# changelog

author: Julio Faracco <jfaracco@redhat.com> [6.12.0-77.el10]
changelog:
  - redhat: enable CONFIG_WERROR=y (Jan Stancek) [RHEL-85334]
  - redhat: don't enforce WERROR for 3rd-party OOT kmods (Jan Stancek) [RHEL-85334]
  - redhat: make ENABLE_WERROR enable also KVM_WERROR (Jan Stancek) [RHEL-85334]
  - fortify: Hide run-time copy size from value range tracking (Jan Stancek) [RHEL-85334]
  - resolve_btfids: Fix compiler warnings (Jan Stancek) [RHEL-85334]
  - platform/x86: intel: Use *-y instead of *-objs in Makefile (Steve Best) [RHEL-45086]
  - platform/x86/intel/ifs: Update documentation with image download path (Steve Best) [RHEL-45086]
  - platform/x86/intel/ifs: Add Clearwater Forest to CPU support list (Steve Best) [RHEL-45086]
  - s390/diag: Add memory topology information via diag310 (Mete Durlu) [RHEL-72681]
  - i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition (CKI Backport Bot) [RHEL-81452] {CVE-2024-57984}
  - x86/cpu: Add CPU type to struct cpuinfo_topology (Steve Best) [RHEL-64636]
  - x86/amd: Use heterogeneous core topology for identifying boost numerator (Steve Best) [RHEL-64636]
  - PCI/ACS: Fix 'pci=config_acs=' parameter (Myron Stowe) [RHEL-72899]
  - tools/power/x86/intel-speed-select: v1.22 release (Steve Best) [RHEL-74190]
  - tools/power/x86/intel-speed-select: Prefix header search path with sysroot (Steve Best) [RHEL-74190]
  - tools/power/x86/intel-speed-select: Die ID for IO dies (Steve Best) [RHEL-74190]
  - tools/power/x86/intel-speed-select: Fix the condition to check multi die system (Steve Best) [RHEL-74190]
  - tools/power/x86/intel-speed-select: Prevent increasing MAX_DIE_PER_PACKAGE (Steve Best) [RHEL-74190]
  - platform/x86/intel: power-domains: Add Clearwater Forest support (Steve Best) [RHEL-74190]
  - platform/x86: ISST: Correct command storage data length (Steve Best) [RHEL-74190]
  - s390/cio: Do not unregister the subchannel based on DNV (Mete Durlu) [RHEL-87158]
  - PCI: Use downstream bridges for distributing resources (Myron Stowe) [RHEL-73398]
  - ipmi: ssif_bmc: Fix new request loss when bmc ready for a response (Tony Camuso) [RHEL-82110]
  - ipmi: make ipmi_destroy_user() return void (Tony Camuso) [RHEL-82110]
  - char:ipmi: Fix a not-used variable on a non-ACPI system (Tony Camuso) [RHEL-82110]
  - Get rid of 'remove_new' relic from platform driver struct (Tony Camuso) [RHEL-82110]
  - char:ipmi: Fix the wrong format specifier (Tony Camuso) [RHEL-82110]
  - ipmi: ipmb: Add check devm_kasprintf() returned value (Tony Camuso) [RHEL-82110]


author: Julio Faracco <jfaracco@redhat.com> [6.12.0-78.el10]
changelog:
  - redhat: Remove kernel-rt-kvm package (Juri Lelli) [RHEL-62687]
  - nfsd: clear acl_access/acl_default after releasing them (Olga Kornievskaia) [RHEL-81534] {CVE-2025-21796}
  - redhat/configs: Remove CONFIG_VDPA_USER unset config on RHEL10 (Cindy Lu) [RHEL-87716]
  - scripts/nsdeps: get 'make nsdeps' working again (José Expósito) [RHEL-85957]
  - doc: module: revert misconversions for MODULE_IMPORT_NS() (José Expósito) [RHEL-85957]
  - module: Convert default symbol namespace to string literal (José Expósito) [RHEL-85957]
  - scripts/kernel-doc: Get -export option working again (José Expósito) [RHEL-85957]
  - doc: module: Fix documented type of namespace (José Expósito) [RHEL-85957]
  - module: Convert symbol namespace to string literal (José Expósito) [RHEL-85957]
  - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. (Paolo Abeni) [RHEL-87453]
  - net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Paolo Abeni) [RHEL-87453]
  - netpoll: hold rcu read lock in __netpoll_send_skb() (Paolo Abeni) [RHEL-87453]
  - netmem: prevent TX of unreadable skbs (Paolo Abeni) [RHEL-87453] {CVE-2025-21954}
  - net: Clear old fragment checksum value in napi_reuse_skb (Paolo Abeni) [RHEL-87453]
  - ipvs: Always clear ipvs_property flag in skb_scrub_packet() (Paolo Abeni) [RHEL-87453]
  - net: set the minimum for net_hotdata.netdev_budget_usecs (Paolo Abeni) [RHEL-87453]
  - flow_dissector: Fix handling of mixed port and port-range keys (Paolo Abeni) [RHEL-87453]
  - neighbour: use RCU protection in __neigh_notify() (Paolo Abeni) [RHEL-87453] {CVE-2025-21763}
  - net: fib_rules: annotate data-races around rule->[io]ifindex (Paolo Abeni) [RHEL-87453]
  - flow_dissector: use RCU protection to fetch dev_net() (Paolo Abeni) [RHEL-87453]
  - net: let net.core.dev_weight always be non-zero (Paolo Abeni) [RHEL-87453] {CVE-2025-21806}
  - dev: Acquire netdev_rename_lock before restoring dev->name in dev_change_name(). (Paolo Abeni) [RHEL-87453]
  - ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() (Paolo Abeni) [RHEL-87453] {CVE-2024-57994}
  - nfsd: validate the nfsd_serv pointer before calling svc_wake_up (Olga Kornievskaia) [RHEL-86641]
  - Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc (Bastien Nocera) [RHEL-74484] {CVE-2024-58009}
  - Bluetooth: btnxpuart: Fix glitches seen in dual A2DP streaming (Bastien Nocera) [RHEL-74484]
  - Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context" (Bastien Nocera) [RHEL-74484]
  - Bluetooth: SCO: fix sco_conn refcounting on sco_conn_ready (Bastien Nocera) [RHEL-74484]
  - Bluetooth: btnxpuart: Fix driver sending truncated data (Bastien Nocera) [RHEL-74484]
  - Bluetooth: MGMT: Fix Add Device to responding before completing (Bastien Nocera) [RHEL-74484]
  - Bluetooth: hci_sync: Fix not setting Random Address when required (Bastien Nocera) [RHEL-74484]
  - Bluetooth: iso: Fix circular lock in iso_conn_big_sync (Bastien Nocera) [RHEL-74484] {CVE-2024-54191}
  - Bluetooth: iso: Fix circular lock in iso_listen_bis (Bastien Nocera) [RHEL-74484] {CVE-2024-54460}
  - Bluetooth: SCO: Add support for 16 bits transparent voice setting (Bastien Nocera) [RHEL-74484]
  - Bluetooth: iso: Fix recursive locking warning (Bastien Nocera) [RHEL-74484]
  - Bluetooth: iso: Always release hdev at the end of iso_listen_bis (Bastien Nocera) [RHEL-74484] {CVE-2024-57879}
  - Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating (Bastien Nocera) [RHEL-74484] {CVE-2024-56654}
  - Bluetooth: Improve setsockopt() handling of malformed user input (Bastien Nocera) [RHEL-74484]
  - Bluetooth: SCO: remove the redundant sco_conn_put (Bastien Nocera) [RHEL-74484]
  - Bluetooth: MGMT: Fix possible deadlocks (Bastien Nocera) [RHEL-74484] {CVE-2024-53207}
  - Bluetooth: MGMT: Add initial implementation of MGMT_OP_HCI_CMD_SYNC (Bastien Nocera) [RHEL-74484]
  - Bluetooth: hci_bcm: Use the devm_clk_get_optional() helper (Bastien Nocera) [RHEL-74484]
  - Bluetooth: ISO: Send BIG Create Sync via hci_sync (Bastien Nocera) [RHEL-74484]
  - Bluetooth: hci_conn: Remove alloc from critical section (Bastien Nocera) [RHEL-74484]
  - Bluetooth: ISO: Use kref to track lifetime of iso_conn (Bastien Nocera) [RHEL-74484]
  - Bluetooth: SCO: Use kref to track lifetime of sco_conn (Bastien Nocera) [RHEL-74484]
  - Bluetooth: HCI: Add IPC(11) bus type (Bastien Nocera) [RHEL-74484]
  - Bluetooth: btusb: Add 3 HWIDs for MT7925 (Bastien Nocera) [RHEL-74484]
  - Bluetooth: btusb: Add new VID/PID 0489/e124 for MT7925 (Bastien Nocera) [RHEL-74484]
  - Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Bastien Nocera) [RHEL-74484]
  - Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending (Bastien Nocera) [RHEL-74484]
  - Bluetooth: ISO: Fix matching parent socket for BIS slave (Bastien Nocera) [RHEL-74484]
  - Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending (Bastien Nocera) [RHEL-74484]
  - Bluetooth: btrtl: Decrease HCI_OP_RESET timeout from 10 s to 2 s (Bastien Nocera) [RHEL-74484]
  - Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name() (Bastien Nocera) [RHEL-74484]
  - Bluetooth: btusb: Add new VID/PID 0489/e111 for MT7925 (Bastien Nocera) [RHEL-74484]
  - Bluetooth: Set quirks for ATS2851 (Bastien Nocera) [RHEL-74484]
  - Bluetooth: Support new quirks for ATS2851 (Bastien Nocera) [RHEL-74484]
  - Bluetooth: Add new quirks for ATS2851 (Bastien Nocera) [RHEL-74484]
  - Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() (Bastien Nocera) [RHEL-74484]
  - Bluetooth: hci_qca: use devm_clk_get_optional_enabled_with_rate() (Bastien Nocera) [RHEL-74484]
  - Bluetooth: btmtksdio: Lookup device node only as fallback (Bastien Nocera) [RHEL-74484]
  - Bluetooth: hci_core: Fix not checking skb length on hci_scodata_packet (Bastien Nocera) [RHEL-74484]
  - Bluetooth: btnxpuart: Add GPIO support to power save feature (Bastien Nocera) [RHEL-74484]
  - Bluetooth: hci_conn: Use disable_delayed_work_sync (Bastien Nocera) [RHEL-74484] {CVE-2024-56591}
  - Bluetooth: btusb: Add USB HW IDs for MT7920/MT7925 (Bastien Nocera) [RHEL-74484]
  - Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables (Bastien Nocera) [RHEL-74484]
  - Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions (Bastien Nocera) [RHEL-74484]
  - Bluetooth: btnxpuart: Rename IW615 to IW610 (Bastien Nocera) [RHEL-74484]
  - Bluetooth: btnxpuart: Drop _v0 suffix from FW names (Bastien Nocera) [RHEL-74484]
  - Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Bastien Nocera) [RHEL-74484]
  - Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Bastien Nocera) [RHEL-74484]
  - Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Bastien Nocera) [RHEL-74484]
  - Bluetooth: add HAS_IOPORT dependencies (Bastien Nocera) [RHEL-74484]
  - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() (Bastien Nocera) [RHEL-74484] {CVE-2024-56604}
  - Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (Bastien Nocera) [RHEL-74484] {CVE-2024-56605}
  - igb: Fix potential invalid memory access in igb_init_module() (Corinna Vinschen) [RHEL-74378] {CVE-2024-52332}
  - RDMA/bnxt_re: Remove unusable nq variable (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Fix budget handling of notification queue (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Support perf management counters (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Fix allocation of QP table (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Fix the statistics for Gen P7 VF (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Fix issue in the unload path (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Add sanity checks on rdev validity (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Fix the condition check while programming congestion control (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Fix buffer overflow in debugfs code (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Congestion control settings using debugfs hook (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Allocate dev_attr information dynamically (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Pass the context for ulp_irq_stop (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Query firmware defaults of CC params during probe (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Add Async event handling support (Sreekanth Reddy) [RHEL-76566]
  - bnxt_en: Add ULP call to notify async events (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Fix to drop reference to the mmap entry in case of error (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Remove deliver net device event (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Fix MSN table size for variable wqe mode (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Add send queue size check for variable wqe (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Fix to export port num to ib_query_qp (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Remove unnecessary header file inclusion (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Eliminate need for some forward declarations (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Use the default mode of congestion control (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Support different traffic class (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Cache MSIx info to a local structure (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Refactor NQ allocation (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Fail probe early when not enough MSI-x vectors are reserved (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Add set_func_resources support for P5/P7 adapters (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Sreekanth Reddy) [RHEL-76566]
  - bnxt_en: Add support for RoCE sriov configuration (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Add debugfs hook in the driver (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Support raw data query for each resources (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Add support for querying HW contexts (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Support driver specific data collection using rdma tool (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Fix access flags for MR and QP modify (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Add support for modify_device hook (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Add support for CQ rx coalescing (Sreekanth Reddy) [RHEL-76566]
  - RDMA/bnxt_re: Add support for optimized modify QP (Sreekanth Reddy) [RHEL-76566]
  - tools headers: Update the socket headers with the kernel sources (Paolo Abeni) [RHEL-87244]
  - net: ipv6: fix TCP GSO segmentation with NAT (Paolo Abeni) [RHEL-87244]
  - net-timestamp: support TCP GSO case for a few missing flags (Paolo Abeni) [RHEL-87244]
  - tcp: Defer ts_recent changes until req is owned (Paolo Abeni) [RHEL-87244]
  - tcp: devmem: don't write truncated dmabuf CMSGs to userspace (Paolo Abeni) [RHEL-87244]
  - tcp: adjust rcvq_space after updating scaling ratio (Paolo Abeni) [RHEL-87244]
  - tcp: correct handling of extreme memory squeeze (Paolo Abeni) [RHEL-87244] {CVE-2025-21710}
  - tcp_cubic: fix incorrect HyStart round start detection (Paolo Abeni) [RHEL-87244]
  - tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset (Paolo Abeni) [RHEL-87244]
  - udp: Fix memory accounting leak. (Paolo Abeni) [RHEL-87213]
  - udp: Fix multiple wraparounds of sk->sk_rmem_alloc. (Paolo Abeni) [RHEL-87213]
  - udp: gso: do not drop small packets when PMTU reduces (Paolo Abeni) [RHEL-87213]
  - udp: Deal with race between UDP socket address change and rehash (Paolo Abeni) [RHEL-87213] {CVE-2024-57974}
  - io_uring/sqpoll: zero sqd->thread on tctx errors (CKI Backport Bot) [RHEL-74652] {CVE-2025-21633}
  - selftests: netfilter: add test case for recent mismatch bug (CKI Backport Bot) [RHEL-87160]
  - nft_set_pipapo: fix incorrect avx2 match of 5th field octet (CKI Backport Bot) [RHEL-87160]
  - sctp: detect and prevent references to a freed transport in sendmsg (Xin Long) [RHEL-84557]
  - sctp: add mutual exclusion in proc_sctp_do_udp_port() (Xin Long) [RHEL-84557]
  - sctp: Remove unused payload from sctp_idatahdr (Xin Long) [RHEL-84557]
  - sctp: Fix undefined behavior in left shift operation (Xin Long) [RHEL-84557]
  - sctp: Remove commented out code (Xin Long) [RHEL-84557]
  - sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy (Xin Long) [RHEL-84557]
  - sctp: sysctl: udp_port: avoid using current->nsproxy (Xin Long) [RHEL-84557]
  - sctp: sysctl: auth_enable: avoid using current->nsproxy (Xin Long) [RHEL-84557]
  - sctp: sysctl: rto_min/max: avoid using current->nsproxy (Xin Long) [RHEL-84557]
  - sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (Xin Long) [RHEL-84557]
  - sctp: Prepare sctp_v4_get_dst() to dscp_t conversion. (Xin Long) [RHEL-84557]
  - sctp: Avoid enqueuing addr events redundantly (Xin Long) [RHEL-84557]
  - ice: ensure periodic output start time is in the future (Petr Oros) [RHEL-86857]
  - ice: fix PHY Clock Recovery availability check (Petr Oros) [RHEL-86857]
  - ice: Drop auxbus use for PTP to finalize ice_adapter move (Petr Oros) [RHEL-86857]
  - ice: Use ice_adapter for PTP shared data instead of auxdev (Petr Oros) [RHEL-86857]
  - ice: Initial support for E825C hardware in ice_adapter (Petr Oros) [RHEL-86857]
  - ice: Add ice_get_ctrl_ptp() wrapper to simplify the code (Petr Oros) [RHEL-86857]
  - ice: Introduce ice_get_phy_model() wrapper (Petr Oros) [RHEL-86857]
  - ice: Enable 1PPS out from CGU for E825C products (Petr Oros) [RHEL-86857]
  - ice: Read SDP section from NVM for pin definitions (Petr Oros) [RHEL-86857]
  - ice: Disable shared pin on E810 on setfunc (Petr Oros) [RHEL-86857]
  - ice: Cache perout/extts requests and check flags (Petr Oros) [RHEL-86857]
  - ice: Align E810T GPIO to other products (Petr Oros) [RHEL-86857]
  - ice: Add SDPs support for E825C (Petr Oros) [RHEL-86857]
  - ice: Implement ice_ptp_pin_desc (Petr Oros) [RHEL-86857]
  - ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CKI Backport Bot) [RHEL-81460] {CVE-2025-21738}
  - blackhole_dev: convert self-test to KUnit (Hangbin Liu) [RHEL-81699]
  - treewide: Switch/rename to timer_delete[_sync]() (Kamal Heib) [RHEL-86552]
  - RDMA/cxgb4: Notify rdma stack for IB_EVENT_QP_LAST_WQE_REACHED event (Kamal Heib) [RHEL-86552]
  - rdma/cxgb4: Prevent potential integer overflow on 32bit (Kamal Heib) [RHEL-86552]
  - ipc/util.c: complete the kernel-doc function descriptions (Rafael Aquini) [RHEL-86254]
  - ipc: fix memleak if msg_init_ns failed in create_ipc_ns (Rafael Aquini) [RHEL-86254]
  - ipc/msg: replace one-element array with flexible array member (Rafael Aquini) [RHEL-86254]
  - do_mq_notify(): saner skb freeing on failures (Rafael Aquini) [RHEL-86254]
  - switch netlink_getsockbyfilp() to taking descriptor (Rafael Aquini) [RHEL-86254]
  - scsi: core: Clear driver private data when retrying request (Ewan D. Milne) [RHEL-86157]
  - scsi: core: Do not retry I/Os during depopulation (Ewan D. Milne) [RHEL-86157]
  - scsi: core: Use GFP_NOIO to avoid circular locking dependency (Ewan D. Milne) [RHEL-86157]
  - scsi: core: Add passthrough tests for success and no failure definitions (Ewan D. Milne) [RHEL-86157]
  - scsi: scsi_debug: Constify sdebug_driver_template (Ewan D. Milne) [RHEL-86157]
  - scsi: transport: sas: spi: Fix kernel-doc for exported functions (Ewan D. Milne) [RHEL-86157]
  - scsi: scsi_scan: Add kernel-doc for exported function (Ewan D. Milne) [RHEL-86157]
  - scsi: scsi_lib: Add kernel-doc for exported functions (Ewan D. Milne) [RHEL-86157]
  - scsi: scsi_ioctl: Add kernel-doc for exported functions (Ewan D. Milne) [RHEL-86157]
  - scsi: scsi_error: Add kernel-doc for exported functions (Ewan D. Milne) [RHEL-86157]
  - scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request (Ewan D. Milne) [RHEL-86157]
  - scsi: scsi_debug: Skip host/bus reset settle delay (Ewan D. Milne) [RHEL-86157]
  - scsi: core: Constify 'struct bin_attribute' (Ewan D. Milne) [RHEL-86157]
  - scsi: iscsi: Remove unused iscsi_create_session() (Ewan D. Milne) [RHEL-86157]
  - scsi: Eliminate scsi_register() and scsi_unregister() usage & docs (Ewan D. Milne) [RHEL-86157]
  - scsi: docs: Remove init_this_scsi_driver() (Ewan D. Milne) [RHEL-86157]
  - scsi: core: Remove the .slave_configure() method (Ewan D. Milne) [RHEL-86157]
  - scsi: Convert SCSI drivers to .sdev_configure() (Ewan D. Milne) [RHEL-86157]
  - scsi: Rename .device_configure() into .sdev_configure() (Ewan D. Milne) [RHEL-86157]
  - scsi: Rename .slave_alloc() and .slave_destroy() (Ewan D. Milne) [RHEL-86157]
  - scsi: scsi_debug: Fix hrtimer support for ndelay (Ewan D. Milne) [RHEL-86157]
  - scsi: bsg: Replace zero-length array with flexible array member (Ewan D. Milne) [RHEL-86157]
  - scsi: sg: Enable runtime power management (Ewan D. Milne) [RHEL-86157]
  - scsi: Switch back to struct platform_driver::remove() (Ewan D. Milne) [RHEL-86157]
  - scsi: libfcoe: Include <linux/prandom.h> instead of <linux/random.h> (Ewan D. Milne) [RHEL-86157]
  - crypto: ccp - Fix uAPI definitions of PSP errors (Vladis Dronov) [RHEL-85132]
  - crypto: ccp - Add support for PCI device 0x1134 (Vladis Dronov) [RHEL-85132]
  - crypto: ccp - Fix check for the primary ASP device (Vladis Dronov) [RHEL-85132]
  - crypto: ccp: Add external API interface for PSP module initialization (Vladis Dronov) [RHEL-85132]
  - crypto: ccp - Use scoped guard for mutex (Vladis Dronov) [RHEL-85132]
  - crypto: drivers - Switch back to struct platform_driver::remove() (Vladis Dronov) [RHEL-85132]
  - vsock/virtio: discard packets if the transport changes (CKI Backport Bot) [RHEL-77231] {CVE-2025-21669}
  - sched/deadline: Use online cpus for validating runtime (Phil Auld) [RHEL-85609]
  - sched/rt: Update limit of sched_rt sysctl in documentation (Phil Auld) [RHEL-85609]
  - rtla/tests: Test setting default options (Tomas Glozar) [RHEL-73865]
  - rtla/tests: Reset osnoise options before check (Tomas Glozar) [RHEL-73865]
  - rtla: Always set all tracer options (Tomas Glozar) [RHEL-73865]
  - rtla/osnoise: Set OSNOISE_WORKLOAD to true (Tomas Glozar) [RHEL-73865]
  - rtla: Unify apply_config between top and hist (Tomas Glozar) [RHEL-73865]
  - rtla/osnoise: Unify params struct (Tomas Glozar) [RHEL-73865]
  - redhat/kernel.spec.template: Build rtla with BPF sample collection (Tomas Glozar) [RHEL-77357]
  - tools/build: Use SYSTEM_BPFTOOL for system bpftool (Tomas Glozar) [RHEL-77357]
  - rtla/timerlat: Test BPF mode (Tomas Glozar) [RHEL-77357]
  - rtla/timerlat_top: Use BPF to collect samples (Tomas Glozar) [RHEL-77357]
  - rtla/timerlat_top: Move divisor to update (Tomas Glozar) [RHEL-77357]
  - rtla/timerlat_hist: Use BPF to collect samples (Tomas Glozar) [RHEL-77357]
  - rtla/timerlat: Add BPF skeleton to collect samples (Tomas Glozar) [RHEL-77357]
  - rtla: Add optional dependency on BPF tooling (Tomas Glozar) [RHEL-77357]
  - tools/build: Add bpftool-skeletons feature test (Tomas Glozar) [RHEL-77357]
  - rtla/timerlat: Unify params struct (Tomas Glozar) [RHEL-77357]
  - trace/osnoise: Add trace events for samples (Tomas Glozar) [RHEL-77357]
  - tools/rtla: Add basic test suite (Tomas Glozar) [RHEL-77357]
  - mm: page_owner: use new iteration API (Luiz Capitulino) [RHEL-68306]
  - mm: page_table_check: use new iteration API (Luiz Capitulino) [RHEL-68306]
  - mm: page_ext: add an iteration API for page extensions (Luiz Capitulino) [RHEL-68306]
  - cgroup: Remove steal time from usage_usec (Waiman Long) [RHEL-80669]
  - nfsd: Set technology preview if inter SSC offload is enabled (Benjamin Coddington) [RHEL-79657]
  - tools/rv: Keep user LDFLAGS in build (Tomas Glozar) [RHEL-71546]
  - tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault) [RHEL-57735]
  - pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CKI Backport Bot) [RHEL-80057] {CVE-2025-21702}
  - selftests: livepatch: handle PRINTK_CALLER in check_result() (Denis Aleksandrov) [RHEL-85304]
  - livepatch: convert timeouts to secs_to_jiffies() (Denis Aleksandrov) [RHEL-85304]
  - selftests: livepatch: add test cases of stack_order sysfs interface (Denis Aleksandrov) [RHEL-85304]
  - livepatch: Add stack_order sysfs attribute (Denis Aleksandrov) [RHEL-85304]
  - selftests/livepatch: Replace hardcoded module name with variable in test-callbacks.sh (Denis Aleksandrov) [RHEL-85304]
  - net: gso: fix ownership in __udp_gso_segment (Antoine Tenart) [RHEL-82260] {CVE-2025-21926}


author: Julio Faracco <jfaracco@redhat.com> [6.12.0-79.el10]
changelog:
  - redhat: find-debuginfo workaround is no longer needed on F42 (Jan Stancek) [RHEL-85401]
  - redhat/kernel.spec: use target versions of tools for debugedit and gdb-add-index (Jan Stancek) [RHEL-85401]
  - thermal: intel: int340x: Fix Panther Lake DLVR support (Steve Best) [RHEL-88233]
  - redhat/configs: Adjust CONFIG_TUNE for s390x (Mete Durlu) [RHEL-86680]
  - ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CKI Backport Bot) [RHEL-82520] {CVE-2024-58077}
  - redhat: remove kernel-ipaclones-internal package (Joe Lawrence) [RHEL-86517]
  - keys: Fix UAF in key_put() (CKI Backport Bot) [RHEL-86852] {CVE-2025-21893}
  - efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Marcin Juszkiewicz) [RHEL-83074]
  - mm/kasan: Convert symbol namespace to string literal [cont.] (Julio Faracco)


author: Julio Faracco <jfaracco@redhat.com> [6.12.0-80.el10]
changelog:
  - scsi: fnic: Remove unnecessary spinlock locking and unlocking (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Replace fnic->lock_flags with local flags (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Replace use of sizeof with standard usage (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Fix indentation and remove unnecessary parenthesis (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Remove unnecessary debug print (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Propagate SCSI error code from fnic_scsi_drv_init() (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Test for memory allocation failure and return error code (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Return appropriate error code from failure of scsi drv init (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Return appropriate error code for mem alloc failure (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Remove always-true IS_FNIC_FCP_INITIATOR macro (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Fix use of uninitialized value in debug message (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Delete incorrect debugfs error handling (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Remove unnecessary else to fix warning in FDLS FIP (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Remove extern definition from .c files (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Remove unnecessary else and unnecessary break in FDLS (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Increment driver version (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Add support to handle port channel RSCN (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Code cleanup (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Add stats and related functionality (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Modify fnic interfaces to use FDLS (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Modify IO path to use FDLS (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Add functionality in fnic to support FDLS (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Add and integrate support for FIP (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Add and integrate support for FDMI (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Add Cisco hardware model names (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Add support for unsolicited requests and responses (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Add support for target based solicited requests and responses (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Add support for fabric based solicited requests and responses (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Add headers and definitions for FDLS (Karan Kumar) [RHEL-72902]
  - scsi: fnic: Replace shost_printk() with dev_info()/dev_err() (Karan Kumar) [RHEL-72902]
  - redhat: Enable virtio-mem (and corresponding kdump code) on s390x (Thomas Huth) [RHEL-72992]
  - s390/kdump: virtio-mem kdump support (CONFIG_PROC_VMCORE_DEVICE_RAM) (Thomas Huth) [RHEL-72992]
  - virtio-mem: support CONFIG_PROC_VMCORE_DEVICE_RAM (Thomas Huth) [RHEL-72992]
  - virtio-mem: remember usable region size (Thomas Huth) [RHEL-72992]
  - virtio-mem: mark device ready before registering callbacks in kdump mode (Thomas Huth) [RHEL-72992]
  - fs/proc/vmcore: introduce PROC_VMCORE_DEVICE_RAM to detect device RAM ranges in 2nd kernel (Thomas Huth) [RHEL-72992]
  - fs/proc/vmcore: factor out freeing a list of vmcore ranges (Thomas Huth) [RHEL-72992]
  - fs/proc/vmcore: factor out allocating a vmcore range and adding it to a list (Thomas Huth) [RHEL-72992]
  - fs/proc/vmcore: move vmcore definitions out of kcore.h (Thomas Huth) [RHEL-72992]
  - fs/proc/vmcore: prefix all pr_* with "vmcore:" (Thomas Huth) [RHEL-72992]
  - procfs: fix a locking bug in a vmcore_add_device_dump() error path (Thomas Huth) [RHEL-72992]
  - fs/proc/vmcore: disallow vmcore modifications while the vmcore is open (Thomas Huth) [RHEL-72992]
  - fs/proc/vmcore: replace vmcoredd_mutex by vmcore_mutex (Thomas Huth) [RHEL-72992]
  - fs/proc/vmcore: convert vmcore_cb_lock into vmcore_mutex (Thomas Huth) [RHEL-72992]
  - s390/sparsemem: Provide memory_add_physaddr_to_nid() with CONFIG_NUMA (Thomas Huth) [RHEL-72992]
  - s390/sparsemem: Reduce section size to 128 MiB (Thomas Huth) [RHEL-72992]
  - lib/Kconfig.debug: Default STRICT_DEVMEM to "y" on s390 (Thomas Huth) [RHEL-72992]
  - virtio-mem: s390 support (Thomas Huth) [RHEL-72992]
  - s390/physmem_info: Query diag500(STORAGE LIMIT) to support QEMU/KVM memory devices (Thomas Huth) [RHEL-72992]
  - Documentation: s390-diag.rst: Document diag500(STORAGE LIMIT) subfunction (Thomas Huth) [RHEL-72992]
  - Documentation: s390-diag.rst: Make diag500 a generic KVM hypercall (Thomas Huth) [RHEL-72992]
  - PM: sleep: Avoid unnecessary checks in device_prepare_smart_suspend() (Mark Langsdorf) [RHEL-80696]
  - PM: runtime: Introduce pm_runtime_blocked() (Mark Langsdorf) [RHEL-80696]
  - PM: Block enabling of runtime PM during system suspend (Mark Langsdorf) [RHEL-80696]
  - PM: Rearrange documentation related to __pm_runtime_disable() (Mark Langsdorf) [RHEL-80696]
  - PM: sleep: Fix bit masking operation (Mark Langsdorf) [RHEL-80696]
  - PM: sleep: Use DPM_FLAG_SMART_SUSPEND conditionally (Mark Langsdorf) [RHEL-80696]
  - drivers: core: fix device leak in __fw_devlink_relax_cycles() (Mark Langsdorf) [RHEL-80696]
  - driver core: add a faux bus for use when a simple device/bus is needed (Mark Langsdorf) [RHEL-80696]
  - PM: sleep: core: Restrict power.set_active propagation (Mark Langsdorf) [RHEL-80696]
  - regmap-irq: Add missing kfree() (Mark Langsdorf) [RHEL-80696]
  - PM: sleep: core: Synchronize runtime PM status of parents and children (Mark Langsdorf) [RHEL-80696]
  - PM: sleep: wakeirq: Introduce device-managed variant of dev_pm_set_wake_irq() (Mark Langsdorf) [RHEL-80696]
  - devcoredump: Constify 'struct bin_attribute' (Mark Langsdorf) [RHEL-80696]
  - devcoredump: Define 'struct bin_attribute' through macro (Mark Langsdorf) [RHEL-80696]
  - PM: sleep: Allow configuring the DPM watchdog to warn earlier than panic (Mark Langsdorf) [RHEL-80696]
  - device property: Split property reading bool and presence test ops (Mark Langsdorf) [RHEL-80696]
  - devres: add devm_remove_action_nowarn() (Mark Langsdorf) [RHEL-80696]
  - drivers: core: remove device_link argument from class_compat_[create|remove]_link (Mark Langsdorf) [RHEL-80696]
  - driver core: Move two simple APIs for finding child device to header (Mark Langsdorf) [RHEL-80696]
  - driver core: Introduce device_iter_t for device iterating APIs (Mark Langsdorf) [RHEL-80696]
  - driver core: Correct API device_for_each_child_reverse_from() prototype (Mark Langsdorf) [RHEL-80696]
  - blk-cgroup: Fix class @block_class's subsystem refcount leakage (Mark Langsdorf) [RHEL-80696]
  - driver core: Rename declaration parameter name for API device_find_child() cluster (Mark Langsdorf) [RHEL-80696]
  - driver core: Correct parameter check for API device_for_each_child_reverse_from() (Mark Langsdorf) [RHEL-80696]
  - driver core: Move true expression out of if condition in 3 device finding APIs (Mark Langsdorf) [RHEL-80696]
  - regmap: sdw-mbq: Add support for further MBQ register sizes (Mark Langsdorf) [RHEL-80696]
  - driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() (Mark Langsdorf) [RHEL-80696]
  - firmware_loader: Constify 'struct bin_attribute' (Mark Langsdorf) [RHEL-80696]
  - devcoredump: cleanup some comments (Mark Langsdorf) [RHEL-80696]
  - topology: Keep the cpumask unchanged when printing cpumap (Mark Langsdorf) [RHEL-80696]
  - driver core: Introduce an device matching API device_match_type() (Mark Langsdorf) [RHEL-80696]
  - driver core: Remove match_any() (Mark Langsdorf) [RHEL-80696]
  - driver core: Simplify API device_find_child_by_name() implementation (Mark Langsdorf) [RHEL-80696]
  - libnvdimm: Replace namespace_match() with device_find_child_by_name() (Mark Langsdorf) [RHEL-80696]
  - driver core: Constify API device_find_child() and adapt for various usages (Mark Langsdorf) [RHEL-80696]
  - net: qcom/emac: Find sgmii_ops by device_for_each_child() (Mark Langsdorf) [RHEL-80696]
  - bus: fsl-mc: Constify fsl_mc_device_match() (Mark Langsdorf) [RHEL-80696]
  - kernel/range: Const-ify range_contains parameters (Mark Langsdorf) [RHEL-80696]
  - drivers: base: test: Add ...find_device_by...(... NULL) tests (Mark Langsdorf) [RHEL-80696]
  - drivers: base: test: Enable device model tests with KUNIT_ALL_TESTS (Mark Langsdorf) [RHEL-80696]
  - drivers: base: Don't match devices with NULL of_node/fwnode/etc (Mark Langsdorf) [RHEL-80696]
  - regmap: regmap_multi_reg_read(): make register list const (Mark Langsdorf) [RHEL-80696]
  - PM: sleep: sysfs: don't include 'pm_wakeup.h' directly (Mark Langsdorf) [RHEL-80696]
  - PM: sleep: Update stale comment in device_resume() (Mark Langsdorf) [RHEL-80696]
  - regmap: cache: rbtree: use krealloc_array() to replace krealloc() (Mark Langsdorf) [RHEL-80696]
  - regmap: cache: mapple: use kmalloc_array() to replace kmalloc() (Mark Langsdorf) [RHEL-80696]
  - regmap: place foo / 8 and foo % 8 closer to each other (Mark Langsdorf) [RHEL-80696]
  - regmap: Use BITS_TO_BYTES() (Mark Langsdorf) [RHEL-80696]
  - regmap: cache: Use BITS_TO_BYTES() (Mark Langsdorf) [RHEL-80696]
  - regmap: detach regmap from dev on regmap_exit (Mark Langsdorf) [RHEL-80696]
  - regmap: Use correct format specifier for logging range errors (Mark Langsdorf) [RHEL-80696]
  - firmware_loader: Fix possible resource leak in fw_log_firmware_info() (Mark Langsdorf) [RHEL-80696]
  - drivers: core: fw_devlink: Fix excess parameter description in docstring (Mark Langsdorf) [RHEL-80696]
  - driver core: class: Correct WARN() message in APIs class_(for_each|find)_device() (Mark Langsdorf) [RHEL-80696]
  - cacheinfo: Use of_property_present() for non-boolean properties (Mark Langsdorf) [RHEL-80696]
  - drivers: core: fw_devlink: Make the error message a bit more useful (Mark Langsdorf) [RHEL-80696]
  - driver core: fw_devlink: Stop trying to optimize cycle detection logic (Mark Langsdorf) [RHEL-80696]
  - driver core: constify devlink class (Mark Langsdorf) [RHEL-80696]
  - driver core: Put device attribute @wakeup_last_time_ms and its show() together (Mark Langsdorf) [RHEL-80696]
  - cacheinfo: Don't opencode per_cpu_cacheinfo() (Mark Langsdorf) [RHEL-80696]
  - driver core: auxiliary bus: Spelling s/pecific/specific/ (Mark Langsdorf) [RHEL-80696]
  - regmap: irq: Set lockdep class for hierarchical IRQ domains (Mark Langsdorf) [RHEL-80696]
  - regmap: maple: Provide lockdep (sub)class for maple tree's internal lock (Mark Langsdorf) [RHEL-80696]
  - regmap: kunit: Fix repeated test param (Mark Langsdorf) [RHEL-80696]
  - PM: QoS: Export dev_pm_qos_read_value (Mark Langsdorf) [RHEL-80696]
  - devres: Fix page faults when tracing devres from unloaded modules (Mark Langsdorf) [RHEL-80696]
  - drivers/base: Remove unused auxiliary_find_device (Mark Langsdorf) [RHEL-80696]
  - firmware_loader: Reorganize kerneldoc parameter names (Mark Langsdorf) [RHEL-80696]
  - PM: domains: Support required OPPs in dev_pm_domain_attach_list() (Mark Langsdorf) [RHEL-80696]
  - OPP: Rework _set_required_devs() to manage a single device per call (Mark Langsdorf) [RHEL-80696]
  - driver core: Add device probe log helper dev_warn_probe() (Mark Langsdorf) [RHEL-80696]
  - regmap: Specifically test writing 0 as a value to sparse caches (Mark Langsdorf) [RHEL-80696]
  - regmap-irq: Consistently use memset32() in regmap_irq_thread() (Mark Langsdorf) [RHEL-80696]
  - xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO (Sabrina Dubroca) [RHEL-84543]
  - xfrm: state: fix out-of-bounds read during lookup (Sabrina Dubroca) [RHEL-84543]
  - xfrm: delete intermediate secpath entry in packet offload mode (Sabrina Dubroca) [RHEL-84543]
  - xfrm: Fix the usage of skb->sk (Sabrina Dubroca) [RHEL-84543]
  - xfrm: fix tunnel mode TX datapath in packet offload mode (Sabrina Dubroca) [RHEL-84543]
  - xfrm_output: Force software GSO only in tunnel mode (Sabrina Dubroca) [RHEL-84543]
  - xfrm: prevent high SEQ input in non-ESN mode (Sabrina Dubroca) [RHEL-84543]


author: Julien Rische <jrische@redhat.com> - 1.21.2-1
changelog:
  - New upstream version (1.21.2)
  - Fix double-free in KDC TGS processing (CVE-2023-39975)
    Resolves: rhbz#2229113
  - Make tests compatible with Python 3.12
    Resolves: rhbz#2224013


author: Julien Rische <jrische@redhat.com> - 1.21.2-3
changelog:
  - Fix double free in klist's show_ccache()
    Resolves: rhbz#2257301
  - Store krb5-tests files in architecture-specific directories
    Resolves: rhbz#2244601


author: Julien Rische <jrische@redhat.com> - 1.21.3-1
changelog:
  - New upstream version (1.21.3)
  - CVE-2024-37370 CVE-2024-37371
    Fix vulnerabilities in GSS message token handling
    Resolves: RHEL-45387 RHEL-45378
  - Fix memory leak in GSSAPI interface
    Resolves: RHEL-47284
  - Fix memory leak in PMAP RPC interface
    Resolves: RHEL-47287
  - Fix memory leak in failing UTF-8 to UTF-16 re-encoding for PAC
    Resolves: RHEL-47285
  - Make TCP waiting time configurable
    Resolves: RHEL-47278


author: Julien Rische <jrische@redhat.com> - 1.21.3-4
changelog:
  - libkrad: implement support for Message-Authenticator (CVE-2024-3596)
    Resolves: RHEL-55427
  - Fix various issues detected by static analysis
    Resolves: RHEL-45165
  - Remove RSA protocol for PKINIT
    Resolves: RHEL-56070


author: Julien Rische <jrische@redhat.com> - 1.21.3-6
changelog:
  - Support PKCS11 EC client certs in PKINIT
    Resolves: RHEL-74373
  - kdb5_util: fix DB entry flags on modification
    Resolves: RHEL-56058
  - Add ECDH support for PKINIT (RFC5349)
    Resolves: RHEL-71881


author: Lukas Javorsky <ljavorsk@redhat.com> - 3.7.7-1
changelog:
  - Rebase to version 3.7.7
  - Fixing SAST issues, accepted by upstream
  - Resolves: RHEL-39391 RHEL-67895


author: Karel Zak <kzak@redhat.com> - 2.40.2-3
changelog:
  - revert recent uuidd mode changes
  - rebase rhel specific patches
  - fix uuidd-tmpfiles.conf (upstream patch)
  - remove unused patches


author: Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.69-1
changelog:
  - Update to 2.69 (with contribs from Yanko Kaneti <yaneti@declera.com>, and Andrew G. Morgan <morgan@kernel.org>)
  - Update license to SPDX (by Anderson Toshiyuki Sasaki <ansasaki@redhat.com>)
  - Make file lists more explicit to avoid accidental ABI changes (Dominik Mierzejewski <dominik@greysector.net>)


author: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 2.69-4
changelog:
  - Add manpages for pam_cap and capability.conf (by Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>)
  - Fix incompatibility of the build with go 1.22 (by Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>)
  - Reenable PIE in the captree tool (by Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>)
  - Use sbindir location provided by rpm (by Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>)
  - Include hardening flags by setting CGO_CFLAGS=CFLAGS and CGO_LDFLAGS=LDFLAGS


author: Steve Grubb <sgrubb@redhat.com> 0.8.4-1
changelog:
  - New upstream bugfix release
  - Drop libcap-ng-0.8.3-apply-disable.patch since things should be fixed


author: Gary Buhrmaster <gary.buhrmaster@gmail.com> - 0.7.0-8
changelog:
  - Update license to SPDX format
  - spec file tidy/modernization
    - use modern cmake build and install
    - properly own include directories in the devel package
    - de-glob some files to follow packaging guidelines


author: Gary Buhrmaster <gary.buhrmaster@gmail.com> - 0.10.2-1
changelog:
  - Update to version 0.10.2 ( resolves: rhbz#1880885 )
  - Revise specs per packaging guidelines for globs of soname


author: Jan Kolarik <jkolarik@redhat.com> - 0.1.20-1
changelog:
  - Update to 0.1.20
  - Fixes of xml parsing
  - Fix non-optimized builds by removing inline keyword
  - Use Py_hash_t instead of long


author: Pavol Žáčik <pzacik@redhat.com> - 0.6.5-3
changelog:
  - Patch bugs found by static analysis tools
  - Add %{name}-fix-handle-leaks-in-rdmsr-c.patch
  - Add %{name}-fix-cpuid_get_hypervisor.patch
  - Add %{name}-prevent-intel_fn11-array-overruns.patch


author: Pavol Žáčik <pzacik@redhat.com> - 0.7.0-1
changelog:
  - Rebase to 0.7.0
  - Begin building the package for aarch64
  - Add Python bindings as a subpackage (python3-libcpuid)


author: Petr Pisar <ppisar@redhat.com> - 0.73.1-2
changelog:
  - Fix reinstalling packages which conflicts with themselves in
    dnf_transaction_commit() (RHEL-32919)
  - Fix an invalid memory access when dropping an item in MergedTransaction
    class (RHEL-33541)


author: Fedora Release Engineering <releng@fedoraproject.org> - 0.73.0-1
changelog:
  - Update to 0.73.0
  - filelists metadata loading on demand
  - deltarpm disabled on Fedora
  - conf: Introduce new optional_metadata_types option to load filelists on demand
  - goal: Method for detecting file dependency problems


author: Evan Goode <egoode@redhat.com> - 0.73.1-1
changelog:
  - Update to 0.73.1 (RHEL-38831)
  - Fix https://issues.redhat.com/browse/RHEL-27657 (RHEL-32935)
  - subject-py: Fix memory leak (RHEL-32924)
  - MergedTransaction: Calculate RPM difference between two same versions as
    no-op (RHEL-33541)
  - Onboard packit tests
  - Add virtual destructor to TransactionItem (RHEL-32943)


author: Pino Toscano <ptoscano@redhat.com> 1.29.35-1
changelog:
  - Translated using Weblate (Italian) (toscano.pino@tiscali.it)
  - Clean up tests using Cloud What detectors properly (mhorky@redhat.com)
  - spec: Obsolete subscription-manager-migration (ptoscano@redhat.com)
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (ljanda@redhat.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Translated using Weblate (Italian) (toscano.pino@tiscali.it)
  - Update translation files (noreply@weblate.org)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - Translated using Weblate (Italian) (toscano.pino@tiscali.it)
  - Typo fixes (ptoscano@redhat.com)
  - Avoid string puzzle (ptoscano@redhat.com)
  - Properly use ungettext for plural forms (ptoscano@redhat.com)
  - 2189664: cache: fix SyspurposeComplianceStatusCache on failed load
    (ptoscano@redhat.com)
  - dbus: don't catch exceptions in DomainSocketServer.run()
    (ptoscano@redhat.com)
  - cli: directly exit on InvalidCLIOptionError (ptoscano@redhat.com)
  - Revert "ENT-5549: Fix return code handling of CLI" (ptoscano@redhat.com)
  - ci: add dependabot config for GitHub Actions (ptoscano@redhat.com)
  - Update .git-blame-ignore-revs (mhorky@redhat.com)
  - Format code with black==23.3.0 (mhorky@redhat.com)
  - ENT-5535: Update black to version 23.3.0 (mhorky@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.29.36-1
changelog:
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - ENT-5581: Update messaging around the "container mode" (mhorky@redhat.com)
  - Remove 'dbus' marker for pytest (mhorky@redhat.com)
  - Rewrite D-Bus tests to be testable without pytest-forked (mhorky@redhat.com)
  - Drop further ethtool dependency mentions (mhorky@redhat.com)
  - tests: fix test_file_monitor without pyinotify (ptoscano@redhat.com)
  - tests: switch from imp to importlib (ptoscano@redhat.com)
  - Fix the order of user env var checking for translations.
    (tkuratom@redhat.com)
  - 2215974: Collect network facts using 'ip' (mhorky@redhat.com)
  - ENT-5582: Remove container detection envvar overwrite (mhorky@redhat.com)
  - ENT-5603: Explicitly check for provided entitlement certificates
    (mhorky@redhat.com)
  - fix test case (chambrid@redhat.com)
  - Collect GCP Project information as cloud facts (chambrid@redhat.com)
  - Collect Azure Subscription ID as a cloud fact (#3285) (chambrid@redhat.com)
  - ENT-5580: Disable the proper container detection (mhorky@redhat.com)
  - spec: convert License to SPDX (ptoscano@redhat.com)
  - 2093291: Make reading of cache file more reliable (jhnidek@redhat.com)
  - 2093291: Make code of DNF plugins testable (jhnidek@redhat.com)
  - spec: change subscription-manager dnf dep (ptoscano@redhat.com)
  - spec: update libdnf-plugin-subscription-manager deps (ptoscano@redhat.com)
  - tests: repair attach cases in SCA mode (ptoscano@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.29.37-1
changelog:
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Update translation files (noreply@weblate.org)
  - 2225446: Hotfix of D-Bus policy (jhnidek@redhat.com)
  - TESTING: Update testing requirements (mhorky@redhat.com)
  - Use Fedora registry to pull container images (mhorky@redhat.com)
  - 2232316: dbus: check "force" again from the registration option
    (ptoscano@redhat.com)
  - dbus: run EntCertActionInvoker on PoolAttach (ptoscano@redhat.com)
  - ENT-5624: Properly translate error strings (mhorky@redhat.com)
  - Mock IOError for Insights fact collection tests (mhorky@redhat.com)
  - New extraction for translatable strings (ptoscano@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.29.38-1
changelog:
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (ptoscano@redhat.com)
  - ci: bump actions/checkout from 3 to 4
    (49699333+dependabot[bot]@users.noreply.github.com)
  - ENT-5603: Fix a typo in a comment (mhorky@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.29.39-1
changelog:
  - tito: drop bz requirement (ptoscano@redhat.com)
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (jsefler@redhat.com)
  - RHEL-7206: Small change of message printed by dnf plugin (jhnidek@redhat.com)
  - CCT-118: Fix flake8 error E721 (mhorky@redhat.com)
  - Fix type hint in rhsm (mhorky@redhat.com)
  - Simplify autoregistration test setup (mhorky@redhat.com)
  - RHEL-9435: Get AWS metadata via IMDSv2 (mhorky@redhat.com)
  - Fixed inappropriate logical expression (ataf@openrefactory.com)
  - CCT-71: Try to ping server, when --proxy is used (jhnidek@redhat.com)
  - CCT-10: Ensure IPv6-based URLs are properly formatted (mhorky@redhat.com)
  - RPM: Avoid needless runtime requirement on python3-setuptools
    (miro@hroncok.cz)
  - cli: normalize hostname in error message (ptoscano@redhat.com)
  - connection: normalize hostname in ConnectionOSErrorException
    (ptoscano@redhat.com)
  - Improved printing of addresses and URLs (jhnidek@redhat.com)
  - Use username and password from --proxy=URL (jhnidek@redhat.com)
  - Use parse_url() from utils.py for parsing URL, when --proxy is used.
    (jhnidek@redhat.com)
  - 2225403: Parse URL properly (jhnidek@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.29.40-1
changelog:
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Translated using Weblate (Chinese (Simplified) (zh_CN))
    (mariocanfly@hotmail.com)
  - spec: Add missing GLib dependency when building without DNF
    (debarshir@gnome.org)
  - Remove deprecated `locale.*()` functions (mhorky@redhat.com)
  - Remove version constraint of pytest (mhorky@redhat.com)
  - RHEL-15110: RegisterServer is stopped, when not needed (jhnidek@redhat.com)
  - RHEL-15110: Fix issue with registration using gsd-subman (jhnidek@redhat.com)
  - Fix an error in debug logging of cloud-what (mhorky@redhat.com)
  - ci: bump actions/upload-artifact from 3 to 4
    (49699333+dependabot[bot]@users.noreply.github.com)
  - Improve debug logging to make it faster to understand (mhorky@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.30.0-1
changelog:
  - Translated using Weblate (Russian) (aleksejfedorov963@gmail.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - chore: Format register.py (mhorky@redhat.com)
  - feat: Require SCA for registration (mhorky@redhat.com)
  - doc: Update install and testing guide (stomsa@redhat.com)
  - Fixed spec file to list packages twice (suttner@atix.de)
  - code review comments fixes - update metadata and test. (chambrid@redhat.com)
  - feat: Disable anonymous cloud registration temporarily (mhorky@redhat.com)
  - Collect Azure VM Name and Resource Group Name as a cloud fact.
    (chambrid@redhat.com)
  - fix: Improve wording in redhat.repo template (glutexo@icloud.com)
  - Remove commands moved to syspurpose (glutexo@icloud.com)
  - doc: drop references to "activate" (ptoscano@redhat.com)
  - feat: Remove import command (zpetrace@redhat.com)
  - fix: make SyspurposeComplianceStatusCache.get_overall_status() always usable
    (ptoscano@redhat.com)
  - fix: Change order of checks (jhnidek@redhat.com)
  - fix: Cache shouldn't try to get data from server without UUID
    (jhnidek@redhat.com)
  - feat: Add option to run smoke tests with fake IMDS servers.
    (jhnidek@redhat.com)
  - fix: Hide subscription management "errors" in container mode
    (mhorky@redhat.com)
  - feat(ci): Update testing matrix (mhorky@redhat.com)
  - fix(test): Properly stop method mock (mhorky@redhat.com)
  - feat: Azure: added extended location and type of location fact
    (jhnidek@redhat.com)
  - fix: Update version of Azure metadata (jhnidek@redhat.com)
  - feat: Added Azure location to facts (jhnidek@redhat.com)
  - feat: Added zone GCP fact (jhnidek@redhat.com)
  - feat: Added more AWS cloud facts (jhnidek@redhat.com)
  - fix: Change type hint according returned value. (jhnidek@redhat.com)
  - feat: Add warning message about release version to dnf plugin
    (jhnidek@redhat.com)
  - Bump black from 23.3.0 to 24.3.0
    (49699333+dependabot[bot]@users.noreply.github.com)
  - Format code with black==24.3.0 (ptoscano@redhat.com)
  - Fix memory leaks in test-productdb.c (jhnidek@redhat.com)
  - Fix memory leaks in productdb.c (jhnidek@redhat.com)
  - fix: Function prototype without declaration is deprecated
    (jhnidek@redhat.com)
  - Removed unused includes of .h files (jhnidek@redhat.com)
  - libdnf: switch from g_error_free() to g_clear_error() in tests
    (ptoscano@redhat.com)
  - libdnf: do not build test code in plugin (ptoscano@redhat.com)
  - Change handling of deprecated `datetime.datetime.utcnow()`
    (mhorky@redhat.com)
  - CCT-66: Update identity reporting in DNF plugin during autoregistration
    (mhorky@redhat.com)
  - Remove automatic registration delay for rhsmcertd (mhorky@redhat.com)
  - Remove API endpoint for automatic cloud registration v1 (mhorky@redhat.com)
  - CCT-67: Use automatic registration v2 (mhorky@redhat.com)
  - IdentityUpdateAction: Improve logging for updating identity certificates
    (mhorky@redhat.com)
  - Identity: Add method to extract current owner (mhorky@redhat.com)
  - rhsmcertd: Define exit codes (mhorky@redhat.com)
  - rhsmcertd: Use module-level logger (mhorky@redhat.com)
  - Add AnonymousCertificateManager (mhorky@redhat.com)
  - Add CloudTokenCache for Candlepin JWT (mhorky@redhat.com)
  - Implement API endpoints for Automatic registration v2 (mhorky@redhat.com)
  - Update documentation for one API call in connection.py (mhorky@redhat.com)
  - Fix type hint of RegisterService.register() (mhorky@redhat.com)
  - rhsmcertd: Drop D-Bus loop code (mhorky@redhat.com)
  - rhsmcertd: Add type hints (mhorky@redhat.com)
  - rhsmcertd: Remove forgotten old comment (mhorky@redhat.com)
  - Stop logging full lscpu output (mhorky@redhat.com)
  - Prevent double-logging of syspurpose cache log statement (mhorky@redhat.com)
  - Update the log message containing response time statistics
    (mhorky@redhat.com)
  - CCT-266: Update TLS flags (mhorky@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.30.2-1
changelog:
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - feat: Create consumer cert & key owner by rhsm group (jhnidek@redhat.com)
  - feat: Add rhsm group during installation of subman RPM (jhnidek@redhat.com)
  - feat: dnf plugin - outsource uploading of profile to rhsmcertd.
    (jhnidek@redhat.com)
  - docs: remove references to removed commands (jajerome@redhat.com)
  - feat: Remove auto-attach command (jhnidek@redhat.com)
  - feat: Eliminate command 'remove' from subscription-manager
    (jvlcek@redhat.com)
  - feat: Remove attach from bash completion script (jhnidek@redhat.com)
  - feat: Remove references on auto-attach in man page (jhnidek@redhat.com)
  - feat: Removed attach service (jhnidek@redhat.com)
  - feat: Removed D-Bus methods related to attach (jhnidek@redhat.com)
  - feat: Removed attach command and CLI option related to attach
    (jhnidek@redhat.com)
  - feat: Remove 'addons' subcommand(s) (mhorky@redhat.com)
  - feat: Removed command "redeem" from subscription-manager (jhnidek@redhat.com)
  - Update the correct man page file. (jvlcek@redhat.com)
  - docs: Change reverse proxy to proxy in man page (jvlcek@redhat.com)
  - test(ci): Improve container pre-test script (mhorky@redhat.com)


author: Jiri Hnidek <jhnidek@redhat.com> 1.30.3-1
changelog:
  - Card ID: CCT-731 - integration tests for DBus Register method
    (jstavel@redhat.com)
  - chore: Remove the --token authentication (pkoprda@redhat.com)
  - chore: Remove artifacts of import (stomsa@redhat.com)
  - chore: Remove artifacts of redeem (stomsa@redhat.com)
  - chore: Remove artifacts of remove (stomsa@redhat.com)
  - chore: Remove artifacts of autoheal (glutexo@icloud.com)
  - chore: Remove artifacts of --auto-attach (glutexo@icloud.com)
  - chore: Remove artifacts of attach (stomsa@redhat.com)
  - fix: Added missing python packages (jhnidek@redhat.com)
  - fix: Fixed integration tests (jhnidek@redhat.com)
  - chore: Remove auto-assign CI job (mhorky@redhat.com)
  - feat: Add initial support for tmt (jhnidek@redhat.com)
  - fix: Renamed integration-tests to cockpit-tests (jhnidek@redhat.com)
  - Feat CCT-965: Include timezone in the logs In `subscription-
    manager/src/rhsm/logutil.py`i: (mgrunwal@redhat.com)
  - feat: remove content access mode cache (jajerome@redhat.com)
  - feat: add GetEnvironments method to DBus register (ryanverdile@gmail.com)
  - feat: Added basic configuration for Packit (jhnidek@redhat.com)
  - fix: drop "autoattachinterval" from the rhsmcertd defaults
    (ptoscano@redhat.com)
  - feat/cct-875: Options -i and --cert-interval were removed from rhsmcertd
    command autocompletion Options -i and --cert-interval were removed from
    rhsmcertd command autocompletion. (mgrunwal@mgrunwal-
    thinkpadp1gen3.rmtcz.csb)
  - feat/cct-874: Autocompletion for option --servicelevel removed Autocompletion
    for option --servicelevel (sub-man register --servicelevel) was removed.
    (mgrunwal@mgrunwal-thinkpadp1gen3.rmtcz.csb)
  - fix: Handle Retry-After headers better for 429 responses (mhorky@redhat.com)
  - feat: Better automatic registration logging (mhorky@redhat.com)
  - refactor: Moved some definition of lists from list.py (jhnidek@redhat.com)
  - fix: Removed show_autosubscribe_output() method (jhnidek@redhat.com)
  - feat: Remove useless CLI options from list command (jhnidek@redhat.com)
  - fix: perform autoreg waiting when performing standard autoreg
    (ptoscano@redhat.com)
  - chore: move autoreg waiting code in own function (ptoscano@redhat.com)
  - feat: support registering specifying environments with activation keys
    (ryanverdile@gmail.com)
  - feat: Remove autoheal functionality from rhsmcertd (jvlcek@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.30.4-1
changelog:
  - Revert "feat: Disable anonymous cloud registration temporarily"
    (ptoscano@redhat.com)
  - Revert "feat: forcefully switch automatic cloud registration to v1"
    (ptoscano@redhat.com)
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (ptoscano@redhat.com)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Translated using Weblate (Italian) (toscano.pino@tiscali.it)
  - Translated using Weblate (French) (leane.grasser@proton.me)
  - Translated using Weblate (Georgian) (noreply-mt-weblate-translation-
    memory@weblate.org)
  - Update translation files (noreply@weblate.org)
  - spec: respect the %{_sbindir} of the distro (ptoscano@redhat.com)
  - build: make it possible to customize the 'sbin' install dir
    (ptoscano@redhat.com)
  - fix: Restart rhsm service after installation (pkoprda@redhat.com)
  - Drop pam_console leftovers (ptoscano@redhat.com)
  - Stop using usermode (ptoscano@redhat.com)
  - fix: Do not upload profile from DNF, when it is disabled in conf
    (jhnidek@redhat.com)
  - rhsmcertd: use ISO 8601 timestamps for the log file (ptoscano@redhat.com)
  - rhsmcertd: refactor timestamp function (ptoscano@redhat.com)
  - ci: temporarily install 'which' on CentOS Stream 10 (ptoscano@redhat.com)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - ci: use official c10s container image (ptoscano@redhat.com)
  - Translated using Weblate (Italian) (info@salvatorecocuzza.it)
  - Translated using Weblate (French) (leane.grasser@proton.me)
  - Translated using Weblate (German) (atalanttore@googlemail.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - feat: Enable register with environment names and environment types
    (jhnidek@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.30.5-1
changelog:
  - fix: Disabling of content in D-Bus methods Register*() (jhnidek@redhat.com)
  - chore: logging.warn() -> logging.warning() (ptoscano@redhat.com)
  - Feat CCT-467: Add explanatory info about the source of overrides in repo-
    overrides command (mgrunwal@mgrunwal-thinkpadp1gen3.rmtcz.csb)
  - feat: Allow to call RegisterWithActivationKeys() with enable_content
    (jhnidek@redhat.com)
  - refactor: Small changes of _enable_content (jhnidek@redhat.com)
  - fix: It is possible to disable content using enable_content option
    (jhnidek@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.30.6-1
changelog:
  - Translated using Weblate (Italian) (toscano.pino@tiscali.it)
  - Translated using Weblate (Japanese) (ptoscano@redhat.com)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Translated using Weblate (French) (leane.grasser@proton.me)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Translated using Weblate (Korean) (noreply-mt-weblate-translation-
    memory@weblate.org)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Update translation files (noreply@weblate.org)
  - spec: Remove an unnecessary explicit dependency on json-c
    (debarshir@gnome.org)
  - spec: Require shared libraries with architecture-specific dependencies
    (debarshir@gnome.org)
  - Revert "ci: temporarily install 'which' on CentOS Stream 10"
    (ptoscano@redhat.com)
  - build: cockpit: fix installation of sub-man with newer Fedora
    (ptoscano@redhat.com)
  - spec: Require the base package with architecture-specific dependencies
    (debarshir@gnome.org)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - feat: drop the --ondate option of "status" (ptoscano@redhat.com)
  - feat: drop non-SCA support in status command (ptoscano@redhat.com)
  - tests: fix mocking of get_terminal_width() in TestColumnize
    (ptoscano@redhat.com)
  - feat: print compliance errors & syspurpose status only in entitlement mode
    (ptoscano@redhat.com)
  - feat: print "registered" as status when using SCA (ptoscano@redhat.com)
  - feat: print "not registered" on status when not registered
    (ptoscano@redhat.com)
  - tests: force syspurpose tests in test_status to non-SCA (ptoscano@redhat.com)
  - refactor: move determination of content access mode in own method
    (ptoscano@redhat.com)
  - tests: move StubIdentity to stubs (ptoscano@redhat.com)
  - tests: cleanup dead/broken bits in test_status (ptoscano@redhat.com)
  - chore: move banner printing to its own function (ptoscano@redhat.com)


author: Pavol Žáčik <pzacik@redhat.com> - 2.1.12-13
changelog:
  - Update license identifiers to SPDX in subpackages
  - Add Apache-2.0 license which appears in sample/ssl-client-mbedtls.c


author: Gary Buhrmaster <gary.buhrmaster@gmail.com> - 1.13.0-1
changelog:
  - Update to 1.13.0 release ( resolves: rhbz#2172297 )
  - Perform some deglobing of files per packaging guidelines


author: Alexey Tikhonov <atikhono@redhat.com> - 2.10.0~beta1-1
changelog:
  - Resolves: RHEL-40253 - Rebase SSSD for RHEL 10-beta
  - Resolves: RHEL-29303 - Issue discovered by static analyzer.
  - Resolves: RHEL-11181 - sssd[4022110]: gencache_init: Failed to create directory: //.cache/samba - Permission denied
  - Resolves: RHEL-4986 - [RFE] sssd use systemd-sysusers
  - Resolves: RHEL-4974 - sssd status shows error "krb5_kt_start_seq_get failed: Permission denied" when running as unprivileged user 'sssd'


author: Alexey Tikhonov <atikhono@redhat.com> - 2.10.0~beta2-1
changelog:
  - Resolves: RHEL-40253 - Rebase SSSD for RHEL 10-beta
  - Resolves: RHEL-43259 - sudo does not work any more with krb ticket


author: Alexey Tikhonov <atikhono@redhat.com> - 2.10.0~beta2-2
changelog:
  - Resolves: RHEL-51891 - [RHEL-10]logrotate.service fails to start because /var/log/sssd has insecure permission
  - Resolves: RHEL-52400 - SYSDB: remove index on dataExpireTimestamp [rhel-10]
  - Resolves: RHEL-50243 - Please install sssd-polkit-rules by default


author: Alexey Tikhonov <atikhono@redhat.com> - 2.10.0-1
changelog:
  - Resolves: RHEL-62725 - Rebase SSSD for RHEL 10.0
  - Resolves: RHEL-56701 - sss_ssh_knownhosts is breaking ansible-pull
  - Resolves: RHEL-55993 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-3
changelog:
  - Disable enumeration support for IPA and AD providers.
    Deprecation was announced in F39 release notes:
    https://docs.fedoraproject.org/en-US/fedora/latest/release-notes/sysadmin/Security/#_support_for_the_enumeration_feature_has_been_deprecated_for_ad_and_ipa_backends
    This is a backport of upstream patch:
    https://github.com/SSSD/sssd/commit/9240bca7dcc28371ae5dce31c01e85d28409cd04


author: Alexey Tikhonov <atikhono@redhat.com> - 2.10.1-1
changelog:
  - Resolves: RHEL-62725 - Rebase SSSD for RHEL 10.0
  - Resolves: RHEL-4984 - Mismatch between input and parsed domain name when default_domain_suffix is set.
  - Resolves: RHEL-65848 - sssd password authentication broken in sssd-2.10.0~beta2-2 and later
  - Resolves: RHEL-67669 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option
  - Resolves: RHEL-68421 - sssd ldap_child process segfaults when krb5.conf is invalid [rhel-10]
  - Resolves: RHEL-66935 - Avoid log flooding in case an app keeps making invalid `getservbyport(0, ...)` request
  - Resolves: RHEL-65736 - ipa: sudo commands doesn't check threshold correctly
  - Resolves: RHEL-68319 - Please deprecate/remove ad_allow_remote_domain_local_groups


author: Scott Mayhew <smayhew@redhat.com> 2.8.2-0
changelog:
  - Updated to the latest release: nfs-utils-2-8-2 (RHEL-67786)
    Resolves: RHEL-65826
    Resolves: RHEL-67041
    Resolves: RHEL-67168
    Resolves: RHEL-67786
    Resolves: RHEL-68575


author: Scott Mayhew <smayhew@redhat.com> 2.8.2-3
changelog:
  - fix ownership of /var/lib/nfs/statd/state (RHEL-77913)
  - /var/lib/nfs/{etab,rmtab} should not be marked as config files (RHEL-77912)


author: Jan Macku <jamacku@redhat.com> 1.60.0-1
changelog:
  - update to the latest upstream release
  - update PGP key from https://keyserver.ubuntu.com/pks/lookup?op=vindex&search=0x7e8403d5d673c366


author: Jan Macku <jamacku@redhat.com> 1.61.0-1
changelog:
  - update to the latest upstream release
  - fixes CVE-2024-28182 - HTTP/2 CONTINUATION frames can be utilized for DoS attacks


author: Dmitry Belyavskiy - 0.10.1-1
changelog:
  - Rebase to 0.10.1 version (CVE-2024-36405)
    Resolves: RHEL-40699
  - Use dlopen for OpenSSL algos implementation
    Resolves: RHEL-46598
  - Correct license naming
    Resolves: RHEL-45265


author: José Expósito <jexposit@redhat.com> - 0.16-13
changelog:
  - Fix findings from static application security testing (SAST)
    Resolves: https://issues.redhat.com/browse/RHEL-29742


author: Lukáš Zaoral <lzaoral@redhat.com> - 0.21.2-5
changelog:
  - migrate to SPDX license format
    - the old and new license tags are identical, this changelog entry just
      indicates that it was checked to be correct


author: Jan Kolarik <jkolarik@redhat.com> - 1.15.2-1
changelog:
  - Update to 1.15.2
  - Fixes and optimizations in header files
  - Fix lr_gpg_list_keys function when keys are empty
  - Update PGP test vectors
  - Fix CMake warnings
  - Bump glib version


author: Jan Kolarik <jkolarik@redhat.com> - 1.17.0-1
changelog:
  - Update to 1.17.0
  - lr_gpg_check_signature: Forward PGP error messages from RPM
  - PGP: fix: Support importing binary public keys in librpm backend
  - PGP: Enable creating a UID directory for GnuGP agent socket in /run/gnupg/user
  - PGP: Set a default creation SELinux labels on GnuPG directories


author: Jan Kolarik <jkolarik@redhat.com> - 1.17.1-1
changelog:
  - Update to 1.17.1 (RHEL-38831)
  - gpg_gpgme.c: fix build errors with older gcc
  - Change header files to match a configured ABI regarding a zchunk support
  - Fix building zchunk code if zchunk is enabled
  - Fix compiler warnings


author: Evan Goode <egoode@redhat.com> - 1.18.0-1
changelog:
  - Update to 1.18.0 (RHEL-35699)
  - API: Add LRO_USERNAME and LRO_PASSWORD options
  - Add a private dependency on zck to librepo.pc if zchunk support is enabled
  - Hash cache: Improved work with extended file attributes
  - Improve performance of large number of package downloads
  - Fix error handling, Fix examples and build them


author: Petr Pisar <ppisar@redhat.com> - 1.18.0-2
changelog:
  - Use librpmio instead of gpgme for handling PGP keys (RHEL-47106)
  - Fix a memory leak in select_next_target() (RHEL-35699)


author: Petr Pisar <ppisar@redhat.com> - 0.0.3-14
changelog:
  - Improve a documentation (RHEL-38831)
  - Refactor parse_entitlement_data() (RHEL-32365)
  - Fix relocating certificate paths to /etc/rhsm-host (RHEL-37866)


author: Vit Mojzis <vmojzis@redhat.com> - 3.7-5
changelog:
  - libselinux-3.7-3
  - restorecon: Include <selinux/label.h>
  - Fix integer comparison issues when compiling for 32-bit


author: Vit Mojzis <vmojzis@redhat.com> - 3.7-3
changelog:
  - restorecon: Include <selinux/label.h> (RHEL-53852)
  - Fix integer comparison issues when compiling for 32-bit


author: Vit Mojzis <vmojzis@redhat.com> - 3.7-5
changelog:
  - setexecfilecon: Remove useless rc check (RHEL-35586)
  - matchpathcon: RESOURCE_LEAK: Variable "con" (RHEL-35584)


author: Vit Mojzis <vmojzis@redhat.com> - 3.7-4
changelog:
  - cil: Check that sym_index is within bounds (RHEL-34823)
  - cil: Initialize avtab_datum on declaration (RHEL-34810)
  - mls: Do not destroy context on memory error (RHEL-34810)
  - cil/cil_post: Initialize tmp on declaration (RHEL-34810)
  - Initialize "strs" on declaration (RHEL-34810)


author: Tulio Magno Quites Machado Filho <tuliom@redhat.com> - 18.1.8-1
changelog:
  - Update to LLVM 18.1.2 (RHEL-28056)
  - Remove llvm17 compat package (RHEL-30890)
  - Workaround for GFX11.5 export priority (RHEL-49746)


author: Nikita Popov <npopov@redhat.com> - 19.1.7-1
changelog:
  - Update to LLVM 19.1.7 (RHEL-57456)
  - Remove llvm18 compat package (RHEL-57457)
  - Remove generated html content from llvm-doc subpackage (RHEL-58900)
  - Enable LLVM_ENABLE_ZSTD=ON (RHEL-70325)


author: Martin Osvald <mosvald@redhat.com> - 2.1.1-1
changelog:
  - New version 2.1.1 (rhbz#2250290)
  - Fix incorrect upstream URL and SourceX (rhbz#2249526)
  - SPDX migration


author: Tom Callaway <spot@fedoraproject.org> - 5.4.6-3
changelog:
  - disable "corrupted binary dump" test that has issues on big-endian architectures
  - apply upstream fix for 5.4.6 bug 1


author: DJ Delorie <dj@redhat.com> - 1:4.4.1-3
changelog:
  - Migrate License field to SPDX identifiers for
    https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2


author: Lianbo Jiang <lijiang@redhat.com> - 1.7.5-11
changelog:
  - Fix failure of hugetlb pages exclusion on Linux 6.9 and later
  - Fix wrong exclusion of Slab pages on Linux 6.10-rc1 and later


author: Jaroslav Rohel <jrohel@redhat.com> - 3.9.0-1
changelog:
  - Update to 3.9.0
  - Add leaves command - List installed packages not required by other installed packages


author: Evan Goode <egoode@redhat.com> - 3.10.1-1
changelog:
  - Update to 3.10.1
  - Correct spelling of summary
  - Print more helpful error message when reinstalling non-installed pkg
    Resolves: RHEL-53430


author: Miro Hrončok <mhroncok@redhat.com> - 2.5.1-6
changelog:
  - Split libmpdec++ into a mpdecimal++ subpackage
  - This prevents packages only using the libmpdec library from transitively depending on libstdc++


author: Charalampos Stratakis <cstratak@redhat.com> - 2.5.1-11
changelog:
  - Fix bind-now annocheck failure by passing the proper LDFLAGS to the C++ library
  Resolves: RHEL-33509


author: Lukáš Zaoral <lzaoral@redhat.com> - 7.2-1
changelog:
  - Update to 7.2 (rhbz#2161916)
  - Do not use %{_bindir}/* and %{_mandir}/* as suggested by the packaging
    guidelines.


author: Lukáš Zaoral <lzaoral@redhat.com> - 8.0-1
changelog:
  - rebase to latest upstream version (RHEL-35944)
  - remove `nano-default-editor` from the specfile (RHEL-30790)


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.63.20160912git
changelog:
  - Resolves: #2114821 - The output of `route -A inet6` does not display properly when the 'Use' column output is over 6 digits


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.64.20160912git
changelog:
  - Resolves: #2077846 - net-tools utilities display incorrect statistics for interfaces with 15-character names


author: Pavel Reichl <preichl@redhat.com> - 0.4.2-3
changelog:
  - Actually change License from BSD to LGPL, based on content of COPYING file
  - Convert License tag to SPDX format


author: Kevin Fenzi <kevin@scrye.com> - 1.0.7-1
changelog:
  - Update to 1.0.7. Fixes rhbz#2155658
  - Build the package with setuptools instead of distutils. Fixes: rhbz#2154872


author: Phil Sutter <psutter@redhat.com> - 1:1.0.9-1
changelog:
  - Fix devel sub-package description
  - Utilize pyproject-rpm-macros for the python sub-package
  - new version 1.0.9


author: Phil Sutter <psutter@redhat.com> [1.1.1-1.el10]
changelog:
  - monitor: Recognize flowtable add/del events (Phil Sutter) [RHEL-65346]
  - tests: py: Fix for storing payload into missing file (Phil Sutter) [RHEL-65346]
  - json: Support typeof in set and map types (Phil Sutter) [RHEL-65346]
  - json: collapse set element commands from parser (Phil Sutter) [RHEL-65346]
  - doc: extend description of fib expression (Phil Sutter) [RHEL-65346]
  - tests: monitor: fix up test case breakage (Phil Sutter) [RHEL-65346]
  - src: fix extended netlink error reporting with large set elements (Phil Sutter) [RHEL-65346]
  - rule: netlink attribute offset is uint32_t for struct nlerr_loc (Phil Sutter) [RHEL-65346]
  - mnl: update cmd_add_loc() to take struct nlmsghdr (Phil Sutter) [RHEL-65346]
  - mnl: rename to mnl_seqnum_alloc() to mnl_seqnum_inc() (Phil Sutter) [RHEL-65346]
  - src: collapse set element commands from parser (Phil Sutter) [RHEL-65346]
  - libnftables-json: fix raw payload expression documentation (Phil Sutter) [RHEL-65346]
  - tests: shell: fix spurious dump failure in vmap timeout test (Phil Sutter) [RHEL-65346]
  - Rebase onto version 1.1.1 (Phil Sutter) [RHEL-65346]


author: Lukáš Zaoral <lzaoral@redhat.com> - 0.5-42.20150602git
changelog:
  - recognize the -m option
  - modernize the specfile
      - use recommended systemd macros
      - fix manual pages installation
      - sort file list and BuildRequires
      - use modern make macros
      - simplify %install section


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.1-4
changelog:
  - Install NetworkManager override for nbft interfaces
  - Rename reconnect NetworkManager hook to 99-nvme-nbft-connect.sh


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 6.9.8-2.D20220919gitb041f6d
changelog:
  - Update to the latest git, expecially:
    - Update to Unicode 15.0 (upstream #272)
    - [[:punct:]] behavoir change (upsteam #268)


author: Than Ngo <than@redhat.com> - 3.23.0-1
changelog:
  - 3.23.0
     * EP11: Add support for FIPS-session mode
     * Updates to harden against RSA timing attacks
     * Bug fixes


author: Than Ngo <than@redhat.com> - 3.24.0-1
changelog:
  - Resolves: RHEL-58996, update to 3.24.0
  - Resolves: RHEL-39004, provide opencryptoki CCA Token also on x86_64 and ppc64le
  - Resolves: RHEL-43675, openCryptoki cca token RSA OAEP v2.1 support
  - Resolves: RHEL-43674, openCryptoki CCA token support of Dilithium
  - Resolves: RHEL-43676, openCryptoki cca token SHA3 support
  - Resolves: RHEL-24036, support protected keys for extractable keys


author: Than Ngo <than@redhat.com> - 3.24.0-5
changelog:
  - Use systemd-sysusers
  - Modifie the unit file to change file ownership
  - opencryptoki doesn't work in image mode
    Resolves: RHEL-77146


author: Than Ngo <than@redhat.com> - 3.24.0-7
changelog:
  - Resolves: RHEL-80632, tokens are deleted on reboot
  - Related: RHEL-77146, opencryptoki doesn't work in image mode


author: Simon Pichugin <spichugi@redhat.com> - 2.6.7-1
changelog:
  - Rebase to version 2.6.7 (rhbz#2261163)
  - Use systemd-sysusers for ldap user and group (rhbz#2173965)
  - Fix compiler errors (rhbz#2261427)
  - Replace License with SPDX identifier


author: Simon Pichugin <spichugi@redhat.com> - 2.6.7-2
changelog:
  - Remove libslapi from the main package (RHEL-35581)
  - Add "servers" conditional which includes libslapi


author: Simon Pichugin <spichugi@redhat.com> - 2.6.8-1
changelog:
  - Rebase to version 2.6.8 (RHEL-71052)
  - Avoid SSL context cleanup during library destruction (RHEL-68424)


author: Veronika Hanulikova <vhanulik@redhat.com> - 0.26.1-1
changelog:
  - Rebase to new upstream release (RHEL-71523)
  - Separate OpenSC into libraries and binaries (RHEL-73314)


author: Zoltan Fridrich <zfridric@redhat.com> - 9.6p1-1.3
changelog:
  - Correctly audit hostname and IP address (RHEL-22316)
  - Make default key sizes configurable in sshd-keygen (RHEL-26454)


author: Zoltan Fridrich <zfridric@redhat.com> - 9.6p1-1.5
changelog:
  - Build OpenSSH without ENGINE API
    Resolves: RHEL-45507
  - Remove pam_ssh_agent_auth subpackage
    Resolves: RHEL-45002


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.8p1-2.0
changelog:
  - Temporary disabling self-test
    Related: RHEL-42635
  - Change ssh-keygen defaults in FIPS mode
    Resolves: RHEL-37324
  - Use FIPS-compatible API for key derivation RHEL-10
    Resolves: RHEL-43592


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.8p1-3
changelog:
  - sshd doesn't propose to enter password again when a non-existing user is specified
    Resolves: RHEL-11981
  - Reenabling self-test on rpm build
    Related: RHEL-42635


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.8p1-5
changelog:
  - Restore GSS connectivity when no hostkeys are present
    Related: RHEL-42635
  - Add missing gsskeyex authentication method
    Related: RHEL-42635
  - "publickey-hostbound@openssh.com" extension makes no sense with GSS
    Related: RHEL-42635


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-1
changelog:
  - Update to OpenSSH 9.9p1
    Resolves: RHEL-60564
  - Separate ssh-keysign to a dedicated package
    Resolves: RHEL-62112
  - Use FIPS KEX defaults in FIPS mode
    Resolves: RHEL-58986


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-2
changelog:
  - Resolve memory management issues after rebase
    Related: RHEL-60564
  - Add extra help information on ssh early failure
    Resolves: RHEL-62718


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-3
changelog:
  - Extra help information should not be printed if stderr is not a TTY
    Resolves: RHEL-63061
  - Provide details on crypto error instead of "error in libcrypto"
    Resolves: RHEL-63190


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-5
changelog:
  - Fix regression of Match directive processing
    Resolves: RHEL-76317
  - Avoid linking issues for openssl logging
    Related: RHEL-63190


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-6
changelog:
  - Fix regression of Match directive processing
    Related: RHEL-76317
  - Fix missing error codes set and invalid error code checks in OpenSSH. It
    prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS
    is on (CVE-2025-26465, CVE-2025-26466).
    Resolves: RHEL-78699
    Resolves: RHEL-78943


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-8
changelog:
  - OpenSSH should not use its own implementation of MLKEM
    Resolves: RHEL-58252
  - Correct processing of Compression directive
    Resolves: RHEL-68346
  - Supress systemd warning
    Resolves: RHEL-84816


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-9
changelog:
  - CVE-2025-32728: Fix logic error in DisableForwarding option
    Resolves: RHEL-86819
  - Provide better error for non-supported private keys
    Resolves: RHEL-68124
  - Ignore bad hostkeys in known_hosts file
    Resolves: RHEL-83644


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-7
changelog:
  - Disallow SHA1 at SECLEVEL2 in OpenSSL
    Resolves: RHEL-39962
  - SHA-1 signature shouldn't work in normal mode
    Resolves: RHEL-36677


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-10
changelog:
  - Use PBMAC1 by default when creating PKCS#12 files in FIPS mode
    Related: RHEL-36659
  - Support key encapsulation/decapsulation in openssl pkeyutl command
    Resolves: RHEL-54156
  - Fix typo in the patch numeration
    Related: RHEL-41261
  - Enable KTLS, temporary disable KTLS tests
    Related: RHEL-47335
  - Speedup SSL_add_{file,dir}_cert_subjects_to_stack
    Resolves: RHEL-54232
  - Resolve SAST package scan results
    Resolves: RHEL-37561


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-15
changelog:
  - Fix providers no_cache behavior
    Resolves: RHEL-71903
  - Fix pkcs12 command line segfault
    Resolves: RHEL-70878
  - Print key exchange group for hybrid PQC
    Resolves: RHEL-66163
  - Ensure correct fips.so checksum calculation
    Resolves: RHEL-73170
  - Locally configured providers should not interfere with openssl build-time tests
    Resolves: RHEL-76182
  - Load system default cipher string from crypto-policies configuration file
    include /etc/crypto-policies/back-ends/opensslcnf.config and remove
    /etc/crypto-policies/back-ends/openssl.config.
    Resolves: RHEL-71132


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-16
changelog:
  - Fix timing side-channel in ECDSA signature computation (CVE-2024-13176)
    Resolves: RHEL-70879
  - Load system default cipher string from crypto-policies configuration file
    should ignore errors.
    Related: RHEL-71132
  - RFC7250 handshakes with unauthenticated servers don't abort as expected (CVE-2024-12797)
    Resolves: RHEL-76754
  - Fix segfault on printing the temp key from s_client when connection is not established
    Resolves: RHEL-79045


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-1
changelog:
  - Rebasing OpenSSL to 3.5
    Resolves: RHEL-80811
    Resolves: RHEL-57022
    Resolves: RHEL-24098
    Resolves: RHEL-24097
    Resolves: RHEL-86865


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.6.1-2
changelog:
  - Fix static analyzer detected issues. Resolves: RHEL-36475
  - pam_env: fixes for NULL environment variables


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.6.1-6
changelog:
  - pam_access: always match local address and clarify LOCAL keyword behaviour.
    Resolves: RHEL-65223


author: Brian C. Lane <bcl@redhat.com> - 3.5-11
changelog:
  - parted: Fix ending sector location when using kibi IEC suffix (bcl)
  - tests: Fix formatting and snprintf warnings in tests. (bcl)
  - ui: Add checks for prompt being NULL (bcl)
  - strlist: Handle realloc error in wchar_to_str (bcl)
  - libparted: Fix potential NULL dereference in ped_disk_next_partition (bcl)
  - filesys: Check for null from close_fn (bcl)


author: Brian C. Lane <bcl@redhat.com> - 3.5.28-1
changelog:
  - Upstream 3.5.28 Alpha release
  - Dropped all patches included in new upstream release
  - Bumped minor version on libparted.so and libparted-fs-resize.so


author: Brian C. Lane <bcl@redhat.com> - 3.6-7
changelog:
  - tests: Add test for dvh with a bad checksum (bcl)
    Related: RHEL-73220
  - libparted: Fix dvh disklabel unhandled exception (bcl)
    Related: RHEL-73220
  - tests: Add test for SUN disklabel handling (bcl)
    Related: RHEL-73220
  - libparted: Fix sun disklabel unhandled exception (bcl)
    Resolves: RHEL-73220


author: Michal Hlavinka <mhlavink@redhat.com> - 3.9.0-4
changelog:
  - update license tag format (SPDX migration) for https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1


author: Michal Hlavinka <mhlavink@redhat.com> - 3.13.0-1
changelog:
  - updated to 3.13, adds support for cxl1.1 device link status information (#RHEL-29153)
  - add riscv64 build support (#RHEL-40383)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.38.2-503
changelog:
  - 5.38.2 bump (see <https://metacpan.org/release/PEVANS/perl-5.38.2/view/pod/perldelta.pod>
    or release notes


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.40.0-509
changelog:
  - 5.40.0 bump (see <https://metacpan.org/release/HAARG/perl-5.40.0/view/pod/perldelta.pod)
  - Subpackage Term-Table
  - Subpackage Test-Suite2


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.40.0-512
changelog:
  - Resolves: RHEL-75798
  - 5.40.1 bump (see <https://metacpan.org/release/SHAY/perl-5.40.1/view/pod/perldelta.pod>)
  - Add config.over to make build od perl reproducible
  - Removed unnecessary conversion
  - Add new systemtap-sdt-dtrace to build deps


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.40.2-513
changelog:
  - 5.40.2 bump (see <https://metacpan.org/release/SHAY/perl-5.40.2/view/pod/perldelta.pod>)
  - Resolves: RHEL-87186


author: Paul Howarth <paul@city-fan.org> - 1.92-7
changelog:
  - Update test suite to handle potential unavailability of sha1 algorithm
    https://github.com/radiator-software/p5-net-ssleay/pull/433
  - Avoid deprecated patch syntax


author: Paul Howarth <paul@city-fan.org> - 1.94-1
changelog:
  - Update to 1.94
    - Net::SSLeay now officially supports all stable releases of OpenSSL 3.1 and
      3.2, and LibreSSL 3.5-3.8
    - Many noisy compiler warnings have been silenced - if SSLeay.xs fails to
      compile, it should now be much easier to identify the cause
    - libcrypto's OPENSSL_init_crypto() function and libssl's OPENSSL_init_ssl()
      function are now exposed, enabling fine-grained control over the
      initialisation and configuration of both libraries
    - libssl functions implementing TLS 1.3 PSK authentication are now exposed,
      in particular SSL_CTX_set_psk_find_session_callback() (on the server side)
      and SSL_CTX_set_psk_use_session_callback() (on the client side)
    - libssl functions implementing server-side TLS 1.2 PSK authentication are
      now exposed, in particular SSL_CTX_set_psk_server_callback()
    - libssl's SSL_CTX_set_client_hello_cb() function is now exposed, allowing a
      TLS server to set a callback function that is executed when the server
      processes a ClientHello message
    - Many more libcrypto/libssl constants and functions are now exposed; see the
      release notes for the 1.93 developer releases for a full list


author: Christian Glombek <cglombek@redhat.com> - 123-2
changelog:
  - Provide a sysusers.d file to get user() and group() provides
    (see https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format).


author: Jan Rybar <jrybar@redhat.com> - 0.1-26
changelog:
  - use build macros, on behalf of original author Tom Stellard (tstellar)
  - Pagure doesn't allow one-click rebase, AFAIK


author: Jan Rybar <jrybar@redhat.com> - 6.6.4-17
changelog:
  - migrate to autosetup; convert specfile script to a patch
  - FORTIFY_SOURCE_3 detected a buffer overflow
  - Resolves: bz#2190057


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-3
changelog:
  - Fix potential use of uninitialized pipe array (RHEL-54012)
  - Fix potential use of uninitialized pgp struct (RHEL-54013)
  - Fix memory leak in rpmsign(8) (RHEL-37564)


author: Panu Matilainen <pmatilai@redhat.com> - 4.19.1.1-4
changelog:
  - Remove hardcoded GPG references from signing error messages
  - Support switching between GnuPG and Sequoia for package signing (RHEL-56363)


author: Panu Matilainen <pmatilai@redhat.com> - 4.19.1.1-9
changelog:
  - Revert the gnupg/sequoia sub-packages, too much headache
  - Ship sequoia-signing enablement macros as documentation instead
  - Generate binary signatures with Sequoia too


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-10
changelog:
  - Report unsafe symlinks during installation as a specific case (RHEL-73186)
  - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-54386)
  - Rebuild for ima-evm-utils 1.6 soname bump (RHEL-65378)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-11
changelog:
  - Fix possible package corruption on --delsign/resign/addsign (RHEL-69518)
  - Fix regression on build-id generation from compressed ELF (RHEL-54000)
  - Fix root relocation regression (RHEL-56613)
  - Update sequoia macros for sq 1.0 (RHEL-56363)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-13
changelog:
  - Make %_passwd_path and %_group_path into lists (RHEL-78693)
  - Fix memory leak in rpmspec --shell (RHEL-55284)
  - Fix memory leak in rpmsign (RHEL-82284)
  - Fix command references in rpmsign(8) man page (RHEL-73173)
  - Fix exit code regression on update failure (RHEL-87384)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-14
changelog:
  - Store configurable digest(s) on packages in rpmdb (RHEL-84062)
  - Fix command references in rpmsign(8) man page, take II (RHEL-73173)


author: Petr Lautrbach <lautrbach@redhat.com> - 4.4.2-4
changelog:
  - Disable/remove neverallow options in sediff.
  - Improve man pages
  - seinfoflow: Add -r option to get flows into the source type.
  - seinfoflow.1: Remove references to sepolgen permission map.
  - AVRule/AVRuleXperm: Treat rules with no permissions as invalid policy.
  - SELinuxPolicy: Add explicit cast for libspol message


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.8-1
changelog:
  - Update to 3.12.8
  - Security fix for CVE-2024-9287 and CVE-2024-12254
  Resolves: RHEL-64877, RHEL-70450


author: Stephen Gallagher <sgallagh@redhat.com> - 1:0.4-0.54.b47
changelog:
  - Fixes for -WError=implicit-function-declaration on RHEL
  - Reinstates the dump headers without compiling the implementations


author: Vladis Dronov <vdronov@redhat.com> - 6.17-2
changelog:
  - Add Intel CET IBT instrumentation to assembly code
  - Update to the upstream v6.17 @ ac43f912 (RHEL-36771)


author: Jonathan Wright <jonathan@almalinux.org> - 3.3.0-6.alma.1
changelog:
  - Fix for CVE-2024-12084
  - Fix for CVE-2024-12085
  - Fix for CVE-2024-12086
  - Fix for CVE-2024-12087
  - Fix for CVE-2024-12088
  - Fix for CVE-2024-12747


author: Michal Ruprich <mruprich@redhat.com> - 3.4.1-1
changelog:
  - New version 3.4.1
  - Resolves: RHEL-70151 - Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling
  - Resolves: RHEL-70159 - Info Leak via Uninitialized Stack Contents
  - Resolves: RHEL-70203 - rsync server leaks arbitrary client files
  - Resolves: RHEL-72500 - Path traversal vulnerability in rsync
  - Resolves: RHEL-72501 - --safe-links option bypass leads to path traversal
  - Resolves: RHEL-71658 - Race Condition in rsync Handling Symbolic Links
  - Resolves: RHEL-71293 - Build rsync with --with-rrsync


author: Paolo Bonzini <pbonzini@redhat.com> - 4.9-1
changelog:
  - Rebase to 4.9
  - Update downstream patches
  - Resolves: rhbz#2140486
  - Remove change to gnulib tests, they pass anyway
  - Install valgrind and langpacks to increase test coverage


author: Tomas Bzatek <tbzatek@redhat.com> - 1.48-7
changelog:
  - udev rules: avoid spurious warning for non-SCSI devices (RHEL-40861,RHEL-54607)
  - Install missing 00-scsi-sg3_config.rules
  - Fix file references to other udev rules


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-5
changelog:
  - passwd: Provide binary from this package. Enable libpam and
    disable account-tools-setuid. Provide passwd PAM service file.
    Resolves: #2233275
  - passwd: provide --stdin option


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.0-1
changelog:
  - Rebase to version 4.15.0
  - getdef: avoid spurious error messages about unknown configuration options


author: Milan Crha <mcrha@redhat.com> - 2.3-6
changelog:
  - Co-own /usr/share/gettext and /usr/share/gettext/its
  - Related to rhbz#2280150
  - Resolves: RHEL-38682 (Backport Fedora 40 changes)


author: Zuzana Miklankova <zmiklank@redhat.com> - 3.45.0-1
changelog:
  - Updated to version 3.45.0 (https://sqlite.org/releaselog/3_45_0.html)
  - List versioned soname in files, preventing unnoticed soname bumps
  - Disable func4 tests for i686 arch due to failing float<->int conversions


author: Bruno Wolff III <bruno@wolff.to> - 4.6-1
changelog:
  - 4.6 release
  - PR #231 was merged
  - See https://github.com/plougher/squashfs-tools/blob/master/CHANGES


author: Bruno Wolff III <bruno@wolff.to> - 4.6.1-1
changelog:
  - Phillip is now doing two tags per release and we can
  - use the one that works better with forgemeta
  - There are a few fixes after the 4.6 release. I think only
  - one applies to Fedora because of the build options we use.
  - It was not something that affects image builds.


author: Eugene Syromiatnikov <esyr@redhat.com> - 6.7-5
changelog:
  - Fix incorrect syscall name reporting in restart_syscall() on attach when
    PTRACE_GET_SYSCALL_INFO is in use (RHEL-65108).
  - Update net-yy-inet* and linkat--secontext_mismatch tests.


author: Eugene Syromiatnikov <esyr@redhat.com> - 6.7-6
changelog:
  - Avoid failures of creat.gen test on kernels that include commit
    v6.11-rc1~242^2~19 ("fs: don't block i_writecount during exec").


author: Yaakov Selkowitz <yselkowi@redhat.com> - 1.9.14-1.p3
changelog:
  - Rebase to 1.9.14p3
  - sudo-1_9_14p2 is available Resolves: rhbz#2175672
  - sudo fails to build with Python 3.12: FAILED: testcase
    check_example_group_plugin_is_able_to_debug() Resolves: rhbz#2186412


author: Radovan Sroka <rsroka@redhat.com> - 1.9.15-1.p5
changelog:
  - Rabase to 1.9.15p5
  - sudo-1_9_15p5 is available Resolves: rhbz#2248505
  - TRIAGE CVE-2023-42465 sudo: Targeted Corruption of Register and Stack
    Variables Resolves: rhbz#2255569


author: Radovan Sroka <rsroka@redhat.com> - 1.9.15-5.p5
changelog:
  - RHEL 10.0 ERRATUM
  - sudo-1.9.15-2.p5.el10: RHEL SAST Automation: address 4 High impact true
    positive(s) Resolves: RHEL-44436
  - sudo subpackage sudo-logsrvd should not be built Resolves: RHEL-52864


author: systemd maintenance team <systemd-maint@redhat.com> - 256-6
changelog:
  - doc: add downstream CONTRIBUTING document (RHEL-40924)
  - ci: allow `policy` as rhel-only keyword (RHEL-40924)
  -  ci: run mkosi test only for Fedora and CentOS Stream (RHEL-40924)
  - taint: remove unused variable `usr_sbin` (RHEL-40924)
  - packit: drop the libarchive workaround (RHEL-40924)
  - packit: drop the dependency on python3-zstd (RHEL-40924)
  - coredump: by default process and store core files up to 1GiB (RHEL-46778)
  - don't ship systemd-ssh-generator harder (RHEL-40924)


author: systemd maintenance team <systemd-maint@redhat.com> - 256-8
changelog:
  - Avoid /tmp being mounted as tmpfs without the user's will (RHEL-40924)
  - unit: don't add Requires for tmp.mount (RHEL-40924)
  - units: add [Install] section to tmp.mount (RHEL-40924)
  - units: don't enable tmp.mount statically in local-fs.target (RHEL-40924)


author: systemd maintenance team <systemd-maint@redhat.com> - 256-12
changelog:
  - netif-naming-scheme: add rhel-9.5 scheme (RHEL-44416)
  - udev-builtin-net_id: use firmware_node/sun for ID_NET_NAME_SLOT (RHEL-44416)
  - man/net-naming-scheme: add missing period (RHEL-44416)
  - Revert "packit: drop the dependency on python3-zstd" (RHEL-36636)


author: systemd maintenance team <systemd-maint@redhat.com> - 256-13
changelog:
  - systemctl: do not try to acquire triggering units for template units (RHEL-55132)
  - core/unit: add one assertion for u->manager (RHEL-55734)
  - core/service: destroy runtime data when Type=oneshot services exit (RHEL-55734)
  - cgroup-util: Ignore kernel threads in cg_kill_items() (RHEL-55746)
  - cgroup-util: Don't try to open pidfd for kernel threads (RHEL-55746)
  - cgroup-util: fix typo (RHEL-55746)
  - netif-naming-scheme: rename rhel-10.0 to rhel-10.0.beta (RHEL-55728)
  - net-naming-scheme: disable NAMING_FIRMWARE_NODE_SUN (RHEL-55728)
  - net-naming-scheme: remove NAMING_FIRMWARE_NODE_SUN from 9.5 (RHEL-55728)
  - make systemd-ukify subpackage arch dependent (RHEL-52634)


author: systemd maintenance team <systemd-maint@redhat.com> - 256-14
changelog:
  - Revert "cgroup-util: Don't try to open pidfd for kernel threads" (RHEL-52634)
  - ukify: Skip test on architectures without UEFI (RHEL-52634)


author: systemd maintenance team <systemd-maint@redhat.com> - 256-15
changelog:
  - ci: rename beta branch to match dist-git name (RHEL-57603)
  - udev: Handle PTP device symlink properly on udev action 'change' (RHEL-59871)
  - Fix detection of TDX confidential VM on Azure platform (RHEL-56144)
  - confidential-virt: split caching of CVM detection into separate method (RHEL-56144)
  - confidential-virt: add detection for s390x target (RHEL-56144)
  - man/systemd-detect-virt: fix row spanning for VM header (RHEL-56144)
  - man/systemd-detect-virt: list known CVM technologies (RHEL-56144)


author: Jan Macku <jamacku@redhat.com> - 257-3
changelog:
  - udev/net_id: introduce naming scheme for RHEL-9.6 (RHEL-44417)
  - Rebase to new upstream stable release v257.2 (RHEL-71409)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-4
changelog:
  - ci: use ubuntu 22:04 for deploy of man pages (RHEL-57603)
  - tree-wide: Fix python formatting (RHEL-57603)
  - ci: fix Packit (RHEL-57603)
  - ci: drop testing farm test (RHEL-57603)
  - dbus: stash the subscriber list when we disconenct from the bus (RHEL-73780)
  - manager: s/deserialized_subscribed/subscribed_as_strv (RHEL-73780)
  - shared/bus-util: move bus_message_read_id128() to bus-message-util (RHEL-73780)
  - shared/bus-util: move bus_message_hash_ops to bus-message-util (RHEL-73780)
  - shared/bus-util: move string set append/get funcs to bus-message-util and bus-get-properties, respectively (RHEL-73780)
  - shared/serialize: make input params const (RHEL-73780)
  - shared/serialize: introduce serialize_id128() (RHEL-73780)
  - bus-util: do not reset the count returned by sd_bus_track_count_name() (RHEL-73780)
  - core/manager: use FOREACH_ARRAY at one more place (RHEL-73780)
  - core/manager: drop duplicate bus track deserialization (RHEL-73780)
  - bus-util: introduce bus_get_instance_id() (RHEL-73780)
  - core: serialize API bus id and validate before deserializing bus tracks (RHEL-73780)
  - core/manager: restore bus track deserialization cleanup in manager_reload() (RHEL-73780)
  - shared/bus-util: add missing `set.h` include (RHEL-73780)
  - udevadm-test: add missing oom check (RHEL-75774)
  - udev-rules: replace 'type *func()' -> 'type* func()' (RHEL-75774)
  - udev-rules: do not change maximum log level when running in test mode (RHEL-75774)
  - udevadm-test: introduce -v/--verbose option to show verbose log messages (RHEL-75774)
  - udev-rules: show original token string in log_event_error() and friends (RHEL-75774)
  - udev-rules: logs result of format substitution (RHEL-75774)
  - udev-rules: add more trace logs for string match (RHEL-75774)
  - udev-rules: introduce udev_replace_chars_and_log() (RHEL-75774)
  - udev-rules: ignore whole command result if it is too long and does not contain newline (RHEL-75774)
  - udev-rules: update log messages (RHEL-75774)
  - udev-rules: add trace logs for GOTO and parent conditions (RHEL-75774)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-8
changelog:
  - Rebase to new upstream stable release v257.3 (RHEL-71409)
  - udev: introduce several features to make debugging rules easier (RHEL-75774)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-10
changelog:
  - resolved: pick up new DNSSEC KSC from 2024 (RHEL-77718)
  - test_ukify: Skip on riscv64 (RHEL-85854)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-11
changelog:
  - fuzz-journal-remote: use ASSERT_OK() and friends (RHEL-79976)
  - logs-show: skip journal entry with an invalid timestamp (RHEL-79976)
  - man: mention that rhel-9.0 net naming scheme is the same as v251 (RHEL-87179)
  - backlight: Drop support for actual_brightness (RHEL-86713)


author: Jan Macku <jamacku@redhat.com> - 257-1
changelog:
  - Rebase to new upstream release v257 (RHEL-71409)
  - netif-naming-scheme: introduce rhel-10.0 scheme (RHEL-44417)


author: Jakub Martisko <jamartis@redhat.com> - 6.0-65
changelog:
  - Fix: Unzip Fails on Large Zip Files
  - Use the patch from Debian dealing with this
  Resolves: RHEL-45993


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.076-2
changelog:
  - enable building without GPM support - build with GPM in Fedora
  - 2262371 - gvim: symbol lookup error: gvim: undefined symbol: g_once_init_enter_pointer


author: Davide Cavalca <dcavalca@fedoraproject.org> - 1:2.10-8
changelog:
  - Backport WPA3 support for Broadcom devices. Fixes: rhbz#2226569
  - Enable parsing of IPv6 addresses in RADIUS configuration (#2095296)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.10-10
changelog:
  - Fix package configuration/add missing patches to avoid regressions when
    upgrading from rhel-9 (RHEL-43250)
  - Backport P2P fixc causing nmci failures (RHEL-17701)
  - Disable OpenSSL ENGINE API (RHEL-33750)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.10-10
changelog:
  - Fix package configuration/add missing patches to avoid regressions when
    upgrading from rhel-9 (RHEL-43250)
  - Backport P2P fix causing nmci failures (RHEL-17701)
  - Disable OpenSSL ENGINE API (RHEL-33750)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.11-1
changelog:
  - Update to version 2.11 (RHEL-59010)
  - backport fix for known regression on brcmfmac (rhbz#2302577)


author: Jakub Martisko <jamartis@redhat.com> - 3.0-42
changelog:
  - Use C implementation of some functions instead of asm
  - Fix the missing compiler/linker flags
  - Minor spec clean up
  Resolves: RHEL-33526


