Fixes problem where SEL response is not recognized correctly
    when SEL request times out
    Resolves: rhbz#2224569


author: Jan Macku <jamacku@redhat.com> - 20210202-10
changelog:
  - arping: Fix 1s delay on exit for unsolicited arpings (RHEL-34110)
  - arping: exit 0 if running in deadline mode and we see replies (RHEL-27718)
  - ping: Print reply with wrong source with warning & some follow-up fixes (RHEL-12789, RHEL-13480)
  - ping: Fix socket error reporting (RHEL-4608)


author: Jan Macku <jamacku@redhat.com> - 20210202-12
changelog:
  - Fix CVE-2025-47268 iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping (RHEL-94334)


author: Marian Koncek <mkoncek@redhat.com> - 2.3.3-4
changelog:
  - Avoid possible NullPointerException
  - Resolves: rhbz#1993889
  - Load native library from the correct location
  - Resolves: rhbz#1994935


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-5
changelog:
  - Allow the default keystore to be configured using security.systemCACerts
  - Use of the property can now be disabled using -Dsecurity.systemCACerts=
  - Move cacerts replacement to install section and retain original of this and tzdb.dat
  - Resolves: rhbz#2077006


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b07-0.2.ea
changelog:
  - Update to shenandoah-jdk8u352-b07 (EA)
  - Update release notes for shenandoah-8u352-b07.
  - Switch to EA mode for 8u352 pre-release builds.
  - Rebase FIPS patch against 8u352-b07
  - Resolves: rhbz#2130623


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-2
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - Switch to GA mode for final release.
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Add test to ensure timezones can be translated
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b01-0.3.ea
changelog:
  - Update to shenandoah-jdk8u362-b01 (EA)
  - Update release notes for shenandoah-8u362-b01.
  - Switch to EA mode for 8u362 pre-release builds.
  - Drop JDK-8195607/PR3776/RH1760437 now this is upstream
  - Related: rhbz#2150196


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b07-0.3.ea
changelog:
  - Update to shenandoah-jdk8u362-b07 (EA)
  - Update release notes for shenandoah-8u362-b07.
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Drop tzdata patches for 2022d & 2022e (JDK-8294357 & JDK-8295173) which are now upstream
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Resolves: rhbz#2150196


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b08-3
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - Fix broken links and missing release notes in older releases.
  - Drop RH1163501 patch which is not upstream or in 11, 17 & 19 packages and seems obsolete
    - Patch was broken by inclusion of "JDK-8293554: Enhanced DH Key Exchanges"
    - Patch was added for a specific corner case of a 4096-bit DH key on a Fedora host that no longer exists
    - Fedora now appears to be using RSA and the JDK now supports ECC in preference to large DH keys
  - Resolves: rhbz#2160111


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b09-3
changelog:
  - Update cacerts patch to fix OPENJDK-1433 SecurityManager issue
  - Update to shenandoah-jdk8u352-b09 (GA)
  - Update release notes for shenandoah-8u352-b09.
  - Resolves: rhbz#2162714


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b09-4
changelog:
  - On portable architectures, replace build section with extraction of existing builds from portables
  - Rewrite ELF files so the source file path is correct and debugsources can be assembled
  - Resolves: rhbz#2150202


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b09-4
changelog:
  - Drop use of portable build on s390x due to libffi compatibility issue (needs libffi.so.6)
  - Related: rhbz#2150202


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b05-0.2.ea
changelog:
  - Update to 8u442-b05 (EA).
  - Update release notes for 8u442-b05.
  - Switch to EA mode for pre-release.
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-73990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b05-0.3.ea
changelog:
  - Add zero_arches to the portable_build_arches now that the portable build bundles libffi
  - Temporarily workaround libffi.so not being in lib/%{archinstall} by copying it
  - Exclude libffi.so from the debugedit run
  - Add a simple -version check on both the JDK and JRE bin/java
  - Add libffi.so to the filelist, including expanding the lib/%{archinstall} contents as with jre/lib
  - Sync the copy of the portable specfile and new patches with the latest update
  - Resolves: RHEL-74302


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b06-2
changelog:
  - Update to 8u442-b06 (GA)
  - Update release notes for 8u442-b06.
  - Switch to GA mode for final release
  - Revise JDK-8141590 backport to install libffi.so* in lib as well as jre/lib
  - Sync the copy of the portable specfile with the latest update
  - Remove libffi.so copying workaround now the portable build installs it in lib
  - Add bundled libffi.so to _privatelibs
  - Remove libffi.so copy if we are building on the same platform as the portable
  - Resolves: RHEL-73554
  - Related: RHEL-74302


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b06-3
changelog:
  - Bump rpmrelease for CentOS build
  - Related: RHEL-73554
  - Related: RHEL-74302
  - Related: RHEL-73990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.452.b09-2
changelog:
  - Update to 8u452-b09 (GA)
  - Update release notes for 8u452-b09.
  - Remove long option documentation from JDK-8335912/JDK-8337499 as not present in 8u
  - Require tzdata 2025a due to upstream inclusion of JDK-8347965
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-04-15 @ 1pm PT. **
  - Resolves: RHEL-86967
  - Resolves: RHEL-86620


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.462.b08-3
changelog:
  - Update to 8u462-b08 (GA)
  - Update release notes for 8u462-b08.
  - Require tzdata 2025b due to upstream inclusion of JDK-8352716
  - Add early backport of JDK-8339414
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
  - Resolves: RHEL-101648
  - Resolves: RHEL-102312
  - Resolves: RHEL-97496


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.462.b08-4
changelog:
  - Bump rpmrelease for CentOS build
  - Remove obsolete hack to hardcode newer portable version on RHEL
  - Related: RHEL-101648
  - Related: RHEL-102312
  - Related: RHEL-97496


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.462.b08-5
changelog:
  - Update get_bundle_versions.sh to match other scripts
  - * get_bundle_versions.sh: Add license
  - * get_bundle_versions.sh: Set compile-command in Emacs
  - * get_bundle_versions.sh: Use different error codes for different failures
  - * get_bundle_versions.sh: Remove unneeded '.' in JPEG version
  - * get_bundle_versions.sh: shellcheck: Double-quote variable references (SC2086)
  - * get_bundle_versions.sh: shellcheck: Drop use of cat and pass file to awk directly (SC2002)
  - Add OpenJDK 8u support to get_bundle_versions.sh
  - Print bundle updates and backouts at end of openjdk_news.sh output
  - Refer user to get_bundle_versions.sh when bundle updates are found by openjdk_news.sh
  - Add timezone data update check to openjdk_news.sh
  - Add duplicate check to openjdk_news.sh
  - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-119329


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.472.b08-1
changelog:
  - Update to 8u472-b08 (GA).
  - Update release notes for 8u472-b08.
  - Drop local JDK-8339414 fix as this is now included upstream
  - Reset rpmrelease to 1 now there are no other RPM builds on RHEL 9
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. **
  - Resolves: RHEL-118767
  - Resolves: RHEL-119455


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.472.b08-2
changelog:
  - Bump rpmrelease for CentOS build
  - Add scripts to handle tagging of portable-based RPMs
  - Related: RHEL-118767
  - Related: RHEL-119455
  - Related: RHEL-118775


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.482.b08-1
changelog:
  - Update to 8u482-b08 (GA).
  - Update release notes for 8u482-b08.
  - Remove generated-configure.sh changes from JDK-8141590 & FIPS patch as we already autogenerate this
  - Turn on system FreeType as on later JDK versions and add to _privatelibs
  - Set bundled FreeType version to 2.13.2 following JDK-8316028
  - Bump LCMS 2 version to 2.14.0 following JDK-8297088
  - Bump libpng version to 1.6.51 following JDK-8372534
  - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT
  - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **
  - Resolves: RHEL-142687
  - Resolves: RHEL-139534
  - Resolves: RHEL-131588
  - Resolves: RHEL-131600
  - Resolves: RHEL-142875
  - Resolves: RHEL-142697


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.482.b08-2
changelog:
  - Bump rpmrelease for CentOS build
  - Related: RHEL-142687
  - Related: RHEL-139534
  - Related: RHEL-131588
  - Related: RHEL-131600
  - Related: RHEL-142875
  - Related: RHEL-142697


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.482.b08-3
changelog:
  - Update tagging scripts to include signature checks and correctly handle gating
  - Add gating scripts to simplify obtaining results and waiving issues
  - Resolves: RHEL-147634
  - Resolves: RHEL-151197


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.492.b09-1
changelog:
  - Update to 8u492-b09 (GA)
  - Update release notes for 8u492-b09.
  - Add missing CVEs for 8u482.
  - Regenerate JDK-8199936/PR3533 patch following JDK-8374917
  - Regenerate JDK-8186464/RH1433262 patch following JDK-8370986
  - Drop local giflib 5.2.2 patch now JDK-8328999 is included upstream
  - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158
  - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078
  - Bump LCMS 2 version to 2.15.0 following JDK-8303482
  - Bump libpng version to 1.6.57 following JDK-8375063, JDK-8377526, JDK-8380959 & JDK-8382047
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
  - Resolves: RHEL-169446
  - Resolves: RHEL-133291
  - Resolves: RHEL-147348
  - Resolves: RHEL-148407
  - Resolves: RHEL-148981
  - Resolves: RHEL-161303
  - Resolves: RHEL-161452
  - Resolves: RHEL-157139
  - Resolves: RHEL-157156


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.492.b09-3
changelog:
  - Add attempted patch for JDK-8385876 to fix -Wnonnull build failure with s390x Zero on CentOS 9
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-212095


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:1.8.0.502.b07-1.1
changelog:
  - Make headless own /usr/share/doc/java-1.8.0-openjdk
  - Make javadoc-zip own /usr/share/javadoc/java-1.8.0-openjdk
  - Do not overwrite slowdebug __provides_exclude_from and __requires_exclude_from regexps
  - Resolves: RHEL-212327
  - Resolves: RHEL-212328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.502.b07-1.1
changelog:
  - Update to 8u502-b07 (GA).
  - Update release notes for 8u502-b07.
  - Bump lcms2 version to 2.19.1 following JDK-8321489, JDK-8348110, JDK-8375065 & JDK-8383354
  - Bump zlib version to 1.3.2 following JDK-8378631
  - Require tzdata 2026b due to upstream inclusion of JDK-8383175
  - Add attempted patch for JDK-8385876 to fix -Wnonnull build failure with s390x Zero on CentOS 9
  - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file
  - Explictly define supported architectures
  - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field
  - Make zone string debug output optional in TestTranslations
  - Change javadoc-zip to just own the top-level directory, not include the entire subtree
  - Update tagged versions to include 9.8.0-z & 9.9.0.
  - Cleanup tagging and gating scripts to appease shellcheck:
  - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg.
  - * scripts/builds/check_signatures.sh: Quote variable usage.
  - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage.
  - * scripts/builds/waive_leapp_issue.sh: Likewise.
  - * scripts/builds/waive_rpminspect.sh: Likewise.
  - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable.
  - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage.
  - Obsolete old RHEL releases (8.2.0-z, 9.0.0-z, 9.7.0-z)
  - Sync the copy of the portable specfile with the latest update
  - Sync portable naming with later JDKs, due to adoption of <compatiblename> by portable
  - Drop <pversion> which is a redundant alias for version now
  - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. **
  - Resolves: RHEL-212095
  - Resolves: RHEL-188852
  - Resolves: RHEL-149784
  - Resolves: RHEL-212316
  - Resolves: RHEL-212318
  - Related: RHEL-212327
  - Resolves: RHEL-212329
  - Resolves: RHEL-212330


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.502.b07-1.2
changelog:
  - Bump release for PQC build
  - Related: RHEL-212095
  - Related: RHEL-188852
  - Related: RHEL-149784
  - Related: RHEL-212316
  - Related: RHEL-212318
  - Related: RHEL-212329
  - Related: RHEL-212330
  - Related: RHEL-212327
  - Related: RHEL-212328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.504.b01-1.1
changelog:
  - Update to 8u504-b01 (GA).
  - Update release notes for 8u504-b01.
  - Bump FreeType version to 2.14.3 following JDK-8385390
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. **
  - Resolves: RHEL-235603


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.504.b01-1.2
changelog:
  - Add CVEs for August 2026 release
  - Bump release for PQC build
  - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. **
  - Related: RHEL-235603


author: Francisco Ferrari Bihurriet <fferrari@redhat.com> - 1:11.0.15.0.10-3
changelog:
  - RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode
  - Resolves: rhbz#2102434


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.10-4
changelog:
  - Rebase FIPS patches from fips branch and simplify by using a single patch from that repository
  - * RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
  - * RH2090378: Revert to disabling system security properties and FIPS mode support together
  - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
  - Enable system security properties in the RPM (now disabled by default in the FIPS repo)
  - Improve security properties test to check both enabled and disabled behaviour
  - Run security properties test with property debugging on
  - Resolves: rhbz#2099839
  - Resolves: rhbz#2100676


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.16.0.7-0.1.ea
changelog:
  - Add additional patch during tarball generation to align tests with ECC changes
  - Related: rhbz#2083325


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.0.7-0.1.ea
changelog:
  - Update to jdk-11.0.16+7
  - Update release notes to 11.0.16+7
  - Switch to EA mode for 11.0.16 pre-release builds.
  - Use same tarball naming style as java-17-openjdk and java-latest-openjdk
  - Drop JDK-8257794 patch now upstreamed
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Make use of the vendor version string to store our version & release rather than an upstream release date
  - Explicitly require crypto-policies during build and runtime for system security properties
  - Resolves: rhbz#2083325


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.0.8-2
changelog:
  - Update to jdk-11.0.16+8
  - Update release notes to 11.0.16+8
  - Switch to GA mode for release
  - Resolves: rhbz#2106517


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.1.1-2
changelog:
  - Update to jdk-11.0.16.1+1
  - Update release notes to 11.0.16.1+1
  - Add patch to provide translations for Europe/Kyiv added in tzdata2022b
  - Add test to ensure timezones can be translated
  - Resolves: rhbz#2119528


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.1.1-3
changelog:
  - Switch to static builds, reducing system dependencies and making build more portable
  - Resolves: rhbz#2121275


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.2.ea
changelog:
  - Update to jdk-11.0.17+1
  - Update release notes to 11.0.17+1
  - Switch to EA mode for 11.0.17 pre-release builds.
  - Bump HarfBuzz bundled version to 4.4.1 following JDK-8289853
  - Bump FreeType bundled version to 2.12.1 following JDK-8290334
  - Related: rhbz#2130619


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-2
changelog:
  - Update to jdk-11.0.17+8 (GA)
  - Update release notes to 11.0.17+8
  - Switch to GA mode for release
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Update CLDR data with Europe/Kyiv (JDK-8293834)
  - Drop JDK-8292223 patch which we found to be unnecessary
  - Update TestTranslations.java to use public API based on TimeZoneNamesTest upstream
  - The stdc++lib, zlib & freetype options should always be set from the global, so they are not altered for staticlibs builds
  - Remove freetype sources along with zlib sources
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.1-0.3.ea
changelog:
  - Update to jdk-11.0.18+1
  - Update release notes to 11.0.18+1
  - Switch to EA mode for 11.0.18 pre-release builds.
  - Drop local copies of JDK-8294357 & JDK-8295173 now upstream contains tzdata 2022e
  - Drop local copy of JDK-8275535 which is finally upstream
  - Related: rhbz#2150197


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.9-0.3.ea
changelog:
  - Update to jdk-11.0.18+9
  - Update release notes to 11.0.18+9
  - Drop local copy of JDK-8293834 now this is upstream
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Resolves: rhbz#2150197


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-3
changelog:
  - Update to jdk-11.0.18+10 (GA)
  - Update release notes to 11.0.18+10
  - Switch to GA mode for release
  - Resolves: rhbz#2160111


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-4
changelog:
  - On portable architectures, replace build section with extraction of existing builds from portables
  - Rewrite ELF files so the source file path is correct and debugsources can be assembled
  - Backport SHA-3 support for PKCS11 provider
  - Sync patch set with portable build we are using by removing rh1648644-java_access_bridge_privileged_security.patch
  - Resolves: rhbz#2150201


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-2
changelog:
  - Update to jdk-11.0.19.0+7
  - Update release notes to 11.0.19.0+7
  - Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Rebase FIPS support against 11.0.19+6
  - Rebase RH1750419 alt-java patch against 11.0.19+6
  - Replace local copies of JDK portable binaries with build dependencies
  - Use portable build on x86_32 now one is available
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182
  - Resolves: rhbz#2150201


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-3
changelog:
  - Revert "Restore native build for x86 as there is no portable build"
  - Reintroduce useful cleanups from x86 reversion
  - Adjust oj_vendor_version & oj_vendor_bug_url to match the portable so test passes
  - Related: rhbz#2150201


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-4
changelog:
  - Include the java-11-openjdk-portable.spec file with instructions on how to rebuild.
  - Related: rhbz#2150201


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-1
changelog:
  - Update to jdk-11.0.20.0+8 (GA)
  - Update release notes to 11.0.20.0+8
  - Drop local inclusion of JDK-8274864 & JDK-8305113 as they are included in 11.0.20+1
  - Bump tzdata requirement to 2023c now it is available in the buildroot
  - Bump bundled LCMS version to 2.15 as in jdk-11.0.20+1.
  - Bump bundled HarfBuzz version to 7.0.1 as in jdk-11.0.20+7
  - Use tapsets from the misc tarball
  - Introduce 'prelease' for the portable release versioning, to handle EA builds
  - Make sure root installation directory is created first
  - Use in-place substitution for all but the first of the tapset changes
  - Sync the copy of the portable specfile with the latest update
  - Add note at top of spec file about rebuilding
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2217715
  - Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-3
changelog:
  - Fix tzdata requirement copy-and-paste error that led to two BuildRequires and no Requires
  - Resolves: rhbz#2224420


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.1.1-1
changelog:
  - Update to jdk-11.0.20.1+1 (GA)
  - Add backport of JDK-8312489 already upstream in 11.0.22 (see OPENJDK-2095)
  - Add backport of JDK-8243210 already upstream in 11.0.21 (see RH2229269)
  - Update openjdk_news script to specify subdirectory last
  - Add missing discover_trees script required by openjdk_news
  - Resolves: rhbz#2236590


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.13.0.10-0.2.ea
changelog:
  - Vary portablesuffix depending on whether we are on RHEL ('el8') or CentOS ('el9')
  - Set rpmrelease to 2
  - Related: RHEL-58785


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.13.0.11-2
changelog:
  - Update to jdk-17.0.13+11 (GA)
  - Update .gitignore to ignore openjdk-17.0.13+11.tar.xz
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
  - Set buildver to 11
  - Set is_ga to 1
  - Update sources to openjdk-17.0.13+11.tar.xz
  - Resolves: RHEL-58785
  - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.13.0.11-4
changelog:
  - Set this to be the default/system JDK providing 'java', 'jre', 'java-devel', etc.
  - Set rpmrelease to 4
  - Resolves: RHEL-63034


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.14.0.1-0.2.ea
changelog:
  - Update to jdk-17.0.14+1 (EA)
  - Add to .gitignore openjdk-17.0.14+1-ea.tar.xz
  - Set updatever to 14
  - Set buildver to 1
  - Set rpmrelease to 2
  - Set is_ga to 0
  - Update sources to openjdk-17.0.14+1-ea.tar.xz
  - Double percent signs consistently throughout comments
  - Set bundled giflib provide version to 5.2.2
  - Set bundled libpng provide version to 1.6.43
  - Warn about bundled provide version bumps and backouts in openjdk_news.sh
  - Remove 0001-8332174-Remove-2-unpaired-RLO-Unicode-characters-in-.patch file
  - Revert: Use component in EPEL and Fedora bug URLs


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.14.0.7-2
changelog:
  - Update to jdk-17.0.14+7 (GA)
  - Add to .gitignore openjdk-17.0.14+7.tar.xz
  - Set buildver to 7
  - Set is_ga to 1
  - Update sources to openjdk-17.0.14+7.tar.xz
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
  - Resolves: RHEL-73981
  - Resolves: RHEL-73559
  - ** This tarball is embargoed until 2025-01-21 @ 1pm PT. **


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.15.0.6-2
changelog:
  - Update to jdk-17.0.15+6 (GA)
  - Add to .gitignore openjdk-17.0.15+6.tar.xz
  - Set updatever to 15
  - Set buildver to 6
  - Update sources to openjdk-17.0.15+6.tar.xz
  - Set bundled freetype provide version to 2.13.2
  - Set bundled harfbuzz provide version to 8.2.2
  - Require tzdata-java 2025a at runtime and for build
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
  - Update FIPS patch
  - Resolves: RHEL-86627
  - ** This tarball is embargoed until 2025-04-15 @ 1pm PT. **


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.16.0.8-2
changelog:
  - Update to jdk-17.0.16+8
  - Add to .gitignore openjdk-17.0.16+8.tar.xz
  - Set updatever to 16
  - Set buildver to 8
  - Set rpmrelease to 2
  - Update sources to openjdk-17.0.16+8.tar.xz
  - Resolves: RHEL-101788
  - Resolves: RHEL-101795
  - Resolves: RHEL-101796
  - Resolves: RHEL-101797
  - Resolves: RHEL-102283
  - Resolves: RHEL-102286
  - Resolves: RHEL-102285
  - Resolves: RHEL-102284
  - Require tzdata-java 2025b at runtime and for build
  - Set bundled freetype provide version to 2.13.3
  - Set bundled harfbuzz provide version to 10.4.0
  - Set bundled lcms2 provide version to 2.17.0
  - Set bundled libpng provide version to 1.6.47
  - Recommend pipewire
  - Related: RHEL-102667
  - Resolves: RHEL-102669
  - Resolves: RHEL-102670
  - Resolves: RHEL-102672
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
  - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.17.0.10-1
changelog:
  - Update to jdk-17.0.17+10 (GA)
  - Add to .gitignore openjdk-17.0.17+10.tar.xz
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
  - Set updatever to 17
  - Set buildver to 10
  - Set rpmrelease to 1, remove 'must start at 2' comment
  - Set bundled harfbuzz version to 11.2.0
  - Update sources to openjdk-17.0.17+10.tar.xz
  - Resolves: RHEL-119458
  - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. **


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.18.0.7-0.1.ea
changelog:
  - Update to jdk-17.0.18+7 (EA)
  - Add to .gitignore openjdk-17.0.18+7-ea.tar.xz
  - Set updatever to 18
  - Set buildver to 7
  - Set is_ga to 0
  - Update sources to openjdk-17.0.18+7-ea.tar.xz
  - Set bundled libpng version to 1.6.51
  - Resolves: RHEL-131590
  - Resolves: RHEL-131601
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.18.0.8-1
changelog:
  - Update to jdk-17.0.18+8 (GA)
  - Add to .gitignore openjdk-17.0.18+8.tar.xz
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
  - Set buildver to 8
  - Set is_ga to 1
  - Update sources to openjdk-17.0.18+8.tar.xz
  - Resolves: RHEL-139552
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.18.0.8-2
changelog:
  - Set rpmrelease to 2
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-centos-9
  - Set fipsver to e1780dd5d39
  - Resolves: RHEL-122136


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.18.0.8-2
changelog:
  - Add test to ensure blocked.certs is valid (OPENJDK-4362)
  - Restore NEWS file so portable can be rebuilt
  - Resolves: RHEL-149327


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.18.0.8-2
changelog:
  - Set portablerelease to 2
  - Remove test to ensure blocked.certs is valid, done in portable
  - Related: RHEL-122136
  - Related: RHEL-131590
  - Related: RHEL-131601
  - Related: RHEL-139552
  - Related: RHEL-149327


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.19.0.10-1
changelog:
  - Update to jdk-17.0.19+10 (GA)
  - Add to .gitignore openjdk-17.0.19+10.tar.xz
  - Set updatever to 19
  - Set buildver to 10
  - Set rpmrelease to 1
  - Update sources to openjdk-17.0.19+10.tar.xz
  - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
  - Set tzdata requires and build requires to 2026a
  - Set bundled freetype library version to 2.14.2
  - Set bundled giflib library version to 6.1.2
  - Set bundled harfbuzz library version to 12.3.2
  - Set bundled libpng library version to 1.6.57
  - Set bundled zlib library version to 1.3.2
  - Set fipsver to 62c0f885e30
  - Sync NEWS from openjdk-portable-rhel-8
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
  - Set portablerelease to 1
  - Resolves: RHEL-133292
  - Resolves: RHEL-147350
  - Resolves: RHEL-148408
  - Resolves: RHEL-148987
  - Resolves: RHEL-161296
  - Resolves: RHEL-161445
  - Resolves: RHEL-157135


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.20.0.8-1
changelog:
  - Update to jdk-17.0.20+8 (GA)
  - Add to .gitignore openjdk-17.0.20+8.tar.xz
  - Set updatever to 20
  - Set buildver to 8
  - Update sources to openjdk-17.0.20+8.tar.xz
  - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. **
  - Resolves: RHEL-188875


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.20.0.8-1.1
changelog:
  - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field (OPENJDK-4876)


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.20.0.8-1.1
changelog:
  - Set tzdata requires and build requires to 2026b
  - Set fipsver to 821eb26f706
  - Delete comments about patch macro syntax
  - Set bundled freetype version to 2.14.3
  - Set bundled giflib version to 6.1.3
  - Set bundled harfbuzz version to 14.2.0
  - Set bundled lcms2 version to 2.19.1
  - Set bundled libpng version to 1.6.58


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.1-0.1.ea
changelog:
  - Update get_bundle_versions.sh to match other scripts
  - * get_bundle_versions.sh: Add license
  - * get_bundle_versions.sh: Set compile-command in Emacs
  - * get_bundle_versions.sh: Use different error codes for different failures
  - * get_bundle_versions.sh: Remove unneeded '.' in JPEG version
  - * get_bundle_versions.sh: shellcheck: Double-quote variable references (SC2086)
  - * get_bundle_versions.sh: shellcheck: Drop use of cat and pass file to awk directly (SC2002)
  - Add OpenJDK 8u support to get_bundle_versions.sh
  - Print bundle updates and backouts at end of openjdk_news.sh output
  - Refer user to get_bundle_versions.sh when bundle updates are found by openjdk_news.sh
  - Related: RHEL-103209


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.2-0.1.ea
changelog:
  - Update to jdk-21.0.8+2 (EA)
  - Update release notes to 21.0.8+2
  - Sync the copy of the portable specfile with the latest update
  - Add timezone data update check to openjdk_news.sh
  - Add duplicate check to openjdk_news.sh
  - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh
  - Related: RHEL-101798
  - Resolves: RHEL-103209


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.8-0.1.ea
changelog:
  - Update to jdk-21.0.8+8 (EA)
  - Update release notes to 21.0.8+8
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-101798


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.7.0.6-3
changelog:
  - Recommend PipeWire on RHEL 9 and later for java.awt.Robot screenshots under Wayland
  - Resolves: RHEL-102677


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.9-1
changelog:
  - Update to jdk-21.0.8+9 (GA)
  - Update release notes to 21.0.8+9
  - Switch to GA mode
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
  - Resolves: RHEL-102289


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.9.0.10-1
changelog:
  - Update to jdk-21.0.9+10 (GA)
  - Update release notes to 21.0.9+10
  - Bump harfbuzz version to 11.2.0 following JDK-8355528
  - Add NEWS corrections from Thomas
  - Use double spacing consistently in notes for this release
  - Correct 11u release reference to corresponding 21u release as pointed out by Kieran
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. **
  - Resolves: RHEL-118774
  - Resolves: RHEL-119466


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.9.0.10-2
changelog:
  - Bump rpmrelease for CentOS build
  - Add scripts to handle tagging of portable-based RPMs
  - Related: RHEL-118774
  - Related: RHEL-119466


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.10.0.7-1
changelog:
  - Update to jdk-21.0.10+7 (GA)
  - Update release notes to 21.0.10+7
  - Bump libpng version to 1.6.51 following JDK-8372534
  - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT
  - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-142859
  - Resolves: RHEL-139560
  - Resolves: RHEL-131592
  - Resolves: RHEL-131602
  - Resolves: RHEL-122121
  - Resolves: RHEL-142820
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.10.0.7-2
changelog:
  - Bump rpmrelease for CentOS build
  - Related: RHEL-142859
  - Related: RHEL-139560
  - Related: RHEL-131592
  - Related: RHEL-131602
  - Related: RHEL-122121
  - Related: RHEL-142820


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.11.0.10-1
changelog:
  - Update to jdk-21.0.11+10 (GA)
  - Update release notes to 21.0.11+10
  - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336
  - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158
  - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078
  - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047
  - Bump zlib version to 1.3.2 following JDK-8378631
  - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
  - Resolves: RHEL-169609
  - Resolves: RHEL-133293
  - Resolves: RHEL-147352
  - Resolves: RHEL-148409
  - Resolves: RHEL-148992
  - Resolves: RHEL-157141
  - Resolves: RHEL-161305
  - Resolves: RHEL-161454
  - Resolves: RHEL-169616


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.11.0.10-1.3
changelog:
  - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm
  - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1
  - Do not overwrite slowdebug __provides_exclude_from and __requires_exclude_from regexps
  - Make headless own /usr/share/doc/java-1.8.0-openjdk
  - Make javadoc-zip own /usr/share/javadoc/java-1.8.0-openjdk
  - Resolves: RHEL-151167
  - Resolves: RHEL-212348
  - Resolves: RHEL-212349


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.12.0.8-1.1
changelog:
  - Update to jdk-21.0.12+8 (GA)
  - Update release notes to 21.0.12+8
  - Bump freetype version to 2.14.3 following JDK-8385390
  - Bump giflib version to 6.1.3 following JDK-8384902
  - Bump HarfBuzz version to 14.2.0 following JDK-8385490
  - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354
  - Bump libpng version to 1.6.58 following JDK-8384495
  - Update tagging scripts to include signature checks and correctly handle gating
  - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3.
  - Add gating scripts to simplify obtaining results and waiving issues
  - Cleanup tagging and gating scripts to appease shellcheck:
  - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg.
  - * scripts/builds/check_signatures.sh: Quote variable usage.
  - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage.
  - * scripts/builds/waive_leapp_issue.sh: Likewise.
  - * scripts/builds/waive_rpminspect.sh: Likewise.
  - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable.
  - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage.
  - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file
  - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field
  - Obsolete old RHEL releases (9.7.0-z, 10.1-z)
  - Make zone string debug output optional in TestTranslations
  - Change javadoc-zip to just own the top-level directory, not include the entire subtree
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. **
  - Resolves: RHEL-212332
  - Resolves: RHEL-212334
  - Resolves: RHEL-212336
  - Resolves: RHEL-151193
  - Resolves: RHEL-212341
  - Resolves: RHEL-188866
  - Resolves: RHEL-212345
  - Resolves: RHEL-212347
  - Related: RHEL-212349


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.12.0.8-1.2
changelog:
  - Bump release for PQC build
  - Related: RHEL-212332
  - Related: RHEL-212334
  - Related: RHEL-212336
  - Related: RHEL-151193
  - Related: RHEL-212341
  - Related: RHEL-188866
  - Related: RHEL-212345
  - Related: RHEL-212347
  - Related: RHEL-151167
  - Related: RHEL-212348
  - Related: RHEL-212349


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.12.0.8-2.1
changelog:
  - Add CVEs to NEWS file
  - Update to tarball with final changeset ID
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-188866


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.12.1.1-1.1
changelog:
  - Update to jdk-21.0.12.1+1 (GA)
  - Update release notes to 21.0.12.1+1
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. **
  - Resolves: RHEL-235625


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.7-1
changelog:
  - Update to jdk-21.0.4+7 (GA)
  - Update release notes to 21.0.4+7
  - Switch to GA mode.
  - Sync the copy of the portable specfile with the latest update
  - Add missing section headers in NEWS
  - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
  - Resolves: RHEL-47023


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.7-2
changelog:
  - Vary portablesuffix depending on whether we are on RHEL ('el8') or CentOS ('el9')
  - Handle debugedit being a separate package installed in /usr on RHEL/CentOS 10
  - Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
  - Related: RHEL-58797


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.9-0.2.ea
changelog:
  - Update to jdk-21.0.5+9 (EA)
  - Update release notes to 21.0.5+9
  - Switch to EA mode
  - Bump giflib version to 5.2.2 following JDK-8328999
  - Bump libpng version to 1.6.43 following JDK-8329004
  - Sync with RHEL 7 portable build:
    - Use ExclusiveArch over ExcludeArch
    - pkgos definition needs to be early enough to be used in portablesuffix
  - Make build scripts executable
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-58797
  - Resolves: RHEL-17191


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.10-2
changelog:
  - Update to jdk-21.0.5+10 (GA)
  - Update release notes to 21.0.5+10
  - Switch to GA mode.
  - Revert JDK-8327501 & JDK-8328366 backport until more mature.
  - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **
  - Resolves: RHEL-61344


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.10-3
changelog:
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **
  - Related: RHEL-61344


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.11-2
changelog:
  - Update to jdk-21.0.5+11 (GA)
  - Update release notes to 21.0.5+11
  - Remove local JDK-8327501 & JDK-8328366 backport as this is now upstream.
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-61344


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.11-3
changelog:
  - Transition to the devkit build by not defining pkgos
  - Exempt x86_64 from the static libs debuginfo test until portable uses an older DWARF version
  - Sync the copy of the portable specfile with the devkit version
  - Include the devkit specfile and patches
  - Document the devkit in README.md
  - Resolves: RHEL-74403


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.6.0.7-1
changelog:
  - Update to jdk-21.0.6+7 (GA)
  - Update release notes to 21.0.6+7
  - Sync the copy of the portable & devkit specfiles with the latest update
  - Include the latest devkit patches
  - Update README.md to list an easier way of disabling the devkit
  - ** This tarball is embargoed until 2025-01-21 @ 1pm PT. **
  - Resolves: RHEL-73562


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.7.0.6-1
changelog:
  - Update to jdk-21.0.7+6 (GA)
  - Update release notes to 21.0.7+6
  - Rebase FIPS support against 21.0.7+5
  - Require tzdata 2025a due to upstream inclusion of JDK-8347965
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-04-15 @ 1pm PT. **
  - Resolves: RHEL-86984
  - Resolves: RHEL-86635


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.7.0.6-2
changelog:
  - Add local version of JDK-8351500 for early interim release before 21.0.8
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-90309


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.1-0.1.ea
changelog:
  - Update to jdk-21.0.8+1 (EA)
  - Update release notes to 21.0.8+1
  - Bump freetype version to 2.13.3 following JDK-8348596
  - Bump harfbuzz version to 10.4.0 following JDK-8348597
  - Bump lcms2 version to 2.17.0 following JDK-8348110
  - Bump libpng version to 1.6.47 following JDK-8348598
  - Switch to EA mode
  - Drop JDK-8351500 local patch which is now available in 21.0.8+1 upstream
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-101798


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.1.0.8-1
changelog:
  - Create java-25-openjdk package based on java-21-openjdk
  - Update to jdk-25.0.1+8 (GA)
  - Update release notes with features of JDK 22, 23, 24 & 25
  - Mention finalisation JEP for features finalised in JDK 22, 23 & 24
  - Update release notes to 25.0.1+8
  - Update README file for java-25-openjdk
  - Make sure this is not the default/system JDK providing 'java', 'jre', 'java-devel' ,etc.
  - Remove 21u FIPS patch and disable use until we are ready for the 25 version
  - Adjust CLDR expectations in TestTranslations.java after JDK-8317979 started using tzdata values
  - Adjust TestTranslations.java to expect the same short name throughout for fr_FR and de_DE (bug?)
  - Remove references to libsystemconf.so and nss.fips.cfg from the 21u FIPS patch
  - Include static libraries in the vm_variant subdirectory after JDK-8307858 (libjvm.a)
  - Flip equals test in TestSecurityProperties.java to handle null values from Security.getProperty
  - Introduce crypto_policy_active to designate whether we should expect policy adherence in testing
  - Flip crypto_policy_active to false while the crypto policy & FIPS patch is not present
  - Handle new libsimdsort.so introduced on x86_64 only by JDK-8309130
  - Remove lible.so handling following its removal in JDK-8327476: "Upgrade JLine to 3.26.1"
  - Install jaxp-strict.properties.template added by JDK-8330542: "Template for Creating Strict JAXP Configuration File"
  - alt-java man page installation is now handled by the OpenJDK build
  - Adjust TestTranslations.java with updated German translations from CLDR 46 (JDK-8333582) (Mountain->Mountains)
  - Run javap with the disassembled code (-c) option now required for -l by JDK-8345145
  - Remove default.policy and java.policy following JDK-8338411: "Permanently Disable the Security Manager"
  - Make man page handling dependent on pandoc being available during the portable build
  - Handle new CDS archive variants (*_coh*) added by Compact Object Headers (JDK-8305895)
  - Add missing man page alternatives for jdeprscan, jfr, jhsdb, jimage, jlink & jmod and fix alphabetical ordering
  - Support jnativescan added by JDK-8317611: "Add a tool like jdeprscan to find usage of restricted methods"
  - Add recent native libraries to _privatelibs (libjsvml.so, libsimdsort.so, libsyslookup.so)
  - Support libsleef on AArch64 & RISC-V added by JDK-8329816, JDK-8320500 (RISC-V) & JDK-8312425 (AArch64)
  - Remove superfluous backslashes that cause two alternative commands to be combined
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-126022


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:25.0.1.0.8-1
changelog:
  - Add libnssadapter.so
  - Add FIPS crypto-policies configuration
  - Remove obsolete security.useSystemPropertiesFile setup
  - Update TestSecurityProperties.java test and calling convention
  - Resolves: RHEL-128414
  - Resolves: RHEL-128412


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.1.0.8-1
changelog:
  - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS
  - Patch the nssadapter build to recognise LDFLAGS
  - Resolves: RHEL-131898


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:25.0.1.0.8-2
changelog:
  - Add java-25-openjdk-crypto-adapter subpackage
  - Update library setting in create-redhat-properties-files.bash
  - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties
  - Resolves: RHEL-132520
  - Resolves: RHEL-132523


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.1.0.8-2
changelog:
  - Incorporate new FIPS patch for 25u
  - Drop static libjvm.a following adjusted build target for portable build
  - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image
  - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-133743
  - Resolves: RHEL-133737
  - Related: RHEL-131898


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-1
changelog:
  - Update to jdk-25.0.2+10 (GA)
  - Update release notes to 25.0.2+10
  - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3
  - Bump libpng version to 1.6.51 following JDK-8372534
  - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch
  - Test for java.security's existence in create-redhat-properties-files.bash
  - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **
  - Resolves: RHEL-139577
  - Resolves: RHEL-143373
  - Resolves: RHEL-143368
  - Resolves: RHEL-142856
  - Resolves: RHEL-142808


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-2
changelog:
  - Bump rpmrelease for CentOS build
  - Related: RHEL-139577
  - Related: RHEL-142856
  - Related: RHEL-142808


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-3
changelog:
  - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown
  - Fix FIPS issue list to represent the new 25u version
  - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3
  - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3
  - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3
  - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526
  - Bump harfbuzz version to 12.3.2 following JDK-8375057
  - Bump nssadapter version to bring in shared PKCS11 session fix
  - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1
  - Add tagging scripts with signature checks and gating handling
  - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3.
  - Add gating scripts to simplify obtaining results and waiving issues
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-155001
  - Resolves: RHEL-147354
  - Resolves: RHEL-148410
  - Resolves: RHEL-148997
  - Resolves: RHEL-155047
  - Resolves: RHEL-155330
  - Resolves: RHEL-156036
  - Resolves: RHEL-156040


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:25.0.2.0.10-3
changelog:
  - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm
  - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1
  - Resolves: RHEL-149786


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.3.0.9-1
changelog:
  - Update to jdk-25.0.3+9 (GA)
  - Update release notes to 25.0.3+9
  - Update FIPS patch to 57722aab802 version synced with 25.0.3+8
  - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream
  - Drop local HarfBuzz patch now JDK-8375057 is included upstream
  - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158
  - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078
  - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047
  - Bump zlib version to 1.3.2 following JDK-8378631
  - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
  - Resolves: RHEL-169619
  - Resolves: RHEL-157142
  - Resolves: RHEL-157154
  - Resolves: RHEL-161306
  - Resolves: RHEL-161455
  - Resolves: RHEL-169615


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.3.0.9-3.1
changelog:
  - Cleanup tagging and gating scripts to appease shellcheck:
  - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg.
  - * scripts/builds/check_signatures.sh: Quote variable usage.
  - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage.
  - * scripts/builds/waive_leapp_issue.sh: Likewise.
  - * scripts/builds/waive_rpminspect.sh: Likewise.
  - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable.
  - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage.
  - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file
  - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field
  - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-155330
  - Related: RHEL-156040
  - Resolves: RHEL-149785
  - Resolves: RHEL-211047
  - Resolves: RHEL-211051


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:25.0.3.0.9-3.2
changelog:
  - Add family option with name argument to alternatives install lines (OPENJDK-4854)
  - Resolves: RHEL-211053


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.4.0.7-1.1
changelog:
  - Update to jdk-25.0.4+7 (GA)
  - Update release notes to 25.0.4+7
  - Bump freetype version to 2.14.3 following JDK-8385390
  - Bump giflib version to 6.1.3 following JDK-8384902
  - Bump HarfBuzz version to 14.2.0 following JDK-8385490
  - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354
  - Bump libpng version to 1.6.58 following JDK-8384495
  - Require tzdata 2026b due to upstream inclusion of JDK-8383175
  - Drop local copy of JDK-8375294 EOPNOTSUPP patch
  - Obsolete old RHEL releases (9.7.0-z, 10.1-z)
  - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed
  - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269)
  - Make zone string debug output optional in TestTranslations
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. **
  - Resolves: RHEL-188880
  - Resolves: RHEL-212293
  - Resolves: RHEL-212297


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.4.0.7-2.1
changelog:
  - Add CVEs to NEWS file
  - Update to tarball with final changeset ID
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-188880


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.4.1.1-1.1
changelog:
  - Update to jdk-25.0.4.1+1 (GA)
  - Update release notes to 25.0.4.1+1
  - Report pkgos value during build
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. **
  - Resolves: RHEL-235632


author: Orion Poplawski <orion@nwra.com> - 0.19-3
changelog:
  - Use autoreconf -f to remove rpath
  - Use --disable-static to disable static builds
  - Use current make macros


author: Jiri Vanek <jvanek@redhat.com> - 0.2-0.1.20210701c15dd4c
changelog:
  - criu-devel moved to BR
  - now requires criu-libs
  - enabled debuginfo generation
  - excluded i686 build as criu is 64b only
  - .so file moved out of jar. Required teo patches:
  - added and applied patch0 output_loc.patch
  - added and applied patch1 load_library.patch
  - on aarch64 workarounded missing lib64 on /usr/LD_LIBRARY_PATH


author: Andrew Hughes <gnu.andrew@redhat.com> - 0.2-0.3.20210802a3007aa
changelog:
  - Rewrite to use autotools build system, avoiding need for Maven dependencies missing in RHEL 9.
  - This also ensures use of the standard build flags and installs the jar in the expected location.
  - Resolves: rhbz#1972029


author: Andrew Hughes <gnu.andrew@redhat.com> - 0.2-0.4.20210807b2d3751
changelog:
  - Update to latest upstream version with renamed package and consistent use of "jigawatts"
  - Drop library patch which is no longer needed.
  - Resolves: rhbz#1972029


author: Andrew Hughes <gnu.andrew@redhat.com> - 1.0~SNAPSHOT^20210827.a5f8e31-1
changelog:
  - Store the upstream version (currently "1.0-SNAPSHOT") and snapshot info completely in the Version field rather than using Release.
  - Resolves: rhbz#1972029


author: Andrew Hughes <gnu.andrew@redhat.com> - 1.21.0.0.0-4
changelog:
  - Bump release number to make RHEL 9.1 build later than RHEL 9 Beta & RHEL 9 GA builds
  - Resolves: rhbz#2071920


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 5.0.2-1
changelog:
  - Rebase to JSS 5.0.2
  - Bug 2029838 - SHA1withRSA being listed in signing certificates while approving certificate via Agent page in browser


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 5.0.3-1
changelog:
  - Rebase to JSS 5.0.3
  - Bug 2046023 - CVE-2021-4213 jss: memory leak in TLS connection leads to OOM [rhel-9.0]


author: Zamir SUN <zsun@fedoraproject.org> - 0-0.17.20191127gitbd56a60
changelog:
  - Workaround "multiple definition of `yyin'"
  - Resolves https://bugzilla.redhat.com/show_bug.cgi?id=1799559


author: Cestmir Kalina <ckalina@redhat.com> - 0.24
changelog:
  - Fix annocheck failures
  - Fix osci tier0 test reference
  - Fix ET_DYN vmlinux namespace support
  - Resolves: rhbz#2038913
  - Resolves: rhbz#2045976
  - Resolves: rhbz#2038892


author: Akira TAGOH <tagoh@redhat.com> - 2.5-35
changelog:
  - Drop gtk2 dependency completely.
  - Make anthy build conditionally for Fedora release only.
    Resolves: rhbz#1939777
  - Fix build fail without anthy-devel.


author: Christine Caulfield <ccaulfie@redhat.com> - 2.2.8-6
changelog:
  - fix "Keepalived claims that blackhole route doesn't have interface and can't be tracked"
    Resolves: RHEL-40520


author: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 0.2.10-2
changelog:
  - Fix PCR 16 attestation failure when upgrading from pre-key-separation agent
  - Resolves: RHEL-213679


author: Vincent Mihalkovic <vmihalko@redhat.com> - 3:1.0.6-1
changelog:
  - Rebase to non-beta version, because upstream says it should to be used
    https://github.com/ksh93/ksh/issues/667#issuecomment-1653665697
  - fix acl test case regression
    Resolves: #2034188


author: Steve Dickson <steved@redhat.com> 0.10-0
changelog:
  - Initial package
  - Upstream contributions by:
      - Chuck Lever <chuck.lever@oracle.com>
      - Hannes Reinecke <hare@suse.de>
      - Jeff Layton <jlayton@kernel.org>
      - Benjamin Coddington <bcodding@redhat.com>
      - David Härdeman <david@hardeman.nu>
      - Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
      - Moritz "WanzenBug" Wanzenböck <moritz.wanzenboeck@linbit.com>


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.0-2
changelog:
  - Rebuild with openssl3, presumably in a buildroot with xmlsec1
    linked against openssl3
  - Resolves: rhbz#1962052 - lasso: Port to OpenSSL 3.0


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.0-4
changelog:
  - Resolves: rhbz#1935987 - lasso implements and/or uses the deprecated
                             SHA-1 algorithm by default


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.0-5
changelog:
  - Don't run configure twice
  - Resolves: rhbz#1935987 - lasso implements and/or uses the deprecated
                             SHA-1 algorithm by default


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.0-7
changelog:
  - Fix dead code issue
  - Resolves: rhbz#1966606: CVE-2021-28091 lasso: XML signature wrapping
                            vulnerability when parsing SAML responses


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.0-6
changelog:
  - Resolves: rhbz#1984822 - lasso: FTBFS in test suite due to short test
                             timeout (potentially OpenSSL-related)


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.0-9
changelog:
  - Bump the test timeout again
  - Related: rhbz#1984822 - lasso: FTBFS in test suite due to short test
                             timeout (potentially OpenSSL-related)


author: Tomas Halman <thalman@redhat.com> - 2.7.0-12
changelog:
  - Fixing CVE-2025-47151
    Resolves: RHEL-126685 CVE-2025-47151 lasso: Type confusion in Entr'ouvert Lasso


author: Petr Menšík <pemensik@redhat.com> - 1.7.1-2
changelog:
  - Use make_build and make_install macro instead of make
  - https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make


author: Richard Lescak <rlescak@redhat.com> - 1.7.1-9
changelog:
  - Fix for CVE-2020-19860 ldns: heap overread vulnerability (#2051211)
  - Added also patch for deprecated distutils Python module used in build


author: Fedor Vorobev <fvorobev@redhat.com> - 1.7.1-13
changelog:
  - Fix CVE-2026-10846: Off-path poisoning attacks due to insufficient
    query-response matching (RHEL-210699)


author: Michal Ruprich <mruprich@redhat.com> - 4.9.2-8
changelog:
  - Adding a timeout for TLS close
  - Resolves: RHEL-113471 - "cannot seek on data source" in TLS lftp sessions


author: José Expósito <jexposit@redhat.com> - 1.7.0-9
changelog:
  - Fix CVE-2023-43785: out-of-bounds memory access in _XkbReadKeySyms()
  - Fix CVE-2023-43786: stack exhaustion from infinite recursion in
    PutSubImage()
  - Fix CVE-2023-43787: integer overflow in XCreateImage() leading to
    a heap overflow


author: RHEL Packaging Agent <jotnar@redhat.com> - 1.8.12-1
changelog:
  - Rebase to version 1.8.12
  - Update license to MIT AND X11 (SPDX migration)
  - Change source format from .tar.bz2 to .tar.xz
  - Add libtool as BuildRequires
  - Remove CVE patches (now included upstream)
  - Add patch to lower autoconf requirement to 2.69
  - Update dont-forward-keycode-0.patch for new codebase
  - Remove NEWS from %doc (file not present in 1.8.12)
  - Resolves: RHEL-111537


author: Olivier Fourdan <ofourdan@redhat.com> - 2.0.3-13
changelog:
  - CVE fix for: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003
    Resolves: https://redhat.atlassian.net/browse/RHEL-191874
    Resolves: https://redhat.atlassian.net/browse/RHEL-191934
    Resolves: https://redhat.atlassian.net/browse/RHEL-191935


author: Peter Hutterer <peter.hutterer@redhat.com> - 3.5.13-8
changelog:
  - Fix CVE-2022-46285: infinite loop on unclosed comments (#2160230)
  - Fix CVE-2022-44617: runaway loop with width of 0 (#2160232)
  - Fix CVE-2022-4883: compression depends on $PATH (#2160242)


author: José Expósito <jexposit@redhat.com> - 3.5.13-9
changelog:
  - CVE-2023-43786 libX11: stack exhaustion from infinite recursion
    in PutSubImage()
  - CVE-2023-43787 libX11: integer overflow in XCreateImage() leading to
    a heap overflow
  - CVE-2023-43788 libXpm: out of bounds read in XpmCreateXpmImageFromBuffer()
  - CVE-2023-43789 libXpm: out of bounds read on XPM with corrupted colormap


author: Tomas Popela <tpopela@redhat.com> - 1.42.2-1
changelog:
  - Initial RHEL packaging based on Fedora package with rpmautospec disabled,
    disabled documentation (no gi-docgen in RHEL 9) and downstream patch to
    be able to compile with glib2 2.68 (thanks to Milan Crha)
  - Resolves: RHEL-3234


author: Richard Hughes <richard@hughsie.com> 0.7.16-1
changelog:
  - Update to 0.7.15
  - Add UPL short name to SPDX conversion
  - Allow parsing desktop files using as_app_parse_data()
  - Do not preserve restrictive permissions when installing AppStream files
  - Modernize the validation requirements
  - Remove relative path from icon names
  - Support loading YAML from as_store_from_bytes()
  - Update list of allowed metadata licences
  - Update the SPDX license list to v3.5


author: Richard Hughes <richard@hughsie.com> 0.7.17-1
changelog:
  - New upstream release
  - Add "icon-theme" as recognised component type
  - Fix CI by moving 'future' back a bit
  - Make default content rating values match OARS semantics
  - Properly initialize unique_id_mutex


author: Richard Hughes <richard@hughsie.com> 0.7.18-1
changelog:
  - New upstream release
  - Add content rating system APIs from gnome-software
  - Add "validate-version" command
  - Allow timestamp in the future in validate-relax
  - Don't ignore localized strings that are the same as original
  - Fix crash with invalid children of <ul/>
  - Properly initialize mutexes
  - Test launchable tags in validation


author: Richard Hughes <richard@hughsie.com> 0.7.18-5
changelog:
  - Backport a patch from upstream to fix handling unknown tags in AppStream metadata
  - Resolves: #RHEL-28856


author: Stefan Hajnoczi <stefanha@redhat.com> - 1.2.2-1
changelog:
  - Import Fedora rpm 1.2.2-4 spec file with license updates (https://src.fedoraproject.org/rpms/libblkio/pull-request/1)


author: Stefan Hajnoczi <stefanha@redhat.com> - 1.2.2-2
changelog:
  - Remove 
  %setup       -q


  /usr/bin/git init -q
  /usr/bin/git config user.name "rpm-build"
  /usr/bin/git config user.email "<rpm-build>"
  /usr/bin/git config gc.auto 0
  /usr/bin/git add --force .
  /usr/bin/git commit -q --allow-empty -a\
  	--author "rpm-build <rpm-build>" -m "libblkio-1.3.0 base"


author: Stefan Hajnoczi <stefanha@redhat.com> - 1.2.2-2
changelog:
  - Remove 
  %setup       -q


  /usr/bin/git init -q
  /usr/bin/git config user.name "rpm-build"
  /usr/bin/git config user.email "<rpm-build>"
  /usr/bin/git config gc.auto 0
  /usr/bin/git add --force .
  /usr/bin/git commit -q --allow-empty -a\
  	--author "rpm-build <rpm-build>" -m "libblkio-1.5.0 base"


author: Vojtech Trefny <vtrefny@redhat.com> - 2.28-5
changelog:
  - Allow resizing of inactive LVs with latest LVM
    Resolves: rhbz#2161181
  - Fix test_swapon_pagesize on systems with 64k pages
    Resolves: rhbz#2168220


author: Tomas Bzatek <tbzatek@redhat.com> - 2.28-9
changelog:
  - nvme: HostID fixes for TP4126
    Resolves: RHEL-1375
  - nvme: Stack smashing fixes
    Resolves: RHEL-13127
    Resolves: RHEL-8037


author: Vojtech Trefny <vtrefny@redhat.com> - 2.2-1
changelog:
  - Require the same version of python3-bytesize in libbytesize-tools (v.podzimek)
  - src/gettext: fix warning if gettext is already present (giulio.benetti)
  - Update README.md (vpodzime)
  - fix build on shells where test == fails (tbier)
  - Add POT file to git and do not rebuild it during every build (vtrefny)


author: Vojtech Trefny <vtrefny@redhat.com> - 2.3-1
changelog:
  - Fix memory leak in bs_size_new_from_str (vtrefny)
  - Translated using Weblate (Turkish) (oguzersen)
  - add translation platform widget (jean-baptiste)
  - Update translation files (noreply)
  - Do not regenerate POT file during 'make release' (vtrefny)
  - Remove Zanata from our build and release processes (vtrefny)
  - Add PO files to git (vtrefny)
  - Sync spec with downstream (vtrefny)


author: Vojtech Trefny <vtrefny@redhat.com> - 2.4-1
changelog:
  - Add Travis build status badge (vtrefny)
  - Add Travis CI config and Dockerfiles for running tests (vtrefny)
  - Add ansible playbook for installing test dependencies (vtrefny)
  - remove msgcat dependency (Aduskett)
  - Translated using Weblate (Bengali (India)) (akarshan.biswas)
  - Update translation files (noreply)
  - Added translation using Weblate (Bengali (India)) (akarshan.biswas)
  - Fix library version in pkgconfig file (vtrefny)


author: Vojtech Trefny <vtrefny@redhat.com> - 2.5-1
changelog:
  - Translated using Weblate (Hebrew) (sh.yaron)
  - Added translation using Weblate (Hebrew) (sh.yaron)
  - Add support to ppc64le for debian build (74309971+gururajrkatti)
  - Translated using Weblate (Finnish) (ricky.tigg)
  - tools: Read input from stdin when not running in a tty (vtrefny)
  - travis: Print logs after failed tests (vtrefny)
  - tests: Run pylint and pycodestyle on bscalc (vtrefny)
  - bscalc: Add option to print only single "human readable" result (vtrefny)
  - travis: Add --nogpgcheck when using dnf on Fedora (vtrefny)
  - Translated using Weblate (Asturian) (fitoschido)
  - Update translation files (noreply)
  - Translated using Weblate (Spanish) (fitoschido)
  - Sync spec with downstream (vtrefny)


author: Filip Januš <fjanus@redhat.com> - 5.3.28-54
changelog:
  - Add db_converter into -utils subpackage
  - It allowes to convert BerkeleyDB database format to GDBM/LMDB format
  - Resolves: RHEL-35607


author: José Expósito <jexposit@redhat.com> - 2.4.123-2
changelog:
  - Revert upstream commit ffaa3ce144be ("2.4.122, Build Intel on all arches")
    libpciaccess is not available in RHEL 9 aarch64, ppc64le and s390x
    Resolves: https://issues.redhat.com/browse/RHEL-53869


author: Davide Caratti <dcaratti@redhat.com> - 0.41-2
changelog:
  - add gating test that uses acd-client.c. Related: rhbz#1973511
  - drop tests dependency on libell-devel. Related: rhbz#1973511


author: Jan Grulich <jgrulich@redhat.com> - 0.6.22-7
changelog:
  - Fix integer underflow in MakerNote decoding (CVE-2026-40386)
  - Fix integer overflow in Nikon MakerNote handling (CVE-2026-40385)
    Resolves: RHEL-170254, RHEL-170235


author: Michal Schmidt <mschmidt@redhat.com> - 1.15.1-1
changelog:
  - Update to upstream release 1.15.1
  - Disable LTO on x86_64 due to memory issues (copied from Fedora)
  - Resolves: rhbz#2040454


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-4
changelog:
  - Backport ppc hardware flags detection (#2051307)
  - Disable PKCS#1.5 encryption in FIPS mode (#2061328)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-5
changelog:
  - Allow signature verification with smaller RSA keys (#2083846)
  - Allow short salt for KDF (#2114870)
  - Reseed the kernel DRBG by using GRND_RANDOM (#2118695)
  - Address FIPS review comments around selftests (#2118695)
  - Disable RSA-OAEP in FIPS mode (#2118695)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-6
changelog:
  - Fix SHA3 digests with large inputs (#2129150)
  - Fix FIPS RSA PCT (#2128455)
  - Fix RSA FIPS Keygen that non-deterministically fails (#2130275)
  - Get max 32B from getrandom in FIPS mode (#2130275)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-7
changelog:
  - Properly enforce KDF limits in FIPS mode (#2130275)
  - Fix memory leak in large digest test (#2129150)
  - Fix function name FIPS service indicator by disabling PK encryption and decryption (#2130275)
  - Skip RSA encryption/decryption selftest in FIPS mode (#2130275)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-8
changelog:
  - Fix unneeded PBKDF2 passphrase length limitation in FIPS mode
  - Enforce HMAC key lengths in MD API in FIPS mode


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-9
changelog:
  - Avoid usage of invalid arguments sizes for PBKDF2 in FIPS mode
  - Do not allow large salt lengths with RSA-PSS padding
  - Disable X9.31 key generation in FIPS mode
  - Update the FIPS integrity checking code to upstream version
  - Update cipher modes FIPS indicators for AES WRAP and GCM
  - Disable jitter entropy generator


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-10
changelog:
  - Provide FIPS indicators for MD and HMACs
  - Improve PCT tests for ECDSA and always run them after key is generated
  - Add missing guards for FIPS status in md_sign/verify function
  - Provider FIPS indicators for public key operation flags


author: Kalev Lember <klember@redhat.com> - 0.12.2-2
changelog:
  - Remove no longer needed ldconfig_scriptlets macro call
  - Remove explicit byte compilation as the automatic works for flatpak builds now


author: Kalev Lember <klember@redhat.com> - 1.1.90-2
changelog:
  - Update to 1.1.90 and libhandy 1 ABI, based on earlier libhandy1 packaging
  - Obsolete separate libhandy1 and libhandy1-devel packages


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.19.3-6
changelog:
  - Add support for the Wacom Intuos Pro (RHEL-105483)
  - Rename existing patches for better order clarity


author: Robert Scheck <robert@fedoraproject.org> 1.5.2-5
changelog:
  - Don't ship API docs twice (devel and doc subpackages)
  - Reworked spec file to build libisoburn1 for RHEL >= 8


author: Michel Alexandre Salim <salimma@fedoraproject.org> - 0.5.0-3
changelog:
  - Minor fixes for Python 3.12 compatibility
  - Fix Python unit tests to use the right assert methods
  - Explicitly BR python3-setuptools


author: Sergio Correia <scorreia@redhat.com> - 9-6
changelog:
  - Define log callback function to use with libcryptsetup
    Logs from libcryptsetup now go to stderr and this prevents issues like
    the one reported in https://bugzilla.redhat.com/show_bug.cgi?id=1770395


author: Michal Ruprich <mruprich@redhat.com> - 1.4.3-1
changelog:
  - Update to 1.4.3
  - Resolves: #1758843 - libmaxminddb-devel i686 can't be installed in parallel to x86_64
  - Fix for CVE-2020-28241


author: Jerry James <loganjerry@gmail.com> - 1.1.0-5
changelog:
  - Make mpfr3 and mpfr3-devel subpackages
  - Drop the compat-libmpc package; nothing in Fedora needs it
  - Update project URL
  - Add a -doc subpackage to hold the GFDL-licensed content
  - Drop unnecessary texinfo BR
  - Drop ldconfig_scriptlets; this version cannot appear in distros that need it
  - Make sure there are no rpaths and that -Wl,--as-needed takes effect


author: Richard W.M. Jones <rjones@redhat.com> - 1.12.6-1
changelog:
  - Rebase to new stable branch version 1.12.6
    resolves: rhbz#2059288
  - New tool: nbddump
  - nbdcopy: Use preferred block size for copying
    related: rhbz#2047660
  - Fix remote TLS failures
    resolves: rhbz#2111524
    (and 2111813)


author: Richard W.M. Jones <rjones@redhat.com> - 1.20.2-2
changelog:
  - Rebase to libnbd 1.20.2
    resolves: RHEL-31883
  - Fix multiple flaws in TLS server certificate checking
    resolves: RHEL-49801
  - Print full NBD error from server
    resolves: RHEL-50665


author: Adrian Reber <areber@redhat.com> - 1.2-5
changelog:
  - Repack tarball to remove problematic license from unused code
  - Apply fixes for warnings found by gcc -fanalyzer


author: Adrian Reber <areber@redhat.com> - 1.2-7
changelog:
  - Apply upstream patch to fix 3 findings from static application security testing
    Resolves: RHEL-27656


author: Phil Sutter <psutter@redhat.com> - 1.0.0-22
changelog:
  - src: fix incorrect building and parsing of the NFCTH_POLICY_SETX attribute
  - examples: kill the "invalid argument" error in nftc-helper-add
  - examples: fix double free in nftc-helper-add
  - include: Sync with kernel headers
  - src: fix use after free


author: Thomas Haller <thaller@redhat.com> - 1.8.28-1
changelog:
  - Update to 1.8.28 release
  - move org.gnome.nm-applet.gschema.xml from network-manager-applet to here.
  - introduce wireless security dialogs


author: Ana Cabral <acabral@redhat.com> - 1.8.36-1
changelog:
  - Update to 1.8.36 release  (rh #2066742)
  - Include OWE wireless security (rh #2066737)
  - Fix OWE wireless security entry in Hidden Networks dialog (rh #2057512)


author: Michel Normand <normand@linux.vnet.ibm.com> 1.1.0-5
changelog:
  - Add remove_2_backslashes_in_shell_call.patch
    Add remove_eng_inc_in_version_pl.patch
    to avoid f33 build failure


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-13
changelog:
  - CVE-2025-64720: buffer overflow (RHEL-131594)
  - CVE-2025-65018: heap buffer overflow (RHEL-131603)
  - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133294)


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-14
changelog:
  - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-147356)
  - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-149000)


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-17
changelog:
  - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161456)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.5.30-16
changelog:
  - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161457)


author: Remi Collet <remi@remirepo.net> - 0.11.0-1
changelog:
  - update to 0.11.0
  - add patch to not install the static library, from
    https://github.com/alanxz/rabbitmq-c/pull/665


author: Neal Gompa <ngompa@datto.com> - 1.6.0-1
changelog:
  - Update to upstream 1.6.0
    resolves: rhbz#1883910
  - Enable all missing features
  - Fix linking to external lz4 library
  - Minor spec cleanups


author: Attila Lakatos <alakatos@redhat.com> - 1.10.0-4
changelog:
  - Replace GNUTLS_SHUT_RDWR by GNUTLS_SHUT_WR when ending TLS connections
    resolves: rhbz#1990735
  - Add patch to comply with crypto policies
  - Forward return code from relpEngineSetTLSLib to relpEngineSetTLSLibByName
  - Enable openssl
    resolves: rhbz#1972067


author: Attila Lakatos <alakatos@redhat.com> - 1.10.0-7
changelog:
  - Backport: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client connect path
    Resolves: RHEL-192631


author: Caolán McNamara <caolanm@redhat.com> - 1:7.1.8.1-8
changelog:
  - Resolves: rhbz#2134759 Untrusted Macros
  - Resolves: rhbz#2134757 Weak Master Keys
  - Resolves: rhbz#2134755 Static Initialization Vector
  - Resolves: rhbz#2134761 Macro URL arbitrary script execution


author: Stephan Bergmann <sbergman@redhat.com> - 1:7.1.8.1-11
changelog:
  - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula
    Parsing
  - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded
    without prompt via IFrame
  - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write


author: Tomas Popela <tpopela@redhat.com> - 1:7.1.8.1-16
changelog:
  - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in
    formula compilation
  - Resolves: RHEL-186057
  - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of
    the spec has
  - Resolves: RHEL-176582
  - ExcludeArch i686 for RHEL-9.* (was part of RHEL, but not brought to CentOS Stream)


author: Daiki Ueno <dueno@redhat.com> - 4.15-2
changelog:
  - Fix auto=ondemand connection initialization with TCP (RHEL-51879)
  - Make use of Netlink extack for additional error reporting (RHEL-51881)


author: Daiki Ueno <dueno@redhat.com> - 4.15-4
changelog:
  - pluto: fix refcounting of whack FD at CREATE_CHILD_SA request (RHEL-61461)
  - pluto: ignore CREATE_CHILD_SA request if crypto is in progress (RHEL-61461)


author: Daiki Ueno <dueno@redhat.com> - 4.15-9
changelog:
  - Backport fixes for CVE-2026-12413, CVE-2026-50721 and CVE-2026-50722 (RHEL-190120, RHEL-190125, RHEL-190155)


author: Sahana Prasad <sahana@redhat.com> - 4.9-5
changelog:
  - Just bumping up the version to include bugs for CVE-2023-2295. There is no
    code fix for it. Fix for it is including the code fix for CVE-2023-30570.
  - Fix CVE-2023-2295 Regression of CVE-2023-30570 fixes in the
    Red Hat Enterprise Linux
  - Resolves: rhbz#2189777, rhbz#2190148


author: Zdenek Dohnal <zdohnal@redhat.com> - 0.99.20-1
changelog:
  - 1900160 - sane-airscan-0.99.20 is available
  - 1897935 - Crash on libsane-airscan when trying to activate scanner


author: Neal Gompa <ngompa13@gmail.com> - 2.4.2-2
changelog:
  - Modernize spec
  - Backport fix for missing __SNR_ppoll symbol (#1777889)
  - Refresh patch to build on aarch64 with upstream version


author: Vit Mojzis <vmojzis@redhat.com> - 3.6-4
changelog:
  - Ignore files removed during relabeling (RHEL-123884)
  - Ignore directories removed during relabeling (RHEL-123884)


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 4.3.1-3
changelog:
  - Fix CVE-2020-29129 CVE-2020-29130 out-of-bounds access while processing ARP/NCSI packets
    rhbz#1902232


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 4.4.0-3
changelog:
  - Fix CVE-2021-3592 CVE-2021-3593 CVE-2021-3594 CVE-2021-3595 out-of-bounds access
    Resolves: rhbz#1970826 rhbz#1970839 rhbz#1970857 rhbz#1970847


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.31-6
changelog:
  - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985029)


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.72.0-9
changelog:
  - Add patches for CVE-2024-52530, CVE-2024-52531, and CVE-2024-52532
    Resolves: RHEL-67069
    Resolves: RHEL-67081


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.72.0-11
changelog:
  - Backport patches for various CVEs, plus test improvements
    Resolves: RHEL-85909
    Resolves: RHEL-85915
    Resolves: RHEL-85920
    Resolves: RHEL-87058
    Resolves: RHEL-87068
    Resolves: RHEL-87101
    Resolves: RHEL-87119
    Resolves: RHEL-88360
    Resolves: RHEL-88363


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.72.0-12
changelog:
  - Backport patches for various CVEs
    Resolves: RHEL-84797
    Resolves: RHEL-85888
    Resolves: RHEL-87080
    Resolves: RHEL-92284


author: Kalev Lember <klember@redhat.com> - 2.72.0-2
changelog:
  - Tighten soname globs
  - Avoid automatic requires on sysprof-devel package
  - Update required glib2 version


author: Kalev Lember <klember@redhat.com> - 2.72.0-5
changelog:
  - Don't try to avoid sysprof dep any more now that sysprof-capture-devel is
    split out to a separate subpackage


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-6
changelog:
  - Fix CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570 CVE-2022-3598
    CVE-2022-3627
  - Resolves: CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570
    CVE-2022-3598 CVE-2022-3627


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-8
changelog:
  - Fix CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804
    CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798 CVE-2023-0799
    CVE-2022-48281
  - Resolves: CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803
    CVE-2023-0804 CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798
    CVE-2023-0799 CVE-2022-48281


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-10
changelog:
  - Fix CVE-2023-26965 CVE-2023-3316 CVE-2023-26966 CVE-2023-3576
  - Resolves: CVE-2023-26965 CVE-2023-3316 CVE-2023-26966 CVE-2023-3576


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-11
changelog:
  - Fix CVE-2023-40090 CVE-2023-3618 CVE-2023-40745 CVE-2023-41175
  - Resolves: RHEL-5458 RHEL-5455 RHEL-5405 RHEL-5450


author: Michal Hlavinka <mhlavink@redhat.com> - 4.4.0-14
changelog:
  - fix CVE-2023-52356: libtiff could crash in TIFFReadRGBATileExt when parsing crafted tiff file (RHEL-17337)


author: Michal Hlavinka <mhlavink@redhat.com> - 4.4.0-16
changelog:
  - fix CVE-2025-9900: Out-of-Bounds Write in TIFFReadRGBAImageOriented (RHEL-112543)
  - fix CVE-2025-8176: use after free in tiffmedian (RHEL-120238)


author: Kalev Lember <klember@redhat.com> - 3.1.0~rc-3
changelog:
  - Obsolete libtracker-control and libtracker-miner
  - Add conflicts with tracker3 packages to help with the upgrade path


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.4-8
changelog:
  - iscsi: CHAP auth algorithm selection fixes (#2188916)
  - tests: Use stronger passphrases for LUKS tests (#2188750,#2188752)
  - integration-test: Fix scsi_debug cd drive read-only detection (#2211191)
  - lvm2: Improve uevent processing (#2031673)
  - tests: Mark test_job.UdisksJobTest.test_job as unstable (#2148844)


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.4-11
changelog:
  - udiskslinuxblockobject: Try issuing BLKRRPART ioctl harder
  - lvm2: Refactor udisks_daemon_util_lvm2_wipe_block()


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.4-1
changelog:
  - Version 2.9.4 (#2010363)
  - CVE-2021-3802: Harden the default mount options for ext filesystems (#2004423)
  - Fix double free on daemon exit (unaligned fastbin chunk) (#2001549)


author: Stefan Hajnoczi <stefanha@redhat.com> - 0.5-1
changelog:
  - Update license to GPL-2.0 OR MIT
  - Add io_uring_prep_epoll_ctl()
  - Add io_uring_get_probe(), io_uring_get_probe_ring()
  - Add io_uring_register_probe()
  - Add io_uring_{register,unregister}_personality()
  - Add io_uring_prep_{recv,send}()
  - Add io_uring_prep_openat2()
  - Add io_uring_ring_dontfork()
  - Add io_uring_prep_read() and io_uring_prep_write()
  - Documentation fixes and improvements


author: Stefan Hajnoczi <stefanha@redhat.com> - 0.6-1
changelog:
  - add io_uring_prep_splice()
  - add io_uring_prep_provide_buffers()
  - add io_uring_prep_remove_buffers()
  - add io_uring_register_eventfd_async()
  - reinstate io_uring_unregister_eventfd() (it was accidentally removed in 0.4)


author: Stefan Hajnoczi <stefanha@redhat.com> - 0.7-1
changelog:
  - Add io_uring_cq_eventfd_toggle() helper for new IORING_CQ_EVENTFD_DISABLED flag
  - Add IORING_OP_TEE
  - Documentation fixes and improvements


author: Jeff Moyer <jmoyer@redhat.com> - 2.12-1.el9
changelog:
  - Rebase to version 2.12.  Follow fedora and get rid of explicit %
    attr for library files
  - Resolves: RHEL-114115


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-3
changelog:
  - util: json: Increase JSON nesting limit when parsing to 300 (RHEL-135128)
  - virjsontest: Add test for nesting depth (RHEL-135128)
  - qemu_validate: Drop VIR_DOMAIN_HYPERV_SYNIC dependency on VIR_DOMAIN_HYPERV_VPINDEX (RHEL-138689)
  - qemu_validate: Drop VIR_DOMAIN_HYPERV_STIMER dependency on VIR_DOMAIN_HYPERV_VPINDEX (RHEL-138689)
  - esx_util: Introduce esxUtil_EscapeInventoryObject() (RHEL-134127)
  - esx: URI encode inventory objects twice (RHEL-134127)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-4
changelog:
  - qemuSecurityMoveImageMetadata: Move seclabels only to virStorageSource of same type (RHEL-140624)
  - qemuDomainSetThrottleGroup: Enforce non-zero 'groupname' string length (RHEL-144010)
  - qemuDomainSetBlockIoTuneField: Move setting of 'group_name' out of the loop (RHEL-144010)
  - qemuDomainSetThrottleGroup: Always honour thottle group name passed as argument (RHEL-144010)
  - qemuDomainSetThrottleGroup: Don't put group name into the 'tunable' event twice (RHEL-144010)
  - qemuSnapshotDiskHasBackingDisk: Avoid call of virStorageSourceIsSameLocation with NULL argument (RHEL-144090)
  - qemuSnapshotUpdateBackingStore: Remove stale comment (RHEL-144090)
  - qemuSnapshotDiskHasBackingDisk: Use proper 'max_depth' when calling 'virStorageSourceGetMetadata' (RHEL-144090)
  - virDomainSnapshotDefAssignExternalNames: Improve error message (RHEL-144090)
  - qemuSnapshotUpdateBackingStore: Retry as curent user if qemu-img fails (RHEL-144090)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-5
changelog:
  - qemublocktest: Iterate all nodenames in 'testQemuDetectBitmaps' (RHEL-145770)
  - qemu: monitor: Detect list of bitmaps from 'qcow2' format specific data (RHEL-145770)
  - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Fix check for existing bitmaps (RHEL-145770)
  - qemu: migration: Always offer block dirty bitmaps during migration (RHEL-145770)
  - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Always consider offered bitmaps (RHEL-145770)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-6
changelog:
  - qemu: Implement support for associating iommufd to hostdev (RHEL-126345)
  - qemu: Introduce privateData for hostdevs (RHEL-126345)
  - qemu: Support per-process memory accounting for iommufd (RHEL-126345)
  - qemu: open VFIO FDs from libvirt backend (RHEL-126345)
  - qemu: open iommufd FD from libvirt backend (RHEL-126345)
  - qemu: Update Cgroup, namespace, and seclabel for iommufd (RHEL-126345)
  - tests: qemuxmlconfdata: provide iommufd sample XML and CLI args (RHEL-126345)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-9
changelog:
  - qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices (RHEL-140614)
  - qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR (RHEL-140614)
  - RHEL-ONLY: backport test data for 'migrate-pr' capability of 'scsi-block' (RHEL-140614)
  - qemu: Implement support for persistent reservation migration control (RHEL-140614)
  - qemu: Extract disk setup done via QMP into a separate helper (RHEL-147866)
  - qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' (RHEL-147866)
  - qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' (RHEL-147866)
  - Expose latency histograms via 'virConnectGetAllDomainStats' (RHEL-147866)
  - qemu: monitor: Add handlers for 'block-latency-histogram-set' (RHEL-147866)
  - docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element (RHEL-147866)
  - docs: formatdomain: Reword section about the '<statistics>' element under disk driver (RHEL-147866)
  - Introduce support for disk operation latency histogram collection (RHEL-147866)
  - qemu: Setup disk latency histograms on startup/hotplug/update (RHEL-147866)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-10
changelog:
  - qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD (RHEL-150353)
  - qemu: Move IOMMUFD validation to qemu_validate (RHEL-150353)
  - util: Move openning IOMMU device to viriommufd (RHEL-150353)
  - qemu_process: Refactor qemuProcessOpenIommuFd (RHEL-150353)
  - util: Move openning VFIO device to virpci (RHEL-150353)
  - qemu_process: Refactor qemuProcessOpenVfioDeviceFd (RHEL-150353)
  - util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath (RHEL-150353)
  - conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD (RHEL-150353)
  - conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD (RHEL-150353)
  - qemu_domain: Add missing IOMMUFD cleanup (RHEL-150353)
  - qemu_process: Fix FD leak with multiple host devices using IOMMUFD (RHEL-150353)
  - qemu_process: Refactor qemuProcessOpenVfioFds (RHEL-150353)
  - qemuxmlconftest: Refactor host device preparation (RHEL-150353)
  - qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData (RHEL-150353)
  - qemuxmlconftest: Set fake FD for IOMMUFD (RHEL-150353)
  - qemu: Convert IOMMUFD to qemuFDPassDirect (RHEL-150353)
  - qemu: Convert vfioDeviceFd to qemuFDPassDirect (RHEL-150353)
  - qemu_command: Don't use host property if IOMMUFD is used (RHEL-150353)
  - qemu: Save IOMMUFD state into status XML (RHEL-150353)
  - qemu_hotplug: Remove iommufd object if no longer needed (RHEL-150353)
  - qemu_command: Extract building IOMMUFD props to function (RHEL-150353)
  - qemu_hotplug: Add support to hotplug host device with IOMMUFD (RHEL-150353)
  - conf: Introduce iommufd enum for domaincaps (RHEL-138544)
  - qemu: Fill iommufd domain capability (RHEL-138544)
  - tests: properly mock VFIO and IOMMU checks (RHEL-138544)
  - iommufd: fix FD leak in case of error (RHEL-150353)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-11
changelog:
  - domain_conf: initialize network hostdev private data (RHEL-151953)
  - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151953)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-13
changelog:
  - conf: Parse hyperv features even for host-model (RHEL-151688)
  - qemu: Wire up new hyperv host-model mode behavior (RHEL-151688)
  - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-153653)
  - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-153653)
  - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-153653)
  - docs: Clarify host-model description in domain capabilities (RHEL-153653)
  - qemu: Fix job handling when domain dies in post-copy migration (RHEL-145179)
  - security_apparmor: Use g_auto* in AppArmorSetSecurityHostdevLabel (RHEL-159902)
  - security: Cleanup hostdev label error logic (RHEL-159902)
  - qemu: Fix IOMMUFD and VFIO security labels (RHEL-159902)
  - viriommufd: Set IOMMU_OPTION_RLIMIT_MODE only when running privileged (RHEL-156803)
  - conf: Move and rename virStorageSourceFDTuple object (RHEL-156803)
  - conf: Refactor virHostdevIsPCIDevice (RHEL-156803)
  - hypervisor: Fix virHostdevNeedsVFIO detection (RHEL-156803)
  - qemu: Expand call to qemuDomainNeedsVFIO (RHEL-156803)
  - qemu: Update qemuDomainNeedsVFIO to ignore PCI hostdev with IOMMUFD (RHEL-156803)
  - src: Use virHostdevIsPCIDeviceWith* to check for IOMMUFD (RHEL-156803)
  - conf: Introduce domain iommufd element (RHEL-156803)
  - qemu: Implement iommufd (RHEL-156803)
  - conf: Add iommufd fdgroup support (RHEL-156803)
  - qemu: Implement iommufd fdgroup (RHEL-156803)
  - tests: Add iommufd fdgroup test (RHEL-156803)
  - hypervisor: Call virWaitForDevices() after detaching host devices (RHEL-156803)
  - qemuMigrationSrcBeginXML: Don't call 'qemuMigrationSrcBeginPhaseBlockDirtyBitmaps' with offline VM (RHEL-173433)
  - qemuMigrationSrcBeginPhase: Don't call 'qemuBlockNodesEnsureActive' with offline VM (RHEL-173433)
  - util: virGetSubIDs: do not limit file size (RHEL-174491)
  - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-177364)
  - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-177364)
  - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel (RHEL-177364)
  - qemu_capabilities: Always sort features in host-model CPU (RHEL-177364)
  - qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel (RHEL-177364)
  - qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel (RHEL-177364)
  - qemu_capabilities: Cache expanded CPU (RHEL-177364)
  - domaincapstest: Test EXPAND_CPU_FEATURES flag (RHEL-177364)
  - util: Publish and mock virHostCPUGetMSRFromKVM (RHEL-177364)
  - cpu_x86: Introduce virCPUx86DataAddMSR (RHEL-177364)
  - cpu: Introduce virCPUUpdateFeatures (RHEL-177364)
  - Fix documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-177364)
  - Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES flag (RHEL-177364)
  - virsh: Add --supported-cpu-features option for domcapabilities (RHEL-177364)
  - domaincapstest: Test SUPPORTED_CPU_FEATURES flag (RHEL-177364)
  - qemu_capabilities: Fix domain capabilities on AMD CPUs (RHEL-177364)
  - distro: Replace old gating with tmt


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-14
changelog:
  - distro: Update URL in plans.fmf
  - qemu: Ensure proper shutdown ordering of virtlockd/virtlogd daemons (RHEL-180876)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-15
changelog:
  - qemu: capabilities: Apply 'capability_filters' configration option on all capabilities (RHEL-177646)
  - qemu: capabilities: Export 'virQEMUCapsNewCopy' outside of 'qemu_capspriv' (RHEL-177646)
  - qemu: Allow reuse of 'qemuProcessStartUpdateCustomCaps' (RHEL-177646)
  - qemu: validate: Validate VM config with qemuCaps influenced by <qemu:capabilities> (RHEL-177646)
  - qemu: postparse: Process VM config with qemuCaps influenced by <qemu:capabilities> (RHEL-177646)
  - virQEMUCapsCacheLookupDefault: Fix error message when no emulators are installed (RHEL-177646)
  - qemuxmlconfdata: un-symlink 'video-virtio-vga-gpu-gl' output (RHEL-177646)
  - qemuxmlconftest: Add 'video-virtio-vga' invocation with QEMU_CAPS_DEVICE_VIRTIO_VGA disabled (RHEL-177646)
  - qemuxmlconftest: Add test cases for configs asking for 'virtio-gpu-gl' or 'virtio-vga-gl' without the capability (RHEL-177646)
  - qemuxmlconftest: Add invocation of 'video-virtio-vga-gpu-gl' with missing caps and VIR_DOMAIN_DEF_PARSE_ABI_UPDATE (RHEL-177646)
  - qemustatusxml2xml: Add test case capturing virtio video device (RHEL-177646)
  - virDomainVideoDefFormat: Use 'virXMLFormatElement' instead of custom formatter (RHEL-177646)
  - conf: Add fields for recording actually-selected virtio video device (RHEL-177646)
  - qemuxmlconftest: Add test case for specifying 'virtio-gpu' where 'virtio-vga' would be picked (RHEL-177646)
  - qemuDeviceVideoGetModel: Directly return picked model (RHEL-177646)
  - qemu: postparse: Fill in selected virtio video frondend device in the XML (RHEL-177646)
  - qemuValidateDomainDeviceDefVideo: Fix checks of virtio video devices (RHEL-177646)
  - qemuDeviceVideoGetModel: Remove logic for selecting 'virtio' devices (RHEL-177646)
  - qemuDeviceVideoGetModel: Simplify by relying on checks from 'qemuValidateDomainDeviceDefVideo' (RHEL-177646)
  - qemu: Remove 'qemuDomainSupportsVideoVga' (RHEL-177646)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-16
changelog:
  - Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to virtio-vga on target (RHEL-177646)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-17
changelog:
  - conf: schemas: Allow '.' in schema for CPU flag name (RHEL-222551)
  - tests: capabilityschemadata: Add a real test example (RHEL-222551)
  - util: virFileChownFiles: do not follow symlinks (CVE-2026-63622)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-18
changelog:
  - qemu: Always assume support for 'QEMU_CAPS_SET_ACTION' (RHEL-242546)
  - qemu: Remove unused 'qemuProcessRebootAllowed' (RHEL-242546)
  - qemu: monitor: Remove support for 'watchdog-set-action' (RHEL-242546)
  - qemu: Remove 'allowReboot' field (RHEL-242546)
  - qemu: capabilities: Retire QEMU_CAPS_SET_ACTION (RHEL-242546)
  - qemuProcessSetupLifecycleActions: Prepare to handle other actions (RHEL-242546)
  - qemuDomainModifyLifecycleActionLive: Prepare to handle other actions (RHEL-242546)
  - processGuestPanicEvent: Don't pass panic action via parameter (RHEL-242546)
  - conf: Use proper enum types for 'onReboot', 'onPoweroff', 'onCrash', and 'onLockFailure' (RHEL-242546)
  - qemuMonitorGuestPanicEventInfoFormatMsg: Directly return message (RHEL-242546)
  - qemuProcessGuestPanicEventInfo: Fold into only caller (RHEL-242546)
  - qemu: processGuestPanicEvent: Split individual steps under separate conditions (RHEL-242546)
  - Add support for keeping VM running when panic notifier is used (RHEL-242546)
  - qemu: Fix proper ordering of 'virtlockd' shutdown (RHEL-180876)
  - Add guest device info to virDomainGetGuestInfo (RHEL-243300)
  - qemu_agent: Introduce guest-get-devices (RHEL-243300)
  - qemuagenttest: Introduce GetGuestDeviceInfo test case (RHEL-243300)
  - qemu: Implement device info for virDomainGetGuestInfo() API (RHEL-243300)
  - virsh: Add support for VIR_DOMAIN_GUEST_INFO_DEVICES (RHEL-243300)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-12
changelog:
  - qemuMonitorJSONGetCPUModelExpansion: refactor parsing functions (RHEL-89415)
  - qemu: parse deprecated-props from query-cpu-model-expansion response (RHEL-89415)
  - qemu_capabilities: query deprecated features for host-model (RHEL-89415)
  - libvirt-domain: introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES (RHEL-89415)
  - qemu_capabilities: filter deprecated features if requested (RHEL-89415)
  - virsh: add --disable-deprecated-features flag to domcapabilities (RHEL-89415)
  - conf: add deprecated_features attribute (RHEL-89415)
  - redhat: Restore hunks in tests/qemucapabilitiesdata/caps_10.0.0_s390x.* (RHEL-89415)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-14
changelog:
  - qemu: introduce QEMU_CAPS_AMD_IOMMU (RHEL-50560)
  - qemu: introduce QEMU_CAPS_PCI_ID (RHEL-50560)
  - docs: formatdomain: document intel-only IOMMU attributes (RHEL-50560)
  - qemu: add IOMMU model amd (RHEL-50560)
  - conf: add passthrough and xtsup attributes for IOMMU (RHEL-50560)
  - esx: Allow specifying different CA bundle for remote connections (RHEL-97440)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-15
changelog:
  - qemu: fix order of VNC TLS config entries (RHEL-106276)
  - qemu: sanitize blank lines in config file (RHEL-106276)
  - qemu: add ability to set TLS priority string with QEMU (RHEL-106276)


author: Jiri Denemark <jdenemar@redhat.com> - 11.8.0-1
changelog:
  - Rebased to libvirt-11.8.0 (RHEL-118197)
  - The rebase also fixes the following bugs:
      RHEL-15693, RHEL-95397, RHEL-111609, RHEL-116847, RHEL-117774


author: Jiri Denemark <jdenemar@redhat.com> - 11.9.0-1
changelog:
  - Rebased to libvirt-11.9.0 (RHEL-118197)
  - The rebase also fixes the following bugs:
      RHEL-114003


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-1
changelog:
  - Rebased to libvirt-11.10.0 (RHEL-118197)
  - The rebase also fixes the following bugs:
      RHEL-126090, RHEL-128107
  - spec: Fix RPM build when %{fedora} is undefined (RHEL-118197)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-2
changelog:
  - qemu: tpm: Account for possible migration without actually sharing storage (RHEL-108915)
  - tests: Test virFileIsSharedFSOverride (RHEL-135287)
  - util: Fix race condition in virFileIsSharedFSType (RHEL-135287)
  - util: Fix race condition in virFileIsSharedFSOverride (RHEL-135287)
  - util: Rework virFileIsSharedFSOverride using virFileCheckParents (RHEL-135287)


author: Kalev Lember <klember@redhat.com> - 1:0.4.0-31
changelog:
  - Use make_build/make_install macros
  - Drop unneeded ldconfig_scriptlets macro call
  - Remove a no longer needed -mmmx CFLAGS addition
  - Disable strict aliasing


author: Ville-Pekka Vainio <vpvainio AT iki.fi> - 4.3-1
changelog:
  - Update to 4.3
  - Add GPG signature check for the source
  - Fix pycached stuff
  - Remove old python_provide macro
  - Remove ldconfig_scriptlets macro
  - Only use VFST for now, HFST can be provided in a later update


author: Ville-Pekka Vainio <vpvainio AT iki.fi> - 4.3-2
changelog:
  - Bump release for a new Copr build
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild


author: Ville-Pekka Vainio <vpvainio AT iki.fi> - 4.3-3
changelog:
  - The dictionary data directory will now be /usr/lib/voikko on all architectures
  - Create and own /usr/lib/voikko, so different dictionary packages can own the subdirectories there
  - This was suggested in the review of the voikko-fi package, see rhbz#1919688
  - Use the license macro


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.12.1-2
changelog:
  - Drop libwacom-show-stylus, it's a debugging tool that requires extra
    dependencies that we shouldn't pull in everywhere (#2044710)


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.12.1-4
changelog:
  - Add support for the Cintiq Pro 27 (RHEL-101886)
  - Add support for the Intuos Pro 3rd Gen series (RHEL-101881)


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.12.1-5
changelog:
  - Rearrange the OSD buttons for the Intuos Pro 3rd Gen (RHEL-101881)
  - Use separate Ring/Ring2 assignments


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.12.1-6
changelog:
  - Add stylus definitions for the propen group (RHEL-122207)
  - Add tablet definitions for the latest Cintiqs (RHEL-122206)
  - Fix the overlap for button assignments in the SVG (RHEL-126355)


author: Tomas Popela <tpopela@redhat.com> - 1.2.0-6
changelog:
  - Add fix for mzbz#1819244
  - Fix tools subpackage dependency
  - Bump the release to "6" to accommodate the 9.1.0.z release bumps


author: Tomas Popela <tpopela@redhat.com> - 1.2.0-7
changelog:
  - Bump the release to "7" to accommodate the 9.1.0.z release bumps as
    libwebp-1.2.0-6.el9 < libwebp-1.2.0-6.el9_1


author: Caolán McNamara <caolanm@redhat.com> - 0.2.12-6
changelog:
  - document that libwmf bundles a modified old copy of gd 2.0.1
    https://fedoraproject.org/wiki/Bundled_Libraries#Requirement_if_you_bundle


author: Wolfgang Ulbrich <fedora@raveit.de> - 40.0-2
changelog:
  - revert https://gitlab.gnome.org/GNOME/libwnck/-/commit/3456b74
  - fixes rhbz #1971048
  - and https://github.com/mate-desktop/mate-panel/issues/1230


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.6.8-17
changelog:
  - Use make macros, patch by Tom Stellard <tstellar@redhat.com>
    (https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro)
  - Update flags, enable LTO
  - Remove RANDFILE and increase default bits in ssleay.conf


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-1
changelog:
  - Update to openwsman-2.8.1
    Resolves: RHEL-97643
  - Add libwsman-client.so.4 for backward compatibility
    Related: RHEL-97643


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-2
changelog:
  - Support added for post-quantum cryptography
    Resolves: RHEL-127516
  - Fix bogus 'sscg' arguments
    Related: RHEL-118292


author: Toke Høiland-Jørgensen <toke@redhat.com> 1.5.7-1
changelog:
  - Upstream version bump
  - Add annocheck exceptions for BPF objects (Felix)
  - Re-enable debug builds (Felix)
  - Add libcap-ng-devel to BuildDepends


author: Simo Sorce <simo@redhat.com> - 1.1.34-3
changelog:
  - Drop crypto dependency.
  - The "cryptography" implemented in exslt is outdated and bad supporting only
    insecure algorithms (RC4, SHA1, MD5, MD4), and should not be used anyway.


author: Michal Ruprich <mruprich@redhat.com> - 1.0.225-3
changelog:
  - Resolves: #1965253 - CVE-2021-28902 libyang: NULL pointer dereference in read_yin_container()
  - Resolves: #1965255 - CVE-2021-28903 libyang: recursive call to lyxml_parse_mem() lead to crash


author: Remi Collet <remi@remirepo.net> - 1.7.2-1
changelog:
  - update to 1.7.2
  - fix installation layout using merged patch from
    https://github.com/nih-at/libzip/pull/190


author: Rex Dieter <rdieter@fedoraproject.org> - 1.7.3-2
changelog:
  - use %cmake_build, %cmake_install, 
    cd "ppc64le-redhat-linux-gnu" 
    /usr/bin/ctest --output-on-failure --force-new-ctest-process -j20  
    cd -


author: Miroslav Lichvar <mlichvar@redhat.com> 3.1.1-6
changelog:
  - add support for VLAN over bond (#2120521)
  - handle EINTR when waiting for transmit timestamp (#2128786)
  - check for unexpected changes in frequency offset (#2150815)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2-1
changelog:
  - update to 4.2 (RHEL-2026 RHEL-2342 RHEL-12182 RHEL-15929)
  - fix ts2phc to handle large NMEA delay (RHEL-23208)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2-3
changelog:
  - rework NMEA delay patch to fix PPS edge rejection (RHEL-39387)
  - fix ts2phc to correctly handle leap seconds (RHEL-40216)
  - fix ts2phc to reset NMEA parser after RMC message (RHEL-40947)
  - add options to configure multicast IP addresses (RHEL-31178)
  - add holdover support to ts2phc (RHEL-50216)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.4-1
changelog:
  - update to 4.4 (RHEL-58213 RHEL-57040)
  - fix port-specific ptp/p2p_dst_ipv4 configuration (RHEL-60027)
  - support static sink clocks in phc2sys automatic mode (RHEL-62864)
  - don't require -O option without -a and -w in phc2sys (RHEL-69138)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.4-2
changelog:
  - add experimental option for external PPS in ts2phc automatic mode
    (RHEL-72468)
  - add command to set external grandmaster properties (RHEL-90585)
  - refresh link status on faults (RHEL-56168)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.4-5
changelog:
  - fix high CPU usage by ptp4l when link is down (RHEL-178071)
  - fix phc2sys to not get stuck in static mode (RHEL-187950)


author: Artem Egorenkov <aegorenk@redhat.com> - 3.6.0-7
changelog:
  - New flag for no sensors added. This flag is used in VM environment
    to make sensors binaries not fail if no sensors was detected.


author: Tom Callaway <spot@fedoraproject.org> - 33.3.1-17
changelog:
  - hack this ancient beastie to work with lua 5.4
  - maintainer, please update this to the current upstream release at your earliest convenience


author: Andrew Hughes <gnu.andrew@redhat.com> - 35.0-6
changelog:
  - Pass LDFLAGS to the build so RPM linker flags are used and annocheck passes.
  - Add patch from upstream to fix propagation of LDFLAGS into build system.
  - Resolves: rhbz#2044879


author: Marian Csontos <mcsontos@redhat.com> - 2.03.23-2
changelog:
  - Add warning message when mirror images have (r)efresh bit set.
  - Document lv_attr volume type bit (g) for raid+integrity in lvs(8).


author: Marian Csontos <mcsontos@redhat.com> - 2.03.28-2
changelog:
  - Fix SPDX License identifiers.
  - Fix input units for VDO LV's minimim_io_size.
  - Fix stripe count and validation for RAID LVs.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.28-5
changelog:
  - Fix temporary LVs not cleaned when converting in use LV to a thin pool.
  - Check FS resize is supported before extending LV.
  - Fix issue affecting memory locking before suspend (2.03.27).


author: Marian Csontos <mcsontos@redhat.com> - 2.03.32-2
changelog:
  - Fix vgremove hanging immediately after lockstart.
  - Add repair option for RAID volumes with too many transiently failed devices.


author: Nikola Davidova <ndavidov@redhat.com> - 3:10.5.29-5
changelog:
  - Backport MDEV-37899 to prevent excessive SELinux AVC denials during Galera SST
  - Resolves: INFRASERV-1809


author: Michal Schorm <mschorm@redhat.com> - 3.1.9-5
changelog:
  - Revert the CMake change regarding the in-source builds for now
  - %cmake macro covers the %{set_build_flags}, so they are not needed
    That also means, the debug buildchnages to the build flags must be done AFTER the
    %cmake macro was used.
  - %cmake macro also covers the CMAKE_INSTALL_PREFIX="%{_prefix}" option
  - Default to %cmake commands instead fo %make commands
  - Update the WITH_UNITTEST macro to the one upstream use now
  - Introduce macro to enable / disable testusite (and building of the *-test subpackage)


author: Michal Schorm <mschorm@redhat.com> - 3.1.9-4
changelog:
  - Force the CMake change regarding the in-source builds also to F31 and F32
  - %cmake macro covers the %{set_build_flags}, so they are not needed
    That also means, the debug build changes to the build flags must be done AFTER the
    %cmake macro was used.
  - %cmake macro also covers several other options which redudndant specification I removed in this commit
  - Default to %cmake commands instead of %make commands


author: Cornelia Huck <cohuck@redhat.com> - 0.69-1
changelog:
  - a2621934aa37 ("Merge pull request #18 from cohuck/validate")
  - ffbcef5a1c84 ("Merge pull request #25 from etrunko/master")
  - 5ec75a83bf30 ("Remove never used 'available' option")
  - d49b0f0db6b3 ("Merge pull request #23 from eskultety/man-fix")
  - 4cfe37eb2d99 ("man: Point --verbose to the 'list' command rather than 'types'")
  - a0ae49eb7178 ("Merge pull request #17 from cohuck/install_symlinks")
  - 504beba6e8f9 ("Force symlink cretion")
  - 522c5ded00ff ("Fix attribute validation")


author: Alex Williamson <alex.williamson@redhat.com> - 0.78-1
changelog:
  - e029640033d3 ("Automatic version commit for tag 0.78")
  - e32f506656fd ("use standard bash path")
  - 70690b64401f ("avoid other tags spilling into the .spec changelog")
  - 70b89c18cf5b ("Merge pull request #31 from awilliam/20201113.0")
  - 80187bc9ba03 ("Merge pull request #30 from fiuczy/fix-error-cleanup")
  - 97ea8bbeefb7 ("mdevctl: fix cleanup on error when creating and removing mdev")
  - b45d33dfd36c ("version support")
  - 2b1c16ce6fb0 ("Fix attributes getting applied via start-parent-mdevs")
  - 25d5e8d24d57 ("mdevctl: fix cleanup on error when writing to attribute")


author: Michal Schorm <mschorm@redhat.com> - 0.996-3.4
changelog:
  - Bump version for package rebuild
    We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'CRB' repo
  - Resolves: #2182069


author: José Expósito <jexposit@redhat.com> - 24.1.2-3
changelog:
  - Match mesa-libEGL version
    Cherry-picked from: https://src.fedoraproject.org/rpms/mesa/pull-request/24
    Resolves: https://issues.redhat.com/browse/RHEL-50229


author: José Expósito <jexposit@redhat.com> - 24.2.8-2
changelog:
  - AMD Navi4x support
    Backport fixes for radeonsi and disable GFX12 on radv
    Resolves: https://issues.redhat.com/browse/RHEL-53419


author: Anusha Srivatsa <asrivats@redhat.com> - 25.0.7-2
changelog:
  - NV dGFX fix for firefox crashing
    Backport fixes for NV dGFX driver crashing firefox
    Resolves: https://issues.redhat.com/browse/RHEL-93219


author: Petr Menšík <pemensik@redhat.com> - 5.5.9-4
changelog:
  - Enable mkpasswd building (#2054043)
  - Remove changelog from mkpasswd, it has double size of actual tool


author: Jakub Hrozek <jhrozek@redhat.com> - 0.17.0-6
changelog:
  - Related: rhbz#1986806 - CVE-2021-3639 mod_auth_mellon: Open Redirect
                            vulnerability in logout URLs


author: Tomas Halman <thalman@redhat.com> - 0.17.0-9
changelog:
  - Fixing mellon_create_metadata.sh script
    Resolves: RHEL-35898
  - Publishing diagnostic module in CRB repository
    Resolves: RHEL-33585


author: Tomas Halman <thalman@redhat.com> - 2.4.9.4-2
changelog:
  - Resolves: rhbz#2153656 - CVE-2022-23527 - Open Redirect in
    oidc_validate_redirect_url() using tab character


author: Tomas Halman <thalman@redhat.com> - 2.4.9.4-3
changelog:
  - Resolves: rhbz#2184145 - CVE-2023-28625 NULL pointer dereference
    when OIDCStripCookies is set and a crafted Cookie header is supplied


author: Tomas Halman <thalman@redhat.com> - 2.4.10-1
changelog:
  Rebase to 2.4.10 version improves `state cookies piling up` problem
    Resolves: RHEL-32450 Race condition in mod_auth_openidc filecache
    Resolves: RHEL-25422 mod_auth_openidc: DoS when using
              `OIDCSessionType client-cookie` and manipulating cookies
              (CVE-2024-24814)


author: Jakub Hrozek <jhrozek@redhat.com> - 2.4.9.1-1
changelog:
  - Resolves: rhbz#1987223 - CVE-2021-32792 mod_auth_openidc: XSS when using
                             OIDCPreservePost On [rhel-9.0]
  - Resolves: rhbz#1987217 - CVE-2021-32791 mod_auth_openidc: hardcoded
                             static IV and AAD with a reused key in AES GCM
                             encryption [rhel-9.0]
  - Resolves: rhbz#1987204 - CVE-2021-32786 mod_auth_openidc: open redirect in
                             oidc_validate_redirect_url() [rhel-9.0]


author: Tomas Halman <thalman@redhat.com> - 2.4.9.4-1
changelog:
  - Resolves: rhbz#2001852 - CVE-2021-39191 mod_auth_openidc: open redirect
                             by supplying a crafted URL in the target_link_uri
                             parameter


author: Paul Howarth <paul@city-fan.org> - 2.3.9-24
changelog:
  - Drop EL-6 support
    - Use %license unconditionally
    - _httpd_* macros always available
    - Run directory is always /run on tmpfs
    - Assume httpd ≥ 2.4 filesystem layout
    - systemd-units always provided by systemd


author: Lubos Uhliarik <luhliari@redhat.com> - 2.3.9-26
changelog:
  - Resolves: #1958882 - mod_fcgid does not pass more than 64 variables to an FCGI
    server process environment


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.19-3
changelog:
  - Resolves: #2066311 - CVE-2021-44224 httpd: possible NULL dereference or SSRF
    in forward proxy configurations


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.19-5
changelog:
  - Resolves: #2177753 - CVE-2023-25690 httpd: HTTP request splitting with
    mod_rewrite and mod_proxy


author: Luboš Uhliarik <luhliari@redhat.com> - 2.0.26-5
changelog:
  - Resolves: RHEL-108706 - CVE-2025-49630 httpd: untrusted input from a client
    causes an assertion to fail in the Apache mod_proxy_http2 module


author: Luboš Uhliarik <luhliari@redhat.com> - 2.0.26-6
changelog:
  - Resolves: RHEL-166293 - httpd: Apache HTTP Server: HTTP/2 DoS by Memory
    Increase (CVE-2025-53020)


author: Coty Sutherland <csutherl@redhat.com> - 1.2.48-20
changelog:
  - Cleanup spec file and remove .redhat-N suffix from release
  - Remove ap24 subpackage since we only need to build for one version of httpd


author: Luboš Uhliarik <luhliari@redhat.com> - 1:2.4.26-1
changelog:
  - Resolves: RHEL-25075 - new version 2.4.26
  - Resolves: RHEL-11838 - [RFE] add support of dns_01 challenge to mod_md
  - Resolves: RHEL-17462 - OCSP response rejected when nextUpdate field not set
  - Resolves: RHEL-17467 - mod_md should trigger the reissue of new pair
    key/certificate when OCSP reports a revoked status


author: Luboš Uhliarik <luhliari@redhat.com> - 1:2.4.26-2
changelog:
  - Resolves: RHEL-134497 - httpd: Apache HTTP Server: mod_md (ACME), unintended
    retry intervals (CVE-2025-55753)


author: Sokratis Zappis <szappis@redhat.com> - 1.3.20-1
changelog:
  - Rebase mod_cluster to upstream 1.3.20.Final tag
  - Related: RHEL-27497 - Rebase to upstream 1.3.20.Final release


author: Fedora Release Engineering <releng@fedoraproject.org> - 2.9.3-10
changelog:
  - Resolves: #1930664 - RFE: Add a feature that can set a mod_security/libcurl
    timeout for retrieving the rules
  - rename mlogc to mod_security-mlogc


author: Luboš Uhliarik <luhliari@redhat.com> - 2.9.6-2
changelog:
  - Resolves: RHEL-93014 - mod_security: ModSecurity Has Possible DoS
    Vulnerability (CVE-2025-47947)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.9.6-3
changelog:
  - Resolves: RHEL-100098 - mod_security: ModSecurity Denial of Service
    Vulnerability (CVE-2025-48866)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.9.6-4
changelog:
  - Resolves: RHEL-30628 - mod_security: httpd doesn't close read side of pipe
    to rotatelogs for SecAuditLog leading to frozen state during graceful restart


author: Tomas Orsava <torsava@redhat.com> - 4.7.1-9
changelog:
  - Add automatically generated Obsoletes tag with the python39- prefix
    for smoother upgrade from RHEL8
  - Use the modern way of filtering Provides not to interfere with modern Python
    RPM generators
  - Related: rhbz#1990421


author: Adam Jackson <ajax@redhat.com> - 2.3.4-25
changelog:
  - Fix invoking autogen/configure so the default CFLAGS actually get applied
    Resolves: rhbz#2044881


author: José Expósito <jexposit@redhat.com> - 2.3.4-28
changelog:
  - Fix CVE-2023-43788: out of bounds read in XpmCreateXpmImageFromBuffer()
  - Fix CVE-2023-43789: out of bounds read on XPM with corrupted colormap


author: Olivier Fourdan <ofourdan@redhat.com> - 2.3.4-30
changelog:
  - Keep drop-down menus on the same monitor as the pull-down button with
    Xinerama
    Resolves: RHEL-92832


author: Charalampos Stratakis <cstratak@redhat.com> - 2.5.1-1
changelog:
  - Import into RHEL
  - Fedora contributions by:
        Charalampos Stratakis <cstratak@redhat.com>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Jan Vcelak <jvcelak@fedoraproject.org>
        Jaroslav Škarvada <jskarvad@redhat.com>
        Jeff Law <law@redhat.com>
        Lukas Zachar <lzachar@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Tom Stellard <tstellar@redhat.com>


author: Miro Hrončok <mhroncok@redhat.com> - 2.5.1-3
changelog:
  - Split libmpdec++ into a mpdecimal++ subpackage
  - This prevents packages only using the libmpdec library from transitively depending on libstdc++


author: Honggang Li <honli@redhat.com> - 5.7-3
changelog:
  - Update OSU benchmarks to upstream release 5.7.1
  - Update Intel MPI Benchmarks 2021.2
  - Resolves: rhbz#1960479


author: Honggang Li <honli@redhat.com> - 5.8-1
changelog:
  - Update OSU benchmarks to upstream release 5.8
  - Update Intel MPI Benchmarks 2021.3
  - Resolves: rhbz#2015392


author: Davide Caratti <dcaratti@redhat.com> - 0.7-2
changelog:
  - add a simple sanity test and enable gating. Related: rhbz#1962741
  - don't overwrite global build options. Related: rhbz#1967697
  - fix 'check_conflicts' on multilib. Related: rhbz#1967697


author: Davide Caratti <dcaratti@redhat.com> - 0.8-2
changelog:
  - fix mptcpize to work also when protocol number is 0 (upstream issue #159)
    and when command resides in another file system (upstream issue #161)
    Related: rhbz#2015623


author: Robert Scheck <robert@fedoraproject.org> - 2:0.94-1
changelog:
  - Rebase to 0.94 (#1742473, #1840079)
  - Drop policykit wrapper for xmtr due to libcap (#1488417, #1488418)


author: Gerd Pokorra <gp@zimt.uni-siegen.de> - 0.5.13-6
changelog:
  - updating line in /usr/lib/tmpfiles.d/munge.conf: /var/run/munge → /run/munge
  - add license tag
  - add requires logrotate


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.5.13-8
changelog:
  - Provide a sysusers.d file to get user() and group() provides
    (see https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format).


author: Jonas Ådahl <jadahl@redhat.com> - 40.9-20
changelog:
  - Fix positioning when using always-on-top windows
    Resolves: RHEL-45998
  - Improve handling of always-on-visible-workspace windows
    Resolves: RHEL-45366


author: Jonas Ådahl <jadahl@redhat.com> - 40.9-22
changelog:
  - Fix crash when moving window while switching workspace
    Resolves: RHEL-62997
  - Improve app discovery for workspace logic
    Resolves: RHEL-63000


author: Olivier Fourdan <ofourdan@redhat.com> - 40.9-31
changelog:
  - Backport linux-dmabuf v4 support to restore hardware acceleration
    in Xwayland 24.1 with Mesa 25.2
    Resolves: RHEL-129832


author: Richard W.M. Jones <rjones@redhat.com> - 1.36.2-1
changelog:
  - Rebase to 1.36.2
    resolves: RHEL-14475
  - partition: Suggest alternate partition-sectorsize
    resolves: RHEL-19815


author: Richard W.M. Jones <rjones@redhat.com> - 1.38.3-1
changelog:
  - Rebase to 1.38.3 (along stable branch)
  - Send the last error to the NBD client
    resolves: RHEL-50664


author: Richard W.M. Jones <rjones@redhat.com> - 1.38.5-6
changelog:
  - Add extra system call checking and debugging to nbdkit-file-plugin
    resolves: RHEL-85510
  - Allow nbdkit-file-plugin to zero and trim block devices
    resolves: RHEL-89353


author: Richard W.M. Jones <rjones@redhat.com> - 1.38.5-10
changelog:
  - CVE-2025-47711 denial of service attack by client sending maximum size block
    status
  - CVE-2025-47712 denial of service attack by client sending large unaligned
    size block status
    resolves: RHEL-95814


author: Richard W.M. Jones <rjones@redhat.com> - 1.34.2-1
changelog:
  - Rebase to 1.34.2
    resolves: rhbz#2168629
  - Backport nbdkit-curl-plugin "multi" interface support
    resolves: rhbz#2228131


author: Miroslav Lichvar <mlichvar@redhat.com> 6.2-9.20210508
changelog:
  - fix buffer overflow on terminfo with too many capabilities (CVE-2023-29491)
  - ignore TERMINFO and HOME environment variables if running as root (#2211666)


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-14.20191109
changelog:
  - update to 6.1-20191109
  - remove LDFLAGS from pkgconfig files and ncurses-config scripts (#1771137)


author: Fedora Release Engineering <releng@fedoraproject.org> - 6.2-4.20200222
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
  - Use make macros
  - Remove MIT definition
  - Add BuildRequires: make


author: Josef Ridky <jridky@redhat.com> - 1:5.9.1-9
changelog:
  - fix CVE-2022-44792 and CVE-2022-44793 (#2141902) and (#2141906)
  - fix memory leak when ipv6 disable set to 1 (#2151540)


author: Josef Ridky <jridky@redhat.com> - 1:5.9.1-14
changelog:
  - fix CVE-2022-24805, CVE-2022-24806, CVE-2022-24807, CVE-2022-24808,
    CVE-2022-24809 and CVE-2022-24810 (RHEL-26649)


author: Josef Ridky <jridky@redhat.com> - 1:5.9.1-18
changelog:
  - fix inverted usage of -n in snmptrapd (RHEL-101078)
  - fix use after free issue (RHEL-121091)
  - fix help and manpage for net-snmp-create-v3-user 
    script(RHEL-101614 and RHEL-103557)


author: Thomas Haller <thaller@redhat.com> - 1.20.0-1
changelog:
  - Update to 1.20.0 release
  - Drop NotShowIn=GNOME
  - Use wireless-security code from libnma
  - Add flatpak build configuration
  - applet: hide unmanaged ethernet devices in nm-applet
  - applet: fix Wi-Fi scan requests with appindicator
  - editor: fix drop down list for connection.secondaries


author: Scott Mayhew <smayhew@redhat.com> 2.5.4-32
changelog:
  - Undo 'Add explicit version requirement for libnfsidmap' from previous build (RHEL-78107)
  - Undo 'Add --disable-sbin-override for when /sbin is a symlink' from previous build (RHEL-69771)
  - Undo 'Move remaining binaries from /sbin to /usr/sbin' from previous build (RHEL-69771)


author: Steve Dickson <steved@redhat.com> 2.5.4-35
changelog:
  - nfs(5): Add new rdirplus functionality, clarify (RHEL-87143)
  - nfsd: allow more than 64 backlogged connections (RHEL-87752)


author: Steve Dickson <steved@redhat.com> 2.5.4-37
changelog:
  - gssd.man: add documentation for use-gss-proxy nfs.conf option (RHEL-85408)
  - gssd: do not use krb5_cc_initialize (RHEL-85412)


author: Scott Mayhew <smayhew@redhat.com> 2.5.4-42
changelog:
  - Replace statfs64 with statfs (RHEL-127105)
  - NFS export symlink vulnerability fix (RHEL-127105)
  - mountd: Minor refactor of get_rootfh() (RHEL-127105)
  - mountd: Separate lookup of the exported directory and the mount path (RHEL-127105)
  - support: Add a mini-library to extract and apply RPC credentials (RHEL-127105)
  - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127105)
  - Add requires for selinux-policy (RHEL-127105)
    Resolves: CVE-2025-12801


author: Scott Mayhew <smayhew@redhat.com> 2.5.4-43
changelog:
  - nfsrahead: enable event-driven mountinfo monitoring and skip non-NFS devices (RHEL-158527)
  - nfsrahead: zero-initialise device_info struct (RHEL-158527)
  - nfsrahead: quieten misleading error for non-NFS block devices (RHEL-158527)


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-23
changelog:
  - Resolves: RHEL-6786 - SSL-errors 0A000126 / NS_NET_ERROR_PARTIAL_TRANSFER
    at nginx with reverse-proxy


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-24
changelog:
  - Resolves: RHEL-84477 - nginx: specially crafted MP4 file may cause
    denial of service (CVE-2024-7347)
  - Resolves: RHEL-85556 - nginx: Memory disclosure in the
    ngx_http_mp4_module (CVE-2022-41742)
  - Resolves: RHEL-91446 - nginx: Memory corruption in the
    ngx_http_mp4_module (CVE-2022-41741)


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-25
changelog:
  - Resolves: RHEL-114935 - Image mode: The dir /var/lib and /var/log
    is not created when updating system in image mode


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-28
changelog:
  - Resolves: RHEL-146528 - CVE-2026-1642 nginx: NGINX: Data injection via
    man-in-the-middle attack on TLS proxied connection


author: Petr Dancak <pdancak@redhat.com> - 2:1.20.1-29
changelog:
  - Resolves: RHEL-159563 - CVE-2026-27654 nginx: NGINX: Denial of Service
    or file modification via buffer overflow in ngx_http_dav_module
  - Resolves: RHEL-159542 - CVE-2026-27784 nginx: NGINX: Denial of Service
    due to memory corruption via crafted MP4 file
  - Resolves: RHEL-159450 - CVE-2026-27651 nginx: NGINX: Denial of Service
    via undisclosed requests when ngx_mail_auth_http_module is enabled
  - Resolves: RHEL-157891 - CVE-2026-32647 nginx: NGINX: Denial of Service
    or Code Execution via specially crafted MP4 files


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-31
changelog:
  - Resolves: RHEL-178683 - nginx: code execution and denial of
    service (CVE-2026-9256)
  - Resolves: RHEL-182551 - nginx: HTTP/2: Remote Denial of Service via
    compression bomb and Slowloris-style attack
  - Resolves: RHEL-188407 - nginx: NGINX: Arbitrary code execution or.
    Denial of Service via heap-based buffer overflow with crafted HTTP/2
    headers (CVE-2026-42055)


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.22.1-1
changelog:
  - Resolves: #2096174 - RFE: add nginx:1.22 module stream
  - switch to pcre2
  - add stream_geoip_module and stream_realip_module
  - enable kTLS support


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.22.1-4
changelog:
  - Resolves: #2170808 - Running nginx with systemctl and entering ssl
    private key's pass phrase
  - added new ssl_pass_phrase_dialog directive which enables setting
    external program for entering password for encrypted private key


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.22.1-5
changelog:
  - Resolves: RHEL-12737 - nginx:1.22/nginx: HTTP/2: Multiple HTTP/2 enabled web
    servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.24.0-5
changelog:
  - Resolves: RHEL-84480 - nginx:1.24/nginx: specially crafted MP4 file may cause
    denial of service (CVE-2024-7347)


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.24.0-6
changelog:
  - Resolves: RHEL-146529 -  CVE-2026-1642 nginx: NGINX: Data injection via
    man-in-the-middle attack on TLS proxied connections


author: Petr Dancak <pdancak@redhat.com> - 1:1.24.0-7
changelog:
  - Resolves: RHEL-159564 - CVE-2026-27654 nginx: NGINX: Denial of Service
    or file modification via buffer overflow in ngx_http_dav_module
  - Resolves: RHEL-159543 - CVE-2026-27784 nginx: NGINX: Denial of Service
    due to memory corruption via crafted MP4 file
  - Resolves: RHEL-159451 - CVE-2026-27651 nginx: NGINX: Denial of Service
    via undisclosed requests when ngx_mail_auth_http_module is enabled
  - Resolves: RHEL-157892 - CVE-2026-32647 nginx: NGINX: Denial of Service
    or Code Execution via specially crafted MP4 files


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.26.3-4
changelog:
  - CVE-2026-1642 nginx: NGINX: Data injection via man-in-the-middle attack
    on TLS proxied connections


author: pdancak <pdancak@redhat.com> - 2:1.26.3-5
changelog:
  - RHEL-159565 CVE-2026-27654 nginx: NGINX: Denial of Service or file
    modification via buffer overflow in ngx_http_dav_module


author: pdancak <pdancak@redhat.com> - 2:1.26.3-6
changelog:
  - RHEL-159544 - CVE-2026-27784 nginx: NGINX: Denial of Service due to
    memory corruption via crafted MP4 file


author: pdancak <pdancak@redhat.com> - 2:1.26.3-7
changelog:
  - RHEL-159452 CVE-2026-27651 nginx: NGINX: Denial of Service via
    undisclosed requests when ngx_mail_auth_http_module is enabled


author: pdancak <pdancak@redhat.com> - 2:1.26.3-8
changelog:
  - RHEL-157893 CVE-2026-32647 nginx: NGINX: Denial of Service or Code
    Execution via specially crafted MP4 files


author: Matej Focko <mfocko@redhat.com> - 1.2.14-1
changelog:
  - New release 1.2.14 (Gris Ge)
  - bond: support changing bond mode (Gris Ge)
  - Reorganize the code structure (Gris Ge)
  - CI: Enable VRF and ethool pause test (Gris Ge)
  - CI: Upgrade the version of github action tasks (Gris Ge)
  - test: Fix ethtool link mode test on Ubuntu (Gris Ge)
  - Github CI: Install extra module of running kernel (Gris Ge)
  - macsec: add base_iface property (Fernando Fernandez Mancera)
  - macsec: add MACsec interface support (Fernando Fernandez Mancera)
  - Bump netlink-packet-route to 0.17.1 (Fernando Fernandez Mancera)


author: Martin Osvald <mosvald@redhat.com> - 3:7.92-1
changelog:
  - New version 7.92
  - Resolves: #2180330 - Rebase nmap for TLS v1.3 support
  - Resolves: #2164833 - Remove duplicate tests


author: Martin Osvald <mosvald@redhat.com> - 3:7.92-5
changelog:
  - Remove obsolete alternatives left behind after leapp upgrade from RHEL8 to RHEL9
    Resolves: RHEL-101161


author: Gris Ge <fge@redhat.com> - 2.2.46-1
changelog:
  - Upgrade to 2.2.46
  - Store DNS to both iface and global DNS. RHEL-91291
  - Support nmpolicy against down iface. RHEL-88989
  - Support removal VLAN connection with empty ifname. RHEL-93146


author: Gris Ge <fge@redhat.com> - 2.2.48-1
changelog:
  - Upgrade to 2.2.48
  - Validate OVN bridge mapping. RHEL-85787
  - Support bond `lacp_active` and `ns_ip6_target`. RHEL-85784
  - Support matching by PCI adress. RHEL-88993
  - Apply dispatch changes first. RHEL-101742
  - Fix SRIOV VF reference. RHEL-93180


author: Rahul Rajesh <rrajesh@redhat.com> - 2.2.49-1
changelog:
  - Upgrade to 2.2.49
  - Ignore desired MAC for bonds with fail_over_mac. RHEL-107526
  - Fix setting DNS only with search or option. RHEL-104797


author: Mingyu Shi <mshi@redhat.com> - 2.2.50-1
changelog:
  - Upgrade to 2.2.50
  - Support MAC referring for VLAN in gen_conf. RHEL-110369
  - Introduce state: ignore for route. RHEL-107130
  - Support PCI address matching in gen_conf. RHEL-110369
  - Support MacSec interface in gen_conf. RHEL-110369


author: Gris Ge <fge@redhat.com> - 2.2.54-1
changelog:
  - Upgrade to 2.2.54.
  - Automatically set HSR port MAC address. RHEL-122171
  - Fix OVSDB query failure on database bigger than 20KiB. RHEL-121992


author: Gris Ge <fge@redhat.com> - 2.2.56-1
changelog:
  - Upgrade to 2.2.56
  - Allow using VRF name to specify route table. RHEL-123541
  - Support OVS-DPDK dpdk-lsc-interrupt in nmstate. RHEL-125052
  - Applying desired state with static DNS with static IP will touch `br-ex` even not mentioned. RHEL-126731
  - Support rightca ipsec option. RHEL-123542


author: Mingyu Shi <mshi@redhat.com> - 2.2.58-1
changelog:
  - Upgrade to 2.2.58
  - vrf: Handle ignore interface when verifying desired state. RHEL-141606
  - alt-name: Remove alt-names when interface marked as absent. RHEL-141602
  - hsr: Automatically disable IP on hsr port. RHEL-141609
  - hsr: add support for configuring "interlink" property. RHEL-141608
  - Support referring interface name using its alternative name. RHEL-141601


author: Ján Václav <jvaclav@redhat.com> - 2.2.60-1
changelog:
  - Upgrade to 2.2.60
  - ipv4: Add new parameter prefix-route-metric RHEL-166365
  - Fix error when modify port list of down interfaces RHEL-166366
  - Add support for configuring ipip tunnel in nmstate RHEL-166367


author: Rahul Rajesh <rrajesh@redhat.com> - 2.2.61-1
changelog:
  - Upgrade to 2.2.61
  - Support referring alt-name in `copy-mac-from` property. RHEL-214096
  - Fix validation of conflicting routes in kernel mode. RHEL-214095


author: Jan Staněk <jstanek@redhat.com> - 1:16.20.1-1
changelog:
  - Rebase to 16.20.1
    Resolves: rhbz#2188291
    Resolves: CVE-2023-30581 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590
  - Replace /usr/etc/npmrc symlink with builtin configuration
    Resolves: rhbz#2177781


author: Jan Staněk <jstanek@redhat.com> - 1:16.20.2-5
changelog:
  - Backport patches for several CVEs.
    Fixes CVE-2024-22025 CVE-2024-25629 CVE-2024-27983 CVE-2024-28182


author: Jan Staněk <jstanek@redhat.com> - 1:18.16.1-1
changelog:
  - Rebase to 18.16.1
    Resolves: rhbz#2188292 rhbz#2187683
    Resolves: CVE-2023-30581 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590
  - Replace /usr/etc/npmrc symlink with builtin configuration
    Resolves: rhbz#2222285


author: Jan Staněk <jstanek@redhat.com> - 1:18.17.1-1
changelog:
  - Rebase to version 18.17.1
    Resolves: rhbz#2228940
    Resolves: CVE-2023-32002 CVE-2023-32006 CVE-2023-32559
  - Specify proper OpenSSL configuration section build
    Related: rhbz#2226726


author: Lukas Javorsky <ljavorsk@redhat.com> - 1:18.19.1-1
changelog:
  - Rebase to version 18.19.1
  - Fixes: CVE-2024-21892 CVE-2024-22019 (high)
  - Fixes: CVE-2023-46809 (medium)


author: Andrei Radchenko <aradchen@redhat.com> - 1:20.18.2-1
changelog:
  - Update to version 20.18.2
    Fixes: CVE-2025-23083 CVE-2025-23085 CVE-2025-22150
    Resolves: RHEL-76363 RHEL-76554 RHEL-76540


author: Tomas Juhasz <tjuhasz@redhat.com> - 1:20.20.2-1
changelog:
  - Update to version 20.20.2
    Patch nghttp2 to version 1.68.1 and disable tests which would fail due to this change.
    Resolves: RHEL-154020
    Fixes:  CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-25547 CVE-2026-21710


author: Andrei Radchenko <aradchen@redhat.com> - 1:22.22.2-1
changelog:
  - Update to version 22.22.2
  - introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135
  - disabled failing tests in nghttp2 due to newer version
  - patch for npm/braces CVE-2026-25547
    Resolves: RHEL-154021
    Fixes: CVE-2026-1528 CVE-2026-2229 CVE-2026-1526 CVE-2026-1525 CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-25547


author: Tomas Juhasz <tjuhasz@redhat.com> - 1:22.23.1-1
changelog:
  - Update to version 22.23.1
    Resolves: RHEL-176171 RHEL-183662
    Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619 CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935


author: Andrei Radchenko <aradchen@redhat.com> - 1:22.23.1-2
changelog:
  - Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion
  - Fix CVE-2026-59873, CVE-2026-59874 (node-tar) by rebasing npm's bundled tar to 7.5.19
    Fixes: CVE-2026-13149
    Resolves: RHEL-208685 RHEL-193881 RHEL-193846


author: Bob Relyea <rrelyea@redhat.com> - 3.101.0-6
changelog:
  - fix param encoding in pkcs12 pbamac encoding
  - add support for certificate compression in selfserv and tstclient


author: Bob Relyea <rrelyea@redhat.com> - 3.112.0-3
changelog:
  - restore CONCATENATE functions accidentally remvoed in the last patch
  - fix big endian issue in tstclnt and selfserv in certificate compression


author: Bob Relyea <rrelyea@redhat.com> - 3.112.0-3
changelog:
  - restore CONCATENATE functions accidentally removed in the last patch
  - fix big endian issue in tstclnt and selfserv in certificate compression


author: Bob Relyea <rrelyea@redhat.com> - 3.112.0-5
changelog:
  - fips update
  -   Fix indicators for the new post-quantum algorithms
  -   Fix the ML-KEM Self-tests
  -   Fix the ML-KEM zeroizaiton
  -   Add partial public validation before OAEP
  - bug fixes
  -   add CKA_SEED to private attributes so they are updated on password change.
  -   mark CKA_PARAMETER_SET as CK_ULONG when storing into the database
  -   fix unrefrence read in leancrypto.


author: Bob Relyea <rrelyea@redhat.com> - 3.124.0-1
changelog:
  - rebase to upstream NSS 3.124
  - backport ml-dsa support that is not upstream yet.
  - pick up in process patches upstream including eddsa


author: Bob Relyea <rrelyea@redhat.com> - 3.124.0-2
changelog:
  - rebase fixes
  - restore rhel-9 dropping of pkcs12 and smime policy
  - restore mlkem aliases
  - add mlkem key lengths to the mechanism info
  - fix crash if you try to encapsulate with an unimported
    public key
  - restore distrusted certs to certdata.txt even though we
    never reference them to make tests happy.


author: Andreas Schneider <asn@redhat.com> - 1.1.11-8
changelog:
  - resolves: rhbz#2028819 - Introduce nss_wrapper-libs package to allow install
                             smaller footprint


author: Jan Macku <jamacku@redhat.com> - 1.15-1
changelog:
  - spec: sync specfile with Fedora
  - makefile: Use rpmdev-bumpspec's legacy date option
  - Add feature to generate specfile entry, commit and archive


author: Jan Macku <jamacku@redhat.com> - 1.16-1
changelog:
  - alternatives: add --keep-foreign (#57)
  - Translations update from Weblate
  - ci: Onboard chkconfig to Packit
  - zanata: remove zanata related stuff
  - Use make macros
  - alternatives: use one function for path cleaning
  - CI: specify more closely when to run CI
  - Add basic CI and README
  - spec: sync specfile with Fedora


author: Jan Macku <jamacku@redhat.com> - 1.21-1
changelog:
  - ci: Add CodeQL to replace LGTM
  - alternatives: replace master/slave with leader/follower
  - chkconfig: use correct cmp function
  - Bump redhat-plumbers-in-action/differential-shellcheck from 2 to 3
  - ci: Add Shell linter - Differential ShellCheck
  - ci: Use more inclusive terminology in workflows
  - ci: Update workflows, packit and dependabot
  - Translated using Weblate (Friulian)
  - Translated using Weblate (Swedish)
  - Translated using Weblate (Estonian)
  - Translated using Weblate (Georgian)
  - Translated using Weblate (Polish)
  - Translated using Weblate (Korean)
  - Translated using Weblate (Czech)
  - Translations update from Fedora Weblate (#77)
  - Translations update from Fedora Weblate (#75)
  - Translations update from Fedora Weblate (#74)
  - Translations update from Fedora Weblate (#73)
  - Translated using Weblate (Ukrainian)
  - Update translation files
  - Family mentioned for --set in both man and help
  - Translated using Weblate (French)
  - build-sys: Ensure `systemd-sysv-install` symlink does not have `//`
  - Translated using Weblate (German)
  - Add LGTM badges to README
  - Merge remote-tracking branch 'weblate/master'
  - Translated using Weblate (Indonesian)
  - Translated using Weblate (Finnish)
  - Translated using Weblate (Korean)
  - Translated using Weblate (Ukrainian)
  - Translated using Weblate (Turkish)
  - Translated using Weblate (Polish)
  - Translated using Weblate (Norwegian Nynorsk)
  - Update translation files
  - Translated using Weblate (Finnish)
  - Translated using Weblate (Czech)
  - Translated using Weblate (Swedish)
  - Translated using Weblate (Italian)
  - Translated using Weblate (Spanish)
  - Translated using Weblate (Chinese (Simplified))


author: Jan Macku <jamacku@redhat.com> - 1.22-1
changelog:
  - migrate to SPDX license
  - Translated using Weblate (English (United Kingdom))
  - Translated using Weblate (Japanese)
  - ci: Add locale linter
  - ci: update workflows
  - test: fix ShellCheck error[SC2070]
  - Bump redhat-plumbers-in-action/differential-shellcheck from 3 to 4 (#94)
  - releng: Packit remove extra job trigger
  - releng: Enable Packit to handle Fedora updates
  - releng: Convert to rpmautospec


author: Jan Macku <jamacku@redhat.com> - 1.23-1
changelog:
  - Translated using Weblate (Korean)
  - Translated using Weblate (English (United Kingdom))
  - alternatives: --keep-foreign incorrectly handles non-existent files
  - alternatives: isLink should return 0 in case of lstat error
  - Translated using Weblate (Swedish)
  - Translated using Weblate (Korean)
  - Translated using Weblate (Georgian)
  - Translated using Weblate (Finnish)
  - Translated using Weblate (Ukrainian)
  - Translated using Weblate (Polish)
  - Update translation files
  - Translated using Weblate (German)
  - doc: update translations
  - spec: remote changelog


author: Jan Macku <jamacku@redhat.com> - 1.24-1
changelog:
  - ci: fix `NEXT_VERSION` in Makefile
  - revert: releng: Enable Packit to handle Fedora updates
  - revert: releng: Convert to rpmautospec


author: Tomas Orsava <torsava@redhat.com> - 1.20.1-5
changelog:
  - Add automatically generated Obsoletes tag with the python39- prefix
    for smoother upgrade from RHEL8
  - Related: rhbz#1990421


author: Jindrich Novy <jnovy@redhat.com> - 1.2.5-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.5
  - Related: #2061316


author: Jindrich Novy <jnovy@redhat.com> - 1.2.6-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.6
  - Related: #2061316


author: Jindrich Novy <jnovy@redhat.com> - 1.2.8-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.8
  - Related: #2124478


author: Jindrich Novy <jnovy@redhat.com> - 1.2.9-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.9
  - Related: #2176063


author: Jindrich Novy <jnovy@redhat.com> - 1.2.10-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.10
  - Related: RHEL-2112


author: Jindrich Novy <jnovy@redhat.com> - 1.2.11-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.11
  - simplify spec
  - Resolves: RHEL-86603


author: Jindrich Novy <jnovy@redhat.com> - 1.3.0-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.3.0
  - Resolves: RHEL-187314 RHEL-212438


author: Nalin Dahyabhai <nalin@redhat.com> - 0.34.5-1
changelog:
  - apply patch from Matthias Gerstner of the SUSE security team to fix a
    possible race condition in the mkhomedir helper (CVE-2020-10737)
  - only process SELinux contexts if SELinux is not disabled (Alexander Bokovoy)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.34.6-1
changelog:
  - update license on src/buffer.h
  - change /var/run -> /run in systemd service file (Orion Poplawski)


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 6.9.6-0.3.rc3
changelog:
  - Apply upstream patch for upstream bug 221
    - Revert change for false CVE-2020-26159 issue
      https://github.com/kkos/oniguruma/issues/221


author: François Cami <fcami@fedoraproject.org> - 1.19.1-9
changelog:
  - Fix FTBFS (rhbz#1865148)
  - Set __cmake_in_source_build
  - BR qt5-qtbase-devel to keep the GUI frontend


author: Than Ngo <than@redhat.com> - 3.21.0-3
changelog:
  - Resolves: #2110497, concurrent MK rotation for cca token
  - Resolves: #2110498, concurrent MK rotation for ep11 token
  - Resolves: #2110499, ep11 token: PKCS #11 3.0 - support AES_XTS
  - Resolves: #2111010, cca token: protected key support 
  - Resolves: #2160061, rebase to 3.21.0
  - Resolves: #2160105, pkcsslotd hardening
  - Resolves: #2160107, p11sak support Dilithium and Kyber keys
  - Resolves: #2160109, ica and soft tokens: PKCS #11 3.0 - support AES_XTS


author: Than Ngo <than@redhat.com> - 3.21.0-8
changelog:
  - Resolves: #2222592, p11sak tool: slot option does not accept argument 0 for slot index 0
  - Resolves: #2222596, p11sak fails as soon as there reside non-key objects


author: Than Ngo <than@redhat.com> - 3.22.0-2
changelog:
  - timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)
  Resolves: RHEL-22792


author: Than Ngo <than@redhat.com> - 3.23.0-1
changelog:
  - Resolves: RHEL-23671, ep11 token: support protected keys for extractable keys
  - Resolves: RHEL-23672, ep11 token support for FIPS 2021-session bound EP11 keys
  - Resolves: RHEL-23673, update to 3.23.0


author: Than Ngo <than@redhat.com> - 3.24.0-1
changelog:
  - Resolves: RHEL-50064, update to 3.24.0
  - Resolves: RHEL-50063, opencryptoki CCA Token support for x86_64 and ppc64le
  - Resolves: RHEL-50058, openCryptoki CCA token support of Dilithium
  - Resolves: RHEL-50056, openCryptoki cca token SHA3 support
  - Resolves: RHEL-50057, openCryptoki cca token RSA OAEP v2.1 support


author: Honggang Li <honli@redhat.com> - 4.1.1-2
changelog:
  - Update to 4.1.1
  - Enable psm2 support
  - fbtl-posix: link to common_ompio
  - Revert upstream commit c36d7459b6331c4d
  - Resolve: rhbz#1869443


author: Jan Černý <jcerny@redhat.com> - 1:1.3.6-4
changelog:
  - Fix potential invalid scan results in OpenSCAP (rhbz#2109485)
  - Remove oscap-remediate service (rhbz#2111358)


author: Jan Černý <jcerny@redhat.com> - 1:1.3.7-1
changelog:
  - Upgrade to the latest upstream release (rhbz#2159286)
  - Fix error when processing OVAL filters (rhbz#2126883)
  - Don't emit xmlfilecontent items if XPath doesn't match (rhbz#2138884)


author: Evgenii Kolesnikov <ekolesni@redhat.com> - 1.3.8-1
changelog:
  - Upgrade to the latest upstream release (rhbz#2217442)
  - Fix systemd* probes unit enumeration (rhbz#2219532)


author: Jan Černý <jcerny@redhat.com> - 1:1.3.10-1
changelog:
  - Rebase to the latest upstream version (RHEL-29172)
  - Fix OVAL results file name (RHEL-7050)
  - Add ability to define a limit of collected items (RHEL-4141)
  - Add ability to refine rules in autotailor (RHEL-1477)
  - Improve the formatting of Blueprint remediations (RHEL-1476)


author: Jan Černý <jcerny@redhat.com> - 1:1.3.11-1
changelog:
  - Upgrade to the latest upstream release (RHEL-76355)
  - Introduce "oscap-im", a tool for building hardened bootable container images
  - Fix RPM probes in bootable container images build environment (RHEL-55251)


author: Matthew Burket <mburket@redhat.com> - 1:1.3.13-1
changelog:
  - Upgrade to the latest upstream release (RHEL-133976)
  - Fix Filepath and Pattern Fields inversion (RHEL-104073)
  - Fix verbose flag (RHEL-53859)


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-2
changelog:
  - Fix implicit destination path selection when source path ends with ".."
    Resolves: RHEL-119515
  - Canonicalize username when matching a user
    Resolves: RHEL-118372


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-3
changelog:
  - Enable support for DSA keys
    Resolves: RHEL-127624
  - CVE-2025-61984: Reject usernames with control characters
    Resolves: RHEL-133959
  - CVE-2025-61985: Reject URL-strings with NULL characters
    Resolves: RHEL-133960


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-5 + 0.10.4-8
changelog:
  - CVE-2026-3497: Fix information disclosure or denial of service due
    to uninitialized variables in gssapi-keyex
    Resolves: RHEL-155825
  - Fix incorrect claim about SSH_AUTH_SOCK in pam_ssh_agent_auth manual page
    Resolves: RHEL-122302


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-8
changelog:
  - Fix static analysis issues
    Resolves: RHEL-163366
  - Ssh should refuse connection when mlkem kex is specified in FIPS
    Resolves: RHEL-155161
  - CVE-2026-35385: Fix privilege escalation via scp legacy protocol
    when not in preserving file mode
    Resolves: RHEL-164754
  - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode
    multiplexing sessions
    Resolves: RHEL-166251
  - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms
    and HostbasedAcceptedAlgorithms with regard to ECDSA keys
    Resolves: RHEL-166235
  - CVE-2026-35414: Fix mishandling of authorized_keys principals option
    Resolves: RHEL-166203
  - CVE-2026-35386: Add validation rules to usernames and hostnames
    set for ProxyJump/-J on the commandline
    Resolves: RHEL-166219


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-9
changelog:
  - CVE-2026-55653: Fix double free in openssh DH-GEX client path during
    FIPS known-group validation that leads to client-side denial of service
    Resolves: RHEL-186440
  - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator
    cleanup due to missing NULL terminator
    Resolves: RHEL-185835
  - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket
    pre-binding
    Resolves: RHEL-185850


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-10
changelog:
  - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed
    in unintended parent directories when scp performs remote-to-remote copy
    via the local host
    Resolves: RHEL-193176
  - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange
    Resolves: RHEL-193023


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-12
changelog:
  - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded
    file location
    Resolves: RHEL-236326
  - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect
    handling of forwarding and tunneling options
    Resolves: RHEL-236284


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-13
changelog:
  - CVE-2026-73283: Complete the fix of security bypass due to incorrect
    handling of forwarding and tunneling options
    Resolves: RHEL-245414
  - CVE-2026-73281: Fix misinteraction between agent locking and
    the session-bind@openssh.com extension
    Resolves: RHEL-245422
  - CVE-2026-73282: Fix information disclosure and data corruption
    via use-after-free in ssh client
    Resolves: RHEL-245420


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-44
changelog:
  - Add extra help information on ssh early failure
    Resolves: RHEL-33809
  - Provide details on crypto error instead of "error in libcrypto"
    Resolves: RHEL-52293
  - Allow duplicate Subsystem directive
    Resolves: RHEL-47112


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-45
changelog:
  - Fix missing error codes set and invalid error code checks in OpenSSH. It
    prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS
    is on (CVE-2025-26465).
    Resolves: RHEL-78700


author: Joseph Marrero <jmarrero@fedoraproject.org> - 2025.7-1
changelog:
  - Rebase to 2025.7
    Backport https://github.com/ostreedev/ostree/pull/3555
    Resolves: #RHEL-129049


author: Joseph Marrero <jmarrero@fedoraproject.org> - 2026.1-1
changelog:
  - Rebase to 2026.1
    Release https://github.com/ostreedev/ostree/releases/tag/v2026.1
    Resolves: #RHEL-167078


author: Joseph Marrero Corchado <jmarrero@redhat.com> - 2026.3-1
changelog:
  - Rebase to 2026.3
    Release https://github.com/ostreedev/ostree/releases/tag/v2026.3
    Resolves: #RHEL-234366


author: Zoltan Fridrich <zfridric@redhat.com> - 0.25.2-1
changelog:
  - Update to new upstream release 0.25.2
    Resolves: RHEL-14834
  - Add IBM specific mechanisms and attributes
    Resolves: RHEL-10570


author: Zoltan Fridrich <zfridric@redhat.com> - 0.25.3-3
changelog:
  - Fix regression in trust where file creation fails for long cert labels
    Resolves: RHEL-58899
  - Fix usage message in p11-kit list-tokens command
    Resolves: RHEL-31810


author: Chris Lumens <clumens@redhat.com> - 2.1.7-2
changelog:
  - Rebase on upstream 2.1.7-rc4 release
  - Use systemd-sysusers to create user/group
  - Pacemaker Remote nodes can validate against later schema versions
  - Related: RHEL-17225
  - Resolves: RHEL-7665


author: Chris Lumens <clumens@redhat.com> - 2.1.7-3
changelog:
  - Rebase on upstream 2.1.7 final release
  - Fix documentation for Pacemaker Remote schema transfers
  - Do not check CIB feature set version when CIB_file is set
  - Consolidate attrd cache handling
  - Avoid duplicating option metadata across daemons
  - Related: RHEL-7665
  - Related: RHEL-13216
  - Resolves: RHEL-7702


author: Chris Lumens <clumens@redhat.com> - 2.1.7-4
changelog:
  - Properly validate attribute set type in pacemaker-attrd
  - Fix `crm_attribute -t nodes --node localhost`
  - Resolves: RHEL-13216
  - Resolves: RHEL-17225
  - Resolves: RHEL-23498


author: Chris Lumens <clumens@redhat.com> - 2.1.8-1
changelog:
  - Rebase on upstream 2.1.8-rc1 release
  - Fix a typo in the help output of pacemaker-fenced
  - Fix escaping characters in XML attribute output
  - Resolves: RHEL-25819
  - Resolves: RHEL-30822


author: Chris Lumens <clumens@redhat.com> - 2.1.8-2
changelog:
  - Rebase on upstream 2.1.8-rc4 release
  - Add ability to immediately shutdown system with PCMK_panic_action=
  - Fix a memory leak in the attribute daemon
  - Add ability to list options and parameters as parseable metadata
  - crm_verify now reports invalid fence level indexes
  - Fix an error in node ID handling in `crm_node -i`
  - Fix regression in attrd_updater output
  - Resolves: RHEL-39057
  - Resolves: RHEL-40117
  - Resolves: RHEL-23401
  - Resolves: RHEL-2996
  - Resolves: RHEL-47249
  - Resolves: RHEL-45935


author: Chris Lumens <clumens@redhat.com> - 2.1.9-1
changelog:
  - Rebase on upstream 2.1.9 final release
  - Use async communication to establish TLS connections
  - Fix regression in adding alerts to CIB
  - Fix a crash in command line tools when stderr is closed
  - Resolves: RHEL-61382
  - Resolves: RHEL-34276
  - Resolves: RHEL-55458
  - Resolves: RHEL-59043


author: Chris Lumens <clumens@redhat.com> - 2.1.10-1
changelog:
  - Rebase on upstream 2.1.10-rc1 release
  - Use dbus to detect completion of systemd resource start/stop actions
  - Add an option for controlling remote node fencing behavior
  - Related: RHEL-89134
  - Resolves: RHEL-86143
  - Resolves: RHEL-84018


author: Chris Lumens <clumens@redhat.com> - 2.1.10-2
changelog:
  - Handle large timeouts correctly in crm_resource --wait
  - Do not try to connect to subdaemons before they're respawned
  - Don't evict IPC clients as long as they're still processing messages
  - Don't overwhelm the FSA queue with repeated CIB queries
  - Resolves: RHEL-45869
  - Resolves: RHEL-87484
  - Resolves: RHEL-114894


author: Chris Lumens <clumens@redhat.com> - 2.1.11-1
changelog:
  - Fix integer overflows in remote message decompression code (CVE-2026-10649)
  - Resolves: RHEL-181156


author: Paulo Alcantara <paalcant@redhat.com> - 7.0-4
changelog:
  - mount.cifs.rst: add missing reference for sssd
  - mount.cifs.rst: update section about xattr/acl support
  - Resolves: RHEL-22495


author: Peng Wu <pwu@redhat.com> - 1.48.7-3
changelog:
  - Update pango-emoji-table.h for emoji 14 support
  - Add pango-update-emoji.patch
  - Resolves: #2119674


author: Benjamin A. Beasley <code@musicinmybrain.net> - 2.42.2-3
changelog:
  - Use pkgconfig to BR the required cairomm API/ABI version 1.0 (vs. 1.16); use
    cairomm1.0, which may be a virtual Provides, in the manual lib Requires


author: RHEL Packaging Agent <jotnar@redhat.com> - 7.2.0-1
changelog:
  - Rebase to papi 7.2.0
  - Update license tag to BSD-3-Clause
  - Remove old patches and add new patches for 7.2.0 compatibility
  - Update configure options and package files
  - Resolves: RHEL-121673


author: Nathan Scott <nathans@redhat.com> - 6.3.7-5
changelog:
  - Backport some more fixes to the OpenMetrics PMDA (RHEL-54039)
  - Fix a multilib regression in PCP header files (RHEL-93186)
  - Fix python PMDA wrapper handling of list objects
  - Improve tmpfiles.d handling of empty directories


author: Lauren Chilton <lchilton@redhat.com> - 6.3.7-6
changelog:
  - Backport fix for pmdaopenmetrics metric removal (RHEL-101745)
  - Backport fix for pcp2openmetrics metric hanging (RHEL-106772)
  - Backport fix for atop cpu utilization bug (RHEL-79767)


author: Jan Kurik <jkurik@redhat.com> - 6.3.7-11
changelog:
  - Backport PCP security CVE fixes for RHEL 9.9
  - Fix integer overflow in __pmGetPDU() (CVE-2026-16529)
  - Fix missing pmproxy -Q/-S authentication flags (CVE-2026-16527)
  - Set FD_CLOEXEC on AF_UNIX sockets (CVE-2026-16526)
  - Fix command injection in linux_sockets PMDA (CVE-2026-16524)
  - Backport applicable private-pcp security hardening fixes
  - CVE-2026-16531 is not applicable (pmproxy logger servlet absent in 6.3.7)


author: Jan Kurik <jkurik@redhat.com> - 6.3.7-13
changelog:
  - Fix qa/2101 to stop using undefined $seq_full on PCP 6.3.7
  - Fix qa/2105 to ship malformed PDU test data for CVE-2026-16529


author: Petr Pisar <ppisar@redhat.com> - 8.43-3
changelog:
  - Make erroroffset initializion in a POSIX wrapper thread-safe
    (upstream bug #2447)
  - Fix an integer overflow when parsing numbers after "(?C" (upstream bug #2463)
  - Fix shifting integer bits and a NULL pointer dereferce in pcretest tool
    (upstream bug #2380)


author: Petr Pisar <ppisar@redhat.com> - 10.36-4
changelog:
  - Fix a mismatch if \K was involved in a recursion
  - Restore single character repetition optimization in JIT (upstream bug #2698)


author: Lukas Javorsky <ljavorsk@redhat.com> - 10.37-1
changelog:
  - Rebase to the 10.37
  - libpcre2-posix.so.2* SONAME bump to libpcre2-posix.so.3*
  - Enable JIT for s390x arch
  - Patches upstreamed: Patch 1,2,3,4
  - Resolves: rhbz#1970765, BZ#1965025


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-716.el9]
changelog:
  - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-183463]
  - tools/power turbostat: Fix unrecognized option '-P' (Dennis Chen) [RHEL-140922]
  - mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (David Arcari) [RHEL-117326]
  - crypto: krb5 - filter out async aead implementations at alloc (Ilya Dryomov) [RHEL-182254]
  - crypto: krb5enc - fix async decrypt skipping hash verification (Ilya Dryomov) [RHEL-182254]
  - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (Ilya Dryomov) [RHEL-182254]
  - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (Ilya Dryomov) [RHEL-182254]
  - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Desnes Nunes) [RHEL-147793]
  - xhci: sideband: don't dereference freed ring when removing sideband endpoint (Desnes Nunes) [RHEL-147793] {CVE-2026-23009}
  - phy: freescale: imx8m-pcie: assert phy reset during power on (Desnes Nunes) [RHEL-147793]
  - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Desnes Nunes) [RHEL-147793]
  - USB: serial: option: add Telit LE910 MBIM composition (Desnes Nunes) [RHEL-147793]
  - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Desnes Nunes) [RHEL-147793]
  - usb: dwc3: Check for USB4 IP_NAME (Desnes Nunes) [RHEL-147793]
  - phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Desnes Nunes) [RHEL-147793]
  - phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Desnes Nunes) [RHEL-147793]
  - Revert "usb: typec: ucsi: Update UCSI structure to have message in and message out fields" (Desnes Nunes) [RHEL-147793]
  - Revert "usb: typec: ucsi: Add support for message out data structure" (Desnes Nunes) [RHEL-147793]
  - Revert "usb: typec: ucsi: Enable debugfs for message_out data structure" (Desnes Nunes) [RHEL-147793]
  - Revert "usb: typec: ucsi: Add support for SET_PDOS command" (Desnes Nunes) [RHEL-147793]
  - Revert "usb: typec: ucsi: Fix null pointer dereference in ucsi_sync_control_common" (Desnes Nunes) [RHEL-147793]
  - Revert "usb: typec: ucsi: Get connector status after enable notifications" (Desnes Nunes) [RHEL-147793]
  - usb: typec: ucsi: Get connector status after enable notifications (Desnes Nunes) [RHEL-147793]
  - usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Desnes Nunes) [RHEL-147793]
  - usb: typec: ucsi: Fix null pointer dereference in ucsi_sync_control_common (Desnes Nunes) [RHEL-147793]
  - usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() (Desnes Nunes) [RHEL-147793]
  - usb: dwc3: keep susphy enabled during exit to avoid controller faults (Desnes Nunes) [RHEL-147793]
  - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (Desnes Nunes) [RHEL-147793]
  - USB: serial: option: move Telit 0x10c7 composition in the right place (Desnes Nunes) [RHEL-147793]
  - USB: serial: option: add Telit Cinterion FE910C04 new compositions (Desnes Nunes) [RHEL-147793]
  - usb: dwc3: core: Remove redundant comment in core init (Desnes Nunes) [RHEL-147793]
  - usb: phy: Initialize struct usb_phy list_head (Desnes Nunes) [RHEL-147793]
  - USB: serial: option: add Foxconn T99W760 (Desnes Nunes) [RHEL-147793]
  - usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Desnes Nunes) [RHEL-147793]
  - USB: add WQ_PERCPU to alloc_workqueue users (Desnes Nunes) [RHEL-147793]
  - USB: mon: make mon_bin_class a static const structure (Desnes Nunes) [RHEL-147793]
  - USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Desnes Nunes) [RHEL-147793]
  - USB: gadget: f_hid: Add GET_REPORT via userspace IOCTL (Desnes Nunes) [RHEL-147793]
  - usb: gadget: f_hid: fix report descriptor allocation (Desnes Nunes) [RHEL-147793]
  - USB: gadget: f_hid: make hidg_class a static const structure (Desnes Nunes) [RHEL-147793]
  - usb: gadget: f_hid: tidy error handling in hidg_alloc (Desnes Nunes) [RHEL-147793]
  - usb: gadget: f_hid: fix refcount leak on error path (Desnes Nunes) [RHEL-147793] {CVE-2022-50514}
  - usb: gadget: f_hid: fix f_hidg lifetime vs cdev (Desnes Nunes) [RHEL-147793] {CVE-2022-50568}
  - drivers/usb/storage: use min() instead of min_t() (Desnes Nunes) [RHEL-147793]
  - usb: uas: reduce time under spinlock (Desnes Nunes) [RHEL-147793]
  - dt-bindings: usb: Fix EIC7700 USB reset's issue (Desnes Nunes) [RHEL-147793]
  - usb: dwc3: eic7700: Add EIC7700 USB driver (Desnes Nunes) [RHEL-147793]
  - dt-bindings: usb: Add ESWIN EIC7700 USB controller (Desnes Nunes) [RHEL-147793]
  - usb: typec: ucsi: Add support for SET_PDOS command (Desnes Nunes) [RHEL-147793]
  - usb: typec: ucsi: Enable debugfs for message_out data structure (Desnes Nunes) [RHEL-147793]
  - usb: typec: ucsi: Add support for message out data structure (Desnes Nunes) [RHEL-147793]
  - usb: typec: ucsi: Update UCSI structure to have message in and message out fields (Desnes Nunes) [RHEL-147793]
  - uapi: cdc.h: cleanly provide for more interfaces and countries (Desnes Nunes) [RHEL-147793]
  - usb: Remove redundant pm_runtime_mark_last_busy() calls (Desnes Nunes) [RHEL-147793]
  - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Desnes Nunes) [RHEL-147793] {CVE-2025-40314}
  - scsi: pm: Drop unneeded call to pm_runtime_mark_last_busy() (Desnes Nunes) [RHEL-147793]
  - redhat/configs: Adding CONFIG_PM_RUNTIME_KUNIT_TEST (Desnes Nunes) [RHEL-147793]
  - PM: runtime: Update kerneldoc return codes (Desnes Nunes) [RHEL-147793]
  - PM: runtime: Make put{,_sync}() return 1 when already suspended (Desnes Nunes) [RHEL-147793]
  - PM: runtime: Add basic kunit tests for API contracts (Desnes Nunes) [RHEL-147793]
  - Documentation: PM: *_autosuspend() functions update last busy time (Desnes Nunes) [RHEL-147793]
  - PM: runtime: Mark last busy stamp in pm_request_autosuspend() (Desnes Nunes) [RHEL-147793]
  - PM: runtime: Mark last busy stamp in pm_runtime_autosuspend() (Desnes Nunes) [RHEL-147793]
  - Documentation: PM: runtime: Fix a reference to pm_runtime_autosuspend() (Desnes Nunes) [RHEL-147793]
  - PM: runtime: Mark last busy stamp in pm_runtime_put_sync_autosuspend() (Desnes Nunes) [RHEL-147793]
  - PM: runtime: Mark last busy stamp in pm_runtime_put_autosuspend() (Desnes Nunes) [RHEL-147793]
  - PM: runtime: Document return values of suspend-related API functions (Desnes Nunes) [RHEL-147793]
  - PM: runtime: Add pm_runtime_put_autosuspend() replacement (Desnes Nunes) [RHEL-147793]
  - PM: runtime: Remove unsued extern declaration of pm_runtime_update_max_time_suspended() (Desnes Nunes) [RHEL-147793]
  - PM: runtime: Fix pm_runtime_active() kerneldoc comment (Desnes Nunes) [RHEL-147793]
  - usb: host: ehci-platform: Call reset assert/deassert on suspend/resume (Desnes Nunes) [RHEL-147793]
  - usb: host: Do not check priv->clks[clk] (Desnes Nunes) [RHEL-147793]
  - usb: typec: tipd: mark as orientation aware (Desnes Nunes) [RHEL-147793]
  - usb: uas: add WQ_PERCPU to alloc_workqueue users (Desnes Nunes) [RHEL-147793]
  - usb: dwc3: replace use of system_wq with system_percpu_wq (Desnes Nunes) [RHEL-147793]
  - usb: typec: ucsi: Set orientation_aware if UCSI version is 2.x and above (Desnes Nunes) [RHEL-147793]
  - usb: chaoskey: fix locking for O_NONBLOCK (Desnes Nunes) [RHEL-147793]
  - xhci: Fix NULL pointer dereference when reading portli debugfs files (Desnes Nunes) [RHEL-147793] {CVE-2026-43431}
  - usb: xhci: Add debugfs support for xHCI Port Link Info (PORTLI) register. (Desnes Nunes) [RHEL-147793]
  - usb: xhci: standardize single bit-field macros (Desnes Nunes) [RHEL-147793]
  - usb: xhci: drop xhci-caps.h dependence on xhci-ext-caps.h (Desnes Nunes) [RHEL-147793]
  - usb: xhci: simplify Max Scratchpad buffer macros (Desnes Nunes) [RHEL-147793]
  - usb: xhci: simplify Isochronous Scheduling Threshold handling (Desnes Nunes) [RHEL-147793]
  - usb: xhci: improve xhci-caps.h comments (Desnes Nunes) [RHEL-147793]
  - usb: xhci: limit number of interrupts to 128 (Desnes Nunes) [RHEL-147793]
  - usb: xhci: limit number of ports to 127 (Desnes Nunes) [RHEL-147793]
  - usb: xhci: simplify handling of Structural Parameters 1 values (Desnes Nunes) [RHEL-147793]
  - usb: xhci: use cached HCSPARAMS1 value (Desnes Nunes) [RHEL-147793]
  - usb: xhci: remove unused trace operation and argument (Desnes Nunes) [RHEL-147793]
  - usb: xhci: remove deprecated TODO comment (Desnes Nunes) [RHEL-147793]
  - usb: xhci: replace use of system_wq with system_percpu_wq (Desnes Nunes) [RHEL-147793]
  - usb: xhci: Don't unchain link TRBs on quirky HCs (Desnes Nunes) [RHEL-147793]
  - usb: xhci: Assume that endpoints halt as specified (Desnes Nunes) [RHEL-147793]
  - usb: xhci: implement USB Port Register Set struct (Desnes Nunes) [RHEL-147793]
  - usb: xhci: add USB Port Register Set struct (Desnes Nunes) [RHEL-147793]
  - usb: xhci: add helper to read PORTSC register (Desnes Nunes) [RHEL-147793]
  - usb: xhci: add tracing for PORTSC register writes (Desnes Nunes) [RHEL-147793]
  - usb: xhci: rework xhci_decode_portsc() (Desnes Nunes) [RHEL-147793]
  - xhci: simplify and rework trb_in_td() (Desnes Nunes) [RHEL-147793]
  - xhci: Add helper to find trb from its dma address (Desnes Nunes) [RHEL-147793]
  - usb: xhci: limit run_graceperiod for only usb 3.0 devices (Desnes Nunes) [RHEL-147793]
  - phy: fsl-imx8mq-usb: support alternate reference clock (Desnes Nunes) [RHEL-147793]
  - dt-bindings: phy: imx8mq-usb: add alternate reference clock (Desnes Nunes) [RHEL-147793]
  - usb: dwc3: imx8mp: Set out of band wakeup for i.MX95 (Desnes Nunes) [RHEL-147793]
  - usb: chipidea: ci_hdrc_imx: Set out of band wakeup for i.MX95 (Desnes Nunes) [RHEL-147793]
  - usb: chipidea: core: detach power domain for ci_hdrc platform device (Desnes Nunes) [RHEL-147793]
  - phy: core: Remove extra space after '=' (Desnes Nunes) [RHEL-147793]
  - phy: add new phy_notify_state() api (Desnes Nunes) [RHEL-147793]
  - USB: serial: ftdi_sio: drop NDI quirk module parameter (Desnes Nunes) [RHEL-147793]
  - USB: serial: ftdi_sio: clean up NDI speed hack (Desnes Nunes) [RHEL-147793]
  - USB: serial: ftdi_sio: enable NDI speed hack consistently (Desnes Nunes) [RHEL-147793]
  - USB: serial: ftdi_sio: rename quirk symbols (Desnes Nunes) [RHEL-147793]
  - USB: serial: ftdi_sio: clean up quirk comments (Desnes Nunes) [RHEL-147793]
  - USB: serial: ftdi_sio: rewrite 8u2232c quirk (Desnes Nunes) [RHEL-147793]
  - USB: serial: ftdi_sio: silence jtag probe (Desnes Nunes) [RHEL-147793]
  - USB: serial: ftdi_sio: match on interface number for jtag (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Fix typos in xdomain.c (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Fix typos in usb4.c (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Fix typos in tunnel.c (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Fix typos in tmu.c (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Fix typos in tb_regs.h (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Fix typos in tb.h (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Fix typos in tb.c (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Fix typos in switch.c (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Fix typos in retimer.c (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Fix typos in nhi.c (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Fix typos in lc.c (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Fix typos in icm.c (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Fix typos in domain.c (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Fix typos in debugfs.c (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Fix typos in ctl.c (Desnes Nunes) [RHEL-147793]
  - dt-bindings: usb: Add wake-up support for Tegra234 XUSB host controller (Desnes Nunes) [RHEL-147793]
  - usbnet: fix crash due to missing BQL accounting after resume (Desnes Nunes) [RHEL-147793]
  - usbnet: avoid a possible crash in dql_completed() (Desnes Nunes) [RHEL-147793]
  - net: usb: usbnet: adhere to style (Desnes Nunes) [RHEL-147793]
  - usbnet: Add support for Byte Queue Limits (BQL) (Desnes Nunes) [RHEL-147793]
  - net: usb: usbnet: coding style for functions (Desnes Nunes) [RHEL-147793]
  - usbnet: Prevents free active kevent (Desnes Nunes) [RHEL-147793] {CVE-2025-68312}
  - usbnet: Fix memory leak in usbnet_disconnect() (Desnes Nunes) [RHEL-147793]
  - net: usb: usbnet: restore usb%d name exception for local mac addresses (Desnes Nunes) [RHEL-147793]
  - net: usb: usbnet: fix name regression (Desnes Nunes) [RHEL-147793]
  - usbnet: modern method to get random MAC (Desnes Nunes) [RHEL-147793]
  - drivers/net/usb: Remove all strcpy() uses (Desnes Nunes) [RHEL-147793]
  - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (Desnes Nunes) [RHEL-147793] {CVE-2023-53548}
  - thunderbolt: Replace use of system_wq with system_percpu_wq (Desnes Nunes) [RHEL-147793]
  - Documentation: treewide: Replace marc.info links with lore (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Update deprecated firmware update site in icm.c (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Update NVM firmware upgrade documentation (Desnes Nunes) [RHEL-147793]
  - usb: typec: ucsi: Add support for orientation (Desnes Nunes) [RHEL-147793]
  - usb: typec: ucsi: Add SET_POWER_LEVEL UCSI command to debugfs (Desnes Nunes) [RHEL-147793]
  - USB: serial: kobil_sct: drop unnecessary initialisations (Desnes Nunes) [RHEL-147793]
  - USB: serial: kobil_sct: clean up set_termios() (Desnes Nunes) [RHEL-147793]
  - USB: serial: kobil_sct: add control request helpers (Desnes Nunes) [RHEL-147793]
  - USB: serial: kobil_sct: clean up device type checks (Desnes Nunes) [RHEL-147793]
  - USB: serial: kobil_sct: clean up tiocmset() (Desnes Nunes) [RHEL-147793]
  - USB: serial: belkin_sa: clean up tiocmset() (Desnes Nunes) [RHEL-147793]
  - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (Desnes Nunes) [RHEL-147793]
  - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (Desnes Nunes) [RHEL-147793]
  - usb: dwc3: Allow usb role swich control from userspace (Desnes Nunes) [RHEL-147793]
  - dt-bindings: usb: qcom,dwc3: Correct MSM8994 interrupts (Desnes Nunes) [RHEL-147793]
  - dt-bindings: usb: qcom,dwc3: Correct IPQ5018 interrupts (Desnes Nunes) [RHEL-147793]
  - dt-bindings: usb: qcom,snps-dwc3: Add the SM8750 compatible (Desnes Nunes) [RHEL-147793]
  - dt-bindings: usb: qcom,snps-dwc3: Add Glymur compatible (Desnes Nunes) [RHEL-147793]
  - dt-bindings: usb: qcom,snps-dwc3: Add Kaanapali compatible (Desnes Nunes) [RHEL-147793]
  - dt-bindings: usb: qcom,snps-dwc3: Add Milos compatible (Desnes Nunes) [RHEL-147793]
  - usb: uhci: Work around bogus clang shift overflow warning from DMA_BIT_MASK(64) (Desnes Nunes) [RHEL-147793]
  - usb: typec: ps883x: Fix missing mutex_unlock() (Desnes Nunes) [RHEL-147793]
  - usb: typec: ps883x: Add USB4 mode and TBT3 altmode support (Desnes Nunes) [RHEL-147793]
  - usb: typec: ps883x: Rework ps883x_set() (Desnes Nunes) [RHEL-147793]
  - usb: typec: ps883x: Cache register settings, not Type-C mode (Desnes Nunes) [RHEL-147793]
  - usb: typec: ps883x: fix configuration error handling (Desnes Nunes) [RHEL-147793]
  - usb: typec: ps883x: fix missing accessibility check (Desnes Nunes) [RHEL-147793]
  - usb: typec: ps883x: fix registration race (Desnes Nunes) [RHEL-147793]
  - usb: typec: ps883x: fix probe error handling (Desnes Nunes) [RHEL-147793]
  - usb: typec: ucsi: Report power supply change on sink path change (Desnes Nunes) [RHEL-147793]
  - usb: typec: ucsi: Report power supply changes on power opmode changes (Desnes Nunes) [RHEL-147793]
  - usb: typec: ucsi: psy: Add power supply status (Desnes Nunes) [RHEL-147793]
  - usb: dwc3: glue: Allow more fine grained control over mode switches (Desnes Nunes) [RHEL-147793]
  - usb: dwc3: glue: Add documentation (Desnes Nunes) [RHEL-147793]
  - usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required (Desnes Nunes) [RHEL-147793]
  - usb: typec: pd: Register SPR AVS caps with usb_power_delivery class (Desnes Nunes) [RHEL-147793]
  - tcpm: Parse and log AVS APDO (Desnes Nunes) [RHEL-147793]
  - usbip: Use min to simplify stub_send_ret_submit (Desnes Nunes) [RHEL-147793]
  - usb: core: Add tracepoints for device allocation and state changes (Desnes Nunes) [RHEL-147793]
  - usb: core: Centralize device state update logic (Desnes Nunes) [RHEL-147793]
  - thunderbolt: Fix typo in tb_eeprom_ctl_read documentation (Desnes Nunes) [RHEL-147793]
  - usb: vhci-hcd: Replace pr_*() with dev_*() logging (Desnes Nunes) [RHEL-147793]
  - usb: vhci-hcd: Switch to dev_err_probe() in probe path (Desnes Nunes) [RHEL-147793]
  - usb: typec: ucsi: Handle incorrect num_connectors capability (Desnes Nunes) [RHEL-147793] {CVE-2025-71108}
  - USB: Fix descriptor count when handling invalid MBIM extended descriptor (Desnes Nunes) [RHEL-147793]
  - usb: dwc3: dwc3-generic-plat: Add layerscape dwc3 support (Desnes Nunes) [RHEL-147793]
  - usb: dwc3: Add software-managed properties for flattened model (Desnes Nunes) [RHEL-147793]
  - dt-bindings: usb: add missed compatible string for arm64 layerscape (Desnes Nunes) [RHEL-147793]
  - dt-bindings: usb: add layerscape super speed usb support (Desnes Nunes) [RHEL-147793]
  - usb: typec: altmodes/displayport: do not enter mode if port is the UFP (Desnes Nunes) [RHEL-147793]
  - usb: typec: class: add typec_get_data_role symbol (Desnes Nunes) [RHEL-147793]
  - usb: chipidea: imx: add USB support for i.MX94 (Desnes Nunes) [RHEL-147793]
  - dt-bindings: usb: usbmisc-imx: add fsl,imx94-usbmisc compatible (Desnes Nunes) [RHEL-147793]
  - usb: typec: tipd: Fix error handling in cd321x_read_data_status (Desnes Nunes) [RHEL-147793]
  - dt-bindings: usb: xhci: Add "generic-xhci" compatible for Marvell Armada 37xx/8k (Desnes Nunes) [RHEL-147793]
  - dt-bindings: usb: xhci: Allow "iommus" and "dr_mode" properties (Desnes Nunes) [RHEL-147793]
  - usb: hub: Use max() to improve usb_set_lpm_pel() (Desnes Nunes) [RHEL-147793]
  - usbip: Fix locking bug in RT-enabled kernels (Desnes Nunes) [RHEL-147793]
  - usb: usbtmc: Remove unnecessary local variable from usbtmc_ioctl_request (Desnes Nunes) [RHEL-147793]
  - usb: ehci: Add Aspeed AST2700 support (Desnes Nunes) [RHEL-147793]
  - dt-bindings: usb: ehci: Add Aspeed AST2700 compatible (Desnes Nunes) [RHEL-147793]
  - usb: uhci: Add Aspeed AST2700 support (Desnes Nunes) [RHEL-147793]
  - dt-bindings: usb: uhci: Add Aspeed AST2700 compatible (Desnes Nunes) [RHEL-147793]
  - usb: uhci: Add reset control support (Desnes Nunes) [RHEL-147793]
  - dt-bindings: usb: uhci: Add reset property (Desnes Nunes) [RHEL-147793]
  - usb: core: Drop spaces after function names (Desnes Nunes) [RHEL-147793]
  - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180305] {CVE-2026-43260}
  - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179595] {CVE-2026-45984}
  - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179595] {CVE-2026-45984}
  - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179711] {CVE-2026-45852}
  - livepatch: Match old_sympos 0 and 1 in klp_find_func() (Rado Vrbovsky) [RHEL-152191]
  - selftests: livepatch: use canonical ftrace path (Rado Vrbovsky) [RHEL-152191]
  - objtool/x86: Reorder ORC register numbering (Rado Vrbovsky) [RHEL-152187]
  - objtool: Support Clang RAX DRAP sequence (Rado Vrbovsky) [RHEL-152187]
  - objtool: Fix Clang jump table detection (Rado Vrbovsky) [RHEL-152187]
  - objtool: Handle Clang RSP musical chairs (Rado Vrbovsky) [RHEL-152187]
  - objtool: Fix ERROR_INSN() error message (Rado Vrbovsky) [RHEL-152187]
  - kbuild: Leave objtool binary around with 'make clean' (Rado Vrbovsky) [RHEL-152187]
  - kbuild: Add objtool to top-level clean target (Rado Vrbovsky) [RHEL-152187]
  - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175822]
  - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175822]
  - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175819]
  - dpll: add pin operational state (Ivan Vecera) [RHEL-175819]
  - nfsd: fix file change detection in CB_GETATTR (Olga Kornievskaia) [RHEL-171546]
  - Revert "nfsd: don't set the ctime on delegated atime updates" (Olga Kornievskaia) [RHEL-171546]
  - NFS: Fix RCU dereference of cl_xprt in nfs_compare_super_address (Olga Kornievskaia) [RHEL-171546]
  - NFSv4.2: fix CLONE/COPY attrs in presence of delegated attributes (Olga Kornievskaia) [RHEL-171546]
  - pnfs/flexfiles: validate ds_versions_cnt is non-zero (Olga Kornievskaia) [RHEL-171546]
  - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot (Olga Kornievskaia) [RHEL-171546]
  - xprtrdma: Avoid 250 ms delay on backlog wakeup (Olga Kornievskaia) [RHEL-171546]
  - xprtrdma: Close sendctx get/put race that can block a transport (Olga Kornievskaia) [RHEL-171546]
  - nfs: update inode ctime after removexattr operation (Olga Kornievskaia) [RHEL-171546]
  - nfs: fix utimensat() for atime with delegated timestamps (Olga Kornievskaia) [RHEL-171546]
  - NFS: Fix LTP test failures when timestamps are delegated (Olga Kornievskaia) [RHEL-171546] {CVE-2025-68242}
  - NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Olga Kornievskaia) [RHEL-171546]
  - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-171546]
  - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() (Olga Kornievskaia) [RHEL-171546]
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Olga Kornievskaia) [RHEL-171546] {CVE-2026-31402}
  - sunrpc: fix cache_request leak in cache_release (Olga Kornievskaia) [RHEL-171546] {CVE-2026-31400}
  - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (Olga Kornievskaia) [RHEL-171546] {CVE-2026-31403}
  - NFSD: Defer sub-object cleanup in export put callbacks (Olga Kornievskaia) [RHEL-171546] {CVE-2026-31404}
  - NFSD: fix race between nfsd registration and exports_proc (Olga Kornievskaia) [RHEL-171546] {CVE-2025-38232}
  - xprtrdma: Decrement re_receiving on the early exit paths (Olga Kornievskaia) [RHEL-171546] {CVE-2026-43469}
  - nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit(). (Olga Kornievskaia) [RHEL-171546] {CVE-2026-43394}
  - nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit(). (Olga Kornievskaia) [RHEL-171546] {CVE-2026-23297}
  - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Olga Kornievskaia) [RHEL-171546]
  - fs/nfs: Fix readdir slow-start regression (Olga Kornievskaia) [RHEL-171546]
  - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Olga Kornievskaia) [RHEL-171546]
  - nfsd: fix return error code for nfsd_map_name_to_[ug]id (Olga Kornievskaia) [RHEL-171546]
  - nfsd: never defer requests during idmap lookup (Olga Kornievskaia) [RHEL-171546]
  - pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Olga Kornievskaia) [RHEL-171546]
  - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Olga Kornievskaia) [RHEL-171546] {CVE-2026-23038}
  - pNFS: Fix a deadlock when returning a delegation during open() (Olga Kornievskaia) [RHEL-171546] {CVE-2026-23050}
  - nfsd: provide locking for v4_end_grace (Olga Kornievskaia) [RHEL-171546] {CVE-2026-22980}
  - NFSD: Remove NFSERR_EAGAIN (Olga Kornievskaia) [RHEL-171546]
  - NFS: trace: show TIMEDOUT instead of 0x6e (Olga Kornievskaia) [RHEL-171546]
  - nfsd: Drop the client reference in client_states_open() (Olga Kornievskaia) [RHEL-171546]
  - lockd: fix vfs_test_lock() calls (Olga Kornievskaia) [RHEL-171546]
  - NFSD: NFSv4 file creation neglects setting ACL (Olga Kornievskaia) [RHEL-171546] {CVE-2025-68803}
  - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Olga Kornievskaia) [RHEL-171546]
  - net/handshake: restore destructor on submit failure (Olga Kornievskaia) [RHEL-171546] {CVE-2025-71148}
  - nfsd: Mark variable __maybe_unused to avoid W=1 build break (Olga Kornievskaia) [RHEL-171546]
  - svcrdma: return 0 on success from svc_rdma_copy_inline_range (Olga Kornievskaia) [RHEL-171546]
  - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Olga Kornievskaia) [RHEL-171546] {CVE-2025-71120}
  - NFS: Fix up the automount fs_context to use the correct cred (Olga Kornievskaia) [RHEL-171546]
  - NFS: Fix inheritance of the block sizes when automounting (Olga Kornievskaia) [RHEL-171546]
  - Revert "nfs: ignore SB_RDONLY when mounting nfs" (Olga Kornievskaia) [RHEL-171546]
  - Revert "nfs: clear SB_RDONLY before getting superblock" (Olga Kornievskaia) [RHEL-171546]
  - Revert "nfs: ignore SB_RDONLY when remounting nfs" (Olga Kornievskaia) [RHEL-171546]
  - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (Olga Kornievskaia) [RHEL-171546] {CVE-2025-68764}
  - fs_context: drop the unused lsm_flags member (Olga Kornievskaia) [RHEL-171546]
  - NFSD: use correct reservation type in nfsd4_scsi_fence_client (Olga Kornievskaia) [RHEL-171546]
  - NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state (Olga Kornievskaia) [RHEL-171546]
  - nfs/vfs: discard d_exact_alias() (Olga Kornievskaia) [RHEL-171546]
  - NFS: Initialise verifiers for visible dentries in nfs_atomic_open() (Olga Kornievskaia) [RHEL-171546]
  - NFS: Initialise verifiers for visible dentries in readdir and lookup (Olga Kornievskaia) [RHEL-171546]
  - NFS: Avoid changing nlink when file removes and attribute updates race (Olga Kornievskaia) [RHEL-171546]
  - NFSD/blocklayout: Fix minlength check in proc_layoutget (Olga Kornievskaia) [RHEL-171546]
  - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174333]
  - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174333]
  - dmaengine: idxd: Add Max SGL Size Support for DSA3.0 (Eder Zulian) [RHEL-154486]
  - dmaengine: idxd: Expose DSA3.0 capabilities through sysfs (Eder Zulian) [RHEL-154486]
  - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock (Eder Zulian) [RHEL-172444]
  - dmaengine: sh: rz-dmac: Protect the driver specific lists (Eder Zulian) [RHEL-172444]
  - dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (Eder Zulian) [RHEL-172444]
  - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (Eder Zulian) [RHEL-172444]
  - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. (Eder Zulian) [RHEL-172444]
  - dmaengine: idxd: Fix leaking event log memory (Eder Zulian) [RHEL-172444]
  - dmaengine: idxd: Fix freeing the allocated ida too late (Eder Zulian) [RHEL-172444]
  - dmaengine: idxd: Fix memory leak when a wq is reset (Eder Zulian) [RHEL-172444]
  - dmaengine: idxd: Fix not releasing workqueue on .release() (Eder Zulian) [RHEL-172444]
  - dmaengine: idxd: Wait for submitted operations on .device_synchronize() (Eder Zulian) [RHEL-172444]
  - dmaengine: idxd: Flush all pending descriptors (Eder Zulian) [RHEL-172444]
  - dmaengine: idxd: Flush kernel workqueues on Function Level Reset (Eder Zulian) [RHEL-172444]
  - dmaengine: idxd: Fix possible invalid memory access after FLR (Eder Zulian) [RHEL-172444]
  - dmaengine: idxd: Fix crash when the event log is disabled (Eder Zulian) [RHEL-172444]
  - dmaengine: omap-dma: fix dma_pool resource leak in error paths (Eder Zulian) [RHEL-172444]
  - dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Eder Zulian) [RHEL-172444]
  - dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Eder Zulian) [RHEL-172444]
  - dmaengine: tegra-adma: Fix use-after-free (Eder Zulian) [RHEL-172444]
  - dmaengine: ti: k3-udma: fix device leak on udma lookup (Eder Zulian) [RHEL-172444]
  - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Eder Zulian) [RHEL-172444]
  - dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Eder Zulian) [RHEL-172444]
  - dmaengine: sh: rz-dmac: fix device leak on probe failure (Eder Zulian) [RHEL-172444]
  - dmaengine: idxd: fix device leaks on compat bind and unbind (Eder Zulian) [RHEL-172444]
  - dmaengine: tegra210-adma: drop unused module alias (Eder Zulian) [RHEL-172444]
  - dmaengine: dw: drop unused module alias (Eder Zulian) [RHEL-172444]
  - dmaengine: bcm2835: drop unused module alias (Eder Zulian) [RHEL-172444]
  - dmaengine: qcom: gpi: Add GPI Block event interrupt support (Eder Zulian) [RHEL-172444]
  - dmaengine: idxd: drain ATS translations when disabling WQ (Eder Zulian) [RHEL-172444]
  - dmaengine: sh: Kconfig: Drop ARCH_R7S72100/ARCH_RZG2L dependency (Eder Zulian) [RHEL-172444]
  - dmaengine: rcar-dmac: Convert to NOIRQ_SYSTEM_SLEEP/RUNTIME_PM_OPS() (Eder Zulian) [RHEL-172444]
  - dmaengine: rcar-dmac: Remove dummy Runtime PM callback (Eder Zulian) [RHEL-172444]
  - dmaengine: sh: usb-dmac: Convert to NOIRQ_SYSTEM_SLEEP/RUNTIME_PM_OPS() (Eder Zulian) [RHEL-172444]
  - dmaengine: dw-edma: Set status for callback_result (Eder Zulian) [RHEL-172444]
  - dmaengine: Fix dma_async_tx_descriptor->tx_submit documentation (Eder Zulian) [RHEL-172444]
  - dmaengine: sh: setup_xref error handling (Eder Zulian) [RHEL-172444]
  - dmaengine: Replace zero-length array with flexible-array (Eder Zulian) [RHEL-172444]
  - dmaengine: idxd: Replace memset(0) + strscpy() with strscpy_pad() (Eder Zulian) [RHEL-172444]
  - dmaengine: idxd: Allow registers.h to be included from tools/ (Eder Zulian) [RHEL-172444]
  - dmaengine: ioat: Move system_has_dca_enabled() to dma.h (Eder Zulian) [RHEL-172444]
  - ACPICA: Provide #defines for EINJV2 error types (Mark Langsdorf) [RHEL-169029]
  - ACPICA: actbl1: Add EINJv2 get error type action (Mark Langsdorf) [RHEL-169029]
  - ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Mark Langsdorf) [RHEL-169029]
  - ACPI: APEI: EINJ: Clean up on error in einj_probe() (Mark Langsdorf) [RHEL-169029]
  - ACPI: APEI: EINJ: Fix EINJV2 memory error injection (Mark Langsdorf) [RHEL-169029]
  - ACPI: APEI: EINJ: Fix EINJV2 initialization and injection (Mark Langsdorf) [RHEL-169029]
  - ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Mark Langsdorf) [RHEL-169029]
  - ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Mark Langsdorf) [RHEL-169029]
  - ACPI: APEI: EINJ: Fix trigger actions (Mark Langsdorf) [RHEL-169029]
  - ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Mark Langsdorf) [RHEL-169029]
  - ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Mark Langsdorf) [RHEL-169029]
  - ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Mark Langsdorf) [RHEL-169029]
  - ACPI: APEI: EINJ: Enable EINJv2 error injections (Mark Langsdorf) [RHEL-169029]
  - ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Mark Langsdorf) [RHEL-169029]
  - ACPI: APEI: EINJ: Discover EINJv2 parameters (Mark Langsdorf) [RHEL-169029]
  - ACPI: APEI: EINJ: Add einjv2 extension struct (Mark Langsdorf) [RHEL-169029]
  - ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Mark Langsdorf) [RHEL-169029]
  - ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Mark Langsdorf) [RHEL-169029]
  - ACPI: APEI: EINJ: Fix kernel test sparse warnings (Mark Langsdorf) [RHEL-169029]
  - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-151897]
  - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-151897]
  - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-151897]
  - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-159916]
  - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-151898]
  - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-152411]
  - rtmutex: Use waiter::task instead of current in remove_waiter() (Waiman Long) [RHEL-171802]
  - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170540] {CVE-2026-31508}
  - ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states (Mark Langsdorf) [RHEL-156421]
  - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (Mark Langsdorf) [RHEL-156421]
  - ACPI: video: Clear driver_data pointer on remove (Mark Langsdorf) [RHEL-156421]
  - drm/amdgpu: Fix ISP segfault issue in kernel v7.0 (Mark Langsdorf) [RHEL-156421]
  - ACPICA: Update the format of Arg3 of _DSM (Mark Langsdorf) [RHEL-156421]
  - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() (Mark Langsdorf) [RHEL-156421]
  - ACPICA: Update the _CPC definition to match ACPI 6.6 (Mark Langsdorf) [RHEL-156421]
  - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 (Mark Langsdorf) [RHEL-156421]
  - ACPI: PM: Save NVS memory on Lenovo G70-35 (Mark Langsdorf) [RHEL-156421]
  - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Mark Langsdorf) [RHEL-156421]
  - ACPI: button: Tweak acpi_button_remove() (Mark Langsdorf) [RHEL-156421]
  - ACPI: button: Tweak system wakeup handling (Mark Langsdorf) [RHEL-156421]
  - ACPI: battery: Drop redundant checks from acpi_battery_remove() (Mark Langsdorf) [RHEL-156421]
  - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Mark Langsdorf) [RHEL-156421]
  - ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Mark Langsdorf) [RHEL-156421]
  - ACPI: button: Call device_init_wakeup() earlier during probe (Mark Langsdorf) [RHEL-156421]
  - ACPI: battery: Drop redundant check from acpi_battery_notify() (Mark Langsdorf) [RHEL-156421]
  - ACPI: battery: fix incorrect charging status when current is zero (Mark Langsdorf) [RHEL-156421]
  - hwmon: (acpi_power_meter) Replace deprecated strcpy() with strscpy() (Mark Langsdorf) [RHEL-156421]
  - hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify() (Mark Langsdorf) [RHEL-156421]
  - ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() (Mark Langsdorf) [RHEL-156421]
  - ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Mark Langsdorf) [RHEL-156421]
  - ACPI: sysfs: Replace sprintf() with sysfs_emit() (Mark Langsdorf) [RHEL-156421]
  - ACPI: CPPC: Rename EPP constants for clarity (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor: idle: Rework the handling of acpi_processor_ffh_lpi_probe() (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_dev() to void (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_states() to void (Mark Langsdorf) [RHEL-156421]
  - ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu() (Mark Langsdorf) [RHEL-156421]
  - ACPI: CPPC: Clean up cppc_perf_caps and cppc_perf_ctrls structs (Mark Langsdorf) [RHEL-156421]
  - ACPI: PCI: simplify code with acpi_get_local_u64_address() (Mark Langsdorf) [RHEL-156421]
  - ACPI: video: simplify code with acpi_get_local_u64_address() (Mark Langsdorf) [RHEL-156421]
  - ACPI: PM: Adjust messages regarding postponed ACPI PM (Mark Langsdorf) [RHEL-156421]
  - ACPI: x86: s2idle: Remove dead code in lps0_device_attach() (Mark Langsdorf) [RHEL-156421]
  - x86/acpi: Add acpi=spcr to use SPCR-provided default console (Mark Langsdorf) [RHEL-156421]
  - ACPICA: actbl3.h: ACPI 6.6: SRAT: New flag in Memory Affinity Structure (Mark Langsdorf) [RHEL-156421]
  - ACPICA: ACPI 6.6: Add _VDM (Voltage Domain) object (Mark Langsdorf) [RHEL-156421]
  - ACPICA: Fix asltests using the Fatal() opcode (Mark Langsdorf) [RHEL-156421]
  - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Mark Langsdorf) [RHEL-156421]
  - ACPICA: Add support for the Microsoft display mux _OSI string (Mark Langsdorf) [RHEL-156421]
  - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Mark Langsdorf) [RHEL-156421]
  - ACPICA: ACPICA: replace ACPI_FREE() with acpi_ut_delete_object_desc() (Mark Langsdorf) [RHEL-156421]
  - ACPI: scan: Clean up after recent changes (Mark Langsdorf) [RHEL-156421]
  - ACPI: scan: Use acpi_setup_gpe_for_wake() for buttons (Mark Langsdorf) [RHEL-156421]
  - ACPI: video: Convert the driver to a platform one (Mark Langsdorf) [RHEL-156421]
  - ACPI: video: Adjust event notification routine (Mark Langsdorf) [RHEL-156421]
  - ACPI: scan: Register platform devices for backlight device objects (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor: idle: Add debug log for states with invalid entry methods (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Mark Langsdorf) [RHEL-156421]
  - ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Mark Langsdorf) [RHEL-156421]
  - ACPI: bus: Align acpi_device_get_match_data() with driver match order (Mark Langsdorf) [RHEL-156421]
  - ACPI: APEI: GHES: Improve ghes_notify_sea() status check (Mark Langsdorf) [RHEL-156421]
  - ACPI: APEI: GHES: Extract helper functions for error status handling (Mark Langsdorf) [RHEL-156421]
  - ACPI: APEI: GHES: Improve ghes_notify_nmi() status check (Mark Langsdorf) [RHEL-156421]
  - APEI/GHES: ensure that won't go past CPER allocated record (Mark Langsdorf) [RHEL-156421]
  - ACPI: PM: s2idle: Add module parameter for LPS0 constraints checking (Mark Langsdorf) [RHEL-156421]
  - ACPI: PM: s2idle: Add missing checks to acpi_s2idle_begin_lps0() (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor: Remove unused empty stubs of some functions (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor: Do not expose global variable acpi_idle_driver (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor: idle: Redefine two functions as void (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor: Update cpuidle driver check in __acpi_processor_start() (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor: idle: Optimize ACPI idle driver registration (Mark Langsdorf) [RHEL-156421]
  - ACPI: AGDI: Add interrupt signaling mode support (Mark Langsdorf) [RHEL-156421]
  - ACPI: APEI: EINJ: make read-only array non_mmio_desc static const (Mark Langsdorf) [RHEL-156421]
  - ACPI: PCI: IRQ: Fix INTx GSIs signedness (Mark Langsdorf) [RHEL-156421]
  - ACPI: scan: Drop outdated comment regarding removed function (Mark Langsdorf) [RHEL-156421]
  - ACPI: scan: Use resource_type() for resource type checking (Mark Langsdorf) [RHEL-156421]
  - ACPI: bus: Fix typo under sizeof() in acpi_run_osc() (Mark Langsdorf) [RHEL-156421]
  - ACPI: bus: Adjust acpi_osc_handshake() parameter list (Mark Langsdorf) [RHEL-156421]
  - ACPI: driver: Drop driver_data pointer clearing from two drivers (Mark Langsdorf) [RHEL-156421]
  - ACPI: sysfs: Add device cid attribute for exposing _CID lists (Mark Langsdorf) [RHEL-156421]
  - ACPI: SBS: Convert the driver to a platform one (Mark Langsdorf) [RHEL-156421]
  - ACPI: SMBUS HC: Convert the driver to a platform one (Mark Langsdorf) [RHEL-156421]
  - ACPI: EC: Convert the driver to a platform one (Mark Langsdorf) [RHEL-156421]
  - ACPI: EC: Register a platform device for ECDT EC (Mark Langsdorf) [RHEL-156421]
  - ACPI: HED: Convert the driver to a platform one (Mark Langsdorf) [RHEL-156421]
  - ACPI: battery: Convert the driver to a platform one (Mark Langsdorf) [RHEL-156421]
  - ACPI: battery: Reduce code duplication related to cleanup (Mark Langsdorf) [RHEL-156421]
  - ACPI: battery: Adjust event notification routine (Mark Langsdorf) [RHEL-156421]
  - ACPI: thermal: Rework system suspend and resume handling (Mark Langsdorf) [RHEL-156421]
  - ACPI: thermal: Convert the driver to a platform one (Mark Langsdorf) [RHEL-156421]
  - ACPI: thermal: Adjust event notification routine (Mark Langsdorf) [RHEL-156421]
  - ACPI: scan: Register platform devices for thermal zones (Mark Langsdorf) [RHEL-156421]
  - ACPI: scan: Do not mark button ACPI devices as wakeup-capable (Mark Langsdorf) [RHEL-156421]
  - ACPI: scan: Do not bind ACPI drivers to fixed event buttons (Mark Langsdorf) [RHEL-156421]
  - ACPI: tiny-power-button: Convert the driver to a platform one (Mark Langsdorf) [RHEL-156421]
  - ACPI: button: Convert the driver to a platform one (Mark Langsdorf) [RHEL-156421]
  - ACPI: button: Adjust event notification routines (Mark Langsdorf) [RHEL-156421]
  - ACPI: scan: Reduce code duplication related to fixed event devices (Mark Langsdorf) [RHEL-156421]
  - ACPI: scan: Register platform devices for fixed event buttons (Mark Langsdorf) [RHEL-156421]
  - ACPI: NFIT: core: Convert the driver to a platform one (Mark Langsdorf) [RHEL-156421]
  - ACPI: bus: Rework the handling of \_SB._OSC USB4 features (Mark Langsdorf) [RHEL-156421]
  - ACPI: bus: Adjust feature mask creation for \_SB._OSC (Mark Langsdorf) [RHEL-156421]
  - ACPI: bus: Rework the handling of \_SB._OSC platform features (Mark Langsdorf) [RHEL-156421]
  - ACPI: bus: Rename label and use ACPI_FREE() in acpi_run_osc() (Mark Langsdorf) [RHEL-156421]
  - ACPI: bus: Split _OSC error processing out of acpi_run_osc() (Mark Langsdorf) [RHEL-156421]
  - ACPI: bus: Split _OSC evaluation out of acpi_run_osc() (Mark Langsdorf) [RHEL-156421]
  - ACPI: bus: Rework printing debug messages on _OSC errors (Mark Langsdorf) [RHEL-156421]
  - ACPI: bus: Fix handling of _OSC errors in acpi_run_osc() (Mark Langsdorf) [RHEL-156421]
  - compiler_types: introduce at_least parameter decoration pseudo keyword (Mark Langsdorf) [RHEL-156421]
  - wifi: iwlwifi: trans: rename at_least variable to min_mode (Mark Langsdorf) [RHEL-156421]
  - ACPI: PM: Register wakeup sources under physical devices (Mark Langsdorf) [RHEL-156421]
  - ACPI: PCI: PM: Rework root bus notification setup (Mark Langsdorf) [RHEL-156421]
  - ACPI: PNP: Drop acpi_nonpnp_device_ids[] (Mark Langsdorf) [RHEL-156421]
  - ACPI: PNP: Drop PNP0C01 and PNP0C02 from acpi_pnp_device_ids[] (Mark Langsdorf) [RHEL-156421]
  - ACPI: PCC: Fix race condition by removing static qualifier (Mark Langsdorf) [RHEL-156421]
  - ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Mark Langsdorf) [RHEL-156421]
  - x86/acpi/boot: Correct acpi_is_processor_usable() check again (Mark Langsdorf) [RHEL-156421]
  - acpi: platform_profile - Add max-power profile option (Mark Langsdorf) [RHEL-156421]
  - ACPI: PM: Fix a spelling mistake (Mark Langsdorf) [RHEL-156421]
  - ACPI: LPSS: Fix a spelling mistake (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (Mark Langsdorf) [RHEL-156421]
  - ACPICA: Avoid walking the Namespace if start_node is NULL (Mark Langsdorf) [RHEL-156421]
  - ACPI: property: use min() instead of min_t() (Mark Langsdorf) [RHEL-156421]
  - ACPI: GTDT: Correctly number platform devices for MMIO timers (Mark Langsdorf) [RHEL-156421]
  - acpi/hmat: Fix lockdep warning for hmem_register_resource() (Mark Langsdorf) [RHEL-156421]
  - acpi/hmat: Return when generic target is updated (Mark Langsdorf) [RHEL-156421]
  - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (Mark Langsdorf) [RHEL-156421]
  - ACPI: MRRM: Fix memory leaks and improve error handling (Mark Langsdorf) [RHEL-156421]
  - ACPI: DPTF: Use ACPI_FREE() for ACPI buffer deallocation (Mark Langsdorf) [RHEL-156421]
  - ACPI: DPTF: Remove int340x thermal scan handler (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor: idle: Drop redundant C-state count checks (Mark Langsdorf) [RHEL-156421]
  - ACPI: CPPC: Detect preferred core availability on online CPUs (Mark Langsdorf) [RHEL-156421]
  - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Mark Langsdorf) [RHEL-156421]
  - ACPI: CPPC: Check _CPC validity for only the online CPUs (Mark Langsdorf) [RHEL-156421]
  - ACPI: OSL: Add WQ_PERCPU to alloc_workqueue() users (Mark Langsdorf) [RHEL-156421]
  - ACPI: thermal: Add WQ_PERCPU to alloc_workqueue() users (Mark Langsdorf) [RHEL-156421]
  - ACPI: EC: Add WQ_PERCPU to alloc_workqueue() users (Mark Langsdorf) [RHEL-156421]
  - ACPI: OSL: replace use of system_wq with system_percpu_wq (Mark Langsdorf) [RHEL-156421]
  - ACPI: scan: replace use of system_unbound_wq with system_dfl_wq (Mark Langsdorf) [RHEL-156421]
  - ACPI: SBS: Fix present test in acpi_battery_read() (Mark Langsdorf) [RHEL-156421]
  - ACPI: CPPC: Fix typo in a comment (Mark Langsdorf) [RHEL-156421]
  - ACPI: fan: Add support for Microsoft fan extensions (Mark Langsdorf) [RHEL-156421]
  - ACPI: fan: Add hwmon notification support (Mark Langsdorf) [RHEL-156421]
  - ACPI: fan: Add basic notification support (Mark Langsdorf) [RHEL-156421]
  - ACPI: SPCR: Check for table version when using precise baudrate (Mark Langsdorf) [RHEL-156421]
  - ACPI: battery: Drop redundant locking (Mark Langsdorf) [RHEL-156421]
  - ACPI: PRM: Add acpi_prm_handler_available() (Mark Langsdorf) [RHEL-156421]
  - ACPI: fan: Workaround for 64-bit firmware bug (Mark Langsdorf) [RHEL-156421]
  - ACPI: fan: Use ACPI handle when retrieving _FST (Mark Langsdorf) [RHEL-156421]
  - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Mark Langsdorf) [RHEL-156421]
  - ACPI: button: Call input_free_device() on failing input device registration (Mark Langsdorf) [RHEL-156421]
  - ACPI: property: Rework acpi_graph_get_next_endpoint() (Mark Langsdorf) [RHEL-156421]
  - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Mark Langsdorf) [RHEL-156421]
  - ACPI: property: Make acpi_get_next_subnode() static (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor: idle: Relocate state flags initialization (Mark Langsdorf) [RHEL-156421]
  - acpi,srat: Fix incorrect device handle check for Generic Initiator (Mark Langsdorf) [RHEL-156421]
  - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Mark Langsdorf) [RHEL-156421]
  - ACPI: property: Fix argument order in __acpi_node_get_property_reference() (Mark Langsdorf) [RHEL-156421]
  - ACPI: PM: s2idle: Only retrieve constraints when needed (Mark Langsdorf) [RHEL-156421]
  - ACPI: PM: s2idle: Staticise LPS0 callback functions (Mark Langsdorf) [RHEL-156421]
  - ACPI: PM: s2idle: Drop acpi_get_lps0_constraint() (Mark Langsdorf) [RHEL-156421]
  - ACPI: property: Return present device nodes only on fwnode interface (Mark Langsdorf) [RHEL-156421]
  - cpufreq: Drop unused symbol CPUFREQ_ETERNAL (Mark Langsdorf) [RHEL-156421]
  - ACPI: CPPC: Do not use CPUFREQ_ETERNAL as an error value (Mark Langsdorf) [RHEL-156421]
  - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Mark Langsdorf) [RHEL-156421]
  - cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Mark Langsdorf) [RHEL-156421]
  - cpufreq: Honour transition_latency over transition_delay_us (Mark Langsdorf) [RHEL-156421]
  - ACPI: APEI: Remove redundant rcu_read_lock/unlock() under spinlock (Mark Langsdorf) [RHEL-156421]
  - ACPI: battery: Add synchronization between interface updates (Mark Langsdorf) [RHEL-156421]
  - ACPI: Add support for nargs_prop in acpi_fwnode_get_reference_args() (Mark Langsdorf) [RHEL-156421]
  - ACPI: property: Refactor acpi_fwnode_get_reference_args() to support nargs_prop (Mark Langsdorf) [RHEL-156421]
  - ACPI: debug: fix signedness issues in read/write helpers (Mark Langsdorf) [RHEL-156421]
  - ACPI: GTDT: Generate platform devices for MMIO timers (Mark Langsdorf) [RHEL-156421]
  - x86/acpi/cstate: Remove open coded check for cpu_feature_enabled() (Mark Langsdorf) [RHEL-156421]
  - ACPI: SPCR: Support Precise Baud Rate field (Mark Langsdorf) [RHEL-156421]
  - ACPICA: SPCR: Update the SPCR table to version 4 (Mark Langsdorf) [RHEL-156421]
  - ACPI: property: Adjust failure handling in acpi_nondev_subnode_extract() (Mark Langsdorf) [RHEL-156421]
  - ACPI: property: Do not pass NULL handles to acpi_attach_data() (Mark Langsdorf) [RHEL-156421]
  - ACPI: property: Add code comments explaining what is going on (Mark Langsdorf) [RHEL-156421]
  - ACPI: property: Disregard references in data-only subnode lists (Mark Langsdorf) [RHEL-156421]
  - ACPI: property: Fix buffer properties extraction for subnodes (Mark Langsdorf) [RHEL-156421]
  - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Mark Langsdorf) [RHEL-156421]
  - ACPI: APEI: EINJ: Allow more types of addresses except MMIO (Mark Langsdorf) [RHEL-156421]
  - ACPI: APEI: Remove redundant assignments in erst_dbg_{ioctl|write}() (Mark Langsdorf) [RHEL-156421]
  - ACPICA: Update dsmethod.c to get rid of unused variable warning (Mark Langsdorf) [RHEL-156421]
  - ACPICA: Fix largest possible resource descriptor index (Mark Langsdorf) [RHEL-156421]
  - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Mark Langsdorf) [RHEL-156421]
  - ACPICA: ACPI_TYPE_ANY does not include the package type (Mark Langsdorf) [RHEL-156421]
  - ACPICA: acpidump: fix return values in ap_is_valid_checksum() (Mark Langsdorf) [RHEL-156421]
  - ACPICA: Print error messages for too few or too many arguments (Mark Langsdorf) [RHEL-156421]
  - ACPICA: Modify variable definition position (Mark Langsdorf) [RHEL-156421]
  - ACPICA: Allow to skip Global Lock initialization (Mark Langsdorf) [RHEL-156421]
  - ACPICA: iASL: Fix printing CDAT table header (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor: thermal: Release policy references using __free() (Mark Langsdorf) [RHEL-156421]
  - ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Mark Langsdorf) [RHEL-156421]
  - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Mark Langsdorf) [RHEL-156421]
  - ACPI: fan: Fold two simple functions into their only caller (Mark Langsdorf) [RHEL-156421]
  - ACPI: thermal: Get rid of a dummy local variable (Mark Langsdorf) [RHEL-156421]
  - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Mark Langsdorf) [RHEL-156421]
  - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor: idle: Eliminate static variable flat_state_cnt (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor: idle: Add module import namespace (Mark Langsdorf) [RHEL-156421]
  - ACPI: Use str_low_high() helper in two places (Mark Langsdorf) [RHEL-156421]
  - ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Mark Langsdorf) [RHEL-156421]
  - ACPI: PM: Add HP EliteBook 855 G7 WWAN modem power resource quirk (Mark Langsdorf) [RHEL-156421]
  - ACPI: PM: Add power resource init function (Mark Langsdorf) [RHEL-156421]
  - ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Mark Langsdorf) [RHEL-156421]
  - drm/xe: Add missing <linux/sizes.h> include to xe_lrc.h (Anusha Srivatsa) [RHEL-151751]
  - Revert "drm/i915: Disable tracing points on PREEMPT_RT" (Anusha Srivatsa) [RHEL-151751]
  - redhat: Add new DRM modules to mod-internal.list (Anusha Srivatsa) [RHEL-151751]
  - redhat/configs: Add new configs from DRM 6.19 backport (Anusha Srivatsa) [RHEL-151751]
  - redhat: Add drm/tests to module filter list (Anusha Srivatsa) [RHEL-151751]
  - drm/tegra: nvjpg: Use .remove_new for void remove callback (Anusha Srivatsa) [RHEL-151751]
  - drm: Revert 4-arg pci_resize_resource() calls from upstream (Anusha Srivatsa) [RHEL-151751]
  - Revert "drm/client: Support emergency restore via sysrq for all clients" (Anusha Srivatsa) [RHEL-151751]
  - drm/xe/pm: Partially revert scope-based cleanup helper for runtime PM (Anusha Srivatsa) [RHEL-151751]
  - drm/amd/display: Do not use CC_FLAGS_FPU/CC_FLAGS_NO_FPU in dml2_0 (Anusha Srivatsa) [RHEL-151751]
  - drm/xe/pf: Set VF LMEM BAR size (Anusha Srivatsa) [RHEL-151751]
  - Revert "drm/i915: Remove driver side BAR release before resize" (Anusha Srivatsa) [RHEL-151751]
  - drm: Remove partial backport artifacts from mm/zone_device folio_free rename (Anusha Srivatsa) [RHEL-151751]
  - Revert "drm/xe: Limit number of jobs per exec queue" (Anusha Srivatsa) [RHEL-151751]
  - drm: Remove partial backport artifacts from mm/zone_device folio reinit (Anusha Srivatsa) [RHEL-151751]
  - Revert "drm/amdgpu: Use pci_rebar_get_max_size()" (Anusha Srivatsa) [RHEL-151751]
  - Revert "drm/xe: Remove driver side BAR release before resize" (Anusha Srivatsa) [RHEL-151751]
  - Revert "drm/xe/vram: Use PCI rebar helpers in resize_vram_bar()" (Anusha Srivatsa) [RHEL-151751]
  - Revert "drm/xe/vram: Use pci_rebar_get_max_size()" (Anusha Srivatsa) [RHEL-151751]
  - Revert "drm/i915/gt: Use pci_rebar_size_supported()" (Anusha Srivatsa) [RHEL-151751]
  - fix missing vmalloc.h includes (Anusha Srivatsa) [RHEL-151751]
  - Revert "accel/ivpu: Enable MCA ECC signalling based on MSR" (Anusha Srivatsa) [RHEL-151751]
  - drm/dma-buf: Remove partial backport of phys_vec scatter-gather mapping (Anusha Srivatsa) [RHEL-151751]
  - drm/dma-buf: Remove partial backport of FD_ADD() conversion (Anusha Srivatsa) [RHEL-151751]
  - Revert "drm/vblank: Add vblank timer" (Anusha Srivatsa) [RHEL-151751]
  - Revert "drm/hypervdrm: Use vblank timer" (Anusha Srivatsa) [RHEL-151751]
  - Revert "drm/virtgpu: Use vblank timer" (Anusha Srivatsa) [RHEL-151751]
  - Revert "drm/vkms: Convert to DRM's vblank timer" (Anusha Srivatsa) [RHEL-151751]
  - Revert "drm/qxl: Use vblank timer" (Anusha Srivatsa) [RHEL-151751]
  - Revert "drm/cirrus-qemu: Use vblank timer" (Anusha Srivatsa) [RHEL-151751]
  - Revert "drm/bochs: Use vblank timer" (Anusha Srivatsa) [RHEL-151751]
  - Merge DRM changes from upstream v6.18..v6.19 (Anusha Srivatsa) [RHEL-151751]
  - rxrpc: Fix recvmsg() unconditional requeue (Marc Dionne) [RHEL-147231] {CVE-2026-23066}
  - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-150472] {CVE-2026-23136}
  - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143898] {CVE-2026-22984}
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143880] {CVE-2026-22990}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-717.el9]
changelog:
  - s390/entry: Scrub r12 register on kernel entry (Jan Polensky) [RHEL-174818]
  - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185118]
  - platform/x86/intel-uncore-freq: Increase minor version (David Arcari) [RHEL-184964]
  - platform/x86/intel-uncore-freq: Handle autonomous UFS status bit (David Arcari) [RHEL-184964]
  - s390: Revert support for DCACHE_WORD_ACCESS (Charles Haithcock) [RHEL-184094]
  - nvme: make nvme_add_ns{_head}_cdev return void (Maurizio Lombardi) [RHEL-154109]
  - nvme: fix crash and memory leak during invalid cdev teardown (Maurizio Lombardi) [RHEL-154109]
  - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179756] {CVE-2026-43414}
  - watchdog: only run driver set_pretimeout op if device supports it (David Arcari) [RHEL-182246]
  - watchdog: Switch to use hrtimer_setup() (David Arcari) [RHEL-182246]
  - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182246]
  - watchdog: iTCO_wdt: Convert comma to semicolon (David Arcari) [RHEL-182246]
  - watchdog: iTCO_wdt: Report firmware_version (David Arcari) [RHEL-182246]
  - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (David Arcari) [RHEL-182246]
  - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (David Arcari) [RHEL-182246]
  - watchdog: iTCO_wdt: No need to stop the timer in probe (David Arcari) [RHEL-182246]
  - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (David Arcari) [RHEL-182246]
  - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182246]
  - watchdog: wdat_wdt: Add timeout value as a param in ping method (David Arcari) [RHEL-182246]
  - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179986] {CVE-2026-46181}
  - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180105] {CVE-2026-46135}
  - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179997] {CVE-2026-46176}
  - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179312] {CVE-2026-46090}
  - Revert "media: cx231xx: add USB ID 2040:8360 for Hauppauge WinTV-HVR-935" (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Fix bug in error path of uvc_alloc_urb_buffers (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Add support for P010 pixel format (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Add D436 and D555 cameras metadata support (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Change comment to 'Intel RealSense' (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Add a stream backpointer in uvc_video_queue (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Allow userspace to increase the meta buffersize (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: uvc_queue_to_stream(): Support meta queues (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Enable VB2_DMABUF for metadata stream (Kate Hsuan) [RHEL-162130]
  - media: subdev: Split v4l2_subdev_get_frame_desc_passthrough() into locked and unlocked (Kate Hsuan) [RHEL-162130]
  - media: subdev: Improve v4l2_subdev_get_frame_desc_passthrough() kdoc (Kate Hsuan) [RHEL-162130]
  - media: subdev: Minor v4l2_subdev_get_frame_desc_passthrough() cleanups (Kate Hsuan) [RHEL-162130]
  - media: v4l2-subdev: Fix error check in v4l2_subdev_get_frame_desc_passthrough() (Kate Hsuan) [RHEL-162130]
  - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (Kate Hsuan) [RHEL-162130] {CVE-2026-31473}
  - media: cx231xx: Fix AGC levels for NTSC-M (Kate Hsuan) [RHEL-162130]
  - media: cx25840: Fix NTSC-J, PAL-N, and SECAM standards (Kate Hsuan) [RHEL-162130]
  - media: cx231xx: add USB ID 2040:8360 for Hauppauge WinTV-HVR-935 (Kate Hsuan) [RHEL-162130]
  - media: pulse8-cec: Handle partial deinit (Kate Hsuan) [RHEL-162130]
  - media: cx231xx: drop redundant device reference (Kate Hsuan) [RHEL-162130]
  - media: remove unnecessary module_init/exit functions (Kate Hsuan) [RHEL-162130]
  - media: subdev: Add v4l2_subdev_get_frame_desc_passthrough helper (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Pass allocation size directly to uvc_alloc_urb_buffer (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Fix allocation for small frame sizes (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Return queued buffers on start_streaming() failure (Kate Hsuan) [RHEL-162130] {CVE-2026-43290}
  - media: uvcvideo: Create an ID namespace for streaming output terminals (Kate Hsuan) [RHEL-162130]
  - media: v4l: ctrls: add a control for enabling strobe output (Kate Hsuan) [RHEL-162130]
  - media: v4l: ctrls: add a control for flash/strobe duration (Kate Hsuan) [RHEL-162130]
  - media: v4l2-subdev: Extend VIDIOC_SUBDEV_S_ROUTING error codes (Kate Hsuan) [RHEL-162130]
  - media: v4l2-ctrls: Set error v4l2_ctrl_new_fwnode_properties consistently (Kate Hsuan) [RHEL-162130]
  - Revert "media: uvcvideo: Remove nodrop parameter" (Kate Hsuan) [RHEL-162130]
  - media: mc: add debugfs node to keep track of requests (Kate Hsuan) [RHEL-162130]
  - media: mc: add manual request completion (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Document how to format GUIDs (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Remove nodrop parameter (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: UVC minimum relative pan/tilt/zoom speed fix. (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Fix support for V4L2_CTRL_FLAG_HAS_WHICH_MIN_MAX (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Replace dev_dbg() with uvc_dbg() (Kate Hsuan) [RHEL-162130]
  - media: vb2: drop wait_prepare/finish callbacks (Kate Hsuan) [RHEL-162130]
  - media: vb2: remove vb2_ops_wait_prepare/finish helpers (Kate Hsuan) [RHEL-162130]
  - media: v4l: Add helper to get number of active lanes via a pad (Kate Hsuan) [RHEL-162130]
  - media: videobuf2: forbid remove_bufs when legacy fileio is active (Kate Hsuan) [RHEL-162130] {CVE-2025-40302}
  - media: uvcvideo: Use heuristic to find stream entity (Kate Hsuan) [RHEL-162130]
  - media: cec: Fix debugfs leak on bus_register() failure (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Kate Hsuan) [RHEL-162130] {CVE-2025-40016}
  - media: uvcvideo: Support UVC_CROSXU_CONTROL_IQ_PROFILE (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Run uvc_ctrl_init_ctrl for all controls (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Shorten the transfer size non compliance message (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Do not re-reference dev->udev (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Use intf instead of udev for printks (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Move video_device under video_queue (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Drop stream->mutex (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Move MSXU_CONTROL_METADATA definition to header (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Add missing curly braces (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Drop unneeded memset() in meta device ioctl handlers (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Fix comments in uvc_meta_detect_msxu (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Avoid variable shadowing in uvc_ctrl_cleanup_fh (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Fix assignment in if condition (Kate Hsuan) [RHEL-162130]
  - media: mc: Clear minor number before put device (Kate Hsuan) [RHEL-162130] {CVE-2025-40197}
  - media: v4l2-common: Add legacy camera sensor clock helper (Kate Hsuan) [RHEL-162130]
  - media: mc: Clear minor number reservation at unregistration time (Kate Hsuan) [RHEL-162130]
  - media: v4l2-core: v4l2-dv-timings: support DRM IFs (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: eUSB2 double isochronous bandwidth support (Kate Hsuan) [RHEL-162130]
  - media: uapi: v4l2-controls: Cleanup codec definitions (Kate Hsuan) [RHEL-162130]
  - media: v4l2-common: Constify media_pad argument to v4l2_get_link_freq() (Kate Hsuan) [RHEL-162130]
  - media: uapi: Cleanup tab after define in headers (Kate Hsuan) [RHEL-162130]
  - media: uapi: Move colorimetry controls at the end of the file (Kate Hsuan) [RHEL-162130]
  - media: mc: Improve unconnected pads debugging message in link exploration (Kate Hsuan) [RHEL-162130]
  - media: mc: Fix MUST_CONNECT handling for pads with no links (Kate Hsuan) [RHEL-162130]
  - media: v4l2-common: Drop the workaround from v4l2_get_link_freq() (Kate Hsuan) [RHEL-162130]
  - media: v4l2-subdev: Make struct v4l2_subdev_stream_config private (Kate Hsuan) [RHEL-162130]
  - media: v4l2-common: Add a helper for obtaining the clock producer (Kate Hsuan) [RHEL-162130]
  - media: v4l2: Rename second ioctl handlers argument to 'void *priv' (Kate Hsuan) [RHEL-162130]
  - media: v4l2-core: Rename second ioctl handlers argument to 'void *priv' (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Rename second ioctl handlers argument to 'void *priv' (Kate Hsuan) [RHEL-162130]
  - media: v4l2-ioctl: Push NULL fh argument down to ioctl wrappers (Kate Hsuan) [RHEL-162130]
  - media: v4l2-ioctl: Stop passing fh pointer to ioctl handlers (Kate Hsuan) [RHEL-162130]
  - media: usb: uvc: Access v4l2_fh from file (Kate Hsuan) [RHEL-162130]
  - media: v4l2-ioctl: Access v4l2_fh from private_data (Kate Hsuan) [RHEL-162130]
  - media: Drop V4L2_FL_USES_V4L2_FH checks (Kate Hsuan) [RHEL-162130]
  - media: v4l2-dev: Make open and release file operations mandatory (Kate Hsuan) [RHEL-162130]
  - media: v4l2-ctrls: Move v4l2_fh retrieval after V4L2_FL_USES_V4L2_FH check (Kate Hsuan) [RHEL-162130]
  - media: Reset file->private_data to NULL in v4l2_fh_del() (Kate Hsuan) [RHEL-162130]
  - media: Set file->private_data in v4l2_fh_add() (Kate Hsuan) [RHEL-162130]
  - media: Replace file->private_data access with file_to_v4l2_fh() (Kate Hsuan) [RHEL-162130]
  - media: Wrap file->private_data access with a helper function (Kate Hsuan) [RHEL-162130]
  - media: v4l2: Add mem2mem helpers for REMOVE_BUFS ioctl (Kate Hsuan) [RHEL-162130]
  - media: usb: uvcvideo: Store v4l2_fh pointer in file->private_data (Kate Hsuan) [RHEL-162130]
  - media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Use a count variable for meta_formats instead of 0 terminating (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Auto-set UVC_QUIRK_MSXU_META (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Introduce V4L2_META_FMT_UVC_MSXU_1_5 (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Introduce dev->meta_formats (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Do not mark valid metadata as invalid (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: uvc_v4l2_unlocked_ioctl: Invert PM logic (Kate Hsuan) [RHEL-162130]
  - media: core: export v4l2_translate_cmd (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Turn on the camera if V4L2_EVENT_SUB_FL_SEND_INITIAL (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Remove stream->is_streaming field (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Split uvc_stop_streaming() (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Handle locks in uvc_queue_return_buffers (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Use vb2 ioctl and fop helpers (Kate Hsuan) [RHEL-162130]
  - media: v4l2-common: Add the missing Raw Bayer pixel formats (Kate Hsuan) [RHEL-162130]
  - media: uapi: videodev2: Fix comment for 12-bit packed Bayer formats (Kate Hsuan) [RHEL-162130]
  - media: v4l2-subdev: Add debug prints to v4l2_subdev_collect_streams() (Kate Hsuan) [RHEL-162130]
  - media: v4l2-subdev: Print early in v4l2_subdev_{enable,disable}_streams() (Kate Hsuan) [RHEL-162130]
  - media: cec: core: add rx-no-low-drive setting (Kate Hsuan) [RHEL-162130]
  - media: cec: core: add glitch error injection (Kate Hsuan) [RHEL-162130]
  - media: v4l2: Add Renesas Camera Receiver Unit pixel formats (Kate Hsuan) [RHEL-162130]
  - media: v4l2-subdev: Limit the number of active routes to V4L2_FRAME_DESC_ENTRY_MAX (Kate Hsuan) [RHEL-162130]
  - media: v4l2-ctrls: Return the handler's error in v4l2_ctrl_handler_free() (Kate Hsuan) [RHEL-162130]
  - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Kate Hsuan) [RHEL-162130]
  - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Kate Hsuan) [RHEL-162130]
  - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (Kate Hsuan) [RHEL-162130]
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Kate Hsuan) [RHEL-162130] {CVE-2025-39713}
  - media: gspca: Add bounds checking to firmware parser (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Kate Hsuan) [RHEL-162130] {CVE-2025-38680}
  - media: uvcvideo: Add quirk for HP Webcam HD 2300 (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Refactor uvc_v4l2_compat_ioctl32 (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Refactor uvc_queue_streamon (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Refactor uvc_ctrl_set_handle() (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Populate all errors in uvc_probe() (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Set V4L2_CTRL_FLAG_DISABLED during queryctrl errors (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Fix bandwidth issue for Alcor camera (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Use dev_err_probe for devm_gpiod_get_optional (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Fix deferred probing error (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Rollback non processed entities on error (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Send control events for partial succeeds (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Return the number of processed controls (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Do not turn on the camera for some ioctls (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Make power management granular (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Increase/decrease the PM counter per IOCTL (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Create uvc_pm_(get|put) functions (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Keep streaming state in the file handle (Kate Hsuan) [RHEL-162130]
  - media: v4l: subdev: Fix coverity issue: Logically dead code (Kate Hsuan) [RHEL-162130]
  - media: v4l2-dev: fix error handling in __video_register_device() (Kate Hsuan) [RHEL-162130]
  - media: common: Add v4l2_find_nearest_size_conditional() (Kate Hsuan) [RHEL-162130]
  - media: gspca: Add error handling for stv06xx_read_sensor() (Kate Hsuan) [RHEL-162130]
  - media: videobuf2: check constants during build time (Kate Hsuan) [RHEL-162130]
  - media: v4l2-common: Add RGBR format info (Kate Hsuan) [RHEL-162130]
  - media: v4l2: Add NV15 and NV20 pixel formats (Kate Hsuan) [RHEL-162130]
  - media: v4l2-common: Add helpers to calculate bytesperline and sizeimage (Kate Hsuan) [RHEL-162130]
  - media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition (Kate Hsuan) [RHEL-162130]
  - media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition (Kate Hsuan) [RHEL-162130]
  - media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Kate Hsuan) [RHEL-162130]
  - media: cec: use us_to_ktime() where appropriate (Kate Hsuan) [RHEL-162130]
  - media: v4l2-core: use (t,l)/wxh format for rectangle (Kate Hsuan) [RHEL-162130]
  - media: v4l2-core: Introduce v4l2_query_ext_ctrl_to_v4l2_queryctrl (Kate Hsuan) [RHEL-162130]
  - media: v4l2: Remove vidioc_s_ctrl callback (Kate Hsuan) [RHEL-162130]
  - media: cx231xx: Remove vidioc_s_ctrl callback (Kate Hsuan) [RHEL-162130]
  - media: v4l2: Remove vidioc_g_ctrl callback (Kate Hsuan) [RHEL-162130]
  - media: v4l2: Remove vidioc_queryctrl callback (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Remove vidioc_queryctrl (Kate Hsuan) [RHEL-162130]
  - media: ioctl: Simulate v4l2_queryctrl with v4l2_query_ext_ctrl (Kate Hsuan) [RHEL-162130]
  - media: cx231xx: set device_caps for 417 (Kate Hsuan) [RHEL-162130] {CVE-2025-38044}
  - media: cec: core: allow raw msg transmit while configuring (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Drop the uvc_driver structure (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Add quirk for Actions UVC05 (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: implement UVC v1.5 ROI (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Introduce uvc_mapping_v4l2_size (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: let v4l2_query_v4l2_ctrl() work with v4l2_query_ext_ctrl (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: support V4L2_CTRL_WHICH_MIN/MAX_VAL (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Factor out query_boundaries from query_ctrl (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: add support for compound controls (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Factor out clamping from uvc_ctrl_set (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Support any size for mapping get/set (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: uvc_ioctl_(g|s)_ext_ctrls: handle NoP case (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: refactor uvc_ioctl_g_ext_ctrls (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Handle uvc menu translation inside uvc_set_le_value (Kate Hsuan) [RHEL-162130]
  - media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value (Kate Hsuan) [RHEL-162130]
  - media: v4l2-ctrls: add support for V4L2_CTRL_WHICH_MIN/MAX_VAL (Kate Hsuan) [RHEL-162130]
  - media: v4l2_ctrl: Add V4L2_CTRL_TYPE_RECT (Kate Hsuan) [RHEL-162130]
  - media: pwc: remove useless header files (Kate Hsuan) [RHEL-162130]
  - media: Switch to use hrtimer_setup() (Kate Hsuan) [RHEL-162130]
  - media: v4l2-dv-timings: add v4l2_num_edid_blocks() helper (Kate Hsuan) [RHEL-162130]
  - media: v4l: Memset argument to 0 before calling get_mbus_config pad op (Kate Hsuan) [RHEL-162130]
  - media: v4l: Support obtaining link frequency via get_mbus_config (Kate Hsuan) [RHEL-162130]
  - media: v4l: Support passing media pad argument to v4l2_get_link_freq() (Kate Hsuan) [RHEL-162130]
  - media: cx231xx: remove redundant assignment to variable value (Kate Hsuan) [RHEL-162130]
  - media: mc: Rename pad as origin in __media_pipeline_start() (Kate Hsuan) [RHEL-162130]
  - media: v4l2-subdev: Refactor events (Kate Hsuan) [RHEL-162130]
  - media: vb2: fix confusing log message (Kate Hsuan) [RHEL-162130]
  - media: vb2: Fix comment (Kate Hsuan) [RHEL-162130]
  - media: v4l2-core: constify the class struct (Kate Hsuan) [RHEL-162130]
  - media: v4l2-core: v4l2-dv-timings: check cvt/gtf result (Kate Hsuan) [RHEL-162130]
  - media: video-i2c: drop vb2_ops_wait_prepare/finish (Kate Hsuan) [RHEL-162130]
  - media: videobuf2-core: update vb2_thread if wait_finish/prepare are NULL (Kate Hsuan) [RHEL-162130]
  - v4l2-subdev: Return -EOPNOTSUPP for unsupported pad type in call_get_frame_desc() (Kate Hsuan) [RHEL-162130]
  - media: videodev2: Add flag to unconditionally enumerate pixel formats (Kate Hsuan) [RHEL-162130]
  - media: vb2: use lock if wait_prepare/finish are NULL (Kate Hsuan) [RHEL-162130]
  - media: vb2: vb2_core_queue_init(): sanity check lock and wait_prepare/finish (Kate Hsuan) [RHEL-162130]
  - media: v4l2-core: add v4l2_debugfs_if_alloc/free() (Kate Hsuan) [RHEL-162130]
  - media: v4l2-core: add v4l2_debugfs_root() (Kate Hsuan) [RHEL-162130]
  - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175528] {CVE-2026-31474}
  - serial: ce4100: fix build after serial_in/out() changes (Mark Salter) [RHEL-111649]
  - serial: port: Always update ->iotype in __uart_read_properties() (Mark Salter) [RHEL-111649]
  - serial: port: Assign ->iotype correctly when ->iobase is set (Mark Salter) [RHEL-111649]
  - device property: Implement device_is_big_endian() (Mark Salter) [RHEL-111649]
  - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY (Mark Salter) [RHEL-111649]
  - serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm (Mark Salter) [RHEL-111649]
  - serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling (Mark Salter) [RHEL-111649]
  - serial: 8250: Add serial8250_handle_irq_locked() (Mark Salter) [RHEL-111649]
  - serial: 8250_dw: Avoid unnecessary LCR writes (Mark Salter) [RHEL-111649]
  - serial: 8250: Protect LCR write in shutdown (Mark Salter) [RHEL-111649]
  - serial: 8250_pci: add support for the AX99100 (Mark Salter) [RHEL-111649]
  - serial: 8250_dw: Drop unneeded NULL checks in dw8250_quirks() (Mark Salter) [RHEL-111649]
  - serial: 8250: Fix TX deadlock when using DMA (Mark Salter) [RHEL-111649]
  - serial: 8250: sanitize uart_port::serial_{in,out}() types (Mark Salter) [RHEL-111649]
  - serial: 8250_dw: Comment possible corner cases in serial_out() implementation (Mark Salter) [RHEL-111649]
  - serial: 8250_dw: Call dw8250_quirks() conditionally (Mark Salter) [RHEL-111649]
  - serial: 8250: use serial_port_in/out() helpers (Mark Salter) [RHEL-111649]
  - serial: 8250_dw: Use reset array API to get resets (Mark Salter) [RHEL-111649]
  - serial: 8250_dw: Revert "Move definitions to the shared header" (Mark Salter) [RHEL-111649]
  - serial: 8250_dw: Don't use struct dw8250_data outside of 8250_dw (Mark Salter) [RHEL-111649]
  - serial: 8250_dw: Hide a cast in dw8250_serial_inq() (Mark Salter) [RHEL-111649]
  - serial: 8250_dw: Deduplicate LCR checks (Mark Salter) [RHEL-111649]
  - serial: 8250_dw: Replace ACPI device check by a quirk (Mark Salter) [RHEL-111649]
  - serial: 8250_dw: Switch to use uart_read_port_properties() (Mark Salter) [RHEL-111649]
  - serial: port: Introduce a common helper to read properties (Mark Salter) [RHEL-111649]
  - serial: core: Add UPIO_UNKNOWN constant for unknown port type (Mark Salter) [RHEL-111649]
  - serial: 8250_dw: Emit an error message if getting the baudclk failed (Mark Salter) [RHEL-111649]
  - serial: 8250: Use serial8250_do_set_termios for uartclk updating (Mark Salter) [RHEL-111649]
  - serial: 8250_dw: Do not bailout on UCV read returning zero (Mark Salter) [RHEL-111649]
  - serial: 8250_dw: Decouple DLF register check from UCV (Mark Salter) [RHEL-111649]
  - ice: use ice_update_eth_stats() for representor stats (CKI Backport Bot) [RHEL-73628]
  - ice: fix inverted ready check for VF representors (CKI Backport Bot) [RHEL-73628]
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (CKI Backport Bot) [RHEL-170799] {CVE-2026-23401}
  - dm-verity-fec: fix corrected block count stat (Benjamin Marzinski) [RHEL-154976]
  - dm-mpath: don't stop probing paths at presuspend (Benjamin Marzinski) [RHEL-138608]
  - dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski) [RHEL-154976]
  - dm: use bio_clone_blkg_association (Benjamin Marzinski) [RHEL-154976]
  - dm-unstripe: fix mapping bug when there are multiple targets in a table (Benjamin Marzinski) [RHEL-154976]
  - dm-integrity: fix recalculation in bitmap mode (Benjamin Marzinski) [RHEL-144459]
  - dm: clear cloned request bio pointer when last clone bio completes (Benjamin Marzinski) [RHEL-154976]
  - dm-integrity: fix a typo in the code for write/discard race (Benjamin Marzinski) [RHEL-154976]
  - dm: use READ_ONCE in dm_blk_report_zones (Benjamin Marzinski) [RHEL-154976]
  - dm: fix unlocked test for dm_suspended_md (Benjamin Marzinski) [RHEL-154976]
  - dm: replace -EEXIST with -EBUSY (Benjamin Marzinski) [RHEL-154976]
  - dm: remove fake timeout to avoid leak request (Benjamin Marzinski) [RHEL-154976]
  - dm pcache: fix segment info indexing (Benjamin Marzinski) [RHEL-154976]
  - dm pcache: fix cache info indexing (Benjamin Marzinski) [RHEL-154976]
  - dm-pcache: advance slot index before writing slot (Benjamin Marzinski) [RHEL-154976]
  - dm raid: add documentation for takeover/reshape raid1 -> raid5 table line examples (Benjamin Marzinski) [RHEL-154976]
  - dm: ignore discard return value (Benjamin Marzinski) [RHEL-154976]
  - MAINTAINERS: add Benjamin Marzinski as a device mapper maintainer (Benjamin Marzinski) [RHEL-154976]
  - dm-mpath: Simplify the setup_scsi_dh code (Benjamin Marzinski) [RHEL-154976]
  - dm-bufio: align write boundary on physical block size (Benjamin Marzinski) [RHEL-154976]
  - dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Benjamin Marzinski) [RHEL-136803]
  - dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Benjamin Marzinski) [RHEL-154976]
  - dm-verity: remove useless mempool (Benjamin Marzinski) [RHEL-154976]
  - dm-verity: disable recursive forward error correction (Benjamin Marzinski) [RHEL-154976] {CVE-2025-71161}
  - dm-ebs: Mark full buffer dirty even on partial write (Benjamin Marzinski) [RHEL-154976]
  - dm mpath: enable DM_TARGET_ATOMIC_WRITES (Benjamin Marzinski) [RHEL-154976]
  - dm verity fec: Expose corrected block count via status (Benjamin Marzinski) [RHEL-154976]
  - dm: Don't warn if IMA_DISABLE_HTABLE is not enabled (Benjamin Marzinski) [RHEL-154976]
  - dm-verity: remove log message with shash driver name (Benjamin Marzinski) [RHEL-154976]
  - dm: sysfs: use sysfs_emit() in dm-sysfs.c (Benjamin Marzinski) [RHEL-154976]
  - dm: remove useless md->nr_zones variable (Benjamin Marzinski) [RHEL-154976]
  - dm-crypt: use folio_nr_pages() instead of shift operation (Benjamin Marzinski) [RHEL-136803]
  - dm: fix failure when empty flush's bi_sector points beyond the device end (Benjamin Marzinski) [RHEL-154976]
  - dm-pcache: zero cache_info before default init (Benjamin Marzinski) [RHEL-154976]
  - dm-pcache: reuse meta_addr in pcache_meta_find_latest (Benjamin Marzinski) [RHEL-154976]
  - dm-pcache: allow built-in build and rename flush helper (Benjamin Marzinski) [RHEL-154976]
  - dm raid: use proper md_ro_state enumerators (Benjamin Marzinski) [RHEL-154976]
  - dm-integrity: prefer synchronous hash interface (Benjamin Marzinski) [RHEL-136803]
  - dm-integrity: enable asynchronous hash interface (Benjamin Marzinski) [RHEL-136803]
  - dm-integrity: rename internal_hash (Benjamin Marzinski) [RHEL-136803]
  - dm-integrity: add the "offset" argument (Benjamin Marzinski) [RHEL-136803]
  - dm-integrity: allocate the recalculate buffer with kmalloc (Benjamin Marzinski) [RHEL-136803]
  - dm-integrity: introduce integrity_kmap and integrity_kunmap (Benjamin Marzinski) [RHEL-136803]
  - dm-integrity: replace bvec_kmap_local with kmap_local_page (Benjamin Marzinski) [RHEL-136803]
  - dm-integrity: use internal variable for digestsize (Benjamin Marzinski) [RHEL-136803]
  - dm: optimize REQ_PREFLUSH with data when using the linear target (Benjamin Marzinski) [RHEL-154976]
  - dm-pcache: use int type to store negative error codes (Benjamin Marzinski) [RHEL-154976]
  - dm: fix "writen"->"written" (Benjamin Marzinski) [RHEL-154976]
  - dm-pcache: cleanup: fix coding style report by checkpatch.pl (Benjamin Marzinski) [RHEL-154976]
  - dm-pcache: remove ctrl_lock for pcache_cache_segment (Benjamin Marzinski) [RHEL-154976]
  - redhat/configs: Add CONFIG_DM_PCACHE (Benjamin Marzinski) [RHEL-154976]
  - dm-pcache: add persistent cache target in device-mapper (Benjamin Marzinski) [RHEL-154976]
  - dm error: mark as DM_TARGET_PASSES_INTEGRITY (Benjamin Marzinski) [RHEL-154976]
  - docs: device-mapper: fixed spelling mistakes in documentation (Benjamin Marzinski) [RHEL-154976]
  - dm bufio: remove redundant __GFP_NOWARN (Benjamin Marzinski) [RHEL-154976]
  - dm-ima: drop a useless argument (Benjamin Marzinski) [RHEL-154976]
  - dm: use vmalloc_array() to simplify code (Benjamin Marzinski) [RHEL-154976]
  - dm-ima: more strlen() drops (Benjamin Marzinski) [RHEL-154976]
  - cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in update_cpumasks_hier() (Waiman Long) [RHEL-154974]
  - cgroup/cpuset: Consistently compute effective_xcpus in update_cpumasks_hier() (Waiman Long) [RHEL-154974]
  - cpuset: Treat cpusets in attaching as populated (Waiman Long) [RHEL-154974]
  - cgroup/cpuset: Don't track # of local child partitions (Waiman Long) [RHEL-154974]
  - cpuset: remove is_prs_invalid helper (Waiman Long) [RHEL-154974]
  - cpuset: remove impossible warning in update_parent_effective_cpumask (Waiman Long) [RHEL-154974]
  - cpuset: remove redundant special case for null input in node mask update (Waiman Long) [RHEL-154974]
  - cpuset: fix missing error return in update_cpumask (Waiman Long) [RHEL-154974]
  - cpuset: Use new excpus for nocpu error check when enabling root partition (Waiman Long) [RHEL-154974]
  - cpuset: fix failure to enable isolated partition when containing isolcpus (Waiman Long) [RHEL-154974]
  - cpuset: use partition_cpus_change for setting exclusive cpus (Waiman Long) [RHEL-154974]
  - cpuset: use parse_cpulist for setting cpus.exclusive (Waiman Long) [RHEL-154974]
  - cpuset: introduce partition_cpus_change (Waiman Long) [RHEL-154974]
  - cpuset: refactor cpus_allowed_validate_change (Waiman Long) [RHEL-154974]
  - cpuset: refactor out validate_partition (Waiman Long) [RHEL-154974]
  - cpuset: introduce cpus_excl_conflict and mems_excl_conflict helpers (Waiman Long) [RHEL-154974]
  - cpuset: refactor CPU mask buffer parsing logic (Waiman Long) [RHEL-154974]
  - cpuset: Refactor exclusive CPU mask computation logic (Waiman Long) [RHEL-154974]
  - cpuset: change return type of is_partition_[in]valid to bool (Waiman Long) [RHEL-154974]
  - cpuset: remove unused assignment to trialcs->partition_root_state (Waiman Long) [RHEL-154974]
  - cpuset: move the root cpuset write check earlier (Waiman Long) [RHEL-154974]
  - cgroup/cpuset: Remove redundant rcu_read_lock/unlock() in spin_lock (Waiman Long) [RHEL-154974]
  - cpuset: Defer flushing of the cpuset_migrate_mm_wq to task_work (Waiman Long) [RHEL-154974]
  - cpuset: Don't always flush cpuset_migrate_mm_wq in cpuset_write_resmask (Waiman Long) [RHEL-154974]
  - cgroup/cpuset: Prevent NULL pointer access in free_tmpmasks() (Waiman Long) [RHEL-154974]
  - cpuset: add helpers for cpus read and cpuset_mutex locks (Waiman Long) [RHEL-154974]
  - cpuset: separate tmpmasks and cpuset allocation logic (Waiman Long) [RHEL-154974]
  - cpuset: decouple tmpmasks and cpumasks freeing in cgroup (Waiman Long) [RHEL-154974]
  - cpuset: remove redundant CS_ONLINE flag (Waiman Long) [RHEL-154974]
  - cgroup: split cgroup_destroy_wq into 3 workqueues (Waiman Long) [RHEL-154974] {CVE-2025-39953}
  - cgroup: compare css to cgroup::self in helper for distingushing css (Waiman Long) [RHEL-154974]
  - memcg: always call cond_resched() after fn() (Waiman Long) [RHEL-154974]
  - cgroup: fix race between fork and cgroup.kill (Waiman Long) [RHEL-154974]
  - memcg: fix soft lockup in the OOM process (Waiman Long) [RHEL-154974] {CVE-2024-57977}
  - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142099] {CVE-2025-71116}
  - Disable TPM as hwrng source on aarch64 (Štěpán Horáček) [RHEL-66934]


