# changelog

author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20250812-1
changelog:
  - Update Intel CPU microcode to microcode-20250812 release
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000404
      up to 0xd000410;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002d0
      up to 0x10002e0;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000639 up to 0x2b000643;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c0003f7 up to 0x2c000401;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c0003f7 up to 0x2c000401;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
      0x2c0003f7 up to 0x2c000401;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b000639 up to 0x2b000643;
    - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x24
      up to 0x25;
    - Update of 06-ad-01/0x20 (GNR-AP/SP H0) microcode from revision
      0xa0000d1 up to 0xa000100;
    - Update of 06-ad-01/0x95 (GNR-AP/SP B0) microcode from revision
      0x10003a2 up to 0x10003d0;
    - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000341
      up to 0x3000362;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4128 up to 0x4129;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4128 up to 0x4129;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4128 up to 0x4129;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4128 up to 0x4129;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4128
      up to 0x4129;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4128 up to 0x4129;
    - Update of 06-bd-01/0x80 (LNL B0) microcode from revision 0x11f up
      to 0x123;
    - Update of 06-c5-02/0x82 (ARL-H A1) microcode from revision 0x118 up
      to 0x119;
    - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in
      intel-ucode/06-c5-02) from revision 0x118 up to 0x119;
    - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) from
      revision 0x118 up to 0x119;
    - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) from
      revision 0x118 up to 0x119;
    - Update of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02)
      from revision 0x118 up to 0x119;
    - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode from revision
      0x118 up to 0x119;
    - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) from
      revision 0x118 up to 0x119;
    - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) from
      revision 0x118 up to 0x119;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) from revision 0x210002a9 up to 0x210002b3;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x210002a9
      up to 0x210002b3.


author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20251111-1
changelog:
  - Fix typo in /usr/share/microcode_ctl/ucode_with_caveats/intel-06-8f-08/config
    (RHEL-123517)
  - Update Intel CPU microcode to microcode-20251111 release (RHEL-128195)
    - Addition of 06-ae-01/0x97 microcode at revision 0x1000273;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000643 up to 0x2b000650;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000401 up to 0x2c000410;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2c000401 up to 0x2c000410;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000401 up to 0x2c000410;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
      0x2c000401 up to 0x2c000410;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b000643 up to 0x2b000650;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x3a up to 0x3d;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x3a up to 0x3d;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x3a up to 0x3d;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x3a up to 0x3d;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x3a up to 0x3d;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x3a
      up to 0x3d;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x3a up to 0x3d;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x3a up to 0x3d;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x437 up to 0x43a;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x437 up to 0x43a;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x437 up to 0x43a;
    - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0xa up
      to 0xb;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x437
      up to 0x43a;
    - Update of 06-ad-01/0x20 (GNR-AP/SP H0) microcode from revision
      0xa000100 up to 0xa000124;
    - Update of 06-ad-01/0x95 (GNR-AP/SP B0) microcode from revision
      0x10003d0 up to 0x10003f0;
    - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000362
      up to 0x3000382;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12f up
      to 0x132;
    - Update of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) from
      revision 0x12f up to 0x132;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4129 up to 0x6133;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4129 up to 0x6133;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4129 up to 0x6133;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4129 up to 0x6133;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4129
      up to 0x6133;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4129 up to 0x6133;
    - Update of 06-bd-01/0x80 (LNL B0) microcode from revision 0x123 up
      to 0x125;
    - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1d up
      to 0x1e;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x3a up to 0x3d;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x3a up to 0x3d;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x3a up
      to 0x3d;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x3a up to 0x3d;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x3a up to 0x3d;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x3a up to 0x3d;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x3a up to 0x3d;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x3a up
      to 0x3d;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x3a up to 0x3d;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x3a up to 0x3d;
    - Update of 06-c5-02/0x82 (ARL-H A1) microcode from revision 0x119 up
      to 0x11a;
    - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in
      intel-ucode/06-c5-02) from revision 0x119 up to 0x11a;
    - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) from
      revision 0x119 up to 0x11a;
    - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) from
      revision 0x119 up to 0x11a;
    - Update of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02)
      from revision 0x119 up to 0x11a;
    - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode from revision
      0x119 up to 0x11a;
    - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) from
      revision 0x119 up to 0x11a;
    - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) from
      revision 0x119 up to 0x11a;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) from revision 0x210002b3 up to 0x210002c0;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x210002b3
      up to 0x210002c0.


author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20260210-1
changelog:
  - Update Intel CPU microcode to microcode-20260210 release (RHEL-150997)
  - Microcode files (/platform_mask shown) with revision updates (in hex):
    06-6a-06/87: Ice Lake-X: d000410 to d000421
    06-6c-01/10: Ice Lake-D: 10002e0 to 10002f1
    06-7e-05/80: Ice Lake-L: 00ca to 00cc
    06-8c-01/80: Tiger Lake: 00bc to 00be
    06-8c-02/c2: Tiger Lake: 003c to 003e
    06-8d-01/c2: Tiger Lake-H: 0056 to 0058
    06-8f-07/87: Sapphire Rapids: 2b000650 to 2b000661
    06-8f-08/10: Sapphire Rapids with HBM: 2c000410 to 2c000421
    06-8f-08/87: Sapphire Rapids: 2b000650 to 2b000661
    06-97-02/07: Alder Lake: 003d to 003e
    06-97-05/07: Alder Lake: 003d to 003e
    06-9a-03/80: Alder Lake-L: 043a to 043b
    06-9a-04/80: Alder Lake-L: 043a to 043b
    06-9a-04/40: Arizona Beach (Atom C11xx): 000b to 000c
    06-9a-04/80: Alder Lake-L: 043a to 043b
    06-a7-01/02: Rocket Lake: 0064 to 0065
    06-aa-04/e6: Meteor Lake-L: 0025 to 0028
    06-ad-01/20: Granite Rapids-X: a000124 to a000133
    06-ad-01/95: Granite Rapids-X: 10003f0 to 1000405
    06-ae-01/97: Granite Rapids-D: 1000273 to 10002f3
    06-b5-00/80: Arrow Lake-U: 000a to 000d
    06-b7-01/32: Raptor Lake: 0132 to 0133
    06-ba-02/e0: Raptor Lake-P: 6133 to 6134
    06-ba-03/e0: Raptor Lake-P: 6133 to 6134
    06-be-00/19: Gracemont (Alder Lake-N): 001e to 0021
    06-bf-02/07: Raptor Lake-S: 003d to 003e
    06-bf-05/07: Raptor Lake-S: 003d to 003e
    06-c5-02/82: Arrow Lake-H: 011a to 011b
    06-c6-02/82: Arrow Lake: 011a to 011b
    06-cf-02/87: Emerald Rapids: 210002c0 to 210002d3
  Resolves: RHEL-150997


author: Evan Goode <egoode@redhat.com> - 3.10.1-1
changelog:
  - Update to 3.10.1
  - Correct spelling of summary
  - Print more helpful error message when reinstalling non-installed pkg
    Resolves: RHEL-53430


author: Leo Sandoval <lsandova@redhat.com> - 0.7.2-2
changelog:
  - Rebase several patches from upstream which:
    - Introduce --is-sb-enabled parameter and better return codes
    - Remove unused int_to_b64()
    - Show help on unsupported systems
  - Resolves: #RHEL-90836
  - Resolves: #RHEL-90839


author: Miro Hrončok <mhroncok@redhat.com> - 2.5.1-6
changelog:
  - Split libmpdec++ into a mpdecimal++ subpackage
  - This prevents packages only using the libmpdec library from transitively depending on libstdc++


author: Charalampos Stratakis <cstratak@redhat.com> - 2.5.1-11
changelog:
  - Fix bind-now annocheck failure by passing the proper LDFLAGS to the C++ library
  Resolves: RHEL-33509


author: Lukáš Zaoral <lzaoral@redhat.com> - 8.0-1
changelog:
  - rebase to latest upstream version (RHEL-35944)
  - remove `nano-default-editor` from the specfile (RHEL-30790)


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.64.20160912git
changelog:
  - Resolves: #2077846 - net-tools utilities display incorrect statistics for interfaces with 15-character names


author: Vit Mojzis <vmojzis@redhat.com> - 0.30.0-21
changelog:
  - Improve "help/usage" message (RHEL-38477)
  - libnetlabel: fix a header file guard typo
  - netlabel-config: Fix IPv4/IPv6 addresses parsing in nlbl_reset_unlbl()
  - netlabel: Update man page to clarify SELinux labeling
  - tests: add a basic CALIPSO pass through test
  - doc: fix a typo in the netlabel-config man page


author: Pavel Reichl <preichl@redhat.com> - 0.4.2-3
changelog:
  - Actually change License from BSD to LGPL, based on content of COPYING file
  - Convert License tag to SPDX format


author: Phil Sutter <psutter@redhat.com> [1.1.1-5.el10]
changelog:
  - src: add conntrack information to trace monitor mode (Phil Sutter) [RHEL-102994]
  - src: split monitor trace code into new trace.c (Phil Sutter) [RHEL-102994]


author: Phil Sutter <psutter@redhat.com> [1.1.1-6.el10]
changelog:
  - Makefile: Fix for 'make CFLAGS=...' (Phil Sutter) [RHEL-108851]
  - table: Embed creating nft version into userdata (Phil Sutter) [RHEL-108851]
  - doc: nft.8: Minor NAT STATEMENTS section review (Phil Sutter) [RHEL-106743]
  - trace: Fix for memleak in trace_alloc_list() error path (Phil Sutter) [RHEL-111205]


author: Phil Sutter <psutter@redhat.com> [1.1.5-1.el10]
changelog:
  - doc: libnftables-json: Describe RULESET object (Phil Sutter) [RHEL-121194]
  - doc: don't suggest to disable GSO (Phil Sutter) [RHEL-121194]
  - build: don't install ancillary files without systemd service file (Phil Sutter) [RHEL-121194]
  - tests: shell: fix typo in vmap_timeout test script (Phil Sutter) [RHEL-121194]
  - tests: py: inet/osf.t: Fix element ordering in JSON equivalents (Phil Sutter) [RHEL-121194]
  - tests: py: any/ct.t.json.output: Drop leftover entry (Phil Sutter) [RHEL-121194]
  - tests: py: any/tcpopt.t.json: Fix JSON equivalent (Phil Sutter) [RHEL-121194]
  - optimize: Fix verdict expression comparison (Phil Sutter) [RHEL-121194]
  - datatype: Fix boolean type on Big Endian (Phil Sutter) [RHEL-121194]
  - src: parser_json: fix format string bugs (Phil Sutter) [RHEL-121194]
  - doc: fix tcpdump example (Phil Sutter) [RHEL-121194]
  - libnftables: do not re-add default include directory in include search path (Phil Sutter) [RHEL-121194]
  - monitor: Inform JSON printer when reporting an object delete event (Phil Sutter) [RHEL-121194]
  - tests: shell: skip two bitwise tests if multi-register support isn't available (Phil Sutter) [RHEL-121194]
  - tests: monitor: Fix regex collecting expected echo output (Phil Sutter) [RHEL-121194]
  - monitor: Quote device names in chain declarations, too (Phil Sutter) [RHEL-121194]
  - tools: gitignore nftables.service file (Phil Sutter) [RHEL-121194]
  - parser_bison: remove leftover utf-8 character in error (Phil Sutter) [RHEL-121194]
  - Rebase onto version 1.1.5 (Phil Sutter) [RHEL-121194]


author: Phil Sutter <psutter@redhat.com> [1.1.5-2.el10]
changelog:
  - spec: Require libnftnl >= 1.3.0-2 for NFTA_DEVICE_PREFIX handling (Phil Sutter) [RHEL-108861]
  - mnl: Drop asterisk from end of NFTA_DEVICE_PREFIX strings (Phil Sutter) [RHEL-108861]
  - tests: shell: Test ifname-based hooks (Phil Sutter) [RHEL-108861]
  - parser_bison: Accept ASTERISK_STRING in flowtable_expr_member (Phil Sutter) [RHEL-108861]
  - mnl: Support simple wildcards in netdev hooks (Phil Sutter) [RHEL-108861]


author: Phil Sutter <psutter@redhat.com> [1.1.5-3.el10]
changelog:
  - Update expected test suite results (Phil Sutter) [RHEL-121194]
  - tests: monitor: Fix for out-of-path call (Phil Sutter) [RHEL-121194]


author: Phil Sutter <psutter@redhat.com> [1.1.5-4.el10]
changelog:
  - spec: Require libnftnl-1.3.0-3 for nftnl_{expr,set_elem}_set_imm() (Phil Sutter) [RHEL-128553]
  - tests: py: Adjust payloads to changed userdata printing (Phil Sutter) [RHEL-128553]
  - tests: py: Update payload records (Phil Sutter) [RHEL-128553]
  - tests: py: objects.t: must use input, not output (Phil Sutter) [RHEL-128553]
  - tests: py: tools: Add regen_payloads.sh (Phil Sutter) [RHEL-128553]
  - netlink: Make use of nftnl_{expr,set_elem}_set_imm() (Phil Sutter) [RHEL-128553]
  - netlink: No need to reference array when passing as pointer (Phil Sutter) [RHEL-128553]
  - netlink: Introduce struct nft_data_linearize::sizes (Phil Sutter) [RHEL-128553]
  - netlink: Introduce struct nft_data_linearize::byteorder (Phil Sutter) [RHEL-128553]
  - expression: Set range expression 'len' field (Phil Sutter) [RHEL-128553]
  - intervals: Convert byte order implicitly (Phil Sutter) [RHEL-128553]
  - mergesort: Align concatenation sort order with Big Endian (Phil Sutter) [RHEL-128553]
  - mergesort: Fix sorting of string values (Phil Sutter) [RHEL-128553]
  - segtree: Fix range aggregation on Big Endian (Phil Sutter) [RHEL-128553]


author: Than Ngo <than@redhat.com> - 3.24.0-7
changelog:
  - Resolves: RHEL-80632, tokens are deleted on reboot
  - Related: RHEL-77146, opencryptoki doesn't work in image mode


author: Than Ngo <than@redhat.com> - 3.25.0-1
changelog:
  - Resolves: RHEL-85376, ep11 token: PKCS #11 3.0 - support SHA3
  - Resolves: RHEL-90589, CCA token: basic support of AES-GCM
  - Resolves: RHEL-72964, cca token support cipher keys
  - Resolves: RHEL-72968, Support for CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens
  - Resolves: RHEL-73343, Upgrade openCryptoki to latest version
  - Resolves: RHEL-75144, p11kmip: a tool to import/export PKCS #11 keys from to a KMIP server
  - Resolves: RHEL-75761, ep11 token: import and export of secure key objects
  - Resolves: RHEL-85374, cca token: Support ECDH to derive AES keys


author: Than Ngo <than@redhat.com> - 3.25.0-2
changelog:
  - Related: RHEL-73343, Fix detection of EC curve not supported by OpenSSL-3.5.x
  - Related: RHEL-77146, Fix the image mode issue again as bootc expects to use /run/lock


author: Than Ngo <than@redhat.com> - 3.25.0-3
changelog:
  - Fix incorrect effective group id of pkcsslotd daemon
  - Fix covscan findings
    Resolves: RHEL-104598


author: Than Ngo <than@redhat.com> - 3.26.0-1
changelog:
  - Resolves: RHEL-75138, ep11 token BLS support
  - Resolves: RHEL-85380, ep11 token: ML-KEM and ML-DSA support
  - Resolves: RHEL-85383, cca token: ML-KEM and ML-DSA support
  - Resolves: RHEL-100058, openCryptoki 3.26.0


author: Simon Pichugin <spichugi@redhat.com> - 2.6.8-1
changelog:
  - Rebase to version 2.6.8 (RHEL-71052)
  - Avoid SSL context cleanup during library destruction (RHEL-68424)


author: Veronika Hanulikova <vhanulik@redhat.com> - 0.26.1-1
changelog:
  - Rebase to new upstream release (RHEL-71523)
  - Separate OpenSC into libraries and binaries (RHEL-73314)


author: Jakub Jelen <jjelen@redhat.com> - 0.27.1-1
changelog:
  - Rebase to OpenSC 0.27.1 fixing outstanding security reports and bring in new PQC features (RHEL-151598)


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-17
changelog:
  - CVE-2025-61984: Reject usernames with control characters
    Resolves: RHEL-128399
  - CVE-2025-61985: Reject URL-strings with NULL characters
    Resolves: RHEL-128388


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-21
changelog:
  - Implement obtaining Kerberos tickets on behalf of user on SSH authentication
    Resolves: RHEL-92932


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-22
changelog:
  - Remove recommendation of p11-kit
    Resolves: RHEL-139070
  - Only the first value of MaxStartups, PerSourceNetBlockSize and IPQoS
    in sshd_config should count when defined multiple times
    Resolves: RHEL-150365
  - Fix mistracking of MaxStartups process exits in some situations
    Resolves: RHEL-121768
  - Fix GSSAPI authentication indicator issues found by AI
    Resolves: RHEL-154309
  - CVE-2026-3497: Fix information disclosure or denial of service due
    to uninitialized variables in gssapi-keyex
    Resolves: RHEL-155813


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-23
changelog:
  - Don't negotiate non-FIPS algorithms in ssh-keyscan key exchange in FIPS mode
    Resolves: RHEL-88565
  - Fix duplicate audit log entry when destroying ed25519 private keys
    Resolves: RHEL-46782
  - Fix typo in GSSAPIProxyS4U2Services
    Related: RHEL-92932


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-25
changelog:
  - Fix static analysis issues
    Resolves: RHEL-163365
  - Ssh should refuse connection when mlkem kex is specified in FIPS
    Resolves: RHEL-155178
  - CVE-2026-35385: Fix privilege escalation via scp legacy protocol
    when not in preserving file mode
    Resolves: RHEL-164740
  - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode
    multiplexing sessions
    Resolves: RHEL-166239
  - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms
    and HostbasedAcceptedAlgorithms with regard to ECDSA keys
    Resolves: RHEL-166223
  - CVE-2026-35414: Fix mishandling of authorized_keys principals option
    Resolves: RHEL-166191
  - CVE-2026-35386: Add validation rules to usernames and hostnames
    set for ProxyJump/-J on the commandline
    Resolves: RHEL-166207


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-26
changelog:
  - Improve keytab detection when obtaining Kerberos tickets on behalf of user on SSH authentication
    Related: RHEL-92932
  - Add missing NULL check for server key generation in ML-KEM hybrids
    Resolves: RHEL-168106


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.1-1
changelog:
  - Rebasing to OpenSSL 3.5.1
    Resolves: RHEL-90350
    Resolves: RHEL-95613
    Resolves: RHEL-97796
    Resolves: RHEL-99353
    Resolves: RHEL-100168


author: Simo Sorce <simo@redhat.com> - 1:3.5.1-2
changelog:
  - Move fips.so to a seprate subpackage
    Reverts FIPS self test for SLH-DSA
    Add Suggests to try to prefer the openssl-fips-provider package
    over the fips-provider-next package by default
    Revolves: RHEL-102408
    Related: RHEL-80811


author: Simo Sorce <simo@redhat.com> - 1:3.5.1-3
changelog:
  - Add custom define to disable symbol versioning in downstream patched code
    Also add stricter Suggests for openssl-fips-provider
    Resolves: RHEL-101548
  - Fix Requires/Provider to fix default install of fips providers
    Resolves: RHEL-105010


author: Pavol Žáčik <pzacik@redhat.com> - 1:3.5.1-4
changelog:
  - Make openssl speed test signatures without errors
    Resolves: RHEL-95182
  - Build tests in check and without LTO
    Resolves: RHEL-111634


author: Pavol Žáčik <pzacik@redhat.com> - 1:3.5.1-5
changelog:
  - Fix globally disabled LTO
    Related: RHEL-111634
  - Initialize reserved and unused memory in aes-s390x.pl
    Resolves: RHEL-107479


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.5-1
changelog:
  - Rebase to OpenSSL 3.5.5
    Resolves: RHEL-122599
    Resolves: RHEL-141987
    Resolves: RHEL-142009
    Resolves: RHEL-142022
    Resolves: RHEL-142026
    Resolves: RHEL-142030
    Resolves: RHEL-142034
    Resolves: RHEL-142038
    Resolves: RHEL-142042
    Resolves: RHEL-142046
    Resolves: RHEL-142050
    Resolves: RHEL-142054


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.6.1-2
changelog:
  - Fix static analyzer detected issues. Resolves: RHEL-36475
  - pam_env: fixes for NULL environment variables


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.6.1-6
changelog:
  - pam_access: always match local address and clarify LOCAL keyword behaviour.
    Resolves: RHEL-65223


author: Brian C. Lane <bcl@redhat.com> - 3.5-11
changelog:
  - parted: Fix ending sector location when using kibi IEC suffix (bcl)
  - tests: Fix formatting and snprintf warnings in tests. (bcl)
  - ui: Add checks for prompt being NULL (bcl)
  - strlist: Handle realloc error in wchar_to_str (bcl)
  - libparted: Fix potential NULL dereference in ped_disk_next_partition (bcl)
  - filesys: Check for null from close_fn (bcl)


author: Brian C. Lane <bcl@redhat.com> - 3.5.28-1
changelog:
  - Upstream 3.5.28 Alpha release
  - Dropped all patches included in new upstream release
  - Bumped minor version on libparted.so and libparted-fs-resize.so


author: Brian C. Lane <bcl@redhat.com> - 3.6-7
changelog:
  - tests: Add test for dvh with a bad checksum (bcl)
    Related: RHEL-73220
  - libparted: Fix dvh disklabel unhandled exception (bcl)
    Related: RHEL-73220
  - tests: Add test for SUN disklabel handling (bcl)
    Related: RHEL-73220
  - libparted: Fix sun disklabel unhandled exception (bcl)
    Resolves: RHEL-73220


author: Michal Hlavinka <mhlavink@redhat.com> - 3.13.0-1
changelog:
  - updated to 3.13, adds support for cxl1.1 device link status information (#RHEL-29153)
  - add riscv64 build support (#RHEL-40383)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.40.0-509
changelog:
  - 5.40.0 bump (see <https://metacpan.org/release/HAARG/perl-5.40.0/view/pod/perldelta.pod)
  - Subpackage Term-Table
  - Subpackage Test-Suite2


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.40.1-512
changelog:
  - Resolves: RHEL-75798
  - 5.40.1 bump (see <https://metacpan.org/release/SHAY/perl-5.40.1/view/pod/perldelta.pod>)
  - Add config.over to make build od perl reproducible
  - Removed unnecessary conversion
  - Add new systemtap-sdt-dtrace to build deps


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.40.2-513
changelog:
  - 5.40.2 bump (see <https://metacpan.org/release/SHAY/perl-5.40.2/view/pod/perldelta.pod>)
  - Resolves: RHEL-87186


author: Paul Howarth <paul@city-fan.org> - 2.081-1
changelog:
  - Update to 2.081
    - New function set_msg_callback for user defined callback on each SSL message
    - Showcase function in example/ssl_client.pl and example/ssl_server.pl for
      computing JA3S/JA3 fingerprints
    - Fix tracing added in 2.076 to no longer include SSL3_RT_HEADER (noise)


author: Paul Howarth <paul@city-fan.org> - 2.082-1
changelog:
  - Update to 2.082
    - SSL_version default now TLS 1.2+ since TLS 1.1 and lower are deprecated
      (GH#122)
    - Fix output of alert string when debugging (GH#132)
    - Improve regex for hostname validation (GH#130, GH#126)
    - Add can_ciphersuites subroutine for feature checking (GH#127)
    - Utils::CERT_create - die if unexpected arguments are given instead of
      ignoring these
  - Avoid use of deprecated patch syntax


author: Paul Howarth <paul@city-fan.org> - 2.083-1
changelog:
  - Update to 2.083
    - Fix t/protocol_version.t for OpenSSL versions that don't support SECLEVEL
      (regression from GH#122)


author: Paul Howarth <paul@city-fan.org> - 2.084-1
changelog:
  - Update to 2.084
    - Various fixes for edge cases and build: GH#136, GH#141, GH#142, GH#143,
      GH#145
    - Update documentation to reflect default SSL_version


author: Paul Howarth <paul@city-fan.org> - 2.085-1
changelog:
  - Update to 2.085
    - Fix test that failed due to behavior changes in OpenSSL 3.2 (GH#147)
    - Update PublicSuffix
    - Add examples for TLS JA3/JA4 fingerprinting to tls_fingerprint/


author: Paul Howarth <paul@city-fan.org> - 1.94-1
changelog:
  - Update to 1.94
    - Net::SSLeay now officially supports all stable releases of OpenSSL 3.1 and
      3.2, and LibreSSL 3.5-3.8
    - Many noisy compiler warnings have been silenced - if SSLeay.xs fails to
      compile, it should now be much easier to identify the cause
    - libcrypto's OPENSSL_init_crypto() function and libssl's OPENSSL_init_ssl()
      function are now exposed, enabling fine-grained control over the
      initialisation and configuration of both libraries
    - libssl functions implementing TLS 1.3 PSK authentication are now exposed,
      in particular SSL_CTX_set_psk_find_session_callback() (on the server side)
      and SSL_CTX_set_psk_use_session_callback() (on the client side)
    - libssl functions implementing server-side TLS 1.2 PSK authentication are
      now exposed, in particular SSL_CTX_set_psk_server_callback()
    - libssl's SSL_CTX_set_client_hello_cb() function is now exposed, allowing a
      TLS server to set a callback function that is executed when the server
      processes a ClientHello message
    - Many more libcrypto/libssl constants and functions are now exposed; see the
      release notes for the 1.93 developer releases for a full list


author: Vit Mojzis <vmojzis@redhat.com> - 3.9-2
changelog:
  - semanage: Reset active value when deleting boolean customizations (RHEL-111421)
  - setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC (RHEL-111505)


author: Jan Rybar <jrybar@redhat.com> - 125-4
changelog:
  - changing log level via dbus is now restricted to root
  - backport of https://github.com/polkit-org/polkit/commit/5a4ba7dfdcc3f
  - Resolves: RHEL-90807


author: Jan Rybar <jrybar@redhat.com> - 0.1-26
changelog:
  - use build macros, on behalf of original author Tom Stellard (tstellar)
  - Pagure doesn't allow one-click rebase, AFAIK


author: Jan Rybar <jrybar@redhat.com> - 4.0.4-11
changelog:
  - ps: etime overflow reappeared with rewritten library
  - uptime, w: report user sessions only; upstream backport of 734930e47
  - Resolves: RHEL-60826
  - Resolves: RHEL-141839


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.10-3
changelog:
  - Fix PySSL_SetError handling SSL_ERROR_SYSCALL
  - This fixes random flakiness of test_ssl on stressed machines
  Resolves: RHEL-90555


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.11-1
changelog:
  - Update to 3.12.11
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98060, RHEL-98047, RHEL-97813, RHEL-98062, RHEL-98180


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-4
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143057
  Resolves: RHEL-143109
  Resolves: RHEL-144854


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-5
changelog:
  - Rebuilding previous fixes for different build target
  Related: RHEL-143057, RHEL-143109, RHEL-144854


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.13-1
changelog:
  - Update to 3.12.13
  - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672
  - Require expat >= 2.7.2 to prevent symbol lookup errors at runtime with older expat
  Related: RHEL-167886, RHEL-168120


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.13-2
changelog:
  - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224
  Resolves: RHEL-167886, RHEL-168120


author: Fraser Tweedale <ftweedal@redhat.com> - 48.0.0-1
changelog:
  - Update to 48.0.0, resolves RHEL-172409
  - Fix AES-GCM with FIPS provider version mismatch, resolves RHEL-173746


author: Packit <hello@packit.dev> - 1.9.0-1
changelog:
  - Optimize some repo metastuff and prepare v1.9.0 (#364) (nir0s)
  - Actions(deps): Bump actions/setup-python from 4 to 5 (#363) (dependabot[bot])
  - Test on modern versions of CPython and PyPy and macOS (#362) (Christian Clauss)
  - Actions(deps): Bump actions/checkout from 3 to 4 (#361) (dependabot[bot])
  - Refactor `distro.info()` method to return an `InfoDict` (#360) (SCC/楊志璿)
  - Ignore the file '/etc/ec2_version' (Pritam Kulkarni)
  - Add Debian Testing to the tests (#356) (Harshula Jayasuriya)
  - Ignore the file '/etc/board-release' (#353) (Pedro Lamas)
  - Add support for ALT Linux Server 10.1 distribution (#354) (Alexander Stepchenko)
  - Run Python 3.6 on Ubuntu 20.04 for CI and bump isort (#355) (Samuel FORESTIER)
  - Update archlinux resource for tests (Saltaformajo)
  - Resolves rhbz#2255740


author: John Kacur <jkacur@redhat.com> - 0.7.4-1
changelog:
  - Rebase to upstream version 0.7.4
  - Convert to pyproject-based build using pyproject.toml
  - Remove python3-six dependency (no longer needed)
  - Remove distutils patch (no longer needed with pyproject build)
  Resolves: RHEL-114904


author: Miro Hrončok <mhroncok@redhat.com> - 23.3.1-5
changelog:
  - Switched to autogenerated BuildRequires for test dependencies,
    which removed some that were no longer necessary


author: Charalampos Stratakis <cstratak@redhat.com> - 23.3.2-2
changelog:
  - Use tarfile.data_filter for extracting (CVE-2007-4559, PEP-721, PEP-706)
  - Require Python with tarfile filters
  - Resolves: RHEL-25820


author: Miro Hrončok <mhroncok@redhat.com> - 2.28.2-7
changelog:
  - Do not package requests[security] and requests[socks] on RHEL
  - Make the package build even when urllib3 won't pull in pysocks


author: Lumír Balhar <lbalhar@redhat.com> - 2.32.3-1
changelog:
  - Update to 2.32.3
  - Fix for CVE-2024-35195
  Resolves: RHEL-37604
  - Add support for IPv6 CIDR in no_proxy setting
  Resolves: RHEL-32523


author: Miro Hrončok <mhroncok@redhat.com> - 2.32.4-1
changelog:
  - Update to 2.32.4
  - Security fix for CVE-2024-47081: .netrc credentials leak via malicious URLs
  Resolves: RHEL-105460


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-15
changelog:
  - Add support for spec local file attributes and generators (RHEL-84057)
  - Ensure binary and source headers are identified as such (RHEL-87383)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-18
changelog:
  - Add support for multiple OpenPGP signatures per package (RHEL-100571)
  - Add support for OpenPGP v6 signature pre-salting (RHEL-100571)
  - Add support for PQC algorithms from RFC-9580 (RHEL-100571)
  - Add --list and --erase commands to rpmkeys(8) (RHEL-105421)
  - Fix regression on dynamic subpackage RPMTAG_SOURCERPM missing (RHEL-102023)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-21
changelog:
  - Fix pre/post/meta/etc. qualifiers for weak dependencies (RHEL-101936)
  - Fix redundant rpmdb-migrate.service runs (RHEL-96510)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-22
changelog:
  - Ignore signatures made by unknown or disabled algorithms (RHEL-112394)
  - Enable NSS-based user and group lookups again (RHEL-118365)
  - Fix ignored password field if empty in passwd/group file (RHEL-118365)


author: Miro Hrončok <mhroncok@redhat.com> - 1.26.19-3
changelog:
  - Security fix for CVE-2025-66471
  - Security fix for CVE-2025-66418
  - Security fix for CVE-2026-21441
  Resolves: RHEL-142737, RHEL-137215, RHEL-142755


author: Akira TAGOH <tagoh@redhat.com> - 4.0.3-5
changelog:
  - Split packages for variable fonts.
  - Drop unnecessary/duplicate fonts from packages.
  - Worked around broken family name in variable fonts.


author: Akira TAGOH <tagoh@redhat.com> - 4.0.3-8
changelog:
  - Use no VF in family name version of ttf for -vf packages.
  - Adjust properties in VF to avoid confusion.


author: Akira TAGOH <tagoh@redhat.com> - 4.0.3-11
changelog:
  - Add a provide line of font(redhatdisplayvf), font(redhattextvf),
    and font(redhatmonovf) to each sub-packages for backward compatibility.
  - Fix invalid License field.


author: Akira TAGOH <tagoh@redhat.com> - 4.0.3-14
changelog:
  - Remove Italic variable fonts to workaround a crash issue
    and unexpected italic rendering.
    Resolves: RHEL-69430


author: Stephen Gallagher <sgallagh@redhat.com> - 1:0.4-0.54.b47
changelog:
  - Fixes for -WError=implicit-function-declaration on RHEL
  - Reinstates the dump headers without compiling the implementations


author: Vladis Dronov <vdronov@redhat.com> - 6.17-2
changelog:
  - Add Intel CET IBT instrumentation to assembly code
  - Update to the upstream v6.17 @ ac43f912 (RHEL-36771)


author: Vladislav Dronov <vdronov@redhat.com> - 6.17-10
changelog:
  - Update to the upstream v6.17 @ e8da3cdc (RHEL-176338)
  - Handle new radiacode entropy source
  - Build with the updated jitterentropy v3.7.0 library
  - Drop the older i686 force-PIC fix


author: Michal Ruprich <mruprich@redhat.com> - 3.4.1-1
changelog:
  - New version 3.4.1
  - Resolves: RHEL-70151 - Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling
  - Resolves: RHEL-70159 - Info Leak via Uninitialized Stack Contents
  - Resolves: RHEL-70203 - rsync server leaks arbitrary client files
  - Resolves: RHEL-72500 - Path traversal vulnerability in rsync
  - Resolves: RHEL-72501 - --safe-links option bypass leads to path traversal
  - Resolves: RHEL-71658 - Race Condition in rsync Handling Symbolic Links
  - Resolves: RHEL-71293 - Build rsync with --with-rrsync


author: Michal Ruprich <mruprich@redhat.com> - 3.4.1-5
changelog:
  - Resolves: RHEL-169137 - CVE-2026-41035 - Use-after-free vulnerability in extended attribute handling


author: Paolo Bonzini <pbonzini@redhat.com> - 4.9-1
changelog:
  - Rebase to 4.9
  - Update downstream patches
  - Resolves: rhbz#2140486
  - Remove change to gnulib tests, they pass anyway
  - Install valgrind and langpacks to increase test coverage


author: Jakub Martisko <jamartis@redhat.com> - 4.9-5
changelog:
  - lib/dfa.c: Increase the maximum size of the transitions table
  - After changes introduced between sed 4.2 and 4.4, some regexps
    started to hit the table size limits. This lead to repeated deletion
    and rebuilding of the table, leading to massive performance drops.
    While the core issue is still present, this change should at least
    help by moving the threshold of the regexp complexity that triggers the 
    table rebuilds.
  - Resolves: RHEL-144027


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.14-1
changelog:
  - Update ktls policy
  Resolves: RHEL-123737
  - Update policy for redfish-finder
  Resolves: RHEL-50299
  - Allow sshd-session read, write, and map ica tmpfs files
  Resolves: RHEL-138247
  - Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t
  Resolves: RHEL-127721
  - Allow stalld map sysfs files
  Resolves: RHEL-135512
  - Allow aide get attributes of a filesystem with extended attributes
  Resolves: RHEL-121479
  - Label miscellaneous /dev/papr-* devices
  Resolves: RHEL-129839
  - Allow KDE Plasma Login Manager to function as a display manager
  Resolves: RHEL-135676
  - Update specfile trigger for openwsmand
  Resolves: RHEL-133024


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.15-1
changelog:
  - Allow hostapd write to socket files in /tmp
  Resolves: RHEL-77047
  - Allow stap server read virtual memory sysctls
  Resolves: RHEL-114104
  - Allow sshd-session inherit limits from its parent process
  Resolves: RHEL-136673
  - Allow sshd noatsecure on sshd-session execution
  Resolves: RHEL-138247
  - Allow sshd-net read and write to sshd vsock socket
  Related: RHEL-138247


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.16-1
changelog:
  - Allow sshd-session inherit limits from its parent sshd process
  Resolves: RHEL-136673
  - Revert "Allow sshd-session inherit limits from its parent process"
  Resolves: RHEL-136673
  - Allow tlshd write generic certificates
  Resolves: RHEL-123737
  - Allow systemd-hostnamed to create its Varlink socket
  Resolves: RHEL-139385
  - Update gpg_role() interface with unix_stream_socket permissions
  Resolves: RHEL-128555
  - Label /etc/aliases.cdb with etc_aliases_t
  Resolves: RHEL-109976
  - Add aliases.lmdb to mta_filetrans_named_content()
  Resolves: RHEL-140884
  - Update policy for bootupd
  Resolves: RHEL-141391


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.17-1
changelog:
  - Allow rhsmcertd read anaconda run files
  Resolves: RHEL-141391
  - Allow mdadm to use CAP_BPF during RAID monitoring
  Resolves: RHEL-135765
  - Allow mdadm the CAP_SYS_PTRACE capability
  Resolves: RHEL-135765
  - Allow staff and sysadm execute iotop using sudo
  Resolves: RHEL-134940
  - Allow kernel_t to read/write all domains' pipes
  Resolves: RHEL-124442
  - Allow nfsd_t domain setuid and setgid capability for rpc.mountd
  Resolves: RHEL-148107


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.18-1
changelog:
  - Allow NetworkManager list bpf directories
  Resolves: RHEL-142171
  - Dontaudit systemd-generator connect to sssd over a unix stream socket
  Resolves: RHEL-114886
  - Allow pkcsslotd read files in /proc and /sys
  Resolves: RHEL-130812
  - Allow pkcsslotd map its private tmpfs files
  Resolves: RHEL-130812
  - Allow tlshd communication to unconfined_t over a tcp socket
  Resolves: RHEL-125106
  - Label /run/insights-client.ppid with insights_client_run_t
  Resolves: RHEL-146687
  - Allow NM nvme dispatcher script start systemd services
  Resolves: RHEL-140760
  - Allow tlshd write generic certificate dirs
  Resolves: RHEL-127023
  - Allow aide get attributes of tmpfs and devtmpfs filesystems
  Resolves: RHEL-121479
  - Allow plasma login manager stop login services
  Resolves: RHEL-140911
  - Rebuild selinux policy after installation of the extra package
  Resolves: RHEL-135875
  Resolves: RHEL-143926
  - Move triggerin scriptlets to the parent packages
  Resolves: RHEL-141813
  - Rebuild policy before running {binsbin|varrun}-convert.sh
  Resolves: RHEL-141813


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.19-1
changelog:
  - Label the greetd login manager framework as a display manager
  Resolves: RHEL-147638
  - Allow sysadm user connect to lvm over a unix stream socket
  Resolves: RHEL-153729
  - Allow virtqemud map vhost net device
  Resolves: RHEL-141541
  - Allow virtqemud_t send kill signal to svirt_tcg_t
  Resolves: RHEL-69913
  - Allow virtqemud_t get priority of a svirt_t process
  Resolves: RHEL-69920
  - Dontaudit tlshd write generic certificate dirs
  Resolves: RHEL-152619
  - Allow redis_t to create netlink_rdma_socket
  Resolves: RHEL-154814
  - Remove "minimum" as a SELINUXTYPE from /etc/selinux/config
  Resolves: RHEL-140212


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.20-1
changelog:
  - Do not backslash-escape underscores in file context specifications
  Resolves: RHEL-140921
  - Policy for go-fdo-server
  Resolves: RHEL-145754
  - Allow iptables_t read state of some processes
  Resolves: RHEL-164304
  - Allow iptables read firewalld process state
  Resolves: RHEL-164304
  - Allow systemd-machined read virtd process state
  Resolves: RHEL-164304
  - Allow systemd-machined read svirt process state
  Resolves: RHEL-164304
  - Label /dev/HID-SENSOR-.* with hid_sensor_device_t
  Resolves: RHEL-168417
  - Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  Resolves: RHEL-164864
  - Dontaudit setroubleshootd read root's home files like .rpmmacros
  Resolves: RHEL-142548
  - Allow systemd-tmpfiles to adjust resource limits
  Resolves: RHEL-139855


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.21-1
changelog:
  - Allow sys_resource on execution of generic executables conditionally
  Resolves: RHEL-141858
  - Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  Resolves: RHEL-156457
  - Label /run/coreos with coreos_installer_var_run_t
  Resolves: RHEL-156456
  - Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  Resolves: RHEL-156456
  - Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  Resolves: RHEL-170267
  - Remove 14 permissive domains
  Resolves: RHEL-166039
  - Do not audit iptables attempts to read other process state
  Resolves: RHEL-164304


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.22-1
changelog:
  - Allow virtqemud execute kmod in the kmod domain
  Resolves: RHEL-99904
  - Allow qatlib map kernel modules
  Resolves: RHEL-133797
  - Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  Resolves: RHEL-167849
  - Allow go-fdo-server to read system information
  Resolves: RHEL-145754


author: Veronika Syncakova <vsyncako@redhat.com> - 42.1.23-1
changelog:
  - Bring back execmem permission for svirt_tcg_t
  - Leave content of virtqemud_use_execmem empty
  - Dontaudit libvirt-daemons execmem
  - Allow virtstoraged to setattr fixed disk devices
  Resolves: RHEL-44901


author: Martin Osvald <mosvald@redhat.com> - 2.14.4-1
changelog:
  - protocols: add mptcp (262)
  - setup.spec: make setup protected package (rhbz#2155547)
  - setup.spec: don't report rpm -Va error on /run/motd (rhbz#2160954)
  - services: replace hostmon with llmnr for port 5355 (rhbz#2216914)


author: Martin Osvald <mosvald@redhat.com> - 2.14.5-1
changelog:
  - bashrc: switch PROMPT_COMMAND to be an array (rhbz#2097525)
  - profile: don't overwrite the HISTSIZE environment variable
  - hosts: use "example.org" as example domain (rhbz#2246220)
  - csh.login: source csh.local (RHEL-17226)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.48-7
changelog:
  - udev rules: avoid spurious warning for non-SCSI devices (RHEL-40861,RHEL-54607)
  - Install missing 00-scsi-sg3_config.rules
  - Fix file references to other udev rules


author: Paul Evans <pevans@redhat.com> - 1.48-8
changelog:
  - rescan-scsi-bus.sh: Correctly read RMB bit on enquiry (RHEL-153277)
  - rescan-scsi-bus.sh: Replace 'which' with build in 'command -v' (RHEL-70693)
  - sg_safte: update short option of version (RHEL-125869)
  - sg_rdac: accept --help or -h without error (RHEL-69439)
  - sg_inq: fix issing output fields in --export format (RHEL-119246, RHEL-123748)
  - sg_inq: re-add Unit serial number field (RHEL-119246, RHEL-123748)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.0-1
changelog:
  - Rebase to version 4.15.0
  - getdef: avoid spurious error messages about unknown configuration options


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.0-11
changelog:
  - passwd.c: lock, open, close and unlock passwd database
    Resolves: RHEL-151055
    Resolves: RHEL-150955


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.0-12
changelog:
  - groupmod.c: delete gr_free_members(&grp) to avoid double free
    Resolves: RHEL-135902
  - subordinateio.c: list_owner_ranges(): Fix duplicate range when
    username matches ID. Resolves: RHEL-114226


author: Milan Crha <mcrha@redhat.com> - 2.3-6
changelog:
  - Co-own /usr/share/gettext and /usr/share/gettext/its
  - Related to rhbz#2280150
  - Resolves: RHEL-38682 (Backport Fedora 40 changes)


author: Zuzana Miklankova <zmiklank@redhat.com> - 3.45.0-1
changelog:
  - Updated to version 3.45.0 (https://sqlite.org/releaselog/3_45_0.html)
  - List versioned soname in files, preventing unnoticed soname bumps
  - Disable func4 tests for i686 arch due to failing float<->int conversions


author: Bruno Wolff III <bruno@wolff.to> - 4.6-1
changelog:
  - 4.6 release
  - PR #231 was merged
  - See https://github.com/plougher/squashfs-tools/blob/master/CHANGES


author: Bruno Wolff III <bruno@wolff.to> - 4.6.1-1
changelog:
  - Phillip is now doing two tags per release and we can
  - use the one that works better with forgemeta
  - There are a few fixes after the 4.6 release. I think only
  - one applies to Fedora because of the build options we use.
  - It was not something that affects image builds.


author: Eugene Syromiatnikov <esyr@redhat.com> - 6.7-5
changelog:
  - Fix incorrect syscall name reporting in restart_syscall() on attach when
    PTRACE_GET_SYSCALL_INFO is in use (RHEL-65108).
  - Update net-yy-inet* and linkat--secontext_mismatch tests.


author: Eugene Syromiatnikov <esyr@redhat.com> - 6.7-6
changelog:
  - Avoid failures of creat.gen test on kernels that include commit
    v6.11-rc1~242^2~19 ("fs: don't block i_writecount during exec").


author: Radovan Sroka <rsroka@redhat.com> - 1.9.15-5.p5
changelog:
  - RHEL 10.0 ERRATUM
  - sudo-1.9.15-2.p5.el10: RHEL SAST Automation: address 4 High impact true
    positive(s) Resolves: RHEL-44436
  - sudo subpackage sudo-logsrvd should not be built Resolves: RHEL-52864


author: Alejandro López <allopez@redhat.com> - 1.9.15-9.p5
changelog:
  - RHEL 10.1 ERRATUM
  - CVE-2025-32462 sudo: LPE via host option Resolves: RHEL-100009
  - CVE-2025-32463 sudo: LPE via chroot option Resolves: RHEL-100022


author: Alejandro López <allopez@redhat.com> - 1.9.17-2.p2
changelog:
  - Resolves: RHEL-59136 - sudo passes SHELL environment variable twice to
    the shell being executed [rhel-10]
  - Resolves: RHEL-128212 - [RFE] request to backport support for regex in
    sudo [rhel-10]
  - Resolves: RHEL-112100 - Rebase of sudo to 1.9.17p2 [rhel-10]


author: Alejandro López <allopez@redhat.com> - 1.9.17-3.p2
changelog:
  - Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation
    due to failure in privilege drop calls


author: Alejandro López <allopez@redhat.com> - 1.9.17-4.p2
changelog:
  - Bump release number
  - Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation
    due to failure in privilege drop calls


author: Alejandro López <allopez@redhat.com> - 1.9.17-8.p2
changelog:
  - Resolves: RHEL-95850 - A sudo'd command when invoked from ksh through a
    pipe mangles output, leaves tty insane


author: Leo Sandoval <lsandova@redhat.com> - 6.04-0.32
changelog:
  - Bump version and include previous resolves ticket number on commit message
  - Resolves: #RHEL-51170


author: Eduard Abdullin <eabdullin@almalinux.org> - 6.04-0.34.alma.2
changelog:
  - Use static syslinux64.exe and syslinux.exe to avoid a difference in the
    checksum in x86_64_v2 arch


author: Josue Hernandez <josherna@redhat.com> - 6.04-0.35
changelog:
  - Update zlib version to zlib-1.2.11
  - Resolves: #RHEL-156979
  - Resolves: CVE-2022-37434 CVE-2018-25032 CVE-2016-9840
  - Resolves: CVE-2016-9841 CVE-2016-9842 CVE-2016-9843


author: systemd maintenance team <systemd-maint@redhat.com> - 257-15
changelog:
  - coredump: drop RestrictSUIDSGID= option (#38640) (RHEL-113920)
  - ukify: fix insertion of padding in merged sections (RHEL-114414)
  - core: introduce Unit.dependency_generation counter and restart loop when dependency is updated in the loop (RHEL-112203)
  - core/unit: use UNIT_FOREACH_DEPENDENCY_SAFE() at several more places (RHEL-112203)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-16
changelog:
  - test: rename TEST-53-ISSUE-16347 to TEST-53-TIMER (RHEL-118216)
  - test: restarting elapsed timer shouldn't trigger the corresponding service (RHEL-118216)
  - test: check the next elapse timer timestamp after deserialization (RHEL-118216)
  - timer: don't run service immediately after restart of a timer (RHEL-118216)
  - test: store and compare just the property value (RHEL-118216)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-17
changelog:
  - pam_systemd: honor session class provided via PAM environment (RHEL-109832)
  - udev/net_id: introduce naming scheme for RHEL-10.2 (RHEL-72813)
  - udev/net_id: introduce naming scheme for RHEL-9.8 (RHEL-72813)
  - test: split VM-only subtests from TEST-74-AUX-UTILS to new VM-only test (RHEL-112205)
  - core/transaction: first drop unmergable jobs for anchor jobs (RHEL-112205)
  - test: add test case for issue #38765 (RHEL-112205)
  - strv: add strv_equal_ignore_order() helper (RHEL-109902)
  - pam: minor coding style tweaks (RHEL-109902)
  - user-record: add helper that checks if a provided user name matches a record (RHEL-109902)
  - user-record: add support for alias user names to user record (RHEL-109902)
  - pam_systemd_home: use right field name in error message (RHEL-109902)
  - pam_systemd_home: support login with alias names + user names with realms (RHEL-109902)
  - homed: support user record aliases (RHEL-109902)
  - homectl: add support for creating users with alias names (RHEL-109902)
  - test: add test for homed alias and realm user resolution (RHEL-109902)
  - update TODO (RHEL-109902)
  - udev: create symlinks for s390 PTP devices (RHEL-120177)
  - test: build the crashing test binary outside of the test (RHEL-113920)
  - test: exclude test-stacktrace(-not)?-symbolized from the coredump check (RHEL-113920)
  - mkosi: install test dependencies for EnterNamespace= test (RHEL-113920)
  - coredump: verify pidfd after parsing data in usermode helper (RHEL-104135)
  - coredump: restore compatibility with older patterns (RHEL-104135)
  - coredump: wrap long lines, fix grammar in comments (RHEL-104135)
  - coredump: get rid of _META_MANDATORY_MAX (RHEL-104135)
  - coredump: use %d in kernel core pattern (RHEL-104135)
  - coredump: also stop forwarding non-dumpable processes (RHEL-104135)
  - coredump: get rid of a bogus assertion (RHEL-104135)
  - coredump: add support for new %F PIDFD specifier (RHEL-104135)
  - coredump: when %F/pidfd is used, again allow forwarding to containers (RHEL-104135)
  - coredump: introduce an enum to wrap dumpable constants (RHEL-104135)
  - Define helper to call PR_SET_DUMPABLE (RHEL-104135)
  - coredump: fix 0-passed-as-pointer warning (RHEL-104135)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-19
changelog:
  - man: fix a missing word (RHEL-120277)
  - sd_bus_open_user_machine(): Don't shortcut without necessary env (RHEL-129179)
  - udev: set clock group for PTP and RTC devices (RHEL-113051)
  - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-126122)
  - strv: introduce string_strv_hashmap_remove() (RHEL-126937)
  - unit-file: introduce unit_file_remove_from_name_map() (RHEL-126937)
  - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-126937)
  - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-126937)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-20
changelog:
  - tools/check-version-history: avoid DeprecationWarning with newer lxml (RHEL-128767)
  - man: don't duplicate version in History section (RHEL-128767)
  - tools: ignore root element explicitly in check-version-history (RHEL-128767)
  - systemd-logind: Add signal section in man systemd-logind (RHEL-128767)
  - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118216)
  - timer: rebase last_trigger timestamp if needed (RHEL-118216)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-22
changelog:
  - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-125822)
  - hwdb: Add Accelerometer mount matrix for Irbis TW43 (RHEL-72702)
  - hwdb: map FN key on TongFang X4SP4NAL laptops (RHEL-72702)
  - hwdb: update rules (RHEL-72702)
  - hwdb: update autosuspend rules (RHEL-72702)
  - Add Razer Cobra mouse to hwdb (RHEL-72702)
  - hwdb: enable autosuspend for Dell DW5826e WWAN modem (RHEL-72702)
  - hwdb: sort SDR devices by vendor name (RHEL-72702)
  - 70-mouse.hwdb: Add Razer Basilisk V3, Asus Cerberus, +2 more (RHEL-72702)
  - hwdb: run "update-hwdb" (RHEL-72702)
  - Add Hantek DSO-6022 oscilloscopes and compatible devices (RHEL-72702)
  - Update 60-sensor.hwdb - Add support for Lenovo Legion Go (RHEL-72702)
  - hwdb: add Airspy devices (RHEL-72702)
  - hwdb: add more devices (RHEL-72702)
  - hwdb: add MiriSDR MSi2500 devices (RHEL-72702)
  - hwdb: add missing Ettus Research B200 rule (RHEL-72702)
  - hwdb: add LimeSDR XTRX devices (RHEL-72702)
  - hwdb: add HydraSDR RFOne (RHEL-72702)
  - hwdb: add SDRplay devices (RHEL-72702)
  - hwdb: update (RHEL-72702)
  - hwdb: fix calibrate rotation sensor for Positivo K116J (#39189) (RHEL-72702)
  - Add Nulea M501 trackball to hwdb (RHEL-72702)
  - add comment to 70-mouse.hwdb regarding generic name for Nulea M501 USB dongle (RHEL-72702)
  - remove extra space from new hwdb.d/70-mouse.hwdb entries to fix failing test (RHEL-72702)
  - remove bonus line (RHEL-72702)
  - hwdb: drop trailing whitespace (RHEL-72702)
  - remove Nulea M501 usb entry from hwdb (RHEL-72702)
  - test/parse_hwdb: wrap Or inside an And in a Group (RHEL-72702)
  - rules: extend 60-input-id.rules to allow for bus/vid/pid/name matches (RHEL-72702)
  - hwdb: don't tag a named Mouse device as pointingstick (RHEL-72702)
  - hwdb: Add V64x_V65xAU to list of Clevo models where scancode f7+f8 get mapped to touchpad-toggle (RHEL-72702)
  - hwdb: gpd micropc2 sensor (#39493) (RHEL-72702)
  - hwdb: add support for the Logitech MX Master 4 (#39490) (RHEL-72702)
  - hwdb: add entry for Acer Switch One 10 (SW1-011) (#39716) (RHEL-72702)
  - keymap: Ignore brightness keys on Dell Inspiron 3505 to avoid double events (RHEL-72702)
  - Update hwdb (RHEL-72702)
  - hwdb: Add Elecom IST Pro trackball (#39762) (RHEL-72702)
  - hwdb: Fix keyboard backlight keys on Acer Nitro 5 AN515-58 (#39769) (RHEL-72702)
  - hwdb: Add alternative mode for Beacn Mic (#39868) (RHEL-72702)
  - Update hwdb (RHEL-72702)
  - hwdb: add ProtoArc EM01 NL mouse configuration (RHEL-72702)
  - hwdb: add Magic Trackpad v2 USB-C (2024) to quirks (#40032) (RHEL-72702)
  - hwdb: sensor: Remove Lenovo IdeaPad D330 accel mount matrix (RHEL-72702)
  - Update hwdb (RHEL-72702)
  - hwdb: update autosuspend rules (RHEL-72702)
  - hwdb: Add ACCEL_MOUNT_MATRIX for variant of TERRA PAD 1061 (RHEL-72702)
  - hwdb: sensor: Add HP OmniBook Ultra Flip 14 accel mount matrix (#40076) (RHEL-72702)
  - hwdb: sensor: Remove Lenovo IdeaPad Duet 3 accel mount matrix (#40075) (RHEL-72702)
  - hwdb: Fix ACCEL_MOUNT_MATRIX for Lenovo Ideapad MIIX 310-ICR (#40067) (RHEL-72702)
  - hwdb: fix unstable button triggering on Mipad 2 under GNOME (#40071) (RHEL-72702)
  - Update hwdb (RHEL-72702)
  - hwdb: touchpad config for Apple MacbookPro12,1 Early 2015 (RHEL-72702)
  - Add Lenovo Y50-70 touchpad to 60-evdev.hwdb (RHEL-72702)
  - quirks: sensor: add info about ACPI accel_matrix (RHEL-72702)
  - quirks: Re-add D330 accel_matrix as identity one (#40226) (RHEL-72702)
  - quirks: touchpad: Set Duet 3 bt touchpad internal (RHEL-72702)
  - hwdb: Add missing scancodes for Lenovo Legion devices (RHEL-72702)
  - hwdb: Add missing vendor names for older AYANEO devices Adds AYADEVICE and AYA NEO vendor names. Early founders editon and 2021 models used these DMI values instead of AYANEO (RHEL-72702)
  - hwdb: add matrix for ASUS 2-in-1 T101HA (RHEL-72702)
  - hwdb: add HP EliteBoard Mic mute key mapping (RHEL-72702)
  - hwdb: Add GPD Pocket 4 chassis quirk (RHEL-72702)
  - hwdb: make three more hwdb files parsed by parse_hwdb.py (RHEL-72702)
  - hwdb: set touchpad resolution for all ThinkPad T49x chassis laptops (RHEL-72702)
  - hwdb: Update Lenovo Legion Go Models - Different BIOS versions of the Legion Go 2 can init the keyboard   device as set 1 (appears as raw set 2) or as set 2 (appears as   translated set 2). Add the Legion Go 2 to the Translated list. - While at it, specify the models in a more verbose manner for   posterity. (RHEL-72702)
  - hwdb: Add extended SteelSeries Arctis headset device support (#40479) (RHEL-72702)
  - hwdb: keyboard: fix typo CAPSLOCK to NUMLOCK (RHEL-72702)
  - hwdb: keyboard: uppercase apple id (RHEL-72702)
  - integritysetup: Add support for hmac-sha512 (RHEL-27852)
  - integritysetup: Add PHMAC algorithm to list of known algorithms (RHEL-27852)
  - core: increment start limit counter only when we can start the unit (RHEL-115032)
  - TEST-07-PID1: wait for systemd-resolved being stopped (RHEL-115032)
  - test: extend start limit interval (RHEL-115032)
  - userdbctl: optionally show user/group data from JSON filerather than from system (RHEL-143029)
  - man: fix typo (RHEL-143029)
  - test: fix test with -Dnetworkd=false (RHEL-143029)
  - ci: run apt-get update before running mkosi (RHEL-115001)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-23
changelog:
  - test-journal-dump: dump the headers of journal files (RHEL-106795)
  - journal: store counts, not byte sizes, in table size constants (RHEL-106795)
  - journal: treble field hash table size (RHEL-106795)
  - nspawn: move uid shift/chown() code into shared/ (RHEL-143036)
  - user-classification: add new "foreign" UID range (RHEL-143036)
  - userdb: synthesize stub user records for the foreign UID (RHEL-143036)
  - dissect: add new --shift command (RHEL-143036)
  - userdb: optionally parse numeric UIDs/GIDs where a username is expected (RHEL-143036)
  - userdbd: separate parameter structure of GetMemberships() varlink call from the GetUserRecord() one (RHEL-143036)
  - userdb: move setting of 'service' varlink parameter into userdb_connect() (RHEL-143036)
  - user-record: make a NULL UserDBMatch be equivalent to no filtering (RHEL-143036)
  - sd-varlink: add sd_varlink_get_description() call (RHEL-143036)
  - user-record: add helper for dispatching a disposition mask (RHEL-143036)
  - user-record: rename USER_DISPOSITION_MASK_MAX → USER_DISPOSITION_MASK_ALL (RHEL-143036)
  - user-record: add some helpers for working with UserDBMatch (RHEL-143036)
  - varlink: add new calls for server-side user record filtering to varlink IDL + to spec (RHEL-143036)
  - userdb: move UserDBMatch handling from userdbctl into generic userdb code to allow it to be done server side (RHEL-143036)
  - userdbd: implement server side filtering in the Multiplexer API (RHEL-143036)
  - homectl: port has_regular_user() + acquire_group_list() to use server-side filtering (RHEL-143036)
  - update TODO (RHEL-143036)
  - JSON User/Group records: Add properties for UUIDs (RHEL-143036)
  - userdb: add support for printing the UUID from user and group records (RHEL-143036)
  - userdb: add support for looking up users or groups by uuid. (RHEL-143036)
  - userdbctl: add --uuid filtering option (RHEL-143036)
  - userdbctl: add missing --uuid= to --help text (RHEL-143036)
  - userdb: fix typo (RHEL-143036)
  - man/userdbctl: fixup version info (RHEL-143036)
  - user-record: add a concept of inverting per-host matching sections in user record (RHEL-143034)
  - homectl: add interface for controlling storage for negative machine ID matches (RHEL-143034)
  - logind: also save pidfdid as part of session state, even if we don't parse it (RHEL-53112)
  - logind: support deserializing session leader through pidfdid (RHEL-53112)
  - TEST-35-LOGIN: test coldplug without fdstore on kernels with pidfd id (RHEL-53112)
  - logind: fix potential fd leak in deliver_session_leader_fd_consume() (RHEL-53112)
  - Revert "coredump: lock down EnterNamespace= mount even more" (RHEL-95219)
  - coredump: add compat support for SYSTEMD_COREDUMP_ALLOW_NAMESPACE_CHANGE (RHEL-95219)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-24
changelog:
  - ci: re-enable bpf-framework option for build and unit test jobs (RHEL-155454)
  - ci: add bpftool workaround to codeql job too (RHEL-155454)
  - ci: fix workaround about bpftool for codeql (RHEL-155454)
  - ci: add bpftool workaround to coverity too (RHEL-155454)
  - Revert "man: mention RHEL documentation in systemctl's man page" (RHEL-155805)
  - path-util: add flavour of path_startswith() that leaves a leading slash in place (RHEL-155396)
  - cgroup: port some code over to path_startswith_full() (RHEL-155396)
  - path-util: invert PATH_STARTSWITH_ACCEPT_DOT_DOT flag (RHEL-155396)
  - sd-json: fix off-by-one issue when updating parent for array elements (RHEL-155396)
  - core/cgroup: avoid one unnecessary strjoina() (RHEL-155396)
  - core: validate input cgroup path more prudently (RHEL-155396)
  - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-158303)
  - nspawn: normalize pivot_root paths (RHEL-158303)
  - udev: check for invalid chars in various fields received from the kernel (RHEL-158354)
  - udev: ensure there is space for trailing NUL before calling sprintf (RHEL-158354)
  - udev: ensure tag parsing stays within bounds (RHEL-158354)
  - udev: fix review mixup (RHEL-158354)
  - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-158354)
  - udev-builtin-net-id: print cescaped bad attributes (RHEL-158354)
  - core: only activate transaction that contain useful jobs (RHEL-143728)
  - journald: extend STDOUT_STREAMS_MAX to 64k (RHEL-168098)
  - string-util: introduce strprepend() helper (RHEL-143028)
  - missing: add quotactl_fd() wrapper (RHEL-143028)
  - homed: always use quotactl_fd() if its available (RHEL-143028)
  - pid1: add GracefulOptions= setting to .mount units (RHEL-143028)
  - pid1: enable usrquota support on /dev/shm (RHEL-143028)
  - units: enable usrquota support on /tmp/ (RHEL-143028)
  - nspawn: enable usrquota support on /tmp/ and /dev/shm/ (RHEL-143028)
  - nspawn: downgrade log message about usrquota to debug (RHEL-143028)
  - mount-setup: drop outdated comment (RHEL-143028)
  - mount-setup: tune down log level if usrquota is not supported, apply usrquota when smack is in use too (RHEL-143028)
  - devnum-util: add macros to safely convert dev_t to pointers and back (RHEL-143028)
  - user-record: add fields for setting limits on /tmp/ and /dev/shm/ (RHEL-143028)
  - user-runtime-dir: some smaller modernizations/refactorings (RHEL-143028)
  - user-runtime-dir: enforce /tmp/ and /dev/shm/ quota (RHEL-143028)
  - homectl: add support for configuring tmpfs limits (RHEL-143028)
  - test: add test case for tmpfs quota logic + PAMName= ask-password logic (RHEL-143028)
  - update TODO (RHEL-143028)
  - core/dbus-service: fix alignment (RHEL-143028)
  - core/mount: filter out "fail" option as well (RHEL-143028)
  - core/mount: check parameters_fragment first in mount_enter_(re)mounting() (RHEL-143028)
  - core/mount: report accurate can_start and can_reload (RHEL-143028)
  - core/mount: trivial coding style cleanups (RHEL-143028)
  - core/dbus-mount: add missing ReloadResult and CleanResult properties (RHEL-143028)
  - bus-unit-util: add missing assertions (RHEL-143028)
  - core/mount: rework GracefulOptions= to be just x-systemd.graceful-option= (RHEL-143028)
  - mountpoint-util: assume fsopen() works in mount_option_supported() (RHEL-143028)
  - core/mount: log only once about fs not supporting new mount API (RHEL-143028)
  - user-runtime-dir: correct quota size calculation (RHEL-143028)
  - test-display-quota: add a little helper binary to show quota on tmpfs (RHEL-143028)
  - TEST-46-HOMED: check for support on /dev/shm and /tmp separately (RHEL-143028)
  - TEST-46-HOMED: conditionally skip usrquota tests (RHEL-143028)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-25
changelog:
  - core: cleanup unit's dropin directories from global cache (RHEL-171097)
  - libsystemd: drop "const" decorators on public inline functions (RHEL-155454)
  - sd-id128: Drop _sd_const_ from sd_id128_in_setv() (RHEL-155454)
  - test: wrap mount/umount when running with sanitizers (RHEL-155454)
  - test: wrap even more binaries when running with sanitizers (RHEL-155454)
  - test: temporarily ignore sanitizer warning about blocked ptrace() (RHEL-155454)
  - test: slightly reduce the performance/memory overhead for wrapped binaries (RHEL-155454)
  - fstab-generator: support swap on network block devices (RHEL-128058)
  - man: add tags for the next few versions (RHEL-128058)
  - test: drop some extraneous whitespaces (RHEL-155021)
  - shared: fix segfault when processing matchHostname field (RHEL-155021)
  - shared: don't exclude valid min/max values for cgroup weight fields (RHEL-155021)
  - shared: don't leak memory from array fields (RHEL-155021)
  - man: fix short option for userdbctl's --from-file= (RHEL-155021)
  - fuzz: add a fuzzer for user records (RHEL-155021)
  - user-record: extract user_record_image_is_blockdev() common helper (RHEL-155021)
  - udev/net_id: introduce naming scheme for RHEL-9.9 (RHEL-72814)
  - udev/net_id: introduce naming scheme for RHEL-10.3 (RHEL-72814)
  - Tag accel devices for uaccess-render (RHEL-153030)
  - udev: tag kfd devices for xaccess-render (#40888) (RHEL-153030)


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-8
changelog:
  - Backport upstream changes to jailify extraction directory
    Includes related gnulib changes to add openat2
    Fixes CVE-2025-45582


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-10
changelog:
  - added "padding with zeros" info message (#2089298)
  - do not report disk error as file shrank (#2089316)
  - upstream fix for savannah bug 64581, commit 51142180
    (crash with TAR_OPTIONS)
  - Backport fix for regression in the --no-overwrite-dir option
    Upstream commit 4e742fc8674064a9fa00d4483d06aca48d5b0463, discussed
    in https://www.mail-archive.com/bug-tar@gnu.org/msg06445.html


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-11
changelog:
  - Add upstream patch to improve error message for --one-top-level
    with absolute path (unsupported as a result of CVE-2025-45582 fix)


author: Tony Camuso <tcamuso@redhat.com> - 1:1.11.10-1
changelog:
  - Update to latest upstream
    Add tboot-disa-ibt.patch (see https://issues.redhat.com/browse/RHEL-109479)
    Resolves: RHEL-99209


author: Tony Camuso <tcamuso@redhat.com> - 1:1.11.10-2
changelog:
  - Remove downstream tboot-disa-ibt.patch workaround .(RHEL-149438)
    Previous builds appended "ibt=off" to GRUB_CMDLINE_LINUX_TBOOT to avoid
    shutdown crashes on CET-enabled systems. With RHEL-10 kernels enabling
    CET/IBT, the tboot > firmware shutdown path triggered #CP faults because
    firmware shutdown_entry code lacks ENDBR instructions and is not CET-safe.
    The global disable was a temporary mitigation.
    Upstream discussion continues to debate a final fix, but the solution
    posted in https://sourceforge.net/p/tboot/mailman/message/59247821/
    surgically disables CET only around the tboot shutdown_entry call,
    preventing the crash without disabling IBT system-wide.
    RHEL commit 358ed91e4c8a2eb2ab0df50d0e6b71b01dc7e1ed incorporates this fix
    in kernel kernel-6.12.0-205.el10, so the downstream workaround is no longer
    required.
    Update gating.yaml: remove infeasible automated test requirement
    (tboot requires physical TPM and manual GRUB interaction)
    Resolves: RHEL-149438


author: Tony Camuso <tcamuso@redhat.com> - 1:1.11.12-1
changelog:
  - Rebase to upstream tboot 1.11.12
    Drop tboot-gcc14.patch (fix absorbed upstream)
    Resolves: RHEL-177574


author: David Cantrell <dcantrell@redhat.com> - 1:1.11.1-3
changelog:
  - Use %license for the COPYING file in the %files section
  - Convert the License tag to an SPDX expression


author: Jerry Snitselaar <jsnitsel@redhat.com> - 1:1.6.0-8
changelog:
  - migrated to SPDX license
  - resolves: rhbz#2219549* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.6.0-5

  - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild


author: John Kacur <jkacur@redhat.com> - 0.19-14
changelog:
  - Update man page with cpu_power command
  - Fix show_threads -t and show_irqs -q to not match everything if no match
  - Fix run command failing to apply BATCH policy
  - Add -U and -K to the move command
  Resolves: RHEL-107914 RHEL-106070 RHEL-93776 RHEL-106068


author: John Kacur <jkacur@redhat.com> - 0.20-1
changelog:
  - Update to upstream version 0.20
  - Convert spec file to use pyproject-rpm-macros
  - Use %pyproject_buildrequires, %pyproject_build, %pyproject_install
  - Use %pyproject_save_files for automatic file list generation
  - Remove oscilloscope (unsupported in RHEL)
  Resolves: RHEL-114902, RHEL-83080


author: John Kacur <jkacur@redhat.com> - 0.20-2
changelog:
  - Add python3-pip, python3-setuptools, python3-wheel BuildRequires
  - Delete setup.py in %prep so pyproject.toml build is used
  - Compress man page during %prep similar to rteval
  - Install tuna script and compressed man page explicitly
  Resolves: RHEL-114902


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-3
changelog:
  - Fixed privileged execution of arbitrary scripts by active local user,
    (CVE-2024-52336)
    Resolves: RHEL-66636
  - Added sanity checks for API methods parameters, (CVE-2024-52337)
    Resolves: RHEL-66613


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.0-0.1.rc1
changelog:
  - new release
    - tuned-ppd: removed the use of StrEnum
    - tuned-ppd: fixed traceback
      resolves: RHEL-74384
    - tuned-ppd: multiple fixes and updates
    - docs: plugins docs are now automatically generated from the docstrings
    - plugin_cpu: fixed no_turbo boolean option parsing
    - plugin_cpu: allowed raw energy_performance_preference values
    - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
    - plugin_bootloader: added variables to BLS entries only if grub is used
    - plugin_scheduler: do not assume that perf events have type attribute
    - plugin_scheduler: updated sched knobs for kernels 6.6+
    - plugin_scheduler: log process info when its affinity cannot be changed
      resolves: RHEL-69933
    - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
    - plugin_scheduler: made perf support optional
    - plugin_net: added support for hotplug and rename
    - makefile: added support for installation to custom $BINDIR/$SBINDIR
    - functions: dropped cpuspeed support


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-70454
    - sap-hana: Set transparent_hugepages to madvise
      resolves: RHEL-68454
    - plugin_bootloader: export Grub variables to make them available in submenus
    - utils.commands: fixed CPU online detection when not present
    - plugin_net: handled cqe-mode-rx ethtool option
    - profiles: correct CPU governor settings


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.1-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-70454
    - plugins: added missing instance parameters
    - disk: added missing remove parameter
    - plugin_scheduler: added switch to disable processing of kthreads
    - Makefile: added support for installation to custom LIBEXECDIR
    - functions: create a new parser object for each string expansion


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.26.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-94809
    - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
    - tuned-ppd: enabled sysfs_acpi_monitor by default
    - tuned-ppd: fixed inotify watch for performance degradation
    - tuned-ppd: pinned virtual files in memory for inotify
    - fixed instance priority inheritance
      resolves: RHEL-94842
    - hotplug: added fixes for device remove race condition
    - tuned-main.conf: added startup_udev_settle_wait option
      resolves: RHEL-88238
    - functions: silenced errors if module kvm_intel does not exist
    - functions: make calc_isolated_cores return CPU ranges
    - scsi: used 'med_power_with_dipm' for SATA ALPM
    - scsi: do not set ALPM on external SATA ports
      resolves: RHEL-79913
    - network_latency: Set non-zero rcutree.nohz_full_patience_delay
    - realtime: disable appropriate P-State drivers
    - plugin_disk: added support for MMC (MultiMediaCard) devices
    - udev: fix possible traceback in device matcher
      resolves: RHEL-97087
    - udev-settle: obey udev buffer size and handle possible tracebacks
      resolves: RHEL-92637
    - daemon: re-raise daemon init exception in no-daemon mode
    - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
    - gui: fix the profile deleter script


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.27.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-123608
    - cpu-partitioning: autodetect dracut hook directory, systemd workaround
      resolves: RHEL-40619
    - openshift: optimize TCP settings for high throughput and low latency
    - profiles: Set boost=1 in *-performance profiles
    - sap-hana: force latency to 70 us, not to C-states
      resolves: RHEL-142285
    - man: fixed instance_acquire_devices example in tuned-adm man
      resolves: RHEL-90575
    - spec: use correct python interpreter for documentation installation
    - sysctl: add reapply_sysctl_exclude option
    - ppd: ask tuned recommend for base profile


author: Patsy Griffin <patsy@redhat.com> - 2024a-3
changelog:
  - Add java patch to fix incorrect calculations for
    Africa/Casablanca starting in 2027. (RHEL-32178)
  - Remove hardcoded versioned path to javac.


author: Patsy Griffin <patsy@redhat.com> - 2024b-1
changelog:
  - Update to tzdata-2024b
    - Improve historical data for Mexico, Mongolia, and Portugal.
    - System V names are now obsolescent.
    - The main data form now uses %z.
    - The code now conforms to RFC 8536 for early timestamps.
    - Support POSIX.1-2024, which removes asctime_r and ctime_r.
    - Assume POSIX.2-1992 or later for shell scripts.
    - SUPPORT_C89 now defaults to 1.
    - Include two upstream patches for month names as in April vs Apr.
  - Harden against links to removed zones


author: Patsy Griffin <patsy@redhat.com> - 2025a-1
changelog:
  Update to tzdata-2025a (RHEL-74296)
    - Paraguay is now permanently at -03. This impacts timestamps
      starting on 2025-03-22.
    - Includes improvements to pre-1991 data for the Philippines.
    - Etc/Unknown is now reserved.


author: Patsy Griffin <patsy@redhat.com> - 2025b-1
changelog:
  - Update to tzdata-2025b (RHEL-84740)
    - Chile's Aysén Region moves from -04/-03
      to -03 year-round, diverging from America/Santiago and
      creating a new zone America/Coyhaique.


author: Patsy Griffin <patsy@redhat.com> - 2026a-1
changelog:
  - Update to tzdata-2026a (RHEL-154023)
    - Correct the transition times for Moldova.
    - The POSIXRULES option is now obsolete.


author: Patsy Griffin <patsy@redhat.com> - 2026b-1
changelog:
  - Update to tzdata-2026b (RHEL-170780)
    - British Columbia’s 2026-03-08 spring forward is expected
      to be its last transition as it moves to permanent -07.


author: Jakub Martisko <jamartis@redhat.com> - 6.0-65
changelog:
  - Fix: Unzip Fails on Large Zip Files
  - Use the patch from Debian dealing with this
  Resolves: RHEL-45993


author: Jakub Martisko <jamartis@redhat.com> - 6.0-67
changelog:
  - zipinfo: remove the extra %c that caused invalid reads
  - zipinfo: fix the whitespaces in the output
  - Zipbombs: Port Another patch, orinally made by Mark Adler
  - https://github.com/madler/unzip/commit/af0d07f95809653b669d88aa0f424c6d5aa48ba0
    Resolves: RHEL-59972
    Resolves: RHEL-6286


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-6
changelog:
  - RHEL-113549 CVE-2025-53906 vim: Vim path traversal
  - RHEL-113543 CVE-2025-53905 vim: Vim path traversial


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-9
changelog:
  - RHEL-155426 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-9
changelog:
  - RHEL-155410 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-10
changelog:
  - Resolves: RHEL-159617 vim: Vim: Arbitrary code execution via command injection
    in glob() function


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-11
changelog:
  - RHEL-170124 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite
    via path traversal bypass


author: Davide Caratti <dcaratti@redhat.com> - 1:2.10-10
changelog:
  - Fix package configuration/add missing patches to avoid regressions when
    upgrading from rhel-9 (RHEL-43250)
  - Backport P2P fix causing nmci failures (RHEL-17701)
  - Disable OpenSSL ENGINE API (RHEL-33750)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.11-1
changelog:
  - Update to version 2.11 (RHEL-59010)
  - backport fix for known regression on brcmfmac (rhbz#2302577)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.11-4
changelog:
  - Use pkcs11 provider to resolve PKCS11 URIs (RHEL-86951)
  - De-clutter syslog from CTRL-EVENT-SIGNAL-CHANGE messages (RHEL-71344)


author: Jakub Martisko <jamartis@redhat.com> - 3.0-42
changelog:
  - Use C implementation of some functions instead of asm
  - Fix the missing compiler/linker flags
  - Minor spec clean up
  Resolves: RHEL-33526


